Revision as of 07:43, 6 November 2019

Text

Transmittal of Revision 20 to Technical Specification Bases
	ML19004A341
Person / Time
Site:	Clinton
Issue date:	12/31/2018
From:	Kapellas B; Exelon Generation Co
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	U-604454
	Download: ML19004A341 (209)
	v • d • e

Clinton Power Station 8401 Power Road Clinton, IL 61727 U-604454 10 CFR 50.36 December 31, 2018 U. S. Nuclear Regulatory Commission Document Control Desk Washington, DC 20555-0001 Clinton Power Station, Unit 1 Facility Operating License No. NPF-62 NRC Docket No. 50-461

Subject:

Transmittal of Revision 20 to the Clinton Power Station Technical Specification Bases _____ . -

In accordance with Clinton Power Station (CPS) Technical Specification 5.5.11, "Technical Specifications (TS) Bases Control Program," Exelon Generating Company (EGC), LLC is transmitting the revised pages constituting Revision 20 to the CPS TS Bases. The changes associated with TS 5.5.11 require updates to the TS Bases to be submitted_ to the NRC at a frequency consistent with 10 CFR 50. 71, "Maintenance of records, making of reports, paragraph (e)."

There are no regulatory commitments in this letter.

Should you have any questions concerning this report, please contact Mr. Dale Shelton, Regulatory Assurance Manager, at (217) 937-2800.

adley T. Kapellas Plant Manager Clinton Power Station BTK/grs - Revision 20 Bases Page Listing - Revision 20 Bases Pages cc: NRC Regional Administrator - Region Ill NRC Senior Resident Inspector - Clinton Power Station NRC Project Manager, NRR - Clinton Power Station

U-604454 Attachment 1 Revision 20 Bases Page Listing

i B 3.3-145 B 3.6-19 B 3.6-116 ii B 3.3-146a B 3.6-20 B 3.6-117 iii B 3.3-147 B 3.6-21 B 3.6-118 lV B 3.3-148 B 3.6-22 B 3.6-119 V B 3.3-156 B 3.6-23 B 3.6-120 vi B 3.3-158 B 3.6-24 B 3.6-121 B 3.0-1 B 3.3-159 B 3.6-25 B 3.6-122 B3.0-ll B 3.3-169 B 3.6-26 B 3.6-123 B 3.0-12 B 3.3-177 B 3.6-27 B 3.6-124 B 3.0-13 B 3.3-179 B 3.6-28 B 3.6-125 B 3.0-14 B 3.3-180 B 3.6-40 B 3.6-126 B 3.0-15 B 3.3-217 B 3.6-41 B 3.6-127 B 3.0-16 B 3.5-1 B 3.6-42 B 3.6-128 B 3.0-17 B 3.5-2 B 3.6-45 B 3.6-129 B 3.0-18 B 3.5-3 B 3.6-46 B 3.6-130 B 3.0-19 B 3.5-4 B 3.6-49 B 3.6-131 B 3.0-20 B 3.5-5 B 3.6-50 B 3.6~132 B 3.0-21 B 3.5-6 B 3.6-51 B 3.6-133 B 3.0-22 B3S7 B 3.6-52 B 3.7-9 B 3.3-91 B 3.5-8 B 3.6-54 B 3.7-14 B 3.3-93 B 3.5-9 B 3.6-57 B 3.7-16 B 3.3-95 B 3.5-10 B 3.6-83 B 3.7-17 B 3.3-96 B 3.5-11 B 3.6-84 B 3.7-18 B 3.3-97 B 3.5-12 B 3.6-85 B 3.7-23 B 3.3-101 B 3.5-13 B 3.6-86 B 3.7-26 B 3.3-109 B 3.5-14 B 3.6-87 B 3.7-27 B 3.3-110 B 3.5-15 B 3.6-88 B 3.8-8 B3.3-lll B3S16 B 3.6-89 B 3.8-33 B 3.3-114 B3.5-17 B 3.6-90 B 3.8-35 B 3.3-122a B 3.5-18 B 3.6-91 B 3.8-36 B 3.3-122b B 3.5-19 B 3.6-92 B 3.8-37 B 3.3-122c B 3.5-20 B 3.6-93 B 3.8-38 B 3.3-122d B 3.5-21 _ B 3.6-94 B 3.8-57 B 3.3-122e B 3.5-22 B 3.6-95 B 3.8-59 B 3.3-122f B 3.5-23 B 3.6-96 B 3.8-60 B 3.3-122g B 3.5-24 B 3.6-97 B 3.8-62 B 3.3-122h B 3.5-25 B 3.6-98 B 3.8-74 B 3.3-122i B 3.5-26 B 3.6-99 B 3.8-75 B 3.3-122j B 3.5-27 B 3.6-100 B 3.8-76 B 3.3-122k B 3.5-28 B 3.6-101 B 3.8-89 B 3.3-123 B 3.5-29 B 3.6-102 B 3.8-90 B 3.3-124 B 3.5-30 B 3.6-103 B 3.8-91 B 3.3-125 B 3.5-31 B 3.6-104 B3.10-2 B 3.3-126 B 3.5-32 B 3.6-105 B 3.3-127 B 3.5-33 B 3.6-106 B 3.3-128 B 3.5-34 B 3.6-107 B 3.3-129 B 3.5-35 B 3.6-108 B 3.3-130 B 3.5-36 B 3.6-109 B 3.3-131 B3.6-8 B 3.6-110 B 3.3-131a B 3.6-12 B3.6-lll B 3.3-132 B 3.6-13 B 3.6-112 B 3.3-133 B 3.6-14 B 3.6-113 B 3.3-134 B 3.6-17 B 3.6-114 B 3.3-139 B 3.6-18 B 3.6-115

U-604454 Attachment 2 Revision 20 Bases Pages

TABLE OF CONTENTS 1.0 USE AND APPLICATION .......................................................................................... 1.0-1 1.1 Definitions ........................................................................................................... 1.0-1 1.2 Logical Connectors .............................................................................................. 1.0-8 1.3 Completion Times ............................................................................................... 1.0-11 1.4 Frequency ....................................................................................................._....... 1.0-24 2.0 SAFETY LIMITS (SLs ) ............................................................................................... 2.0-1 2.1 SLs ....................................................................................................................... 2.0-1 2.2 SL Violations ............................................................ ~.......................................... 2.0-1 B2.0 SAFETY LIMITS (SLs) ............................................................................................... B 2.0-1 B 2.1.1 Reactor Core SLs ............................................... ,................................................. B 2.0-1 B 2.1.2 Reactor Coolant System (RCS) Pressure SL ....................................................... B 2.0-6 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY .................. 3.0-1 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ................................... 3.0-4 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY .................. B 3.0-1 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY ................................... B 3.0-15 3.1 REACTIVITY CONTROL SYSTEMS ....................................................................... 3.1-1 3.1.1 SHUTDOWN MARGIN (SOM) ......................................................................... 3.1-1 3.1.2 Reactivity Anomalies .......................................................................................... 3 .1-5 3.1.3 Control Rod OPERABILITY .............................................................................. 3 .1-7 3.1.4 Control Rod Scram Times ................................................................................... 3 .1-11 3.1.5 Control Rod Scram Accumulators ....................................................................-... 3.1-15 3.1.6 Control Rod Pattern ............................................................................................. 3 .1-18 3.1.7 Standby Liquid Control (SLC) System ............................................................... 3.1-20 3.1.8 Scram Discharge Volume (SOV) Vent and Drain Valves ............................................................................................... 3.1-24 B 3.1 REACTIVITY CONTROL SYSTEMS ....................................................................... B 3.1-1 B 3.1.1 SHUTDOWN MARGIN (SOM) ......................................................................... B 3.1-1 B 3.1.2 Reactivity Anomalies .......................................................................................... B 3.1-8 B 3.1.3 Control Rod OPERABILITY .............................................................................. B 3.1-13 B 3.1.4 Control Rod Scram Times ................................................................................... B 3.1-22 B 3.1.5 Control Rod Scram Accumulators ..................................... :................................. B 3.1-28 B 3.1.6 Control Rod Pattern ............................................................................................. B 3. 1-33 B 3.1.7 Standby Liquid Control (SLC) System ............................................................... B 3.1-38 B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain ,,,

Valves ......................................................................................................... B 3.1-44 3.2 POWER DISTRIBUTION LIMITS ............................................................................. 3.2-1 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR) ........................................................................................................... 3 .2-1 (continued)

CLINTON Revision No. 20-4

TABLE OF CONTENTS 3.2 POWER DISTRIBUTION LIMITS (continued) 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) ..................................................... 3.2-2 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) ...................................................... 3.2-3 B 3.2 POWER DISTRIBUTION LIMITS ............................................................................. B 3.2-1 B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR) ........................................................................................................... B 3.2-1 B3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) ..................................................... B 3.2-5 B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) ....................................................... B 3.2-9 3.3 INSTRUMENTATION ................................................................................................ 3 .3-1 3.3.1.1 Reactor Protection System (RPS) Instrumentation ............................................. 3 .3-1 3.3.1.2 Source Range Monitor (SRM) Instrumentation .................................................. 3.3-10

3.3.1.3 Oscillation Power Range Monitor (OPRM) Instrumentation .............................. 3 .3-14a 3.3.2.1 Control Rod Block Instrumentation .................................................................... 3 .3-15 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation ............................................. 3 .3-19 3.3.3.2 Remote Shutdown System ................................................................................... 3.3-23 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT)

Instrumentation ........................................................................................... 3 .3-25 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation ................................................. 3.3-28 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation ................................ 3.3-31 3.3.5.2 Reactor Pressure Vessel (RPV) Water Inventory Control Instrumentation ........ 3.3-43a 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation ....................... 3.3-45 3.3.6.1 Primary Containment and Drywell Isolation Instrumentation ............................. 3 .3-49 3.3.6.2 Secondary Containment Isolation Instrumentation ............................................. 3.3-61 3.3.6.3 Residual Heat Removal (RHR) Containment Spray System Instrumentation ........................................................................................... 3 .3-65 3.3.6.4 Suppression Pool Makeup (SPMU) System Instrumentation .............................. 3.3-69 3.3.6.5 Relief and Low-Low Set (LLS) Instrumentation ................................................ 3 .3-74 3.3.7.1 Control Room Ventilation System Instrumentation ............................................ 3 .3-75 3.3.8.1 Loss of Power (LOP) Instrumentation ................................................................. 3 .3-78 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring ............................ 3 .3-81 B 3.3 INSTRUMENTATION ................................................................................................ B 3.3-1

- B 3.3.1.1 Reactor Protection System (RPS) Instrumentation ............................................. B 3.3-1 B 3.3.1.2 Source Range Monitor (SRM) Instrumentation ....................................... ;.......... B 3.3-31 B3.3.1.3 Oscillation Power Range Monitor (OPRM) Instrumentation .............................. B 3.3-39a B 3.3.2.1 Control Rod Block Instrumentation .................................................................... B 3.3-40 B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation ............................................. B 3 .3-49 (continued)

CLINTON Revision No. 20-2 ii

TABLE OF CONTENTS B 3.3 INSTRUMENTATION (continued)

B 3.3.3.2 Remote Shutdown System .......... :........................................................................ B 3.3-60 B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT)

Instrumentation ........................................................................................... B 3 .3-65 B 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip (ATWS-RPT) Instrumentation ........................... B 3.3-76 B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation ................"° .***.***..***** B 3.3-85 B 3.3.5.2 Reactor Pressure Vessel (RPV) Water Inventory Control Instrumentation ........ B 3 .3- l 22a B 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation ....................... B 3.3-123 B 3.3.6.1 Primary Containment and Drywell Isolation Instrumentation ............................. B 3.3-135 B 3.3.6.2 Secondary Containment Isolation Instrumentation ............................................. B 3.3-174 B 3.3.6.3 Residual HeatRemoval (RHR) Containment Spray System Instrumentation ........................................................................................... B 3.3-186 B 3.3.6.4 Suppression Pool Makeup (SPMU) System Instrumentation .............................. B 3.3-197 B 3.3.6.5 Relief and Low-Low Set (LLS) Instrumentation ................................................ B 3.3-208 B 3.3.7.1 Control Room Ventilation (CRV) System Instrumentation ................................ B 3.3-215 B 3.3.8.1 Loss of Power (LOP) Instrumentation ................................................................. B 3.3-222 B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring ........................... ;B 3.3-230 3.4 REACTOR COOLANT SYSTEM (RCS) ................................................................... 3.4-1 3.4.1 Recirculation Loops Operating............................................................................ 3 .4-1 3.4.2 Flow Control Valves (FCVs) ............................................................................... ~.4-6 3.4.3 Jet Pumps ............................................................................................................. 3 .4-8 3.4.4 Safety/Relief Valves (S/RVs) .............................................................................. 3.4-10 3.4.5 RCS Operational LEAKAGE .............................................................................. 3.4-12 3.4.6 RCS Pressure Isolation Valve (PIV) Leakage ..................................................... 3 .4-14 3.4.7 RCS Leakage Detection Instrumentation ............................................................ 3 .4-17 3.4.8 RCS Specific Activity ......................................................................................... 3.4-20 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling System - Hot Shutdown ............................................................................... 3 .4-22 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown ............................................................................. 3 .4-25 3.4.11 RCS Pressure and Temperature (P/T) Limits ...................................................... 3.4-27 3.4.12 Reactor Steam Dome Pressure ............................................................................ 3.4-33 B 3.4 REACTOR COOLANT SYSTEM (RCS) ................................................................... B 3.4-1 B 3.4.1 Recirculation Loops Operating.................... :....................................................... B 3.4-1 B 3.4.2 Flow Control Valves (FCVs) ............................................................................... B 3.4-9 (continued)

CLINTON Revision No. 20-2 iii

TABLE OF CONTENTS B 3.4 REACTOR COOLANT SYSTEM (RCS) (continued)

B 3.4.3 Jet Pumps ............................................................................................................. B 3.4-13 B 3.4.4 Safety/ReliefValves (S/RVs) .............................................................................. B 3.4-17 B 3.4.5 RCS Operational LEAKAGE .............................................................................. B 3.4-23 B 3.4.6 RCS Pressure Isolation Valve (PIV) Leakage ..................................................... B 3.4-28 B 3.4.7 RCS Leakage Detection Instrumentation ............................................................ B 3.4-33 B 3.4.8 RCS Specific Activity ......................................................................................... B 3.4-39 B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling System- Hot Shutdown ............................................................................... B 3.4-43 B 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling System- Cold Shutdown ............................................................................. B 3.4-48 B 3.4.11 RCS Pressure and Temperature (P/T) Limits ...................................................... B 3.4-53 B 3.4.12 Reactor Steam Dome Pressure ............................................................................ B 3 .4-63

3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL *

(RPV) WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING

(RCIC) SYSTEM ......................................................................................................... 3.5-1 3.5.1 ECCS-Operating ................................................................................................ 3.5-1 3.5.2 RPV Water Inventory Control ............................................................................. 3.5-6 3.5.3 RCIC System ....................................................................................................... 3.5-11 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV) WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM ......................................................................................................... B 3.5-1 B 3.5.1 ECCS - Operating ................................................................................................ B 3. 5-1 B 3.5.2 RPV Water Inventory Control ............................................................................. B 3.5-17 B 3.5.3 RCIC System ....................................................................................................... B 3.5-29 3.6 CONTAINMENT SYSTEMS ...................................................................................... 3 .6-1 3.6.1.1 Primary Containment ........................................................................................... 3 .6-1 3.6.1.2 Primary Containment Air Locks .................................................................. ,....... 3.6-3 3.6.1.3 Primary Containment Isolation Valves (PCIVs) ................................................. 3.6-9 3.6.1.4 Primary Containment Pressure ............................................................................ 3.6-20 3.6.1.5 Primary Containment Air Temperature ............................................................... 3 .6-21 3.6.1.6 Low-Low Set (LLS) Valves ................................................................................ 3.6-22 3.6.1.7 Residual Heat Removal (RHR) Containment Spray System ............................... 3.6-24 3.6.1.8 Deleted .......................................................*...................................................... 3.6-26 3.6.1.9 Feedwater Leakage Control System (FWLCS) ................................................... 3.6-27a 3.6.2.1 Suppression Pool Average Temperature ............................................................. 3 .6-28 .

3.6.2.2 Suppression Pool Water Level ............................................................................ 3.6-3 l 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling................................. 3.6-32 3.6.2.4 Suppression Pool Makeup (SPMU) System ........................................................ 3.6-34 3.6.3.1 Deleted ....... *.......................................................................................................-. 3.6-36 3.6.3.2 Pri~ary Containment and Drywell Hydrogen Igniters ........................................ 3.6-38 (continued)

CLINTON Revision No. 20-2 iv

TABLE OF CONTENTS 3.6 CONTAINMENT SYSTEMS (continued) 3.6.3.3 Containment/Drywell Hydrogen Mixing Systems .............................................. 3 .6-41 3.6.4.1 Secondary Containment. ...................................................................................... 3 .6-43 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs) .......................................... 3.6-47 3.6.4.3 Standby Gas Treatment (SGT) System ............................................................... 3.6-51 3.6.5.1 Drywell ............................................................................................................... 3.6-54 3.6.5.2 Drywell Air Lock ................................................................................................. 3 .6-56 3.6.5.3 Drywell Isolation Valves ..................................................................................... 3.6-61 3.6.5.4 Drywell Pressure ................................................................................................. 3 .6-66 3.6.5.5 Drywell Air Temperature .................................................................................... 3 .6-67 3.6.5.6 Drywell Post-LOCA Vacuum ReliefSystem ..................................................... 3.6-68 B 3.6 CONTAINMENT SYSTEMS ...................................................................................... B 3.6-1 B 3.6.1.1 Primary Containment .................................. .'................................................................ B 3.6-1 B 3.6.1.2 Primary Containment Air Locks .................................................................................. B 3.6-6 B 3.6.1.3 Primary Containment Isolation Valves (PCIVs) .......................................................... B 3.6-15 B 3.6.1.4 Primary Containment Pressure ..................................................................................... B 3.6-29 B 3.6.1.5 Primary Containment Air Temperature ........................................................................ B 3.6-32 B 3.6.1.6 Low-Low Set (LLS) Valves ......................................................................................... B 3.6-35 B 3.6.1.7 Residual Heat Removal (RHR) Containment Spray System ....................................... B 3.6-39 B 3.6.1.8 Deleted ......................................................................................................................... B 3.6-44 B 3.6.1.9 Feedwater Leakage Control System (FWLCS) ............................................................ B 3.6-45 B 3.6.2.1 Suppression Pool Average Temperature ...................................................................... B 3.6-48 B 3.6.2.2 Suppression Pool Water Level ..................................................................................... B 3.6-53 B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling ......................................... B 3 .6-56 B 3.6.2.4 Suppression Pool Makeup (SPMU) System ................................................................. B 3.6-60 B 3.6.3.1 Deleted ......................................................................................................................... B 3.6-66 B 3.6.3.2 Primary Containment and Drywell Hydrogen Igniters ................................................ B 3.6-72 B 3.6.3.3 Containment/Drywell Hydrogen Mixing System ......................................................... B 3.6-78 B 3.6.4.1 Secondary Containment ... :........................................................................................... B 3.6-83 B 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs) ................................................... B 3.6-89 B 3.6.4.3 Standby Gas Treatment (SGT) System ........................................................................ B 3.6-95 B 3.6.5.1 Drywell ........................................................................................................................ B 3.6-101 B 3.6.5.2 Drywell Air Lock ......................................................................................................... B 3.6-107 B 3.6.5.3 Drywell Isolation Valves .............................................................................................. B 3.6-114 B 3.6.5.4 Drywell Pressure .......................................................................................................... B 3.6-123 B 3.6.5.5 Drywell Air Temperature ............................................................................................. B 3.6-126 B 3.6.5.6 Drywell Post-LOCAVacuum Relief System ....................................... :*********************** B 3.6-129 (continued)

CLINTON Revision No. 20-2 V

TABLE OF CONTENTS (continued) 3.7 PLANT SYSTEMS ...................................................................................................... 3. 7-1 3.7.1 Division 1 and 2 Shutdown Service Water (SX) Subsystems and Ultimate Heat Sink (UHS) ................................................................... 3.7-l 3.7.2 Division 3 Shutdown Service Water (SX)

Subsystem ................................................................................................... 3. 7-3 3.7.3 Control Room Ventilation System ...................................................................... 3.7-4 3.7.4 Control Room Air Conditioning (AC) System .................................................... 3.7-8 3.7.5 Main Condenser Offgas ....................................................................................... 3 .7-11 3.7.6 Main Turbine Bypass System .............................................................................. 3.7-13 3.7.7 Fuel Pool Water Level ......................................................................................... 3. 7-15 B 3.7 PLANT SYSTEMS ...................................................................................................... B 3.7-1 B 3.7.1 Division 1 and 2 Shutdown Service Water (SX)

Subsystems and Ultimate Heat Sink (UHS) ............................................... B 3.7-1 B 3.7.2 Division 3 Shutdown Service Water Subsystem (SX) ........................................ B 3. 7-8 B 3.7.3 Control Room Ventilation System ...................................................................... B 3. 7-11 B 3.7.4 Control Room Air Conditioning (AC) System .................................................... B 3.7-22 B 3.7.5 Main Condenser Offgas ....................................................................................... B 3.7-28 B 3.7.6 Main Turbine Bypass System .............................................................................. B 3. 7-32 B 3.7.7 Fuel Pool Water Level .................................... :.................................................... B 3. 7-36 3.8 ELECTRICAL POWER SYSTEMS ............................................................................ 3.8-l 3.8.1 AC Sources - Operating ....................................................................................... 3 .8-1 3.8.2 AC Sources - Shutdown ....................................................................................... 3 .8-16 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air ........................................................ 3.8-20 3.8.4 DC Sources -Operating ....................................................................................... 3.8-24 3.8.5 DC Sources - Shutdown ................................................................................... .-... 3.8-27 3.8.6 Battery Cell Parameters ....................................................................................... 3 .8-30 3.8.7 Inverters - Operating ............................................................................................ 3.8-34 3.8.8 Inverters - Shutdown .........._.................................................................................. 3 .8-36 3.8.9 Distribution Systems - Operating ......................................................................... 3.8-39 3.8.10 Distribution Systems - Shutdown ......................................................................... 3.8-42 3.8.11 Static VAR Compensator (SVC) Protection Systems ......................................... 3.8-44 B 3.8 ELECTRICAL POWER SYSTEMS ............................................................................ B 3.8-1 B 3.8.1 AC Sources - Operating ...................................................................... _................. B 3.8-1 B 3.8.2 ,AC Sources - _Shutdown ....................................................................................... B 3.8-33 B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air ....................................................... B 3.8-40 B 3.8.4 DC Sources -Operating ....................................................................................... B 3.8-49 B 3.8.5 DC Sources -Shutdown ....................................................................................... B 3.8-59 B 3.8.6 Battery Parameters ............................................................................................... B 3 .8-64 B 3.8.7 Inverters - Operating ............................................................................................ B 3. 8-69 B 3.8.8 Inverters - Shutdown ........ :.................................................................................... B 3 .8-74 B 3.8.9 Distribution Systems - Operating ......................................................................... B 3.8-78 B 3.8.10 Distribution Systems - Shutdown ......................................................................... B 3 .8-89 B3.8-ll Static VAR Compensator (SVC) Protection Systems ......................................... B 3.8-93 (continued)

CLINTON Revision No. 20-2 VI

LCO Applicability B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs LCO 3.0.1 through LCO 3.0.8 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification)

LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered, unless otherwise specified.

The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:

a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and

b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.

There a-re two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not. completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the (continued)

CLINTON B 3.0-1 Revision No. 20-4

LCO Applicability B 3.0 BASES LCO 3.0.7 These special tests and operations are necessary to (continued) demonstrate select unit performance characteristics, to perform special maintenance activities, and to perform special evolutions. Special Operations LCOs in Section 3.10 allow specified TS requirements to be changed to permit performances of these special tests and operations, which otherwise could not be performed if required to comply with the requirements of these TS. Unless otherwise specified, all the other TS requirements remain unchanged. This will ensure all appropriate requirements of the MODE or other specified condition not directly associated with or required to be changed to perform the special test or operation will remain in effect.

The Applicability of a Special Operations LCO represents a condition not necessarily in compliance with the normal requirements of the TS. Compliance with Special Operations LCOs is optional. A special operation may be performed either under the provisions of the appropriate Special Operations LCO or under the other applicable TS requirements. If it is desired to perform the special operation under the provisions of the Special Operations LCO, the requirements of the Special Operations LCO shall be followed. When a Special Operations LCO requires another LCO to be met, only the requirements of the LCO statement are required to be met regardless of that LCO's Applicability (i.e., should the requirements of this other LCO not be met, the ACTIONS of the Special Operations LCO apply, no~ the ACTIONS of the other LCO). However, there are instances where the Special Operations LCO's ACTIONS may direct the other LCO's ACTIONS be met. The Surveillances of the other LCO are not required to be met, unless specified in the Special Operations LCO. If conditions exist such that the Applicability of any other LCO is met, all the other LCO's requirements (ACTIONS and SRs) are required to be met concurrent with the requirements of the Special Operations LCO.

(continued)

CLINTON B 3;0-11 Revision No. 20-4

LCO Applicability B 3.0 BASES (continued)

LCO 3.0.8 LCO 3.0.8 establishes conditions under which systems are considered to remain capable of performing their intended safety function when associated snubbers are not capable of providing their associated support function(s). This LCO states that the supported system is not considered to be inoperable solely due to one or more snubbers not capable of performing thei~ associated support function(s). This is appropriate because a limited length of time is allowed for maintenance, testing, or repair of one or more snubbers not capable of performing their associated support function(s) and appropriate compensatory measures are* specified iI). the snubber requirements, which are located outside of the Technical Specifications (TS) under licensee control.

LCO 3.0.8 applies to snubbers that only have seismic function. It does not apply to snubbers that also have design functions to mitigate steam/water hammer or other transient loads. The snubber requirements do not meet the criteria in 10 CFR 50.36(c) (2) _(ii), and, as such, are appropriate for control by the licensee.

If the allowed time expires and the snubber(s) are unable to perform their associated support functiqn(s), the affected supported system's LCO(s) must be declared not met and the conditions and Required Actions entered in accordance with LCO 3.0.2.

LCO 3.0.8.a applies when one or more snubbers are not capable of providing their associated support function(s) to a single train or subsystem of a multiple train or subsystem

supported system or to a single train or subsystem supported system. LCO 3.0.8.a allows 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the snubber(s) before declaring the supported system inoperable.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable based on the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function and due to the availability of the redundant train of the supported system.

LCO 3.0.8.b applies when one or more snubbers are not capable of providing their associated support function(s) to more than ori.e train or subsystem of a multiple train or subsystem supported system. LCO 3.0.8.b allows 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to rest.ore the snubber ( s) before declar_ing the supported system inoperable. The 12-hour Completion Time is reasonable based

~n the low probability of a seismic event concurrent with an event that would require operation of the supported system occurring while the snubber(s) are not capable of performing their associated support function.

(continued)

CLINTON B 3.0-12 Revision No. 20-4

LCO Applicability B 3.0 BASES LCO 3.0.8 The following configuration restrictions shall be applied (continued) to the use of LCO 3.0.8:

(1) LCO 3.0.8.a can only be used if one of the following two means of heat removal is available:

a. At least one high pressure makeup path (e.g., using High Pressure Core Spray (HPCS) or Reactor Core Isolation Cooling (RCIC)) and heat removal capability (e.g., suppression pool cooling), including a minimum set of supporting equipment required for success, not associated with the inoperable snubber(s),

OR

b. At least one low pressure makeup path (e.g., Low Pressure Coolant Injection (LPCI) or Low Pressure Core Spray (LPCS)) and heat removal capability (e.g., suppression pool cooling or shutdown cooling), including a minimum set of supporting equipment required for success, not associated with the inoperable snubber(s).

(2) LCO 3.0.8.b can only be used following verification that at least one success path exists, using equipment not associated with the inoperable snubber(s), to provide makeup and core cooling needed to mitigate Loss of Offsite Power (LOOP) accident sequences (i.e., initiated by a seismically-induced LOOP event with concurrent loss of all safety system trains supported by the out-of-service snubbers).

Each use of LCO 3.0.8 requires confirmation that at least one train (or subsystem) of systems supported by the inoperable snubbers would remain capable of performing their required safety or support functions for postulated design loads other than seismic loads. LCO 3.0.8 does not apply to non-seismic snubbers. In addition,~ record of the design function of the inoperable snubber (i.e., seismic vs. non-seismic), implementation an1 compliance with the configuration restrictions defined above, and the associated plant configuration shall be available on a recoverable basis for NRC inspection.

(continued)

CLINTON B .3.0-13 Revision No. 20-4

LCO Applicability B 3.0 BASES LCO 3.0.8 LCO 3.0.8 requires that risk be assessed and managed.

(continued) Industry and NRC guidance on the implementation of 10 CFR 50.65(a) (4) (i.e., the Maintenance Rule) does not address seismic risk. However, use of LCO 3.0.8 should be considered with respect to other plant maintenance activities, and integrated into the existing Maintenance Rule process to the extent possible so that maintenance on any unaffected train or subsystem is properly controlled,.

and emergent issues are properly addressed. The risk assessment need not be quantified, but may be a qualitative awareness of the vulnerability of systems and components when one or more snubbers are not able to perform their associated support function.

LCO 3.0.8 does not apply to non-seismic functions of snubbers. The provisions of LCO 3.0.8 apply to seismic snubbers that may also have non-seismic .functions provided the supported systems would remain capable of performing their required safety or support functions for postulated design loads other than seismic loads. Non-seismic snubber issues will be addressed in the corrective action program.

CLINTON B 3.0-14 Revision No. 20-4

SR Applicability B 3.0 B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY BASES SRs SR 3.0.1 through SR 3.0.4 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated. SR 3.0.2 and SR 3.0.3 apply in Chapter 5 only when invoked by a Chapter 5 Specification.

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the MODES or other specified conditions in the Applicability for which the requirements of the LCO apply, unless otherwise specified in the individual SRs. This Specification is to ensure that Surveillances are performed to verify the OPERABILITY of systems and components, and.

that variables are within specified limits. Failure to meet a Surveillance within the specified Frequency, in accordance with SR 3.0.2, constitutes a failure to meet an LCO.

Systems and components are assumed to be. OPERABLE when the associated SRs have been met. Nothing in this Specification, however, is to be construed as implying that systems or components are OPERABLE when:

a. The systems or components are known to be inoperable, although still meeting the SRs; or

b. The requirements of the Surveillance(s) are known to b'e not met between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a MODE or other specified condition for which the requirements of the associated LCO are not applicable, unless otherwise specified. The SRs associated with a Special Operations LCO are only applicable when the Special Operations LCO is used as an allowable exception to the requirements of a Specification.

Surveillances, including Surveillances invoked by Required Actions, do not have to be performed on inoperable equipment because the ACTIONS define the remedial measures that apply.

Surveillances have to be met and performed in accordance with SR 3. 0. 2, prior to returning equipment t.o OPERABLE status.

(continued)

CLINTON B 3.0-15 Revision No. 20-4

SR Applicability B 3.0 BASES SR 3.0.1 Upon completion of maintenance, appropriate post maintenance (continued) testing is required to declare equipment OPERABLE. This includes ensuring applicable Surveillances are not failed and their most recent performance is in accordance with SR 3.0.2. Post maintenance testing may not be possible in the current MODE or other specified conditions in the Applicability due to the necessary unit parameters not having been established. In these situations, the equipment may be considered OPERABLE provided testing has been satisfactorily completed to the extent possible and the equipment is not otherwise believed to be incapable of performing its function. This will allow operation to proceed to a MODE or other specified condition where other necessary post maintenance tests can be completed. Some examples of this process are:

a. Control rod drive maintenance during refueling that requires scram testing at~ 950 psig. However, if other appropriate testing is satisfactorily completed and the scram time testing of SR 3.1.4.3 is satisfied, the control rod can be considered OPERABLE. This allows startup to proceed to reach 950 psig to perform other necessary testing.

b. Reactor Core Isolation Cooling (RCIC) maintenance during shutdown that requires system functional tests at a specified pressure. Provided other appropriate testing is satisfactorily completed, startup can proceed with RCIC considered OPERABLE. This allows operation to reach the specified pressure to complete the necessary post maintenance testing.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified Frequency for Surveillances and any Required Action with a Completion Time that requires the periodic performance of the Required Action on a "once per ... "

interval.

SR 3.0.2 permits a 25% extension of the interval specified in the.Frequency. This extension facilitates Surveillance scheduling and considers plant operating conditions that may not be suitable for conducting the Surveillance (e.g.,

transient conditions or other ongoing Surveillance o~

maintenance activities).

(continued)

CLINTON B 3.0-16 Revision No. 20-4

SR Applicability B 3.0 BASES SR 3.0.2 The 25% extension does not significantly degrade the (continued) reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. The requirements of.

regulations take precedence over the TS. Therefore, when a test interval is specified in the regulations, the test interval cannot be extended by the TS~ ~nd the is will then include a Note stating, "SR 3.0.2 is not applicable." An example of an-exception when the test interval is not specified in the regulations is the Note in the Primary Containment Leakage Rate Test;i.ng Pr.ogram, "SR 3. 0. 2 is not applicable." This exception is provided because the program already includes extension of test intervals.

As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per ... " basis. The 25%

extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particul~r Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25%

extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.

The provisions of SR 3.0.1 are not intended to be used repeatedly to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an-affected variable outside the specified limits when a Surveillance has not been performed within the specified Frequency. A delay period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified Frequency; whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the (continued)

CLINTON B 3.0-17 Revision No. 20-4

SR Applicability B 3.0 BASES SR 3.0.3 time that the specified Frequency was not met. This delay (continued) period provides adequate time to perform Surveillances that have been missed. This delay period permits the performance of a Surveillance before complying with Required Actions or other remedial measures that might preclude performance of the Surveillance.

The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.

When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50, Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the surveillance.

However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity. SR 3.0.3 provides a.time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.

SR 3.0.3 is only applicable if there is a reasonable expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed. Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be met when performed. An example of the use of SR 3.0.3 would be a rel-ay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by another SR; or historical operation of the subject relay contact has been successful. It is not sufficient to infer the behavior of the associated equipment (continued)

CLINTON B 3.0-18 Revision No. 20-4

SR Applicability B 3.0 BASES SR 3.0.3 from the performance of similar equipment. The rigor of (continued) determining whether there is a reasonable expectation a

-Surveillance will be met when performed should increase based on the length of time since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed. For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.

Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used repeatedly to extend Surveillance intervals. While up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a) (4) and its implementation guidance, NRC Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management action thresholds, and risk management actions up to an including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component.

Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the Clinton Power Station Corrective Action Program.

(continued)

CLINTON B 3.0-19 Revision No. 20-4

SR Applicability B 3.0 BASES SR 3.0.3 If a Surveillance is not completed within the allowed delay (continued) period, then the equipment is considered inoperable or the variable then is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.

Completion of the Surveillance within the delay period allowed by this Specification, or within the Completion Time of the ACTIONS, restores compliance with SR 3.0.1.

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met before entry into a MODE or other specified condition in the Applicability.

This Specification ensures that sy~tem and component OPERABILITY requirements and variable limits are met before entry into MODES or other specified conditions in the Applicability for which these systems and components ensure safe operation of the unit. The provisions of this Specification should not be interpreted as endorsing the failure to exercise the good practice of restoring systems or components to OPERABLE status before entering an associated MODE or other specified condition in the Applicability.

A provision is included to allow entry into a MODE or other specified condition in the Applicability when an LCO is not met due to Surveillance not being met in accordance with LCO 3.0.4.

However, in certain circumstances, failing to meet an SR will not result in SR 3.0.4 restricting a MODE change or other specified condition change. When a system, subsystem, division, component, device, or variable is inoperable or outside its specified limits, the associated SR(s) are not required to be performed, per SR 3.0.1, which states that surveillances do not have to be performed on inoperable equipment. When equipment is inoperable, SR 3.0.4 does not apply to the associated SR(s) since the requirement for the SR(s) to be performed is removed. Therefore, failing to perform the Surveillance(s) within the specified Frequency does not result in an SR 3.0.4 restriction to changing MODES (continued)

CLINTON B 3.0-20 Revision No. 20-4

SR.Applicability B 3.0 BASES SR 3.0.4 or other specified conditions of the Applicability.

(continued) However, since the LCO is not met in this instance, LCO 3.0.4 will govern any restrictions that may (or may not) apply to MODE or other specified condition changes.

SR 3.0.4 does not restrict changing MODES or other specified conditions of the Applicability when a Surveillance has not been performed within the specified- Frequency, provided the requirement to declare the LCO not met has been delayed in accordance with SR 3.0.3.

The provisions of SR 3.0.4 shall not prevent entry into MODES or other spec.ified conditions in the Applicability that are required to comply with ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent changes in MODES or other specified conditions in the Applicability that result from any unit shutdown. In this.context, a unit shutdown is defined as a change in MODE or other specified condition in the Applicability associated with transitioning from MODE 1 to MODE 2 or 3, MODE 2 to MODE 3, and MODE 3 to MODE 4.

The precise requirements for performance of SRs are specified such that exceptions to SR 3.0.4 are not necessary. The specific time frames and conditions necessary.for meeting the SRs are specified in the Frequency, in the Surveillance, or both. This allows performance of Surveillances when the prerequisite condition(s) specified in a Surveillance procedure require entry into the MODE or other specified condition in the Applicability of the associated LCO prior to the performance or completion of a Surveillance. A Surveillance that could not be performed until after entering the LCO's Applicability, would have its Frequency specified such that it is not "due" until the specific conditions needed are met. Alternatelyj the Surveillance may be stated in the form of a Note, as not required (to be met or performed) until a particular event, condition, or time has been reached. Further discussion of the specific formats of SRs' annotation is found in Section 1.4, Frequency.

CLINTON B 3.0-21 Revision No. 20-4

SR Applicability B 3.0 This page intentionally left blank.

CLINTON B 3.0-22 Revision No. 20-4

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Diesel Generators (continued) started manually from the control room and locally in the associated DG room. The DG initiation signal is a sealed in signal and must be manually reset. The DG initiation logic is reset by resetting the associated ECCS initiation logic.

Upon receipt of a LOCA initiation signal, each DG is automatically started, is ready to load in approximately 12 seconds, and will run in standby conditions (rated voltage and speed, with the DG output breaker open). The DGs will only energize their respective Engineered Safety Feature (ESF) buses if a loss of offsite power occurs.

(Refer to Bases for LCO 3.3.8.1.)

APPLICABLE The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES, analyses of References 1, 2, and 3. The ECCS is initiated LCO, and to preserve the integrity of the fuel cladding by limiting APPLICABILITY the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified,Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each ECCS subsystem must also respond within its assumed response time. Table 3.3.5.1-1, footnote (a), is added to show that certain ECCS instrumentation Functions are also required to be OPERABLE to perform DG initiation.

Allowable Values are specified for each ECCS Function specified in the table. Nominal trip -setpoints are specified in the setpoint calculations. The nominal setpoints are selected to ensure that the actual setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. A channel is inoperable if its actual trip (continued)

CLINTON B 3.3-91 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.a, 2.a Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY RPV water level decrease too far, fuel damage could result.

The low pressure ECCS and associated DGs are initiated at Level 1 to ensure that core spray and flooding functions are available to prevent or minimize fuel damage. The Reactor Vessel Water Level-Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Vessel Water Level-Low Low Low, Level 1 Function is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level-Low Low Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

Two channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE, to ensure that no single instrument failure can preclude ECCS initiation. (Two channels input to LPCS and LPCI A, while the other two channels input to LPCI Band LPCI C.)

l.b, 2.b. Drywell Pressure-High High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The low pressure ECCS and associated DGs are initiated upon receipt of the Drywell Pressure-High Function in order to minimize the (continued)

CLINTON B 3.3-93 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE l.c, 2.c. Low Pressure Coolant Injection Pump A and Pump B SAFETY ANALYSES, Start-Time Delay Logic Card (continued)

LCO, and APPLICABILITY There are two LPCI Pump Start-Time Delay Logic Cards, one in each of the RHR "A" and RHR "B" pump start logic circuits.

While each time delay is dedicated to a single pump start logic, a single failure of a LPCI Pump Start-Time Delay Logic Card could result in the failure of the two low pressure ECCS pumps, powered from the same ESF bus, to perform their intended function within the assumed ECCS RESPONSE TIMES (e.g., as in the case where both ECCS pumps on one ESF bus start simultaneously due to an inoperable time delay logic card). This still leaves two of the four low pressure ECCS pumps OPERABLE; thus, the single failure criterion is met (i.e., loss of one instrument doe,s not preclude ECCS initiation). The Allowable Value for the LPCI Pump Start-Time Delay logic card is chosen to be long enough so that most of the starting transient of the first pump is complete before starting the second pump on the same 4.16 kV emergency bus and short enough so that ECCS operation is not degraded.

Each LPCI Pump Start-Time Delay Logic Card Function is only required to be OPERABLE when the associated LPCI subsystem is required to be OPERABLE.

l.d, 2.d. Reactor Vessel Pressure-Low (Injection Permissive)

Low reactor vessel pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. The Reactor Vessel Pressure-Low is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the transients analyzed in References 1 and 3.

In addition, the Reactor Vessel Pressure-Low Function is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Vessel Pressure-Low signals are initiated from four pressure transmitters that sense the reactor dome (continued)

CLINTON B 3.3-95 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE l.d, 2.d. Reactor Vessel Pressure-Low (Injection SAFETY ANALYSES, Permissive) (continued)

LCO, and APPLICABILITY pressure. The four pressure transmitters each drive ATMs (with a total of eight trip channels).

The Allowable Value is low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46.

Four channels of Reactor Vessel Pressure-Low Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude ECCS initiation. (Four-channels are required for LPCS and LPCI A, while four other channels are required for LPCI B and LPCI C.)

1.e; 1.f, 2.e. Low Pressure Coolant Injection and Low Pressure Core Spray Pump Discharge Flow-Low (Bypass)

The minimum flow instruments are provided to protect the associated low pressure ECCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump. The LPCI and LPCS Pump Discharge Flow-Low Functions are assumed to be OPERABLE and capable of closing the minimum flow valves to ensure that the low pressure ECCS flows assumed during the transients and accidents analyzed in References 1, 2, and 3 are met. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

One flow transmitter per ECCS pump is used to detect the associated subsystems' flow rates. The logic is arranged such that each transmitter causes its associated minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is exceeded. The LPCI minimum flow valves are time delayed such that the valves will not open for 8 seconds after the ATMs detect low flow.

The time delay is provided to limit reactor vessel inventory (continued)

CLINTON B 3.3-96 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE l.e, l.f, 2.e. Low Pressure Coolant Injection and Low SAFETY ANALYSES, Pressure Core Spray Pump Discharge Flow-Low (Bypass)

LCO, and (continued)

APPLICABILITY loss during the startup of the RHR shutdown cooling mode (for RHR A and RHR B). The Pump Discharge Flow-Low Allowable Values are high enough to ensure that the pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core.

Each channel of Pump Discharge Flow-Low Function (one LPCS channel and three LPCI channels) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE, to ensure that no single instrument failure can preclude the ECCS function. Refer to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure ECCS subsystems.

l.g, 2.f. Manual Initiation The Manual Initiation push button channels introduce signals into the appropriate ECCS logic to provide manual initiation capability and are redundant to the automatic protective instrumentation. There is one push button for each of the two Divisions of low pressure ECCS (i.e., Division 1 ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI Band LPCI C).

The Manual Initiation Function is not assumed in any accident or transient analyses in the USAR. However, the Function is retained for the low pressure ECCS function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. Each channel of the Manual Initiation Function (one channel per Division) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE.

(continued)

CLINTON B 3.3-97 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.d. RCIC Storage Tank Level-Low (continued)

SAFETY ANALYSES, LCO, and Two channels of the RCIC Storage Tank Level-Low Function APPLICABILITY are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS swap to suppression pool source. Thus, the Function is required to be OPERABLE in MODES 1, 2, and 3.

/

With RCIC Storage Tank water level within limits, a sufficient supply of water exists for injection to minimize the consequences of a vessel draindown event. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.

3.e. Suppression Pool Water Level-High Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the S/RVs. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of HPCS from the RCIC Storage Tank to the suppression pool to eliminate the possibility of HPCS continuing to provide additional water from a source outside containment. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the RCIC Storage Tank suction valve automatically closes. This Function is implicitly assumed in the accident and transient analyses (which take credit for HPCS) since the analyses assume that the HPCS suction source is the suppression pool.

Suppression Pool Water Level-High signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated ATM can cause the suppression pool suction valve to open and the RCIC Storage Tank suction valve to close. The Allowable Value for the Suppression Pool Water Level-High Function is chosen to ensure that HPCS will be aligned for suction from the suppression pool before the water level reaches the point at which suppression pool design loads would be exceeded. The Allowable Value is referenced from an instrument zero of 731 ft 5 inches mean sea level.

(continued)

CLINTON B 3.3-101 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS Condition A is entered for that channel and provides for (continued) transfer to the appropriate subsequent Condition.

B.1, B.2, and B.3 Required Actions B.l and B.2 are intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function (or in some cases, within the same variable) result in redundant automatic initiation capability being lost for the feature(s). Required Action B.1 features would be those that are initiated by Functions 1.a, l.b, 2.a, and 2.b (e.g., low pressure ECCS). The Required Action B.2 feature would be HPCS. For Required Action B.1, redundant automatic initiation capability is lost if either (a) one or more Function 1.a channels and one or more Function 2.a channels are inoperable and untripped, or (b) one or more Function 1.b channels and one or more Function 2.b channels are inoperable and untripped.

For Divisions 1 and 2, since each inoperable channel would have Required Action B.1 applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated Division of low pressure ECCS and DG to be declared inoperable. However, since channels in both Divisions are inoperable and untripped, and the Completion Times started concurrently for the channels in both Divisions, this results in the affected portions _in both Divisions of ECCS and DG being concurrently declared inoperable.

For Required Action B.2, redundant automatic initiation capability is lost if two Function 3.a or two Function 3.b channels are inoperable and untripped in the same trip system. In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Notes are also provided (continued)

CLINTON B 3.3-109 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS B.1, B.2, and B.3 (continued)

(the Note to Required Action B.1 and Required Action B.2) to I delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable. This ensures that the proper loss of initiation capability check is performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in both Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable, untripped channels within the same variable as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCS System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the diversity of sensors available to provide initiation signals an~ the redundancy of the ECCS design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 4) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.3. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition H must be entered and its Required Action taken.

C.l and C.2 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function (or in some cases, within the same variable) result in redundant automatic initiation capability being lost for the feature(s). Required (continued)

CLINTON B 3.3-110 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS C. l and C.2 (continued)

Action C.l features would be those that are initiated by Functions l.c, l.d, 2.c, and 2.d (i.e., low pressure ECCS).

For Functions l.c and 2.c, redundant automatic initiation capability is lost if the Function l.c and Function 2.c channels are inoperable. For Functions l.d and 2.d, redundant automatic initiation capability is lost if two Function l.d channels in the same trip system and two Function 2.d channels in the same trip system (but not necessarily the same trip system as the Function l.d channels) are inoperable. Since each inoperable channel would have Required Action C.l applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected portion of the associated Division to be declared inoperable. However, since channels in both Divisions are inoperable, and the Completion Times started concurrently for the channels in both Divisions, this results in the affected portions in both Divisions being concurrently declared inoperable. For Functions l.c and 2.c, the affected portions of the Division are LPCI A and LPCI B, respectively. For Functions l.d and 2.d, the affected portions of the Division are the low pressure ECCS pumps (Divisions 1 and 2, respectively).

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The Note states that Required Action C.l is only applicable for Functions 1.c, l.d, 2.c, and 2.d. The Required Action is not applicable to Functions l.g, 2.f, and 3.h (which also require entry into this Condition if a channel in these Functions is inoperable), since they are the Manual Initiation Functions and are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action C.2) is allowed. Required Action C.l is also not applicable to Function 3.c (which also requires entry into this Condition (continued)

CLINTON B 3.3-111 Revision No. 20-2

ECCS Instrumentation B 3.3.5.1 BASES ACTIONS *E.1 and E.2 (continued) and 2.e are inoperable. Since each inoperable channel would have Required Action E.l applied separately (refer to ACTIONS Note), each inoperable channel would only require the affected low pressure ECCS pump to be declared inoperable. However, since channels for more than one low pressure ECCS pump are inoperable, and the Completion Times started concurrently for the channels of the low pressure ECCS pump~, this results in the affected low pressure ECCS pumps being concurrently declared inoperable.

In this situation (loss of redundant automatic initiation capability), the 7 day allowance of Required Action E.2 is not appropriate and the feature(s) associated with each inoperable channel must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of initiation capability for feature(s) in both Divisions. A Note is also provided (the Note to Required Action E.1) to delineate that Required Action E.1 is only applicable to low pressure ECCS Functions. Required Action E.1 is not applicable to HPCS Functions 3.f and 3.g since the loss of one channel results in a loss of the Function (one-out-of-one logic). This loss was considered during the development of Reference 4 and considered acceptable for the 7 days allowed by Required Action E.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero for beginning the allowed outage time "clock."

For Required Action E.1, the Completion Time only begins upon discovery that three channels of the variable (Pump Discharge Flow-Low) cannot be automatically initiated due to inoperable channels. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

(continued)

CLINTON B 3.3-114 Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 B 3.3 INSTRUMENTATION B 3.3.5.2 Reactor Pressure Vessel (RPV) Water Inventory Control Instrumentation BASES BACKGROUND The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF. If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to. prevent such elevated cladding temperatures.

Technical Specifications are required by 10 CFR 50.36 to include limiting safety system settings (LSSS) for variables that have significant safety functions. LSSS are defined by the regulation as "Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded."

The Analytical Limit is the limit of the process variable at which a safety action is initiated to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.

The actual settings for the automatic isolation channels are the same as those established for the same functions in MODES 1, 2, and 3 in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," or LCO 3.3.6.1, "Primary Containment Isolation instrumentation."

With the unit in MODE 4 or 5, RPV water inventory control is not required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur. Under the definition of DRAIN TIME, some penetration flow paths may be excluded from the DRAIN TIME calculation if they will be isolated by valves that will close automatically without offsite power prior to the RPV water level being equal to the TAF when actuated by RPV water level isolation instrumentation.

(continued)

CLINTON B 3.3-122a Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES BACKGROUND The purpose of the RPV Water Inventory Control (continued) Instrumentation is to support the requirements of LCO 3.5.2, "RPV Water Inventory Control," and the definition of DRAIN TIME. There are functions that are required for manual initiation or operation of the ECCS injection/spray subsystem required to be OPERABLE by LCO .3.5.2 and other functions that support automatic isolation of*Residual Heat Removal subsystem and Reactor Water Cleanup system penetration flow path(s) on low RPV water level.

The RPV Water Inventory Control Instrumentation supports operation of low pressure core spray {LPCS), low pressure coolant injection (LPCI), and high pressure core spray (HPCS). The equipment involved with each of these systems is described in the Bases for LCO 3.5.2.

APPLICABLE With the unit in MODE 4 or 5, RPV water inventory control is SAFETY not required to mitigate any events or accidents evaluated ANALYSES, LCO, in the-safety analyses. RPV water inventory control is and APPLICABILITY required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur.

A double-ended guillotine break of the Reactor Coolant System (RCS) is not postulated in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is postulated in which a single operator error or initiating event allows draining of the RPV water inventory through a single penetration flow path with the highest flow rate, or the sum of- the dra.in rates through multiple penetration flow paths susceptible to a common mode failure (e.g., seismic event, loss of normal power, single human error). It is assumed, based on engineering judgment, that while in MODES 4 and 5, one ECCS injection/spray subsystem can be manually initiated to maintain adequate reactor vessel water level.

As discussed in References 1, 2, 3, 4, and 5, operating experience has shown RPV water inventory to be significant to public health and safety. Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR 50.36(c) (2) (ii).

Permissive and interlock setpoints are generally considered as nominal values without regard to measurement accuracy.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

(continued)

CLINTON B 3.3-122b Revision No.* 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE Low Pressure Core Spray and Low Pressure Coolant Injection SAFETY Systems ANALYSES, LCO, and APPLICABILITY 1.a, 2.a. Reactor Vessel Pressure - Low (Injection (continued) Permissive)

Low reactor vessel pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. While it is assured during Modes 4 and 5 that the reactor vessel pressure will be below the ECCS maximum design pressure, the Reactor vessel Pressure - Low signals are assumed to be operable and capable of permitting initiation of the ECCS.

The Reactor Vessel Pressure - Low signals are initiated from four pressure transmitters that sense the reactor dome pressure. The four pressure transmitters each drive ATMs (with a total of eight trip channels).

The Allowable Value is low enough to prevent overpressurizing the equipment in the low pressure ECCS.

Four channels of Reactor Vessel Pressure - Low Function per associated ECCS Division are required to be OPERABLE in*

MODES 4 and 5 when ECCS Manual Operation is required, since these channels support the manual operation of the LPCS and LPCI systems. In addition, the channels are only required when the associated ECCS subsystem is required to be OPERABLE by LCO 3.5.2.

1.b, 1.c, 2.b. Low Pressure Coolant Injection and Low Pressure Core Spray Pump Discharge Flow - Low (Bypass)

The minimum flow instruments are provided to protect the associated low pressu~e ECCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump.

One flow transmitter per ECCS pump is used to detect the associated subsystems' flow rates. The logic is arranged such that each transmitter causes its associated minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is exceeded. The LPCI minimum flow valves are time delayed such that the valves will not open for 8 seconds after the ATMs detect lowflow.

The time delay is provided to limit reactor vessel inventory loss during the startup of the Residual Heat Removal (RHR) shutdown cooling mode (for RHR A and RHR B).

(continued)

CLINTON B ~.3-122c Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE The Pump Discharge Flow - Low Allowable Values are high SAFETY enough to ensure that the pump flow rate is sufficient to ANALYSES, LCO, protect the pump, yet low enough to ensure that the closure and APPLICABILITY of the minimum flow valve is initiated to allow full flow (continued) into the core.

One channel of the Pump Discharge Flow - Low Function is required to be OPERABLE in MODES 4 and 5 when the associated LPCS or LPCI pump is required to be OPERABLE by LCO 3.5.2 to ensure the pumps are capable of injecting into the Reactor Pressure Vessel when manually initiated.

High Pressure Core Spray System 3.a. Reactor Core Isolation Cooling (RCIC) Storage Tank Level - Low Low level in the RCIC Storage Tank indicates the unavailability of an adequate supply of makeup water from this normal source. Normally the suction valves between HPCS and the RCIC Storage Tank are open and water for HPCS injection would be taken from the RCIC Storage Tank.

However, if the water leyel in the RCIC Storage Tank falls below a preselected level, first the suppression pool suction valve automatically opens, and then the RCIC Storage Tank suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the HPCS pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the RCIC Storage Tank suction valve automatically closes.

RCIC Storage Tank Level - Low sig*nals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated ATM can cause the suppression pool suction valve to open and the RCIC Storage Tank suction valve to close.

The RCIC Storage Tank Level - Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the RCIC Storage Tank.

Two channels of the RCIC Storage Tank Level - Low Function are only required to be OPERABLE when HPCS is required to be OPERABLE to fulfill the requirements of LCO 3.5.2, HPCS is aligned to the RCIC Storage Tank, and the RCIC Storage Tank water level is not within the limits of SR 3.5.2.3.

(continued)

CLINTON B 3.3-122d Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE 3.b, 3.c. HPCS Pump Discharge Pressure - High (Bypass) and SAFETY HPCS System Flow Rate - Low (Bypass)

ANALYSES, LCO, and APPLICABILITY The minimum flow instruments are provided to protect the (continued) HPCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow and high pump discharge pressure are sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump or the discharge pressure is low (indicating the HPCS pump is not operating).

One flow transmitter is used to detect the HPCS System's flow rate. The logic is arranged such that the transmitter

~auses the minimum flow valve to open, provided the HPCS pump discharge pressure, sensed by another transmitter, is high enough (indicating the pump is operating). The logic will close the minimum flow valve once the closure setpoint is exceeded. (The valve will also close upon HPCS pump discharge pressure decreasing below the setpoint.)

The HPCS System Flow Rate - Low and HPCS Pump Discharge Pressure - High Allowable Value is high enough to ensure that pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core.

The HPCS Pump Discharge Pressure - High Allowable Value is set high enough to ensure that the valve will not be open when the pump is not operating.

One channel of each Function is required to be OPERABLE when

HPCS is required to be OPERABLE by LCO 3.5.2 in MODES 4 and 5.

(continued)

CLINTON B 3.3-122e Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE RHR System Isolation SAFETY ANALYSES, LCO, 4.a - Reactor Vessel Water Level - Low. Level 3 and APPLICABILITY (continued) The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level - Low, Level 3 Function is only required to be OPERABLE when automatic isolation of the associated RHR penetration flow path is credited in calculating DRAIN 'TIME.

Reactor Vessel Water Level - Low, Level 3 signals are initiated from four level transmitters (two per trip system) that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

While four channels (two channels per trip system) of the Reactor Vessel Water Level - Low, Level 3 Function are available, only two channels (all in the same trip system)

are required to be OPERABLE.

The Reactor Vessel Water Level - Low, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low, Level 3 Allowable Value (LCO 3.3.1.1),

since the capability to cool the fuel may be threatened.

(continued)

CLINTON B 3.3-122f Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE Reactor Water Cleanup (RWCU) System Isolation SAFETY ANALYSES, LCO, 5.a - Reactor Vessel Water level - Low Low, Level 2 and APPLICABILITY (continued) The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level - Low Low, Level 2 Function associated with RWCU System isolation may be credited for automatic isolation of penetration flow paths associated with the RWCU System.

Reactor Vessel Water Level - Low Low, Level 2 is initiated from two channels per trip system that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. While four channels (two channels per trip system) of the Reactor Vessel Water Level - Low, Level 2 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low, Level 2 Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level - Low Low, Level 2 Function is only required to be OPERABLE when automatic isolation of the associated penetration flow path is credited in calculating DRAIN TIME.

ACTIONS A Note has been provided to modify the ACTIONS related to RPV Water Inventory Control instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits (continued)

CLINTON B 3.3-122g Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES ACTIONS will not result in separate entry into the Condition.

( continued) Section 1.3 also specifies that Required Actions continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for .inoperable RPV Water Inventory Control instrumentation channels provide appropriate compensatory measures for separate inoperable Condition entry for each inoperable RPV Water Inventory Control instrumentation channel.

A.1.

Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.2-1. The applicable Condition referenced in the Table is Function dependent.

Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for tran$fer to the appropriate subsequent Condition.

B .1 and B. 2 RHR System Isolation, Reactor Vessel Water Level - Low Level 3, and Reactor Water Cleanup System, Reactor Vessel Water Level - Low Low, Level 2 functions are applicable when automatic isolation of the associated penetration flow path is credited in calculating Drain Time. If the instrumentation is inoperable, Required Action B.1 directs.

an immediate declaration that the associated penetration flow path(s) are incapable of automatic isolation. Required Action B. 2 directs calculation .of DRAIN TIME. The

calculation cannot credit automatic isolation of the affected penetration flow pathi.

Low reactor vessel pressure signals are used as permissives for* the low pressure ECCS injection/spray subsystem manual initiation functions. If this permissive is inoperable, manual initiation of ECCS is prohibited. Therefore, the permissive must be placed in the trip condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the permissive in the trip condition, manual initiation may be performed. Prior to placing the permissive in the tripped condition, the operator can take manual control of the pump and the injection valve to inject water into the RPV.

The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is intended to allow the operator time to evaluate any discovered inoperabilities and to place the channel in trip.

(continued)

CLINTON B 3.3-122h Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES ACTIONS D.l and D.2 (continued)

Required Actions D.1 and D.2 are intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function result in a loss of automatic suction swap for the HPCS system from the RCIC storage tank to the suppression pool. The HPCS system must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the HPCS pump suction must be aligned to the suppression pool, since, if aligned, the function is already performed.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes the risk of HPCS being needed without an adequate water source while allowing time for restoration or alignment of HPCS pump suction to the suppression pool.

E.1 If an LPCI or LPCS Discharge Flow - Low bypass function or HPCS System Discharge Pressure - High or Flow Rate - Low bypass function is inoperable, there is a risk that the associated ECCS pump could overheat when the pump is operating and the associated injection valve is not fully open. In this condition, the operator can take manual control of the pump and the injection valve to ensure the pump does not overheat.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time was chosen to allow time for the operator to evaluate and repair any discovered inoperabilities prior to declaring the affected subsystem inoperable. The Completion Time is appropriate given the ability to manually start the ECCS pumps and open the injection valves as necessary to ensure the affected pump does not overheat.

F.1 With the Required Action and associated Completion Time of Conditions C, D, or E not met, the associated ECCS injection/spray subsystem may be incapable of pe*rforming the intended function; and must be declared inoperable immediately.

(continued)

CLINTON B 3.3-122i Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES (continued)

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RPV REQUIREMENTS Water Inventory Control instrument Function are found in the SRs column of Table 3.3.5.2-1.

SR 3.3.5.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK guarantees that undetected outright channel failure is limited; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL FUNCTIONAL TEST.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

(continued)

CLINTON B 3.3-122j Revision No. 20-2

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES SURVEILLANCE SR 3.3.5.2.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Information Notice 84-81 "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," November 1984.

2. Information Notice 86-74, "Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves,"

August 1986.

3. Generic Letter 92-04, "Resolution of the Issues Related to Reactor Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR 50.54(f)," August 1992.

4. NRC Bulletin 93-03, "Resolution of Issues Related to Reactor Vessel Water Level Instrumentation in BWRs,"

May 1993.

5. Information Notice 94-52, "Inadvertent Containment Spray and Reactor Vessel Draindown at Millstone 1,"

July 1994.

CLINTON B 3.3-122k Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 B 3.3 INSTRUMENTATION B 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation BASES BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is unavailable, such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System."

The RCIC System may be initiated by either automatic or manual means. Automatic initiation occurs for conditions of Reactor Vessel Water Level-Low Low, Level 2. The variable is monitored by four transmitters that are connected to four Analog Trip Modules (ATMs). The outputs of the ATMs are connected to solid state logic arranged in a one-out-of-two

. taken twice configuration. Once initiated, the RCIC logic seals in and can be reset by the operator only when the reactor vessel water level signals have cleared.

The RCIC test line isolation valves close on a RCIC initiation signal to allow full system flow.

The R~IC System also monitors the water levels in the RCIC Storage Tank and the suppression pool, since these are the two sources of water for RCIC operation. Reactor grade water in the RCIC Storage Tank is the normal source. Upon receipt of a RCIC initiation signal, the RCIC Storage Tank suction valve is automatically signaled to open (it is normally in the open position) unless the pump suction from the suppression pool valve is open. If the water level in the RCIC Storage Tank falls below a preselected level, first the suppression pool suction valve automatically opens and then the RCIC Storage Tank suction valve automatically closes. Two level transmitters are used to detect low water level in the RCIC Storage Tank. Either switch can cause the suppressiori pool suction valve to open and the RCIC Storage Tank suction valve to close. The suppression pool suction valve also automatically opens and the RCIC Storage Tank suction valve closes if high water level is detected in the (continued)

CLINTON B 3.3-123 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES BACKGROUND suppression pool (one-out-of-two logic similar to the RCIC (continued) Storage Tank water level logic). To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other automatically closes.

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip (two-out-of-two logic), at which time the RCIC steam supply, and cooling water supply valves close (the injection valve also closes due to the closure of the steam supply valve). The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2) .

APPLJCABLE The function of the RCIC System is to provide makeup SAFETY ANALYSES, coolant to the reactor in response to transient events.

LCO, and The RCIC System is an Engineered Safety Feature System APPLICABILITY for the control rod drop accident described in Reference 1.

The RCIC System, and therefore its instrumentation, satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discuqsion.

The OPERABILITY of the RCIC System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.3-1. Each Function must have a required number of OPERABLE channels with their setpoints within the .

specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable .Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RCIC System instrumentation Function specified in the table. Nominal trip setpoints are sp~cified in the setpoint calculations.

The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less (continued)

CLINTON B 3.3-124 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE conservative than the nominal trip setpoint, but within its SAFETY ANALYSES, Allowable Value, is acceptable. Each Allowable Value LCO, and specified accounts for instrument uncertainties appropriate APPLICABILITY to the Function. These uncertainties are described in the (continued) setpoint methodology.

Certain RCIC valves (e.g., minimum flow) also serve the dual function of automatic primary containment isolation valves.

The s.ignals that provide automatic initiation of the RCIC are also associated with the automatic isolation of these valves. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.6.1, "Primary Containment and Drywell Isolation Instrumentation," and are not included in this LCO.

The individual Functions are required to be OPERABLE in MODE 1, and in MODES 2 and 3 with reactor steam dome pressure > 150 psig, s.ince this is when RCIC is required to be OPERABLE. (Refer to LCO 3.5.3 for Applicability Bases for the RCIC System.)

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water Level-Low Low, Level 2 Low reactor pressure vessel (RPV) water level indicates, that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level above the top of the active fuel.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to *a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value is set high enough such that for complete loss of*

feedwater flow, the RCIC System flow (with high pressure (continued)

CLINTON B 3.3-125 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE 1. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY core spray assumed to fail) will be sufficient to avoid initiation of low pressure ECCS at Level 1. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation.

Refer to LCO 3.5.3 for RCIC Applicability Bases.

2. Reactor Vessel Water Level-High, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to close the RCIC steam supply, and cooling water supply valves to prevent overflow into the main steam lines (MSLs).

(The injection valve also closes due to the closure of the steam supply valve.)

Reactor Vessel Water Level-High, Level 8 signals for RCIC are initiated from two level transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor V~ssel Water Level-High, Level 8 Allowable Value is high enough to preclude isolating the injection valve of the RCIC during normal operation, yet low enough to trip the RCIC Sy.stem prior to water overflowing into the MSLs. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

Two channels of Reactor Vessel Water Level-High, Level 8 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

(continued)

CLINTON B 3.3-126 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES APPLICABLE 3. RCIC Storage Tank Level-Low SAFETY ANALYSES, LCO, and Low level in the RCIC Storage Tank indicates the APPLICABILITY unavailability of an adequate supply of makeup water from (continued) this normal source. Normally the suction valve between the RCIC pump and the RCIC Storage Tank is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the RCIC Storage Tank. However, if the water level in the RCIC Storage Tank falls below a preselected level, first the suppression pool suction valve automatically opens and then the RCIC Storage Tank suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the RCIC pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the RCIC Storage Tank suction valve automatically closes.

Two level transmitters are used to detect low water level in the RCIC Storage Tank. The RCIC StorSge Tank Level~Low Function Allowable Value is set high enough to ensure adequate pump suction head while water is being taken from the RCIC Storage Tank. The Allowable Va~ue is referenced from an instrument zero of 739 ft 10-3/4 inches mean sea level.

Two channels of RCIC Storage Tank Level-Low Function are available and are required to be OPERABLE when RCIC.is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source.

Refer to LCO 3.5.3 for RCIC Applicability Bases.

4. Suppression Pool Water Level-High Excessively high suppression pool water level could result in the loads on the.suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the safety/relief valves. Therefore, signals indicating high suppression pool water.level are ~sed to transfer the suction source of RCIC from the RCIC Storage Tank to the suppression pool to eliminate the possibility of RCIC continuing to provide addi.tional water from a source outside primary containment. To prevent losing suction to (continued)

CLINTON B 3.3-127 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES (continued)

APPLICABLE 4. Suppression Pool Water Level-High (continued)

SAFETY ANALYSES, LCO, and the pump, the suction valves are interlocked so that the APPLICABILITY suppression pool suction valve must be open before the RCIC Storage Tank suction valve automatically closes.

Suppression pool water level signals are initiated from two level transmitters. The Allowable Value for the Suppression Pool Water Level-High Function is set low enough to ensure that RCIC will be aligned to take suction from the suppression pool before the water level reaches the point at which suppression design loads would be exceeded. The Allowable Value is referenced from an instrument indicated zero of 732 ft 8 inches mean sea level.

Two channels of Suppression Pool Water Level-High Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument.

failure can preclude RCIC swap to suppression pool source.

Refer to LCO 3.5.3 for RCIC Applicability Bases.

5. Manual Initiation The Manual Initiation push button switch introduces a signal into the RCIC System initiation logic that is redundant to the automatic prot~ctive instrumentation and provides manual initiation capability. There is one push button for the RCIC System.

The Manual Initiation Function is not assumed in any accident or transient analyses in the USAR. However, the Function is retained for the RCIC function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push.button. One channel of Manual Initiation is required to be OPERABLE when RCIC is required to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or (continued)

CLINTON B 3.3-128 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS variables expressed in the Condition discovered to be (continued) inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RCIC System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel.

A.1 Required Action A.l directs entry into the appropriate Condition referenced in Table 3.3.5.3-1 in the accompanying LCO. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

B.1 and B.2 Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in'a complete loss of*automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 channels in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of RCIC initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities . This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel (continued)

CLINTON B 3.3-129 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS B.l and B.2 (continued)

Water Level-Low Low, Level 2 channels in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals, an allowable out of *service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capabi-lity to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.

C.1 A risk based analysis was performed and determined that an allowable out of servi*ce time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref. 2) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.l). A Required Action (similar to Required Action B.1), limiting the allowable out of service time if a loss of automatic RCIC initiation capability exists, is not required. This Condition applies to the Reactor Vessel Water Level-High, Level 8 Function, whose logic is arranged such that any inoperable channel

will result in a loss of automatic RCIC initiation capability. As stated above, this loss of automatic RCIC initiation capability was analyzed and determi_ned to be acceptable. This Condition also applies to the Manual Initiation Function. Since this Function is not assumed in any accident or transient analysis, a total loss of manual initiation capability (Required Action C.1) for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is (continued)

CLINTON B 3.3-130 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS C.1 (continued) allowed. The Required Action does not allow placing a channel in trip since this action would not necessarily result in the safe state for the channel in all events.

D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple inoperable, untripped channels within the same Function result in automatic component initiation capability being lost for the feature(s). For Required Action D.1, the RCIC System is the only associated feature. In this case, automatic component initiation capability is lost if two Function 3 channels or two Function 4 chahnels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of RCIC initiation capability. As noted, Required Action D.1 is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned, the Function is already performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the a*llowed outage time "clock."

For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the.same Function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

(continued)

CLINTON B 3.3-131 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES ACTIONS D.l, D.2.1, and D.2.2 (continued)

(continued)

Because of the redundancy of sensors available to provide initiation signals, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 2) to permit restoration of any inoperable channel to OPERABLE status.

If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool). Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression pool, which also performs the intended function. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the RCIC System piping remains filled with water. If it is not desired to perform Required Actions D.2.1 and D.2.2, Condition E must be entered and its Required Action taken.

E.l With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCIC REQUIREMENTS System instrumentation Function are found in the SRs column of Table 3.3.5.3-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed as follows:

(continued)

CLINTON B 3.3-131a Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES SURVEILLANCE (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 2 and 5; and (b) for up REQUIREMENTS to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 1, 3, and 4 provided the associated (continued) Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary.

SR 3.3.5.3.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring

~he same parameter should read approximately the same value.

Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.5.3.2 A CHANNEL *FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. Any setpoint adjustment shall (continued)

CLINTON B 3.3-132 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES SURVEILLANCE SR 3.3.5.3.2 (continued)

REQUIREMENTS be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.3.3 The calibration of analog trip modules provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.3-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be re-adjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.3.4 and SR 3.3.5.3.6 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter with the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlted under the Surveillance Frequency Control Program.

SR 3.3.5.3.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function.

(continued)

CLINTON B 3.3-133 Revision No. 20-2

RCIC System Instrumentation B 3.3.5.3 BASES SURVEILLANCE SR 3.3.5.3.5 (continued)

REQUIREMENTS The Self Test System may be utilized to perform this testing for those components that it is designed to monitor.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. USAR, Section 15.4.9.

2. NEDE-770-06-2, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed*Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

3. USAR, Section 5.4.6.

CLINTON B 3.3-134 Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE conservative than the nominal trip setpoint, but within its SAFETY ANALYSES, Allowable Value, is acceptable. Trip setpoints are those LCO, and predetermined values of output at which an action should APPLICABILITY take place. The setpoints are compared to the actual (continued) process parameter(e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., ATM) changes state. The.analytic limits are derived from the limiting values of the process parameters obtained the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpointi are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

Certain Emergency Core Cooling Systems (ECCS) and RCIC valves (e.g., minimum flow) also serve the dual function of automatic PCIVs. The signals that isolate these valves are also associated with the automatic initiation of the ECCS and RCIC. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.5.1, "ECCS Instrumentation,"" and LCO 3.3.5.3, "RCIC Instrumentation,"

and are not included in this LCO.

In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment," or LCO 3.6.5.1, "Drywell," as applicable. Functions that have different Applicabilities are discussed below in the individual Functions discussion.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Main Steam Line Isolation 1.a. Reactor Vessel Water Level-Low Low Low, Level 1 Low re~ctor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should (continued)

CLINTON B 3.3-139 Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.a, and 2.e. Reactor Vessel Water Level-Low Low, SAFETY ANALYSES, Level 2 (continued)

LCO, and APPLICABILITY since isolation of these valves is not critical to orderly (continued) plant shutdown. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment. Thus, this Function is also required under those conditions in which a low reactor water level signal could be generated when secondary containment is required to be OPERABLE.

2.b, 2.d, 2.f. Drywell Pressure-High High drywell pressure can indicate a break in the RCPB. The isolation of some of the PCIVs on high drywell pressure supports actions to ensure that offsite dose limits of 10 CFR 100 are not exceeded. The Drywell Pressure-High Function associated with isolation of the primary containment is implicitly assumed in the USAR accident analysis as these leakage paths are assumed to be isolated post LOCA. In addition, Functions 2.b and 2.d provide isolation signals to certain drywell isolation valves. The isolation of drywell isolation valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.

In addition to providing automatic isolation capability for primary containment and drywell isolation valves, Function 2.b provides signals for automatic actuation of the Division 1 and 2 SX subsystems, including automatic start of the Division 1 and 2 SX pumps and automatic actuation of the associated subsystem isolation valves (as required to support automatic operation of the SX subsystems). The equipment involved with the SX subsystems is described in LCO 3.7.1, ftDivision 1 and 2 SX Subsystems."

(continued)

CLINTON B 3.3-145 Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.g., 2.h and 2.i. Containment Building Fuel Transfer Pool SAFETY ANALYSES, Ventilation Plenum, Containment Building, and Containment LCO,and Building Continuous Containment Purge (CCP) Exhaust APPLICABILITY Radiation-High (continued)

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding and to ensure offsite doses remain below 10 CFR 20 and 10 CFR ~00 limits.

These Functions are required to be OPERABLE during movement of r*ecently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures due to dropped fuel assemblies must be provided to ensure offsite dose limits are not exceeded.

2.j. Reactor Vessel Water Level-Low Low Low, Level 1 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of the primary containment occurs to prevent offsite dose limits from being exceeded. The Reactor Vessel Water Level-Low Low Low, Level 1 Function is one of the many Functions assumed to be OPERABLE and capable of providing isolation signals.

The Reactor Vessel Water Level-Low Low Low, Level 1 Function associated with isolation is implicitly assumed in the USAR analysis as these leakage paths are assumed to be isolated post LOCA. In addition, this Function provides an isolation signal to certain drywell isolation valves. The isolation of drywell isolation (continued)

CLINTON B 3.3-146a Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.j. Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY valves, in combination with other accident mitigation systems, functions to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.

Reactor vessel water level signals are initiated from level transmitters that sense the difference between the pressure LCO, and due to a constant column of water (reference leg)

_and the pressure due to the actual water level (variable -

leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low Low, Level 1 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value is chosen to be the same as the ECcs* Reactor Vessel Water Level-Low Low Low, Level 1 Allowable Value (LCO 3.3.5.1) to ensure the valves are isolated to prevent offsite doses from exceeding 10 CFR 100 limits. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment. Thus, this Function is also required under those conditions in which a low reactor water level signal could be generated when secondary containmept is required to be OPERABLE.

2.k. Containment Pressure-High The Containment Pressure-High Function is provided for monitoring containment differential pressure and providing a permissive to open the containment ventilation supply and exhaust isolation bypass valves when the Standby Gas Treatment (SGT) System is used as a backup to the Drywell Purge System in the post LOCA containment purge mode. If these valves are open and the setpoint is exceeded, the opening permissive would no longer be satisfied and, in this case, the h~gh pressure trip signal acts as an isolation signal to close these valves. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC.

(continued)

CLINTON B 3.3-147 Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.k. Containment Pressure-High (continued)

SAFETY ANALYSES, LCO, and The Allowable Value was chosen to prevent opening of the APPLICABILITY containment ventilation supply and exhaust isolation bypass valves when excessive differential pressure could result in damage to the associated ductwork.

Two channels of the Containment Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

2.1. Manual Initiation The Manual Initiation push button channels introduce signals into the primary containment and drywell isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability.

There is no specific USAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system (i.e., 1B21H-S25A and 1B21H-S25B). There is no Allowable Value for this Function since the *channels are mechanically actuated based solely on the position of the push buttons.

Two channels of the Manual Initiation Function are available and are required to be OPERABLE. This Function is also required to be OPERABLE during movement of recently irradiated fuel assemblies (i .. e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in primary or secondary containment. This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment.

Thus, this Function is also required under those conditions in which secondary containment is required to* be OPERABLE.

3. Reactor Core Isolation Cooling System Isolation 3.a. Auxiliary Building RCIC Steam Line Flow-High Auxiliary Building RCIC Steam Line Flow-High Function is provided to detect a break of the RCIC steam lines and initiates closure of the steam line isolation valves. If the steam is allowed to continue flowing out of the break, (continued)

CLINTON B 3.3-148 Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.e. Main Steam Line Tunnel Ambient Temperature-High SAFETY ANALYSES, (continued)

LCO, and .

APPLICABILITY Steam Tunnel Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclu.de the isolation function.

Each Function has one temperature element.

The Allowable Values are chosen to detect a leak equivalent to 25 gpm.

4.f. Reactor Vessel Water Level-Low Low, Level 2 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to isolate the potential sources of a break. The isolation of the RWCU System on Level 2 supports actions to ensure that fuel peak cladding temperature remains below the limits of 10 CFR 50.46. The Reactor Vessel Water Level-Low Low, Level 2 Function associated with RWCU isolation is not directly assumed in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.

Reactor Vessel Water Level-Low Low, Level 2 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1),

since the capability to cool the fuel may be threatened.

The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

This Function initiates isolation of valves which isolate primary containment pe~etrations which bypass secondary (continued)

CLINTON B 3.3-156 Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 4.h. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and irradiated fuel assemblies (i.e., fuel that has occupied APPLICABILITY part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in primary or secondary containment. This Function initiates isolation of valves which isolate primary containment penetrations which bypass secondary containment.

Thus, this Function is also required under those conditions in which secondary containment is required to be operable.

5. RHR System Isolation 5.a. Ambient Temperature-High Ambient Temperature-High is provided to detect a leak from the associated system steam piping. The isolation occurs when a very small leak has occurred and is diverse to the high flow instrumentation. If the small leak is allowed to continue without isolation, offsite dose limits may be reached. This Function is not assumed in any USAR transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs.

Ambient Temperature-High signals are initiated from thermocouples that are appropriately located to protect the system that is being monitored. Two instruments monitor each area. Four channels for RHR Ambient Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are set low enough to detect a leak equivalent to 25 gpm.

The RHR Equipment Room Ambient Temperature-High Function is only required to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, insufficient pressure and temperature are available to develop a significant steam leak in this piping and significant water leakage is protected by the Reactor Vessel Water Level-Low, Level 3 Function.

5.b, 5.c. Reactor Vessel Water Level-Low, Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Theref.ore, isolation of some reactor or vessel interfaces occurs to begin isolating the (continued)

CLINTON B 3.3-158 Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 5.b, 5.c. Reactor Vessel Water Level-Low, Level 3 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY potential sources of a break. The Reactor Vessel Water Level-Low, Level 3 Function associated with RHR System isolation is not directly assumed in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs. The RHR System isolation on Level 3 supports actions to ensure that the RPV water level does not drop below the top of the active fuel 'during a vessel draindown event through the 1E12-F008 and 1E12-F009 valves caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR System. The Reactor Vessel Water level-Low, Level 3 channels required to be OPERABLE by Function 5.c are only those channels which are combined with the Reactor Vessel Pressure-High Function to provide isolation of the RHR Shutdown Cooling System suction from the reactor vessel (i.e., 1E12-F008 and 1E12~F009).

Reactor Vessel Water Level-Low, Level 3 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water Level-Low, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level-Low, Level 3 Allowable Value (LCO 3.3.1.1) since the capability to cool the fuel may be threatened. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

(continued)

CLINTON B 3.3-159 Revision No. 20-2

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES ACTIONS M.l, M.2, M.3.1, M.3.2, M.3.3, and M.3.4 (continued) radioactivity releases. This may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored

to OPERABLE status. In this case, the Surveillances may need to be performed to restore the component to OPERABLE status. In addition, at least one door in the upper containment personnel air lock must be closed. The closed air lock door completes the boundary for control of potential radioactive releases. With the appropriate administrative controls however, the closed door can be opened intermittently for entry and exit. This allowance is acceptable due to the need for containment access and due to the slow progression of events which may result from a reactor vessel draindown event. Reactor vessel draindown events would not be expected to result in the immediate release of appreciable fission products to the containment atmosphere. Actions must continue until all requirements of this Condition are satisfied.

N.l, N.2.1, and N.2.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path(s) should be isolated (Required Action N.l). Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable instrumentation. Alternately, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) must be immediately suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe condition.

(continued)

CLINTON B 3.3-169 Revision No. 20-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 1. Reactor Vessel Water Level-Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value was chosen to be the same as the High Pressure Core Spray (HPCS)/Reactor Core Isolation Cooling (RCIC) Reactor Vessel Water Level-Low Low, Level 2 Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling System (ECCS)

Instrumentation," and LCO 3.3.5.3, "Reactor Core Isolation Cooling (RCIC) System Instrumentation"), since this could indicate the capability to cool the fuel is being threatened. The Allowable Value is referenced from an instrument zero of 520.62 inches above RPV zero.

The Reactor Vessel Water Level-Low Low, Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required.

2. Drywell Pressure-High High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation of high drywell pressure supports actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

However, the Drywell Pressure-High Function associated with isolation is not assumed in any USAR accident or transient analysis. It is retained for the secondary containment (continued)

CLINTON B 3.3-177 Revision No. 20-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 3, 4, 5, 6. Containment Building Fuel Transfer Pool SAFETY ANALYSES, Ventilation Plenum, Containment Building, Containment LCO, and Building Continuous Containment Purge (CCP), and Fuel APPLICABILITY Building Exhaust Radiation-High (continued) detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Four channels of each of these Exhaust Radiation-High Functions are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.

The Exhaust Radiation-High High Functions are required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, these Functions are not required. In addition, the Functions are required to be OPERABLE during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary containment or fuel building, as applicable, because the capability of detecting radiation releases due to fuel failures due to dropped fuel assemblies must be provided to ensure that offsite dose limits are not exceeded.

7.

Manual Initiation The Manual Initiation push button channels introduce signals into the secondary containment isolation logic that are redundant to the automatic protective instrumentation channels, and provide manual isolation capability. There is no specific USAR safety analysis that takes credit for this Function. It is retained for the secondary containment isolation instrumentation as required by the NRC approved licensing basis.

There are two push buttons for the logic, one manual initiation push button per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

(continued)

CLINTON B 3.3-179 Revision No. 20-2

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 7. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and Two channels of the Manual Initiation Function are APPLICABILITY available and are required to be OPERABLE in MODES 1, 2, and 3 and during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary containment or Fuel Building, since these are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE.

ACTIONS A Note has been provided to modif~ the ACTIONS related to secondary containment isolation instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable secondary containment isolation instrumentation channel.

A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Refs. 3 and 4) to permit restoration of any inoperable channel to OPERABLE status.

This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1.

Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue. Alternately, if it is not desired to place the (continued)

CLINTON B 3.3-180 Revision No. 20-2

CRV System Instrumentation B 3.3.7.1 BASES APPLICABLE 1. Control Room Air Intake Radiation Monitors SAFETY ANALYSES, LCO, and The Control Room Air Intake Radiation Monitors measure APPLICABILITY radiation levels exterior to the inlet ducting of the MCR.

(continued) A high radiation level may pose a threat to MCR personnel; thus, a detector indicating this condition automatically signals initiation of the CRV System high radiation mode.

The Control Room Air Intake Radiation Monitors Function consists of four independent monitors, two monitors (one from each division) at each of the normal air intakes. Four channels of Control Room Ventilation Radiation Monitors are available and are required to be OPERABLE to ensure that no single instrument failure can preclude CRV System high radiation mode initiation. The Allowable Value was selected to ensure protection of the control Toom personnel.

The Control Room Air Intake Radiation Monitors Function is required to be OPERABLE in MODES 1, 2, and 3, and during CORE ALTERATIONS, and movement of irradiated fuel in the primary or secondary containment to ensure that control room personnel are protected during a LOCA or a fuel handling event. During MODES 4 and 5, when these specified conditions are not in progress (e.g., CORE ALTERATIONS), the probability of a LOCA or fuel damage is low; thus, the Function is not required.

ACTIONS A Note has been provided to modify the ACTIONS related to CRV instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into (continued)

CLINTON B 3.3-217 Revision No. 20-2

ECCS--Operating B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)

WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM B 3.5.1 ECCS~Operating BASES BACKGROUND The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network is composed of the High Pressure Core Spray (HPCS) System, the Low Pressure Core Spray (LPCS) System, and the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System. The ECCS also consists of the Automatic Depressurization System (ADS). The.

suppression pool provides the required source of water for the ECCS. Although no credit is taken in the safety analyses for the RCIC storage tank, it is capable of providing a source of water for the HPCS System.

On receipt of an initiation signal, each associated ECCS pump automatically starts; simultaneously the system aligns, and the pump injects water, taken either from the RCIC storage tank or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pump. Although the system is initiated, ADS action is delayed by a timer, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCS pump discharge pressure almost immediately exceeds that of the RCS, and the pump* injects coolant into the spray sparger above the core. If the break is small, HPCS will maintain coolant inventory, as well as vessel level, while the RCS is still pressurized. If HPCS fails to maintain water level above Level 1, it is backed up by automatic initiation of ADS in combination with LPCI and LPCS. In this event, the ADS would time out and open the selected safety/relief valves (S/RVs), depressurizing the RCS and allowing the LPCI and LPCS to overcome RCS pressure and inject coolant into the vessel. Alternately, procedures may direct this automatic function be inhibited until subsequently required. If the break is large, RCS pressure initially drops rapidly, and the LPCI' and LPCS systems cool the core.

Water from the break returns to the suppression pool where it is used again and again. Water in the suppression pool is circulated through a heat exchanger cooled by the Shutdown Service Water (SX) System. Depending on the location and size of the break, portions of the ECCS may be ineffective; however, the overall design is effective in cooling the core regardless of the size or location of the (continued)

CLINTON B 3.5-1 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES BACKGROUND piping break. Although no credit is taken in the safety (continued) analysis for the RCIC System, it performs a similar function as HPCS but has reduced makeup capability. Nevertheless, it will maintain inventory and cool the core, while the RCS is still pressurized, following a reactor pressure vessel (RPV) isolation.

All ECCS subsystems are designed to ensure that no single active component failure will prevent automatic initiation and successful operation of the minimum required ECCS subsystems.

The LPCS System (Ref. 1) consists of a motor driven pump, a spray sparger above the core, piping, and valves to transfer water from the suppression pool to the sparger. The LPCS System is designed to provide cooling to the reactor core when the reactor pressure is low. Upon receipt of an initiation signal, the LPCS pump is automatically started after AC power is available. When the RPV pressure drops sufficiently, LPCS flow to the RPV begins. A full flow test line is provided to route water from and to the suppression pool to allow testing of the LPCS System without spraying water into the RPV.

LPCI is an independent operating mode of the RHR System.

There are three LPCI subsystems. Each LPCI subsystem (Ref. 2) consists of a motor driven pump, piping, and valves to transfer water from the suppression pool to the core.

Each LPCI subsystem has its own suction and discharge piping and separate vessel nozz+e that connects with the core shroud through internal piping. The LPCI subsystems are designed to provide core cooling at low RPV pressure. Upon receipt of an initiation signal, each LPCI pump is automatically started (C pump immediately after AC power is available, and A and B pumps approximately 5 seconds after AC power is restored). When the RPV pressure drops sufficiently, LPCI flow to the RPV begins. RHR System valves in *the LPCI flow path are automatically positioned to ensure the proper flow path for water from the suppression pool to inject into the core. A discharge test line is provided to route water from and to the suppression pool to allow testing of each LPCI pump without injecting water into the RPV.

The HPCS System (Ref. 3) consists of a single motor driven pump, a spray sparger above the core, and piping and valves to transfer water from the suction source to the sparger.

Suction piping is provided from the RCIC storage tank and the suppression pool. Pump suction is normally aligned to the RCIC storage tank source to minimize injection of suppression pool water into the RPV. However, if the RCIC storage tank water supply is low or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCS System. The HPCS System is designed to provide (continued)

CLINTON B 3.5-2 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES BACKGROUND core cooling over a wide range of RPV pressures (0 psid to (continued) 1200 psid, vessel to suction source). Upon receipt of an initiation signal, the HPCS pump automatically starts after AC power is available and valves in the flow path begin to open. Since the HPCS System is designed to operate over the full range of expected RPV pressures, HPCS flow begins as soon as the necessary valves are open. Full flow test lines are provided to allow testing of the HPCS System during normal operation without spraying water into the RPV.

The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed or RPV pressure is greater than the LPCS or LPCI pump discharge pressures following system initiation. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the ECCS discharge line "keep fill" systems are designed to maintain all pump discharge lines filled with water.

The ADS (Ref. 4) consists of 7 of the 16 S/RVs. It is designed to provide depressurization of the primary system during a*small break LOCA if HPCS fails or is unable to maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (LPCS and LPCI),

so that these subsystems can provide core cooling. Each ADS valve is supplied with pneumatic power from an air storage system, which consists of air accumulators located in the drywell.

APPLICABLE The ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in References 5, 6, and 7. The requir.ed analyses and assumptions are defined in 10 CFR 50 (Ref. 8), and the results of these analyses are described in Reference 9.

This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref. 10), will be met following a LOCA assuming the worst case single active component failure in the ECCS:

a. Maximum fuel element cladding temperature is~ 2200°F;

b. Maximum cladding oxidation is~ 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from zirconium water reaction is< 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

( continued)

CLINTON B 3.5-3 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES APPLICABLE d. The core is maintained in a coolable geometry; and SAFETY ANALYSES (continued) e. Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 11.

For large and small break LOCAs the HPCS System failure is the most severe. One ADS valve failure is analyzed as a limiting single failure for events requiring ADS operation.

The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of the NRC Policy Statement.

LCO Each ECCS injection/spray subsystem and seven ADS valves are required to be OPERABLE. The ECCS injection/spray subsystems are the three LPCI subsystems, the LPCS System, and the HPCS System. The ECCS injection/spray subsystems are further subdivided into the following groups:

a) The low pressure ECCS injection/spray subsystems are the LPCS System and the three LPCI subsystems; b) The ECCS injection subsystems are the three LPCI subsystems; and c) The ECCS spray subsystems are the HPCS System and the LPCS System.

Management of gas voids is important to ECCS injection/spray subsystem OPERABILITY.

With less than the required number of ECCS subsystems OPERABLE during a limiting design basis LOCA concurrent with the worst case single failure, the limits specified in 10 CFR 50.46 (Ref. 10) could potentially be exceeded. All ECCS subsystems must therefore be OPERABLE to satisfy the single failure criterion required by 10 CFR 50.46 (Ref~ 10)

The LCO is modified by a Note that allow~ a LPCI subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure. This is necessary since the RHR system is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the LPCI mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer. One LPCI subsystem is allowed to be considered inoperable for this temporary period, because in shutdown cooling mode it is fulfilling a decay heat removal capacity function. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the (continued)

CLINTON B 3.5-4 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES LCO required core cooling, thereby allowing operation of RHR (continued) shutdown cooling when necessary.

APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 2, and 3 when there is considerable energy in the reactor core and core cooling would be required to prevent fuel damage in the event of a break in the primary system piping. In MODES 2 and 3, the ADS function is not required when pressure is~ 150 psig because the low pressure ECCS subsystem~ (LPCS and LPCI) are capable of providing flow into the RPV below this pressure. ECCS requirements for MODES 4 and 5 are specified in LCO 3.5.2, "RPV Water Inventory Control."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCS subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCS subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.l If any one low pressure ECCS injection/spray subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a LOCA may result in the ECCS not being able to perform its intended safety function. Th~

7 day Completion Time is based on a reliability study (Ref. 12) that evaluated the impact on ECCS availability by assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

B.l and B.2 If the HPCS System is inoperable, and the RCIC System is verified to be OPERABLE (when RCIC is required to be OPERABLE), the HPCS System must be restored to OPERABLE status within 14 days. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with the ADS. Also, the RCIC System will (continued)

CLINTON B 3.5-5 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES ACTIONS B.1 and B.2 (continued) automatically provide makeup water at most reactor operating pressures. Verification of RCIC OPERABILITY within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is therefore required when HPCS is inoperable and RCIC is required to be OPERABLE. This may be performed by an administrative check, by examining logs or other information, to determine if RCIC is out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. However, if the OPERABILITY of the RCIC System cannot be verified and RCIC is required to be OPERABLE, Condition D must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on the results of a reliability study (Ref. 12) and has been found to be acceptable through operating experience.

C.l With two ECCS injection subsystems inoperable or one ECCS injection and one ECCS spray subsystem inoperable, at least one ECCS injection/spray subsystem must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced in this Condition because a single failure in one of the remaining OPERABLE subsystems concurrent with a design basis LOCA may result in the ECCS not being able to perform its intended safety function. Since the ECCS availability is reduced relative to Condition A, a more restrictive Completion Time is imposed. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on a reliability study, as provided in Reference 12.

D.1 If any Required Action and associated Completion Time of Condition A, B, or Care not met, the plant must be brought to a-MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 13) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action D.l is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not (continued)

CLINTON B 3.5-6 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES ACTIONS D.l (continued) permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.

However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b . . Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.l The LCO requires seven ADS valves to be OPERABLE to.provide the ADS function. Reference 14 contains the results of an analysis that evaluated the effect of one ADS valve being out of service. Per this analysis, operation of only six ADS valves will provide the required depressurization.

However, overall reliability of the ADS is reduced because a single failure in the OPERABLE ADS valves could result in a reduction in depressurization capability. Therefore, operation is only allowed for a limited time. The 14 day Completion Time is based on a reliability study (Ref. 12) and has been found to be acceptable through operating experience.

F.l and F.2 If any one low pressure ECCS injection/spray subsystem is inoperable in addition to one inoperable ADS valve, adequate core cooling is ensured by the OPERABILITY of HPCS and the remaining low pres~ure ECCS injection/spray subsystems.

However, the overall ECCS reliability is reduced because a single active component failure concurrent with a design basis LOCA could result in the minimum required ECCS equipment not being available. Since both a portion of a high pressure (ADS) and a low pressure subsystem are inoperable, a more restrictive Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is required to restore either the low pressure ECCS injection/spray subsystem or the ADS valve to OPERABLE status. This Completion Time is based on a reliability study (Ref. 12) and has been found to be acceptable through operating experience.

(continued)

CLINTON B 3.5-7 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES ACTIONS G.1 (continued)

If any Required Action and associated Completion Time of Condition E or Fare not met or if two or more ADS valves are inoperable, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 13) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action G.l is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.

However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

H.1 When multiple ECCS subsystems are inoperable, as stated* in Condition H, the plant is in a degraded condition not specifically justified for coritinued operation, and may be in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3. 5 .1.1 REQUIREMENTS The ECCS injection/spray subsystem flow path piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the ECCS injection/spray subsystems and may also prevent a water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

(continued)

CLINTON B 3.5-8 Revision No. 20-2

ECCS----Opera ting B 3.5.1 BASES SURVEILLANCE SR 3.5.1.1 (continued)

REQUIREMENTS Selection of ECCS injection/spray subsystem locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The ECCS injection/spray subsystem is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the ECCS injection/spray subsystems are not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.

Accumulated gas should be eliminated or brought within the acceptance criteria limits.

ECCS injection/spray subsystem locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitori'ng is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

(continued)

CLINTON B 3.5-9 Revision No. 20-2

\

ECCS--Operating B 3.5.1 BASES SURVEILLANCE SR 3. 5 .1. 2 REQUIREMENTS (continued) Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves potentially capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.

SR 3. 5 .1. 3 Verification that ADS accumulator supply pressure is

~ 140 psig assures adequate air pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The designed pneumatic supply pressure requirements for the accumulator are such that, following a failure of the pneumatic supply to the accumulator, *at least two valve actuations can occur with the drywell at 70% of design pressure (Ref. 15). The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. This minimum required pressure of 140 psig is provided by the Instrument Air System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3.5-10 Revision No. 20-2

ECCS---Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.3 (continued)

REQUIREMENTS With regard to ADS accumulator supply pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.

This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 17).

SR 3. 5 .1. 4 The performance requirements of the ECCS pumps are determined through application of the 10 CFR 50, Appendix K, criteria*(Ref. 8). This periodic Surveillance is performed (in accordance with the ASME Code requirements for the ECCS pumps) to verify that the ECCS pumps will develop the flow rates required by the respective analyses. The ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of 10 CFR 50.46 (Ref. 10).

The pump flow rates are verified with a pump differential pressure that* is sufficient to overcome the RPV pressure expected during a LOCA. The pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during LOCAs. These values may be established during pre-operational testing. The Frequency for this Surveillance is in accordance with the INSERVICE TESTING PROGRAM requirements.

With regard to pump flow rates and differential pressures values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 18, 19, 20). Calculations 01HP15, 01LP16 and 01RH26 determine the margin between actual pump performance capability and the system design requirements and the Analyzed Design Limits as established by SAFER/GESTR. These margins are large enough to account for the instrument indication uncertainties and the lower EOG frequency limit per SR 3.8.1.2 and therefore the specified limit in this SR can be considered to be a nominal value (Refs. 18, 19, 20,

24) .

(continued)

CLINTON B 3.5-11 Revision No. 20-2

ECCS---Operating B 3.5.1 BASES SURVEILLANCE SR 3. 5 .1. 5 REQUIREMENTS (continued) The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance test verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCS, LPCS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup, and actuation of all automatic valves to their required positions. This Surveillance also ensures that the HPC$ System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV hig0 water level (Level 8) trip and that the suction is automatically transferred from the RCIC storage tank to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required duri.ng the Surveillance.

SR 3.5.1.6 The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.

A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete te.sting of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes valve actuation.

This prevents an RPV pressure blowdown.

SR 3.5.1.7 A manual actuation of each required ADS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can (continued)

CLINTON B 3.5-12 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7 (continued)

REQUIREMENTS be demonstrated by one of two methods. If performed by Method 1, plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements (Ref. 22), prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable Conditions for testing and provides a reasonable time to complete the SR. If performed by Method 2, valve OPERABILITY has been demonstrated for all installed ADS valves based upon the successful operations of a test sample of S/RVs.

1. Manual actuation of the ADS valve, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,

tailpipe temperature or acoustic monitoring). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the ADS valves divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

2. The sample population of S/RVs tested to satisfy SR 3.4.4.1 will also be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that all ADS valves will perform in a similar fashion. After the S/RVs are replaced, the relief-mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified. This verifies that each replaced S/RV will properly perform its intended function.

SR 3.5.1.6 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3.5-13 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.8 REQUIREMENTS (continued) This SR ensures that the ECCS RESPONSE TIMES are within limits for each of the ECCS injection and spray subsystems.

The response time limits (i.e., <42 seconds for the LPCI subsystems, <41 seconds for the LPCS subsystem, and <27 seconds for the HPCS system) are specified in applicable surveillance test procedures. This SR is modified by a Note which identifies that the associated ECCS actuation instrumentation is not required to be response time tested.

This is supported by Reference 16.

Response time testing of the remaining subsystem components is required. However, of the remaining subsystem components, the. time for each ECCS pump to reach rated speed is not directly measured in the response time tests. The time(s) for the ECCS pumps to reach rated speed is bounded, in all cases, by the time(s) for the ECCS injection valve(s) to reach the full-open position. Plant-specific calculations show that all ECCS motor start times at rated voltage are less than two seconds. In addition, these calculations show that under degraded voltage conditions, the time to rated speed is less than five seconds.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

With regard to ECCS RESPONSE TIME values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 21).

(continued)

CLINTON B 3.5-14 Revision No. 20-2

ECCS--Operating B 3.5.1 BASES (continued)

REFERENCES 1. USAR, Section 6.3.2.2.3.

2. USAR, Section 6.3.2.2.4.

3. USAR, Section 6.3.2.2.1.

4. USAR, Section 6.3.2.2.2.

5. USAR, Section 15.2.8.

6. USAR, Section 15. 6. 4.

7. USAR, Section 15.6.5.

8. 10 CFR 50, Appendix K.

9. USAR, Section 6. 3. 3.

10. 10 CFR 50.46.

11. USAR, Section 6.3.3.3.

12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCO's for ECCS Components, II December 1, 1975.

13. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

14. USAR, Table 6.3-8.

15. USAR, Section 7.3.1.1.1.4.

16. NED0-32291-A, "System Analyses for Elimination of Selected Response Time Testing Requirements," January 1994.

17. Calculation IP-0-0044.

18. Calculations 01HP09/10/ll/15, IP-C-0042.

19. Calculations 01LP08/ll/14/16, IP-C-0043.

20. Calculations 01RH19/20/22/26, IP-C-0041.

21. Calculation IP-0-0024.

22. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Power Plants, Part 1.

23. ASME Code for Operation and Maintenance of Nuclear Power Plants.

24. NEDC-32945P, "Clinton Power Station SAFER/GESTR-LOCA Analysis," June 2000.

CLINTON B 3.5-15 Revision No. 20-2

ECCS-Dperating B 3.5.1 This page intentionally left blank.

CLINTON B 3.5-16 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)

WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM B 3.5.2 RPV Water Inventory Control BASES BACKGROUND The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF. If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to prevent such elevated cladding temperatures.

APPLICABLE With the unit in MODE 4 or 5, RPV water inventory control is SAFETY ANALYSES not required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2,1.1.3 and the fuel cladding barrier to prevent the release of radioactive material to the environment should an unexpected draining event occur.

A double-ended guillotine break of the Reactor Coolant System (RCS) is not postulated in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is considered in which single operator error or initiating event allows draining of the RPV water i'nventory through a single penetration flow path with the highest flow rate, or the sum of the drain rates through multiple penetration flow paths susceptible to a common mode failure (e.g., seismic event, loss of normal power, single human error). It is assumed, based on engineering judgment, that while in MODES 4 and 5, one low pressure ECCS injection/spray subsystem can maintain adequate reactor vessel water level.

As discussed in References 1, 2, 3, 4, and 5, operating experience has shown RPV water inventory to be significant to public health and safety. Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO The RPV water level must be controlled in MODES 4 and 5 to ensure that if an unexpected draining event should occur, the reactor coolant water level remains above the top of the active irradiated fuel as required by Safety Limit 2.1.1.3.

The Limiting Condition for Operation (LCO) requires the DRAIN TIME of RPV water inventory to the TAF to be~ 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . A DRAIN TIME of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months is considered reasonable to (continued)

CLINTON B 3.5-17 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES LCO identify and initiate action to mitigate unexpected draining (continued) of reactor coolant. An event that could cause loss of RPV water inventory and result in the RPV water level reaching the TAF in greater than 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months does not represent a significant challenge to Safety Limit 2.1.1.3 and can be managed as part of normal plant operation.

One ECCS injection/spray subsystem is required to be OPERABLE and capable of being manually started to provide defense-in-depth should an unexpected draining event occur.

An ECCS injection/spray subsystem is defined as either one of the three Low Pressure Coolant.Injection (LPCI) subsystems, one Low Pressure Core Spray (LPCS) System, or one High Pressure Core Spray (HPCS) System. The LPCI subsystem and the LPCS System consist of one motor driven pump, piping, and valves to transfer water from the suppression pool to the reactor pressure vessel (RPV). The HPCS System consists of one motor driven pump, piping, and valves to transfer water from the suppression pool or RCIC storage tank to the RPV. Management of gas voids is important to ECCS injection/spray subsystem OPERABILITY.

The LCO is modified by a Note that allows a LPCI subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure. This is necessary since the RHR system is required to .operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the LPCI mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to_damage the RHR system, including water hammer. One LPCI subsystem is allowed to.be considered inoperable for this temporary period, because in shutdown cooling mode it 'is fulfilling a decay heat removal capacity function. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary. Because of the restrictions on DRAIN TIME, sufficient time will be available following an unexpected draining event to manually align and operate the required LPCI subsystem to maintain RPV water inventory prior to the RPV water level reaching the TAF.

(continued)

CLINTON B 3.5-18 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES (continued)

APPLICABILITY RPV water inventory control is required in MODES 4 and 5.

Requirements on water inventory control in other MODES are contained in LCOs in Section 3.3, Instrumentation, and other LCOs in Section 3.5, ECCS, RCIC, and RPV Water Inventory Control. RPV water inventory control is required to protect Safety Limit 2.1.1.3 which is applicaple whenever irradiated fuel is in the reactor vessel.

ACTIONS A.1 and B.1 If the required ECCS injection/spray subsystem is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In this Condition, the LCO controls on DRAIN TIME minimize the possibility that an unexpected draining event could necessitate the use Qf the ECCS injection/spray subsystem, however the defense-in-depth provided by the ECCS injection/spray subsystem is lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time for restoring the required ECCS injection/spray subsystem to OPERABLE status is based on engineering judgment that considers the LCO controls on DRAIN TIME and the low probability of a an unexpected draining event that would result in a loss of RPV water inventory.

If the inoperable ECCS injection/spray subsystem is not restored to OPERABLE status within the required Completion Time, action must be initiated immediately to establish a method of water injection capable of operating without offsite electrical power. The method of water injection includes the necessary instrumentation and controls, water sources, and pumps and valves needed to add water to the RPV or refueling cavity should an unexpected draining event occur. The method of water injection may be manually operated and may consist of one or more systems or subsystems, and must be able to access water inventory capable of maintaining the RPV water level above the TAF for

~ 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . If recirculation of injected water would occur, it may be credited in determining the necessary water volume.

(continued)

CLINTON B 3.5-19 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES ACTIONS C.l, C.2, and C.3 (continued)

With the DRAIN TIME less than 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months but greater than or equal to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , compensatory measures should be taken to ensure the ability to implement mitigating actions should an unexpected draining event occur. Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material. Additional actions are taken to ensure that radioactive material will be contained, diluted, and processed prior to being released to the environment.

The secondary containment provides a controlled volume in which fission products can be contained, diluted, and processed prior to release to the environment. Required Action C.l requires verification of the capability to establish the secondary containment boundary in less than the DRAIN TIME. The required verification confirms actions to establish the secondary containment boundary are preplanned and necessary materials are available. The secondary containment boundary is considered established when one Standby Gas Treatment (SGT) subsystem is capable of maintaining a negative pressure in the secondary containment with respect to the environment.

Verification that the secondary containment boundary can be established must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The required verification is an administrative activity and does not require manipulation or testing of equipment. Secondary containment penetration flow paths form a part of the secondary containment boundary. A secondary containment (continued)

CLINTON B 3.5-20 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES ACTIONS C.l, C.2, and C.3 (continued) penetration flow path can be considered isolated when one barrier in the flow path is in place. Examples of suitable barriers include, but are not limited to, a closed secondary containment isolation damper (SCIO), a closed manual valve, a blind flange, or another sealing device that sufficiently seals the penetration flow path. Required Action C.2 requires verification of the capability to isolate each secondary containment penetration flow path in less than the DRAIN TIME. The required verification confirms actions to isolate the secondary containment penetration flow paths are preplanned and necessary materials are available. Power operated dampers are not required to receive automatic isolation signals if they can be closed manually within the required time. Verification that the secondary containment penetration flow paths can be isolated must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The required verification is an administrative activity and does not*require manipulation or testing of equipment. The primary containment upper personnel airlock is considered part of the secondary containment boundary; therefore, it must be considered when completing this action.

One SGT subsystem is capable of maintaining the secondary containment at a negative pressure with respect to the environment and filter gaseous releases. Required Action C.3 requires verification of the capability to place one SGT subsystem in operation in less than the DRAIN TIME. The required verification confirms actions to place a SGT subsystem in operation are preplanned and necessary materials are available. Verification that a SGT subsystem can be placed in operation must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

The required verification is an administrative activity and does not require manipulation or testing of equipment.

D.l, D.2, D.3, and D.4 With the DRAIN TIME less than 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , mitigating actions are implemented in case an unexpected draining event should occur. Note that if the DRAIN TIME is less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , Required Action E.l is also applicable.

Required Action D.l requires immediate action to establish an additional method of water injection augmenting the ECCS injection/spray subsystem required by the LCO. The systems or injection and the ECCSsubsystems. The additional method of water injection includes the necessary instrumentation and controls, water sources, and pumps and valves needed to add water to the RPV or refueling cavity should an unexpected draining event occur. The Note to Required Action D.l states that either the ECCS injection/spray subsystem or the additional method of water injection must be capable of operating without offsite electrical power.

The additional method of water injection may be manually (continued)

CLINTON B 3.5-21 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES ACTIONS D.l, D.2, D.3, and D.4 (continued) operated and may consist of one or more additional method of water injection must be able to access water inventory capable of being in1ected to maintain the RPV water level above the TAF for~ 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The additional method of water injection and the ECCS injection/spray subsystem may share all or part of the same water sources. If recirculation of injected water would occur, it may be credited in determining the required water volume.

Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material.

Additional actions are taken to ensure that radioactive material will be contained, diluted, and proceised prior to being released to the environment.

The secondary containment provides a control volume into which fission products can be contained, diluted, and processed prior to release to the environment, Required Action D.2 requires that actions be immediately initiated to establish the secondary containment boundary. With the secondary containment boundary established, one SGT subsystem is capable of maintaining a negative pressure in the secondary.containment with respect to the environment.

The secondary containment penetrations form a part of the secondary containment boundary. Required Action D.3 requires that actions be immediately initiated to verify that each secondary containment penetration flow path. is isolated or to verify that it can be manually isolated from the* control room. Examples of manual isolation from the control room could include the use of manual isolation pushbuttons, control switches, or placing a sufficient number of radiation monitor channels in trip. A secondary containment penetration flow path can be considered isolated when one *barrier in the flow path is in place. Examples of suitable barriers include, but are not limited to, a closed secondary containment isolation damper (SCIO), a closed manual valve, a blind flange, or another sealing device that sufficiently seals the penetration flow path. The primary containment upper personnel airlock and other primary containment penetrations that bypass secondary containment are considered part of the secondary containment boundary; therefore, they must be considered when completing this action.

One SGT subsystem is capable or maintaining the secondary containment at a negative pressure with respect to the environment and filter gaseous releases. Required Action D.4 requires that actions be immediately initiated to verify that at least one SGT subsystem is capable of being placed in operation. The required verification is an administrative activity and does not require manipulation or testing of equipment.

(continued)

CLINTON B 3.5-22 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES ACTIONS E.l (continued)

If the Required Actions and associated Completion times of Conditions C or Dare not met or if the DRAIN TIME is less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , actions must be initiated immediately to restore the DRAIN TIME to~ 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . In this condition, there may be insufficient time to respond to an unexpected draining event to prevent the RPV water inventory from reaching the TAF. Note that Required Actions D.l, D.2, D.3, and D.4 are also applicable when DRAIN TIME is less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

SURVEILLANCE SR 3.5.2.1 REQUIREMENTS This Surveillance verifies that the DRAIN TIME of RPV water inventory to the TAF is~ 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The period of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months is considered reasonable to identify and initiate action to mitigate draining of reactor coolant. Loss of RPV water inventory that would result 'in the RPV water level reaching the TAF in greater than 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months does not represent a significant challenge to Safety Limit 2.1.1.3 and can be managed as part of normal plant operation.

The definition of DRAIN TIME states that realistic cross-sectional areas and drain rates are used in the calculation.

A realistic drain rate may be determined using a single, step-wise, or integrated calculation considering the changing RPV water level during a draining event. For a Control Rod RPV penetration flow path with the Control Rod Drive Mechanism removed and not replaced with a blank flange, the realistic cross-sectional area is based on the control rod blade seated in the control rod guide tube. If the control rod blade will be raised from the penetration to adjust or verify seating of the blade, the exposed cross-sectional area of the RPV penetration flow path is used.

The definition of DRAIN TIME excludes from the calculation those penetration flow paths connected to an intact closed system, or isolated by manual or automatic valves that are locked, sealed, or otherwise secured in the closed position, blank flanges, or other devices that prevent flow of reactor coolant through the penetration flow paths. A blank flange or other bolted device must be connected with a sufficient number of bolts to prevent draining in the event of an Operating Basis Earthquake. Normal or expected leakage from closed systems or past isolation devices is permitted.

Determination that a system is intact and closed or isolated must consider the status of branch lines and ongoing plant maintenance and testing activities.

The Residual Heat Removal (RHR) Shutdown Cooling System is only considered an intact closed system when misalignment (continued)

CLINTON B 3.5-23 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 (continued)

REQUIREMENTS issues (Reference 6) have been precluded by functional valve interlocks or by isolation devices, such that redirection of RPV water out of an RHR subsystem is precluded. Further, RHR Shutdown Cooling System is only considered an intact closed system if its controls have not been transferred to Remote Shutdown, which disables the interlocks and isolation signals.

The exclusion of penetration flow paths from the determination of DRAIN TIME must consider .the potential effects of a single operator error or initiating event on items supporting maintenance and testing (rigging, scaffolding, temporary shielding, piping plugs, snubber removal, freeze seals, etc.). If failure of such items could result and would.cause a draining event from a closed system or between the RPV and the isolation device, the penetration flow path may not be excluded from the DRAIN TIME calculation.

Surveillance Requirement 3.0.1 requires SRs to be met between performances. Therefore, any changes in plant conditions that would change the DRAIN TIME requires that a new DRAIN TIME be determined.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.2 and SR 3.5.2.3 The minimum water level of 12 ft 8 inches required for the suppression pool is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the ECCS pump, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, the required ECCS injection/spray subsystem is inoperable unless it is aligned to an OPERABLE RCIC storage tank.

With regard to suppression pool water level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal.value with respect to instrument uncertainties.

This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 2).

When the suppression pool level is< 12 ft 8 inches, the HPCS System is considered OPERABLE only if it can take suction from the RCIC storage tank and the RCIC storage tank (continued)

CLINTON B 3.5-24 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.2 and SR 3.5.2.3 (continued)

REQUIREMENTS water level is sufficient to provide the required NPSH for the HPCS pump. Therefore, a verification that either the suppression pool water level is~ 12 ft 8 inches or the HPCS System is aligned to take suction from the RCIC storage tank and the RCIC storage tank contains~ 125,000 available gallons of water ensures that the HPCS System can supply makeup water to the RPV. Verification that the RCIC storage tank contains~ 125,000 available gallons of water may be performed by verifying that the trip light for 1E51-N801 is on.

With regard to RCIC storage tank water level values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 2).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.4 The Bases provided for SR 3.5.1.1 are applicable to SR 3.5.2.4.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.5 Verifying the correct alignment for manual, power operated, and automatic valves in the required ECCS subsystem flow paths provides assurance that the proper flow paths will be available for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.

This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3.5-25 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.5 (continued)

REQUIREMENTS In MODES 4 and 5, the RHR System may operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor. Therefore, RHR valves that are required for LPCI subsystem operation may be aligned for decay heat removal.

This SR is modified by a Note. The Note exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.

SR 3.5.2.6 Verifying that the required ECCS injection/spray subsystem can be manually started and operate for at least 10 minutes demonstrates that the subsystem is available to mitigate a draining event. Testing the ECCS injection/spray subsystem*

through the full flow test recirculation line is adequate to confirm the operational readiness of the required ECCS injection/spray subsystem. The minimum operating time of 10 m'inutes was based on engineering judgement.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.7 Verifying that each valve credited for automatically isolating a penetration flow path actuates to the isolation position on an actual or simulated RPV water level isolation signal is required to prevent RPV water inventory from dropping below the TAF should an unexpected draining event occur.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3.5-26 Revision No. 20-2

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.8 REQUIREMENTS (continued) The required ECCS subsystem shall be capable of being manually operated from the main control room. This Surveillance verifies that the required LCPI subsystem, LPCS System, or HPCS System (*including the associated pump and valve(s)) can be manually operated, including throttling injection valves, as necessary, to provide additional RPV Water Inventory, if needed, without delay.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the full flow test line, coolant injection into the RPV is not required during the Surveillance.

REFERENCES 1. Information Notice 84-81 "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," November 1984.

2. Information Notice 86-74, "Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves," August 1986.

3. Generic Letter 92-04, "Resolution of the Issues Related to Reactor Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR 50.54(f)," August 1992.

4. NRC Bulletin 93-03, "Resolution of Issues Related to Reactor Vessel Water Level Instrumentation in BWRs,"

May 1993.

5. Information Notice 94-52, "Inadvertent Containment Spray and Reactor Vessel Draindown at Millstone l,"

July 1994.

6. General Electric Service Information Letter No. 388, "RHR Valve Misalignment During Shutdown Cooling Operation for BWR 3/4/5/6," Febru~ry 1983.

CLINTON B 3.5-27 Revision No. 20-2

RPV Water Inventory Control B 3.5.2

.This page intentionally left blank.

CLINTON B 3.5-28 Revision No. 20-2

RCIC System B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), REACTOR PRESSURE VESSEL (RPV)

WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC)

SYSTEM B 3.5.3 RCIC System BASES BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions.

The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of RPV water level. Under these conditions, the High Pressure Core Spray (HPCS) and RCIC systems perform similar functions. The RCIC System design requirements ensure tha~ the criteria of Reference 1 are satisfied.

The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the reactor head cooling spray nozzle. Suction piping is provided from the RCIC storage tank and the suppression pool. Pump suction is normally aligned to the RCIC storage tank to minimize injection of suppression pool water into the RPV. However, if the RCIC storage tank water supply is low, or the suppression pool level is 0igh, an automatic transfer to the

.suppression pool water source ensures a water supply for continuous operation of the RCIC System. The steam supply to the turbine is piped from main steam line A, upstream of the inboard main steam line isolation valve.

The RCIC System is designed to provide core cooling for a wide range of reactor pressures, 165 psia to 1215 psia.

Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed .. As the RCIC flow increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water from and to the RCIC storage tank to allow testing of the RCIC System during normal operation without injecting water into the RPV.

(continued)

CLINTON B 3.5-29 Revision No. 20-2

RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow bypass line, (continued) which discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge line "keep fill" system is designed to maintain the pump discharge line filled with water.

APPLICABLE The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant. to the reactor. The RCIC System is not an Engineered Safety Feature and no credit is taken in the safety analysis for RCIC System operation. The RCIC System satisfies Criterion 4 of the NRC Policy Statement.

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity to maintain RPV inventory during an isolation event. Management of gas voids is important to RCIC System OPERABILITY.

APPLICABILITY The RCIC System is required to be OPERABLE in MODE 1, and MODES 2 and 3 with reactor steam dome pressure> 150 psig since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure~ 150 psig, and in MODES 4 and 5, RCIC is not required to be OPERABLE since the ECCS injection/spray subsystems can provide sufficient flow to the vessel.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

(continued)

CLINTON B 3.5-30 Revision No. 20-2

RCIC System B 3.5.3 BASES ACTIONS A.1 and A.2 (continued)

If the RCIC System is inoperable during MODE 1, or MODES 2 or 3 with reactor steam dome pressure> 150 psig, and the HPCS System is verified to be OPERABLE, the RCIC System must be restored to OPERABLE status within 14 days. In this Condition, loss of the RCIC System will not affect the overall plant capability to provide makeup inventory at high RPV pressure since the HPCS System is the only high pressure system assumed to function during a loss of coolant accident (LOCA). OPERABILITY of the*HPCS is therefore verified within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months when the RCIC System is inoperable. This may be performed as an administrative check, by examining logs or other information, to determine if the HPCS is out of service for maintenance or other reasons. Verification does not require performing the Surveillances needed to demonstrate the OPERABILITY of the HPCS System. If the OPERABILITY of the HPCS System cannot be verified, however, Condition B must be immediately entered. For transients and certain abnormal events with no LOCA, RCIC (as opposed to HPCS) is the preferred source of makeup coolant because of its relatively small capacity, which allows easier control of RPV water level. Therefore, a limited time is allowed to restore the inoperable RCIC to OPERABLE status.

The 14 day Completion Time is base9 on a reliability study (Ref. 3) that evaluated the impact on ECCS availability, assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (AOTs). Because of the similar functions of the HPCS and RCIC, the AOTs (i.e., Completion Times) determined for the HPCS are also applied to RCIC.

B.1 and B.2 If the RCIC System cannot be restored to OPERABLE status within the associated Completion Time, or if the HPCS System is simultaneously inoperable, the plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and reactor steam dome pressure reduced to

~ 150 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.5-31 Revision No. 20-2

RCIC System B 3.5.3 BASES (continued)

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The RCIC System flow path piping and components have the potential to develop voids and pockets of entrained gases.

Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RCIC System and may also prevent a water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

Selection of RCIC System locations susceptible to gas accumulation is based on a self-assessment of the piping configuration to identify where gases may accumulate and remain even after the system is filled and vented, and to identify vulnerable potential degassing flow paths. The review is supplemented by verification that installed high-point vents are actually at the system high points, including field verification to ensure pipe shapes and construction tolerances have not inadvertently created additional high points. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The RCIC System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RCIC Systems are not rendered inoperable by the accumulated gas (i.e.,

the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.

RCIC System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative sub-set of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety.

For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method.used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

(continued)

CLINTON B 3.5-32 Revision No. 20-2

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 (cont.i,.nued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

SR 3.5.3.2 Verifying the correct alignment for manual, power operated, and automatic valves in the RCIC flow path. provides assurance that the proper flow path will exist for RCIC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the RCIC System, this SR also includes the steam flow path for the turbine and the flow controller position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.

(continued)

CLINTON B 3.5-33 Revision No. 20-2

.RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 REQUIREMENTS (continued) The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated. The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system.

Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Since the required reactor steam pressure must be available to perform SR 3.5.3.3 and SR 3.5.3.4, sufficient time is allowed after adequate pressure and flow are achieved to perform these SRs. Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time to satisfactorily perform the Surveillance is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable. Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

With regard to RCIC steam supply pressure values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 5).

With regard to the measured reactor pressure and flow rate values obtained pursuant to SR 3.5.3.3, as read from plant.

instrumentation assumed in Reference 5, are considered to be nominal values and therefore do not require compensation for instrument indication uncertainties.

With regard to the measured reactor pressure and flow rate values obtained pursuant to SR 3.5.3.4, the values as read from plant indication instrumentation are not considered to be nominal values with respect to instrument uncertainties. This requires additional margin to be added to the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 5).

(continued)

CLINTON B 3.5-34 Revision No. 20-2

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.5 REQUIREMENTS (continued) The RCIC System is required to actuate automatically to perform its design function. This Surveillance verifies that with a required system initiation signal (actual or simulated) the automatic initiation logic of RCIC will cause the system to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup and actuation of all automatic valves to their required positions.* This Surveillance test also ensures that the RCIC System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the RCIC storage tank to the suppr.ession pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.3, "Reactor Core Isolation Cooling (RCIC) System Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 33.

2. USAR, Section 5.4.6.

3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), "Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.

4. Deleted.

5. Calculation 01RI15.

CLINTON B 3.5-35 Revision No. 20-2

RCIC System B 3.5.3 This page intentionally left blank.

CLINTON B 3.5-36 Revision No. 20-2

Primary Containment Air Locks B 3.6.1.2 BASES LCO The primary containment air locks are required to be (continued) OPERABLE. For each air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, the air lock must be in compliance with the Type Bair lock leakage test, and both air lock doors must be OPERABLE. The interlock allows only one air lock door to be open at a time. This provision ensures that a gross breach of primary containment does not exist when primary containment is required to be OPERABLE. Closure of a single door in each air lock is sufficient to provide a leak tight barrier following postulated events. Nevertheless, both doors are kept closed when the air lock is not being used for normal entry into and exit from primary containment.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining OPERABLE primary containment air locks in MODE 4 or 5 to ensure a control volume is only required during situations for which significant releases of radioactive material can be postulated; such as during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in.the primary containment.

ACTIONS The ACTIONS are modified by Note 1, which allows entry and exit to perform repairs of the affected air lock component.

If the outei door is inoperable, then it may be easily accessed for most repairs. It is preferred that the air lock be accessed from inside primary containment by entering through the other OPERABLE air lock. However, if this is not practicable, or if repairs on either door must be performed from the barrel side of the door, then it is permissible to enter the air lock through the OPERABLE door, which means there is a short time during which the primary containment boundary is not intact (during access through the OPERABLE door). The ability to open the OPERABLE door, even if it means the primary containment boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the primary containment during the short time in which the OPERABLE door is expected to be open. After each entry and exit, the OPERABLE door must be immediately closed.

(continued)

CLINTON B 3.6-8 Revision No. 20-2

Primary Containment Air Locks B 3.6.1.2

BASES ACTIONS C.l, C.2, and C.3 (continued) both doors failing the seal test, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the affected primary containment air locks must be verified closed. This Required Action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3.6.1.1, which require that primary containment be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status considering that at least one door is maintained closed in each affected air lock.

D.l and D.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time while operating in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.l and E.2 If the inoperable primary containment air lock cannot be restored to OPERABLE status within the associated Completion Time during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary or secondary containment, action is required to immediately suspend activities that represent a potential for releasing radioactive material, thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

The Required Actions of Condition E are modified by a Note indicating that LCO 3.0.3 does not apply. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of recently irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

(continued)

CLINTON B 3.6-12 Revision No. 20-2

Primary Containment Air Locks B 3.6.1.2 BASES (continued)

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of the Primary Containment Leakage Rate Testing Program when in MODES 1, 2, and 3. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The acceptance criteria were established during initial air lock and primary containment OPERABILITY testing. The periodic testing requirements verify that the air lock l~akage does not exceed the allowed fraction of the overall primary .containment leakage rate. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

The SR has been modified by three Notes. Note 1 provides an exception to the specific leakage requirements for the primary containment air locks in other than MODES 1, 2, and 3. When not operating in MODES 1, 2, or 3, primary containment pressure is not expected to significantly increase above normal, and therefore specific testing at elevated pressure is not required. Note 2 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test.

This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a OBA. Note 3 has been added to this SR, requiring the results to be evaluated against the acceptance criteria applicable to SR 3.6.1.1.1, i.e., the acceptance criteria specified in the Primary Containment Leakage Rate Testing Program. Conformance to the Primary Containment Leakage Rate Testing Program requires air lock leakage to be included in determining the overall primary containment leakage rate.

With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 5).

(continued)

CLINTON B 3.6-13 Revision No. 20-2

Primary Containment Air Locks B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.2 REQUIREMENTS (continued) The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident primary containment pressure (Ref. 4), closure of either door will support primary containment OPERABILITY. Thus*, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled unde~ the Surveillance Frequency Control Program.

REFERENCES 1. USAR, Section 3. 8.

2. 10 CFR 50, Appendix J, Option B.

. 3. USAR, Section 6 .2 .1.

4. USAR, Section 15.7.4.

5 Calculation IP-0-0056.

CLINTON B 3.6-14 Revision No. 20-2

PCIVs B 3.6.1.3 BASES LCO applicable, in the USAR (Ref. 5). Purge valves with (continued) resilient seals, secondary containment bypass isolation valves, MSIVs, and hydrostatically tested valves must meet other leakage rate requirements. Other PCIV leakage rates are addressed by LCO 3.6.1.1, "Primary Containment," as Type B or C testing.

This LCO provides assurance that the PCIVs will perform their designed safety functions to minimize th& loss of reactor coolant inventory, and establish the primary containment boundary during accidents.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES . . Therefore, most PCIVs are not required to be OPERABLE in MODES 4 and 5. Certain valves are required to be OPERABLE, however, to prevent release of radioactive material during a postulated fuel handling accident. These valves are those PCIVs in lines which bypass secondary containment.

ACTIONS The ACTIONS are modified by a Note allowing penetration flow path(s) to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated individual at the controls of the valve, who.is in continuous communication with the control room. In this way, the penetration can be rapidly isolated when a need for primary containment isolation is indicated.

A second Note has been added to provide clarification that, for the purpose of this LCO, separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions* for each inoperable PCIV.

Complying with the Required Actions may allow for continued operation, and subsequent inoperable PCIVs are governed by subsequent Condition entry and application of associated Required Actions.

The ACTIONS are modified by Notes 3 and 4. These Notes ensure appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable PCIV (e.g., an Emergency Core Cooling System subsystem is inoperable due to a failed open test return valve, or when the primary containment leakage limits are exceeded). Pursuant to LCO 3.0.6, these ACTIONS are not required even when the associated LCO is not met.

Therefore, Notes 3 and 4 are added to require the proper actions to be taken.

A fifth note has been added to allow removal of the Inclined Fuel Transfer System (IFTS) blind flange when primary containment operability is required. This provides the (continued)

CLINTON B 3.6-17 Revision No. 20-2

PCIVs B 3.6.1.3 BASES ACTIONS option of operating the IFTS for testing, maintenance, or (continued) movement of new (non-irradiated) fuel to the upper containment pool when primary containment operability is required. Requiring the fuel building fuel transfer pool water to be~ el. 753 ft. ensures a sufficient depth of water over the highest point on the transfer tube outlet valve in the fuel building fuel transfer pool to prevent direct communication between the containment building atmosphere and the fuel building atmosphere via the inclined fuel transfer tube. Because excessive leakage of water from the upper containment pool through the open IFTS penetration would result in the inability to provide the required volume of water to the suppression pool in an upper pool dump, an administrative control was required to ensure the upper pool volume meets the design requirements. In addition to the dedicated individual stationed at the IFTS controls, the required administrative controls involved the installation of the Steam Dryer Pool to Reactor Cavity Pool gate.with the seal inflated and a backup air supply provided. Since the IFTS transfer tube drain line does not have the same water level as the transfer tube, and the motor-operated drain valve remains open when the carriage is in the lower pool, administrative controls are required to ensure the drain line flow path. is quickly isolated in the event of a LOCA.

In this instance, administrative controls of the IFTS transfer tube drain line isolation valve(s) include stationing a dedicated individual, who is in continuous communication with the control room, at the IFTS control panel in the fuel building. This individual will initiate closure of the IFTS transfer tube drain line motor-operated isolation valve. (1F42-F003), the IFTS transfer tube drain line manual isolation valve (1F42-F301), and the IFTS drain line test connection isolation.valve (1F42-F305) if a need for primary containment isolation is indicated. The pressure integrity of the IFTS transfer tube, the seal created by water depth of the fuel building transfer pool, and the administrative control of the drain line flow path create an acceptable barrier to prevent the post-accident containment building atmosphere from leaking into the fuel building.

The total time per operating cycle that the blind flange may be open in Modes 1, 2, and 3 without affecting plant risk levels is 40 days.

A.1 and A.2 With one or more penetration flow paths with one PCIV inoperable except for inoperabilitj due to leakage not within a limit specified in an SR to this LCO, th~ affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through (continued)

CLINTON B 3.6-18 Revision No. 20-2

PCIVs B 3.6.1.3 BASES ACTIONS A.land A.2 (continued) the valve secured. For penetrations isolated in accordance with Required Action A.l, the device used to isolate the penetration should be the closest one available to the primary containment. The Required Action must be completed within the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time (8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for main steam lines and 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for instrument line excess flow check valves (EFCVs)). The specified time period of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is reasonable considering the time required to isolate the penetration and the relative importance of supporting primary containment OPERABILITY during MODES 1, 2, and 3.

For main steam lines, an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is allowed.

The Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months for the main steam lines allows a period of time to restore the MSIVs to OPERABLE status given the fact that MSIV closure will result in isolation of the main steam line(s) and a potential for plant shutdown. For EFCVs, a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is allowed. The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for EFCVs allows a period of time to restore the EFCVs to OPERABLE status given the fact that these valves are associated with instrument lines which are of small diameter and thus represent less significant leakage paths.

For affected penetrations that have been isolated in accordance with Required Action A.l, the affected penetration flow path must be verified to be isolated on a periodic basis. This is necessary to ensure that primary containment penetrations required to be isolated following an accident, and no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or device manipulation. Rather, it involves verification that those devices outside primary containment, drywell, and steam tunnel and capable of being mispositioned are in the correct position. The Completion Time for this verification of "once per 31 days for isolation devices outside primary containment, drywell, and steam tunnel," is appropriate because the devices are operated under administrative controls and the probability of their misalignment is low.

For devices inside primary containment, drywell, or steam tunnel, the specified time period of "prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days," is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and the existence of other administrative controls ensuring that device misalignment is an unlikely possibility.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative means.

Allowing verification by administrative means is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment; once they have been verified to be in the proper position, is low.

(continued)

CLINTON B 3.6-19 Revision No. 20-2

PCIVs B 3.6.1.3 BASES ACTIONS B.1 (continued)

With one or more penetration flow paths with two PCIVs inoperable, except due to leakage not within limits, either the inoperable PCIVs must be restored to OPERABLE status or the affected penetration flow path must be isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, and a blind flange.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.1.1.

C.l With the secondary containment bypass leakage rate, hydrostatic leakage rate, or MSIV leakage rate not within limit, the assumptions of the safety analysis may not be met. Therefore, the leakage must be restored to within limit within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage rate for the isolation penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the leakage rate is assumed to be the lesser actual pathway leakage of the two devices.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable considering the time required to restore the leakage by isolating the penetration and the relative importance to the overall containment function.

0.1, 0.2, and 0.3 In the event one or more primary containment purge valves are not within the purge valve leakage limits, purge valve leakage must be restored to within limits or the affected penetration must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, closed manual valve, and blind flange. If a purge valve with resilient seals is utilized to satisfy Required Action 0.1, it must have been demonstrated to meet the leakage requirements of SR 3.6.1.3.5. The specified Completion Time is reasonable, considering that one primary containment purge valve remains closed (refer to the requirements of SR 3.6.1.3.1; if this requirement is not met, entry into Condition A and B, as appropriate, would also be required), so that a gross breach of primary containment does not exist.

In accordance with Required Action 0.2, this penetration flow path must be verified to be isolated on a periodic (continued)

CLINTON B 3.6-20 Revision No. 20-2

PCIVs B 3.6.1.3 BASES ACTIONS D.l, D.2, and D.3 (continued) basis. The periodic verification is necessary to ensure that primary containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or valve manipulation. Rather, it involves verification that those isolation devices outside primary containment and potentially capable of being mispositioned are in ~he correct position. F6r the isolation devices inside primary containment, the time period specified as "prior to entering MODE 2 or 3, from MODE 4 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

For a primary containment purge valve with a resilient seal that is isolated in accordance with Required Action D.l, SR 3.6.1.3.5 must be performed at least once every 92 days.

This provides assurance that degradation of the resilient seal is detected and confirms that the leakage rate of the primary containment purge valve does not increase during the time the* penetration is isolated. The normal Frequency for SR 3.6.1.3,5 is as required by the Primary Containment Leakage Rate Testing Program. Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often. Therefore, a Frequency of once per 92 days was chosen and has been shown acceptable based on operating experience.

E.l and E.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.l If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe condition.

(continued)

CLINTON B 3.6-21 Revision No. 20-2

PCIVs B 3.6.1.3 BASES ACTIONS F.1 (continued)

The Required Actions of Condition Fare modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while *in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of recently irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3 . 6 . 1. 3 . 1 REQUIREMENTS This SR verifies that the 36-inch primary containment purge valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of the limits. If the open valve is known to have excessive le*akage,, Condition D appli'es.

The SR is also modified by a Note (Note 1) stating that primary containment purge valves are only required to be closed in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, the primary containment purge valves are capable of closing before the pressure pulse affects systems downstream of the purge valves and the release of radioactive material will not exceed limits prior to the purge valves closing. At times other than MODE 1, 2, or. 3 when the purge valves are required to be capable of closing (e.g., during movement of recently irradiated fuel assemblies) pressurization concerns are not present and the purge valves are allowed to be open (automatic isolation capability would be required by SR 3.6.1.3.4 and SR 3.6.1.3.7).

The SR is modified by a Note (Note 2) stating that the SR is not required to be met when the purge valves are open for the stated reasons. The Note states that the 36-inch valves may be opened for pressure control, ALARA or air quality considerations for personnel entry, or for Surveillances or special testing on the purge system that require the valves to be open (e.g., testing of containment and drywell ventilation radiation moni~ors), provided the I2-inch containment purge and the drywell vent and purge lines are isolated. These primary containment purge valves are capable of closing in the environment following a LOCA.

Therefore, these valves are allowed to be open for limited periods of time. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3. 6-22 Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.2 REQUIREMENTS (continued) This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment, drywell, and steam tunnel, and is required to be closed during accident conditions, is closed.

The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the primary containment boundary is within design limits. This SR does not require any testin*g or valve manipulation. Rather, it involves verification that those devices outside primary containment, drywell, and steam tunnel, and capable of being mispositioned, are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Two Notes are added to this SR. The first Note applies to valves and blind flanges located in high radiation areas a~d allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low. A second Note is included to clarify that PCIVs open under administrative controls are not required to meet the SR during the time the PCIVs are open.

SR 3.6.1.3.3 This SR verifies that each primary containment manual isolation valve and blind flange located inside primary containment, drywell, or steam tunnel, and required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For devices inside primary containment, drywell, and steam tunnel, the Frequency of "prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days", is appropriate since these devices are operated under administrative controls and the probability of their misalignment is low.

Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1, 2, and 3. Therefore, the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A second Note is included to clarify that PCIVs that are open under administrative controls are not required to meet the SR during the time that the PCIVs are open.

(continued)

CLINTON B 3.6-23 Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.4 REQUIREMENTS (continued) Verifying the isolation time of each power operated and each automatic PCIV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded from this SR since MSIV full closure isolation time is demonstrated by SR 3.6.1.3.6.

The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the INSERVICE TESTING PROGRAM.

With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 8).

SR 3 . 6 . 1. 3 . 5 For primary containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of the Primary Containment Leakage Rate Testing Program is required to ensure OPERABILITY. The ac_ceptance criterion for this test is~ 0.02 La for each penetration when pressurized to Pa, 9.0 psig. Since cycling these valves may introduce additional seal degradation (beyond that which occurs to a valve that has not been opened), this SR must be performed within 92 days after opening the valve. However, operating experience has demonstrated that if a valve with a resilient seal is not stroked during an operating cycle, significant increased leakage through the valve is not observed. Based on this observation, a normal Frequency in accordance with the Primary Containment Leakage Rate Testing Program was established.

The SR is modified by a Note stating that the primary containment purge valves are only required to meet leakage rate testing requirements in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, purge valve leakage must be minimized to ensure offsite radiological release is within limits. At other times when the purge valves are required to be capable of closing (e.g., during handling of recently irradiated fuel),

pressurization concerns are not present and the purge valves are not required to meet any specific leakage criteria.

With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 9).

Dose associated with leakage through the primary containment purge lines is considered to be in addition to that controlled as part of the primary ~ontainment leakage rate limit, La, and the 0.08 La limit for the other secondary containment bypass leakage paths.

(continued)

CLINTON B 3.6-24 Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.6 REQUIREMENTS

( continued) Verifying that the full closure isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY. The full closure isolation time test ensures that the MSIV will isolate in a time period that does not exceed the times assumed in the OBA analyses. The Frequency of this SR is in accordance with 'the INSERVICE TESTING PROGRAM.

With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 10).

SR 3.6.1.3.7 Automatic PCIVs close on a primary containment isolation signal to prevent leakage of radioactive material from primary containment following a OBA. This SR ensures that each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.8 This SR ensures that the leakage rate of secondary containment bypass leakage paths is less than the specified leakage rate. This provides assurance that the assumptions in the radiological evaluations of References 1, 2, and 3 are met. The leakage rate of each bypass leakage path is assumed to be the maximum pathway leakage (leakage through the worse of the two isolation valves) unless the penetration is isolated by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. In this case, the leakage rate of the isolated bypass leakage path is assumed to be the actual pathway leakage through the isolation device. If both isolation valves in the penetration are closed, the actual leakage rate is the lesser leakage rate of the two valves. This method of quantifying maximum pathway leakage is only to be used for this SR.

The Frequency is consistent with the Primary Containment Leakage Rate Testing Program. This SR simply imposes additional acceptance criteria. Secondary containment bypass leakage is considered part of La.

Note 1 states that primary containment purge penetrations lMC-101 and lMC-102 are excluded from this SR verifying the secondary containment bypass leakage. The leakage through (continued)

CLINTON B 3.6-25 Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.8 (continued)

REQUIREMENTS these penetrations is measured by SR 3.6.1.3.5 and the consequences associated with this leakage are evaluated separately as part of the LOCA analysis. Therefore, the leakage through the primary containment purge penetrations is excluded from the total secondary containment bypass leakage as verified in this SR. A second Note is provided to this SR which states that these valves are only required to meet this leakage limit in MODES 1, 2 and 3. In the other conditions,* the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.

Wit'h regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does *not require compensation for instrument indication uncertainties (Ref. 9).

SR 3.6.1.3.9 The analyses in References 1, 2, and 3 are based on leakage that is less than the specified leakage rate. Combined leakage through all four main steamlines must be~ 200 scfh when tested at Pa (9.0 psig). In addition, the leakage rate through any single main steam line must be< 100 scfh when tested at Pa. The MSIV leakage rate must beverified to be in accordance with the assumptions of References 1, 2, and 3. A Note is added to this SR which states that these valves are only required to meet this leakage limit in MODES 1, 2, and 3. In the other conditions, the Reactor Coolant System is not pressurized and primary containment leakage limits are not required. The Frequency is required by the Primary Containment Leakage Rate Testing Program.

With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).

SR 3.6.1.3.10

(

Surveillance of hydrostatically tested lines provides assurance that the calculation assumptions of Reference 4 are met. The combined leakage rates (of 1 gpm times the total number of PCIVs when tested at~ 1.1 Pa) must be demonstrated at the frequency of the leakage test requirem~nts of the Primary Containment Leakage Rate Testing Program.

This SR is modified by a Note that states that these valves are only required to meet the combined leakage rate in MODES 1, 2, and 3 since this is when the Reactor Coolant System is pressurized and primary containment is required.

(continued)

CLINTON B 3. 6-26 Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.10 (continued)

REQUIREMENTS In some instances, the valves are required to be capable of automatically closing during MODES other than MODES 1, 2, and 3. However, specific leakage limits are not applicable in these other MODES or conditions.

With regard to leakage rate values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 12).

SR 3.6.1.3.11 This SR ensures that the combined leakage rate of the primary containment feedwater penetrations is less than the specified leakage rate. The leakage rate is based on water as the test medium since these penetrations are designed to be sealed by the FWLCS. The 2 gpm leakage limit has been shown by testing and analysis to bound the condition following a OBA LOCA where, for a limited time, both air and water are postulated to leak through this pathway. The leakage rate of each primary containment feedwater penetration is assumed to be the maximum pathway leakage, i.e., the leakage through the worst of the two isolation valves (either 1B21-F032A(B) or 1B21-F065A(B)) in each penetration. This provides assurance that the assumptions in the radiological evaluations of References 1 and 2 are met (Ref. 15).

Dose associated with leakage (both air and water) through the primary containment feedwater penetrations is considered to be in addition to the dose associated with all other secondary containment bypass leakage paths.

The Frequency is in accordance with the Primary Containment Leakage Rate Testing Program.

A Note is added to this SR which states that the primary containment feedwater penetrations are only required to meet this leakage limit in Modes 1, 2, and 3. In other conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.

SR 3.6.1.3.12 This SR requires a demonstration that each instrumentation line excess flow check valve (EFCV) which communicates to the reactor coolant pressure boundary (Ref. 16) is OPERABLE by verifying that the valve activates within the required flow range. For instrument lines connected to reactor coolant pressure boundary, the EFCVs serve as an additional flow restrictor to the orifices that are installed inside (continued)

CLINTON B 3.6-27 Revision No. 20-2

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.12 (continued)

REQUIREMENTS the drywell (Ref. 14). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The operating limit or process parameter value associated with this SR, as read from plant indication*instrumentation, is considered nominal. Instrument indications that are considered nominal do not require compensation for instrument indication uncertainties (Ref. 13).

Instrument lines that connect to the containment atmosphere, such as those which measure drywell pressure, or monitor the containment atmosphere or suppression pool water level, are considered extensions of primary containment. A failure of one of these instrument lines during normal operation would not result in the closure of the associated EFCV, since normal operating containment pressure is not sufficient to operate the valve. Such EFCVs will only close with a downstream line break concurrent with a LOCA. Since these conditions are beyond the plant design basis, EFCV closure is not needed and containment atmospheric instrument line EFCVs need not be tested (Ref. 16).

REFERENCES 1. USAR, Chapter 15.6.5.

2. USAR, Section 15.6.4.

3. USAR, Section 15.7.4.

4. USAR, Section 6.2.

5. USAR, Table 6.2-47.

6. 10 CFR 50, Appendix J, Option B.

7. Regulatory Guide 1.11.

8. Calculation IP-0-0059.

9. Calculation IP-0-0056.

10. Calculation IP-0-0028.

11. Calculation IP-0-0063.

12. Calculation IP-0-0064.

13. Calculation IP-0-0065.

14. Calculation IP-M-0506

15. License Amendment 127

16. NEDO 32977-A, ftExcess Flow Check Valve Testing Relaxation" CLINTON B 3.6-28 Revision No. 20-2

RHR Containment Spray System B 3.6.1.7 BASES APPLICABLE The analysis demonstrates that with containment spray SAFETY ANALYSES operation the containment pressure remains within design (continued) limits.

The RHR Containment Spray System satisfies Criterion 3 of the NRC Policy Statement.

LCO In the event of a Design Basis Accident (DEA), a minimum of one RHR containment spray subsystem is required to mitigate potential bypass leakage paths and maintain the primary containment peak pressure below design limits. To ensure that these requirements are met, two RHR containment spray subsystems must be OPERABLE. Therefore, in the event of an accident, at least one subsystem is OPERABLE assuming the worst case single active failure. An RHR containment spray subsystem is OPERABLE when the pump, the heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE. Management of gas voids is important to RHR Containment Spray System OPERABILITY.

The LCO is modified by a Note that allows an RHR containment spray subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure. This is necessary since the RHR system is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the RHR containment *spray mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer. One RHR Containment Spray subsystem is allowed to be considered inoperable for this temporary period, because in shutdown cooling mode it is fulfilling a decay heat removal capacity function. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling when necessary.

APPLICABILITY In MODES 1, 2, and 3, a DEA could cause pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining RHR containment spray subsystems OPERABLE is not required in MODE 4 or 5.

ACTIONS A.l With one RHR containment spray subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE RHR containment spray subsystem is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the (continued)

CLINTON B 3.6-40 Revision No. 20-1

RHR Containment Spray System B 3.6.1.7 BASES ACTIONS A. l (continued)

OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time was chosen in light of the redundant RHR containment capabilities afforded by the OPERABLE subsystem and the low probability of a OBA occurring during this period.

B.1 With two RHR containment spray subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this Condition, there is a substantial loss of the drywell bypass leakage mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a OBA and because alternative methods to remove heat from primary containment are available.

C.1 If the inoperable RHR containment spray subsystem cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action C.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.

However, where. allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.6-41 Revision No. 20-1

RHR Containment Spray System B 3.6.1.7 BASES (continued)

SURVEILLANCE SR 3.6.1.7.1 REQUIREMENTS Verifying the correct alignment for manual, power.operated, and automatic valves in the RHR containment spray mode flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.

SR 3.6.1.7.2 Verifying each RHR pump develops a flow rate~ 3800 gpm while operating in the suppression pool cooling mode with flow through the associated heat exchanger ensures that pump performance has not degraded below the required flow rate during the cycle. It is tested in the pool cooling mode to demonstrate pump OPERABILITY without spraying down equipment in primary containment. Although this SR is satisfied by running the pump in the suppression pool cooling mode, the test procedures that satisfy this SR include appropriate acceptance criteria to account for the higher pressure requirements resulting from aligning the RHR System in the containment spray mode. The Frequency of this SR is in accordance with the Inservice Testing Program.

(continued)

CLINTON B 3.6-42 Revision No. 20-1

FWLCS B 3.6.1.9 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.9 Feedwater Leakage Control System (FWLCS)

BASES BACKGROUND Following a DBA LOCA, the FWLCS supplements the isolation function of primary containment isolation valves (PCIVs) in the feedwater lines which also penetrate the secondary containment. These penetrations are sealed by water form the FWLCS to prevent fission products (post-LOCA containment atmosphere) from leaking past the isolation valves and bypassing the secondary containment after a Design Basis Accident (DBA) loss of coolant accident (LOCA).

The FWLCS consists of two independent, manually initiated subsystems. Each subsystem uses its connected tr~in of the residual heat removal (RHR) system and a header to provide sealing water for pressurizing the feedwater piping either between the inboard and outboard containment isolation check valves or between the outboard containment isolation check valve and the outboard motor-operated gate* valve.

APPLICABLE The analyses described in Reference 1 provide the evaluation SAFETY ANALYSES of offsite dose consequences during accident conditions.

The analyses take credit for manually initiating FWLCS within 20 minutes following the initiation of a DBA LOCA (assuming termination of feedwater flow through the feedwater lines), after which secondary containment bypass leakage through the feedwater lines is assumed to continue until the associated piping is filled, which occurs within one hour after initiation of the accident.

The FWLCS satisfies Criterion 3 of the NRC Policy Statement.

LCO Two FWLCS subsystems must be OPERABLE so that in the event of an accident, at least one subsystem is OPERABLE assuming a worst-case single active failure., A FWLCS subsystem is OPERABLE when all necessary components are available to pressurize each feedwater piping section with sufficient water pressure to preclude containment atmosphere leakage (following the time period required to fill and pressurize the feedwater piping sections) when the containment atmosphere is at the maximum peak coritainment pressure, P.

The LCO is modified by a Note that allows one FWLCS subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pres.sure less than the residual heat removal cut-in permissive pressure.

This is necessary since the RHR system is required to (continued)

CLINTON B 3.6-45 Revision No. 20-1

FWLCS B 3.6.1.9 BASES LCO operate in the shutdown cooling mode to remove decay heat (continued) and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the FWLCS mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer.

APPLICABILITY In MODES 1, 2, and 3, a DEA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these 'MODES. Therefore, the FWLCS is not required to be OPERABLE in MODES 4 and 5 to prevent leakage of radioactive material from primary containment.

ACTIONS A.l With one FWLCS subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 30 days. In this Condition, the remaining OPERABLE FWLCS subsystem is adequate to perform the required leakage control function. The 30-day Completion Time is based on low probability of the occurrence of a DEA LOCA, the amount of time available after the event for operator action to prevent exceeding this limit, the low probability of failure of the OPERABLE FWLCS subsystem, and the availability of the PCIVs.

B.l With two FWLCS subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 7 days. The 7 day Completion Time is based on the low probability of the occurrence of a DEA LOCA, the availability of operator action, and the availability of the PCIVs.

C.l If the inoperable FWLCS subsystem cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

(continued)

CLINTON B 3.6-46 Revision No. 20-2

Suppression Pool Average Temperature B 3.6.2.1 BASES (continued)

APPLICABLE The postulated OBA against which the primary containment SAFETY ANALYSES performance is evaluated is the entire spectrum of postulated pipe breaks within the primary containment.

Inputs to the safety analyses include initial suppression pool water volume and suppression pool temperature (References 1 and 2). An initial pool temperature of 95°F is assumed for the Reference 1 and 2 analyses. Reactor shutdown at a pool temperature of 110°F and vessel depressurization at a pool temperature of 120°F are assumed for the Reference 2 analyses. The limit of 105°F, at which testing is terminated, is not used in the safety analyses because DBAs are assumed to not initiate during plant testing.

Suppression pool average temperature satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO A limitation on the suppression pool average temperature is required to assure that the primary containment conditions assumed for the safety analyses are met. This limitation subsequently ensures that peak primary containment pressures and temperatures do not exceed maximum allowable values during a postulated D~A or any transient resulting in heatup of the suppression pool. The LCO requirements are as follows:

a. Average temperature~ 95°F when THERMAL POWER is> 1%

RTP and no testing that adds heat to the suppression pool is being performed. This requirement ensures that licensing bases initial conditions are met.

b. Average temperature~ 105°F when THERMAL POWER is> 1%

RTP and testing that adds heat to the suppression pool

is being performed. This requirement ensures that the plant has testing flexibility, and was selected to provide margin below the 110°F limit at which reactor shutdown is required. When testing ends, temperature must be restored to~ 95°F within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months according to Required Action A. 2. Therefore*, the time period that the temperature is> 95°F is short enough not to cause a significant increase in plant risk.

c. Average temperature~ 110°F when THERMAL POWER is~ 1%

RTP. This requirement ensures that the plant will be shut down at> 110°F. The pool is designed to absorb decay heat and sensible heat but could be heated

'beyond design limits by the steam i;fenerated if the reactor is not shut down.

Note that when the reactor is producing power essentially equivalent to 1% RTP, heat input is approximately equal to normal system heat losses.

(continued)

CLINTON B 3.6-49 Revision No. 20-2

Suppression Pool Average Temperature B 3.6.2.1 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause significant heatup of the suppression pool. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.

Therefore, maintaining suppression pool average temperature within limits is not required in MODE 4 or 5.

ACTIONS A.1 and A.2 With the suppression pool average temperature above the specified limit when not performing testing that adds heat to the suppression pool and when.above the specified power indication, the initial conditions exceed the conditions assumed for the Reference 1 and 2 analyses. However, primary containment cooling capability still exists,- and the primary containment pressure suppression function will occur at temperatures well above that assumed for safety analyses.

Therefore, continued operation is allowed for a limited time. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is adequate to allow the suppression pool temperature to be restored to below the limit. Additionally, when pool temperature is> 95°F, increased monitoring of the pool temperature is required to ensure it remains~ 110°F. The once per hour Completion Time is adequate based on past experience, which has shown that suppression pool temperature increases relatively slowly except when testing that adds heat to the pool is being performed. Testing that adds heat to the suppression pool excludes RHR pump testing. Furthermore, the once per hour Completion Time is considered adequate in view of other indications in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

B.1 If the suppression pool average temperature cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to< 1% RTP within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to reduce reactor power from full power in an orderly manner and without challenging plant systems.

(continued)

CLINTON B 3.6-50 Revision No. 20-2

Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS C.l (continued)

Suppression pool average temperature is allowed to be> 95°F with THERMAL POWER> 1% RTP when testing that adds heat to the suppression pool is being performed. However, if temperature is> 105°F, the testing must be immediately suspended to preserve the pool's heat absorption capability.

With the testing suspended, Condition A is entered and the Required Actions and associated Completion Times are applicable.

0.1, D.2, and 0.3 Suppression pool average temperature> 110°F requires that the reactor be shut down immediately. This is accomplished by placing the reactor mode switch in the shutdown position.

Further cooldown to MODE 4 is required at normal cooldown rates (provided pool temperature remains~ 120°8.)

Additionally, when pool temperature is> 110°F, increased monitoring of pool temperature is required to ensure that it remains~ 120°F. The once per 30 minute Completion Time is adequate, based on operating experience. Given the high pool temperature in this Condition, the monitoring Frequency is increased to twice that of Condition A. Furthermore, the 30 minute Completion Time is considered adequate in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

E.l and E.2 If suppression pool average temperature cannot be maintained

~ 120°F, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the reactor pressure must be reduced to< 200 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and the plant must be brought to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner without challenging plant systems.

Continued addition of heat to the suppression pool with pool temperature> 120°F could result in exceeding the design basis maximum allowable values for primary containment temperature or pressure.

(continued)

CLINTON B 3.6-51 Revision No. 20-2

Suppression Pool Average Temperature B 3.6.2.1 BASES (continued)

SURVEILLANCE SR 3 . 6 . 2 . 1. 1 REQUIREMENTS The suppression pool average temperature is regularly monitored to ensure that the required limita are satisfied.

Average temperature is determined by taking an arithmetic average of the functional suppression pool water temperature channels. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. When heat is being added to the suppression pool by testing, however, it is necessary to monitor suppression pool temperature more frequently. Testing that adds heat tti the suppression pool excludes RHR pump testing. The 5 minute Frequency during testing is justified by the rates at which testing will heat up the suppression pool, has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded. The Frequency is further justified in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

With regard to the 95°F suppression pool average temp~rature pursuant to this SR, as read from plant indication instrumentation, this limit is considered a nominal value and therefore does not require compensation for instrument indication uncertainties.

With regard to suppression pool average temperature values obtained for compliance with the 105°F, 110°F, and 120°F limits, as read from plant indication instrumentation, the specified limits are not considered to be nominal values with respect to instrument uncertainties. This requires additional margin to be added to the limits to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 3).

REFERENCES 1. USAR, Section 6.2.

2. USAR, Section 15.2.

3. Calculation IP-0-0071.

CLINTON B 3. 6-52 Revision No. 20-2

Suppression Pool Water Level B 3.6.2.2 BASES APPLICABLE within the limits specified so that the safety analysis of SAFETY ANALYSES Reference 1 remains valid.

(continued)

Suppression pool water level satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO A limit that suppression pool water level be~ 18 ft 11 inches and~ 19 ft 5 inches (or~ 18 feet 11 inches and

~ 20 ft 1 inches in MODE 3 with reactor pressure less than 235 psig) is required to ensure that the primary containment conditions assumed for the safety analysis are met. Either the high or low water level limits were used in the safety analysis, depending upon which is conservative for a particular calculation.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant loads on the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced because of the pressure and temperature limitations in these MODES.

Requirements for suppression pool level in MODE 4 or 5 are addressed in LCO 3.5.2, "RPV Water Inventory Control."

ACTIONS A. l With suppression pool water level outside the limits, the conditions assumed for the safety analysis are not met. If water level is below the minimum level, the pressure suppression function still exists as long as horizontal vents are covered, RCIC turbine exhaust is covered, and S/RV quenchers are covered. If suppression pool water level is above the maximum level, protection against overpressurization still exists due to the margin in the peak containment pressure analysis and _due to OPERABLE containment sprays. Prompt action to* restore the suppression pool water level to within.the normal range is prudent, however, to retain the margin to weir wall overflow from an inadvertent upper pool dump and reduce the risks of increased pool swell and dynamic loading. Therefore, continued operation for a limited time is allowed. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion.Time is sufficient to restore suppression pool water level to within specified limits. Also, it takes into account the low probability of an event impacting the suppression pool water level occurring during this interval.

(continued)

CLINTON B 3.6-54 Revision No. 20-2

RHR Suppression Pool Cooling B 3.6.2.3 BASES APPLICABLE The RHR Suppression Pool Cooling System satisfies SAFETY ANALYSES Criterion 3 of the NRC Policy Statement.

(continued)

LCO During a OBA, a minimum of one RHR suppression pool cooling subsystem is required to maintain the primary containment peak pressure and temperature below the design limits (Ref. 1). To ensure that these requirements are met, two RHR suppression pool cooling subsystems must be OPERABLE.

Therefore, in the event of an accident, *at least one subsystem is OPERABLE, assuming the worst case single active failure. An RHR suppression pool cooling subsystem is OPERABLE when the pump, heat exchanger, and associated piping, valves, instrumentation, and controls are OPERABLE.

Management of gas voids is important to RHR Suppression Pool Cooling System OPERABILITY.

The LCO is modified by a Note that allows one RHR suppression pool cooling subsystem to be inoperable during alignment and operation for decay heat removal with reactor steam dome pressure less than the residual heat removal cut-in permissive pressure. This is necessary since the RHR system is required to operate in the shutdown cooling mode to remove decay heat and sensible heat from the reactor, and manual realignment from the shutdown cooling mode to the RHR suppression pool cooling mode could result in pump cavitation and voiding in the suction piping, resulting in the potential to damage the RHR system, including water hammer. At these low pressures and decay heat levels, a reduced complement of ECCS subsystems should provide the required core cooling, thereby allowing operation of RHR shutdown cooling for decay heat removal.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of radioactive material to primary containment and cause a heatup and pressurization of primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the RHR Suppression Pool Cooling System is not required to be OPERABLE in MODE 4 or 5.

ACTIONS A.l With one RHR suppression pool cooling subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining RHR suppression pool cooling subsystem *is adequate to perform the primary containment cooling function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in reduced primary containment cooling capability. The 7 day Completion Time is acceptable in light of the redundant RHR suppression pool cooling capabilities afforded by the OPERABLE subsystem and the low probability of a OBA occurring during this period.

(continued)

CLINTON B 3.6-57 Revision No. 20-1

Secondary Containment B 3.6.4.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.1 Secondary Containment BASES BACKGROUND The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (OBA).

In conjunction with operation of the Standby Gas Treatment (SGT) System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment (e.g., during CORE ALTERATIONS or during movement of irradiated fuel assemblies in the primary or secondary containment), when primary containment is not required to be OPERABLE, or that take place outside primary containment.

The secondary containment is a structure that completely encloses the primary containment (except for the upper containment personnel ~ir. lock penetration) and those components that may be postulated to contain primary system fluid. This structure forms a control volume that serves to hold up and dilute the fission products. It is possible for the pressure in the control volume to rise relative to the environmental pressure (e.g., due to pump/motor heat load additions). To prevent ground level exfiltration while allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure. Requirements for these systems are specified separately in LCO 3.6.4.2, "Secondary Containment Isolation Dampers (SCIDs) ," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System."

The isolation devices for the penetrations in the secondary containment boundary are a part of the secondary containment barrier. To maintain this barrier:

a. All secondary containment penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE automatic secondary containment isolation system, or

2. closed by at least one manual valve or damper, blind flange, or de-activated automatic damper secured in the closed position, except as provided in LCO 3.6.4.2, "Secondary Containment Isolation Dampers (SCIDS)";

(continued)

CLINTON B 3.6-83 Revision No. 20-2

Secondary Containment B 3.6.4.1 BASES BACKGROUND b. The upper containment personnel air lock is (continued) OPERABLE, except as provided in LCO 3.6.1.2, "Primary Containment Air Locks";

c. All secondary containment equipment hatches are closed and sealed;

d. The Standby Gas Treatment System is OPERABLE, except as provided in LCO 3.6.4.3, "Standby Gas Treatment (SGT)

System";

e. At least one door in each access to the secondary containment is closed, except when the access penetration is being used for entry or exit;

f. The pressure within the secondary containment is in compliance with SR 3.6.4.1.1, except as provided in this LCO; and

g. At least one SGT subsystem is capable of drawing the secondary containment pressure down to the required pressure within the required time in compliance with SR 3.6.4.1.4, except as provided in this LCO.

APPLICABLE There are two principal accidents for which credit is SAFETY ANALYSES taken for secondary containment OPERABILITY. These are a LOCA (Ref. 1), and a fuel handling accident (Ref. 2). The secondary containment performs no active function in response to each of these limiting events; however, its leak tightness is required to ensure that the release of radioactive materials from the primary containment is restricted to those leakage paths and associated leakage rates assumed in the accident analysis, and that fission products entrapped within the secondary containment structure will pe treated by the SGT System prior to discharge to the ~nvironment.

Secondary containment satisfies Criterion 3 of the NRC SAFETY ANALYSES Policy Statement.

LCO An OPERABLE secondary containment provides a control volume into which fission products that bypass or leak from primary containment, or are released from the reactor coolant pressure boundary components located in secondary containment, can be diluted and processed prior to release to the environment. For the secondary containment to be considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.

(continued)

CLINTON B 3.6-84 Revision No. 20-2

Secondary Containment B 3.6.4.1 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during movement of* recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary or secondary containment.

ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.

B.1 If the secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant

~isk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3), because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action B.l is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.

However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant (continued)

CLINTON B 3.6-85 Revision No. 20-3

Secondary Containment B 3.6.4.1 BASES ACTIONS B.1 (continued) conditions from full power conditions in an orderly manner and without challenging plant systems.

C.l Movement of recently irradiated fuel assemblies in the primary or secondary containment can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. Movement of recently irradiated fuel assemblies must be immediately suspended if the secondary containment is inoperable.

Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position.

Required Action C.l has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6,4.1.1 REQUIREMENTS This SR ensures that the secondary containment boundary is sufficiently leak tight to preclude exfiltration under expected wind conditions. The SR is modified by a Note which states the SR is not required to be met for up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months if an analysis demonstrates that one SGT subsystem remains capable of establishing the required secondary containment vacuum. Use of the Note is expected to be infrequent but may be necessitated by situations in which secondary containment vacuum may be less than the required containment vacuum, such as, but not limited to, wind gusts or failure or change of operating normal ventilation subsystems. These conditions do not indicate any change in the leak tightness of the secondary containment boundary.

The analysis should consider the actual conditions (equipment configuration, temperature, atmospheric pressure, wind conditions, measured secondary containment vacuum, etc.) to determine whether, if an accident requiring secondary containment to be OPERABLE were to occur, one train of SGT could establish the assumed secondary containment vacuum within the time assumed in the accident analysis. If so, the SR may be considered met for a period up to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months limit is based on the expected short duration of the situations when the Note would be applied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3.6-86 Revision No. 20-3

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.1 (continued)

REQUIREMENTS With regard to secondary containment vacuum values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).

SR 3.6.4.1.2 and SR 3.6.4.1.3 Verifying that secondary containment equipment hatches and access doors are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur. Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application the term "sealed" has no connotation of leak tightness. Maintaining secondary containment OPERABILITY requires verifying one door in the access opening is closed, except when the abcess opening is being used for entry and exit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.4.1.4 and SR 3.6.4.1.5 The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment.

Each SGT subsystem is designed to draw down pressure in the secondary containment to> 0.25 inches vacuum water gauge within the time required and maintain pressure in the secondary containment at> 0.25 inches of vacuum water gauge for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months at a flow rate-of< 4400 cfm. To ensure that all fission products released to the secondary containment are treated, SR 3.6.4.1.4 and SR 3.6.4,1.5 verify that a.

pressure in the secondary containment that is less than the lowest postulated pressure external to the secondary containment boundary can rapidly be* established and maintained. When the SGT System is operating as designed, the establishment and maintenance of secondary containment pressure cannot be accomplished if the secondary containment boundary is not intact. Establishment of this pressure is confirmed by SR 3.6.4.1.4, which demonstrates that secondary containment can be drawn down to> 0.25 inches of vacuum water gauge in the required time using one SGT subsystem.

Specifically, the required drawdown time limit is based on ensuring that the SGT system will draw down the secondary containment pressure to~ 0.25 inches of vacuum water gauge within 19 minutes (i.e., 17 minutes from start of gap release which occurs 2 minutes after LOCA initiation) under LOCA conditions. Typically, however, the conditions under which drawdown testing is performed pursuant to SR 3.6.4.1.4 are different than those assumed for LOCA conditions. For this reason, and because test results are dependent on or influenced by certain plant and/or atmospheric conditions that may be in effect at the time testing is performed, it is necessary to adjust the test acceptance criteria (i.e.,

(continued)

CLINTON B 3.6-87 Revision No. 20-3

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.4 and SR 3.6.4.1.5 (continued)

REQUIREMENTS the required drawdown time) to account for such test conditions. Conditions or factors that may impact the test results include wind speed, whether the turbine building ventilation system is running, and whether the containment equipment hatch is open (when the test is performed during plant shutdown/outage conditions). The acceptance criteria for the drawdown test are thus based on a computer model (Ref. 7), verified by actual performance of drawdown tests,in which the drawdown time determined for accident conditions is adjusted to account for performance of the test during normal but certain plant conditions. The test acceptance criteria are specified in the applicable plant test procedure(s). Since the drawdown time is dependent upon secondary containment integrity, the drawdown requirement cannot be met if the secondary containment boundary is not intact.

SR 3.6.4.1.5 demonstrates that the pressure in the secondary containment can be maintained> 0.25 inches of vacuum water gauge for 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months using one SGT subsystem at a flow rate of

< 4400 cfm. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months test period allows secondary containment to be in thermal equilibrium at steady state conditions. The primary purpose of these SRs is to ensure secondary containment boundary integrity. The secondary purpose of these SRs is to ensure that the SGT subsystem being tested functions as designed. There is a separate LCO with Surveillance Requirements which serves the primary purpose for ensuring OPERABILITY of the SGT System. These SRs need not be performed with each SGT subsystem. The inoperability of the SGT System does not necessarily constitute a failure of these Surveillances relative to the secondary containment OPERABILITY. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

With regard to drawdowri time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Refs. 5, 6).

REFERENCES 1. USAR, Section 15.6.5.

2. USAR, Section 15.7.4.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

4. Calculation IP-0-0082.

5. Calculation IP-0-0083.

6. Calculation IP-0-0084.

7. Calculation 3Cl0-1079-001.

CLINTON B 3.6-88 Revision No. 20-3

SCIDs B 3.6.4.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.2 Secondary Containment Isolation Dampers (SCIDs)

BASES BACKGROUND The function of the SCIDs, in combination with other accident mitigation systems, is to limit fission product release during and following postulated Design Basis Accidents (DBAs) (Refs. 1 and 3). Secondary containment isolation within the time limits specified for those isolation valves and dampers designed to close automatically ensures that fission products that leak from primary containment following a DBA, that are released during certain operations when primary containment is not required to be OPERABLE, or that take place outside primary containment, are maintained within the secondary containment boundary.

The OPERABILITY requirements for SCIDs help ensure that an adequate secondary containment boundary is maintained during and after an accident by minimizing potential paths to the environment. The Isolation devices addressed by this LCO are either passive or active (automatic). Manual dampers and valves de...:activated automatic dampers and valves *secured in their closed position, check valves with flow through the valve secured, and blind flanges are considered passive devices. Check valves and automatic dampers and valves designed to close without operator action following an accident are considered active devices.

Automatic SCIDs close on a secondary containment isolation signal to establish a boundary for untreated radioactive material within secondary containment following a OBA or other accidents.

Other penetrations are isolated by the use of dampers or valves in the closed position or blind flanges.

APPLICABLE The SCIDs must be OPERABLE to ensure the secondary SAFETY ANALYSES containment barrier to fission product releases is established. The principal accidents for which the secondary containment boundary is required are a loss of coolant accident (Ref. 1), and a fuel handling accident (Ref. 3). The secondary containment performs no active function in response to each of these limiting events, but the boundary established by SCIDs is required to ensure that leakage from the primary containment is processed by the Standby Gas Treatment (SGT) System before being released to the environment.

Maintaining SCIDs OPERABLE with isolation times within limits ensures that fission products will remain trapped inside secondary containment so that they can be treated by the SGT System prior to discharge to the environment.

SCIDs satisfy Criterion 3 of the NRC Policy Statement.

(continued)

CLINTON B 3.6-89 Revision No. 20-2

SCIDs B 3.6.4.2 BASES (continued)

LCO SCIDs form a part of the secondary containment boundary.

The SCIO safety function is related to control of offsite radiation releases resulting from DBAs.

The power operated isolation dampers and valves are considered OPERABLE when their isolation times are within limits. Additionally, power operated automatic dampers and valves are required to actuate on an automatic isolation signal.

The normally closed isolation dampers, valves, or blind flanges are considered OPERABLE when manual dampers or valves are closed or open in accordance with appropriate administrative controls, automatic dampers are de-activated and secured in their closed position, or blind flanges are in place. The SCIDs covered by this LCO, along with their associated stroke times, if applicable, are listed in applicable plant procedures.

APPLICABILITY In MODES 1, 2, and 3, a OBA could lead to a fission product release to the primary containment that leaks to the secondary containment. Therefore, OPERABILITY of SCIDs is required.

In MODES 4 and 5,_ the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES. Therefore, maintaining SCIDs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during movement of recently irradiated fuel assemblies. (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ). Moving recently irradiated fuel assemblies in the secondary containment may also occur in MODES 1, 2, and 3.

ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated individual, who is in continuous communication with the control room, at the controls of the isolation device. In this way, the penetration can be rapidly isolated when the need for secondary containment isolation is indicated.

The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable SCIO. Complying with the Required Actions may allow for continued operation, and subsequent inoperable SCIDs are governed by subsequent Condition entry and application of associated Required Actions.

(continued)

CLINTON B 3.6-90 Revision No. 20-2

SCIOs B 3.6.4.2 BASES ACTIONS The third Note ensures appropriate remedial actions are (continued) taken, if necessary, if the affected system(s) are renderid inoperable by an inoperable SCIO.

A.land A.2 In the event that there are one or more penetration flow paths with one SCIO inoperable, the affected penetration flow path(s) must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criteria are a closed and de-activated automatic damper, a closed manual damper or valve, or a blind flange. For penetrations isolated in accordance with Required Action A.l, the device used to isolate the penetration should be the closest available device to secondary containment. This Required Action must be completed within the 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time. The specified time period is reasonable considering the time required to isolate the penetration and the low probability of a OBA, which requires the SCIOs to close, occurring during this short time.

For affected penetrations that have been isolated in accordan9e with Required Action A.l, the affected penetration must be verified to be isolated on a periodic basis. This is necessary to ensure that secondary containment penetrations required to be isolated following an accident, but no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or isolation device manipulation. Rather, it involves verification that the affected penetration remains isolated.

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls.

Allowing verification by administrative control.sis considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

(continued)

CLINTON B 3.6-91 Revision No. 20-2

SCIDs B 3.6.4.2 BASES ACTIONS B.l (continued)

With two SCIDs in one or more penetration flow paths inoperable (Condition A is entered if one SCID is inoperable in each of two penetrations), the affected penetration flow path must be isolated within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic damper, a closed manual valve or damper, and a blind flange. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, considering the time required to isolate the penetration and the low probability of a DBA, whichrequires the SCIDs to close, occurring during this short time.

C.l and C.2 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

Required Action D.1 has been modified by a Note stating that LCO 3 ," 0. 3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

(continued)

CLINTON B 3.6-92 Revision No. 20-2

SCIDs B 3.6.4.2 BASES (continued)

SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS This SR verifies each secondary containment isolation manual valve, damper, and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or valve or damper manipulation. Rather, it involves verification that those SCIDs in secondary containment that are capable of being mispositioned are in the correct position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Two Notes have been added to this SR. The first Note applies to valves, dampers, and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these SCIDs, once they have been verified to be in the proper position, is low.

A second Note has been included to clarify that SCIDs that are open under administrative controls are not required to meet the SR during the time the SCIDs are open.

SR 3.6.4.2.2 Verifying the isolation time of each power operated and each automatic SCIO is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the SCIO will isolate in a time period less than or equal to that assumed in the safety analyses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).

(continued)

CLINTON B 3.6-93 Revision No. 20-2

SCIOs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.3 REQUIREMENTS (continued) Verifying that each automatic SCIO closes on a secondary containment isolation signal is required to prevent leakage of radioactive material from secondary containment following a OBA or other accident. This SR ensures that each automatic SCIO will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. USAR, Section 15.6.5.

2. USAR, Section 6.2.3.

3. USAR, Section 15. 7. 4.

4. Calculation IP-0-0085.

CLINTON B 3.6-94 Revision No. 20-2

SGT System B 3.6.4.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.3 Standby Gas Treatment (SGT) System BASES BACKGROUND The SGT System is required by 10 CFR 50, Appendix A, GDC 41, "Containment Atmosphere Cleanup" (Ref .. 1). The function of the SGT System is to ensure that radioactive materials that leak from the primary containment into the secondary containment following a Design Basis Accident (OBA) are filtered and adsorbed prior to exhausting to the environment. ASME/ANSI N510-1980, Testing of Nuclear Air Cleaning Systems require that rates are measured with respect to design flow. For the SGT system, the design flow rates are in acfm.

The SGT System consists of two fully redundant subsystems, each with its own set of ductwork, dampers, charcoal filter train, and controls.

Each charcoal filter train consists of (components listed in order of the direction of the air flow):

a. A flow control damper;

b. A demister;

c. An electric heater;

d. A prefilter;

e. A high efficiency particulate air (HEPA) filter;

f. A charcoal adsorber;

g. A second HEPA filter; and

h. A centrifugal fan.

The sizing of the SGT System equipment and components is based on the results of an infiltration analysis, as well as an exfiltration analysis of the auxiliary building, fuel building, emergency core cooling system (ECCS) pump rooms, and the gas control boundary. The internal pressure of the SGT System boundary region is maintained at a negative pressure of at least 0.25 inch water gauge when the system is in operation, which represents the internal pressure required to ensure zero exfiltration of air from the building when exposed to a 20 mph wind.

The demister is provided to remove entrained water in the air, while the electric heater reduces the relative humidity of the airstream to less than 70% (Refs. 2 and 5). The prefilter removes large particulate matter, while the HEPA filter is provided to remove fine particulate matter and (continued)

CLINTON B 3.6-95 Revision No. 20-2

SGT System B 3.6.4.3 BASES BACKGROUND protect the charcoal from fouling. The charcoal adsorber (continued) removes gaseous elemental iodine and organic iodides, and the final HEPA filter is provided to collect any carbon fines exhausted from the charcoal adsorber.

The SGT System automatically starts and operates in response to actuation signals indicative of conditions or an accident that could require operation of the system. Following initiation, both charcoal filter train fans start. SGT System flows are controlled by modulating inlet dampers instatled on the charcoal filter train inlets.

APPLICABLE The design basis for the SGT System is to mitigate the SAFETY ANALYSES consequences of a loss of coolant acciden~ and fuel handling accidents (Refs. 3 and 6). F6r all events analyzed, the SGT System is shown to be automatically initiated to reduce, via filtration and adsorption, the radioactive material released to the environment.

The SGT System satisfies Criterion 3 of the NRC Policy Statement.

LCO Following a OBA, a minimum of one SGT subsystem is required to maintain the secondary containment at a negative pressure with respect to the environment and to process gaseous releases. Meeting the LCO requirements for two operable subsystems ensures operation of at least one SGT subsystem in the event of a single active failure.

APPLICABILITY In MODES 1, 2, and 3, a OBA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, SGT System OPERABILITY is required during these MODES.

In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature lim.i tations in these MODES. Therefore, maintaining the SGT System OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) in the primary or secondary containment.

ACTIONS A.1 With one SGT subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is (continued)

CLINTON B 3.6-96 Revision No. 20-2

SGT System B 3.6.4.3 BASES ACTIONS A.l (continued) reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function

.not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the low probability of a OBA occurring during this period.

B.1 If the SGT subsystem cannot be restored to OPERABLE status within the required Completion Time in MODE 1, 2, or 3, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 9) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also ah acceptable low-risk state.

Required Action B.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required A6tion by indicating ~hat it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.

However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 and C.2 During movement of recently irradiated fuel assemblies in the primary or secondary containment, when Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE SGT subsystem should be immediately placed in operation. This Required Action ensures that the remaining subsystem is OPERABLE, that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected.

An alternative to Required Action C.l is to immediately suspend activities that represent a potential for releasing (continued)

CLINTON B 3.6-97 Revision No. 20-2

SGT System B 3.6.4.3 BASES ACTIONS C.l and C.2 (continued) radioactive material to the secondary containment, thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

The Required Actions of Condition C have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficien_t reason to require a reactor shutdown.

D.l If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT System may not be capable of supporting the required radioactivity release control function. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 9) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Required Action D.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.

However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.

(continued)

CLINTON B 3.6-98 Revision No. 20-2

SGT System B 3.6.4.3 BASES ACTIONS E.1 (continued)

When two SGT subsystems are inoperable, if applicable, movement of recently irradiated fuel assemblies in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating each SGT subsystem from the main control room for

> 15 continuous minutes ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequ~ncy is controlled under the Surveillance Frequency Control Program.

With regard to operating time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 10).

SR 3.6.4.3.2 This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber bypass leakage and efficiency, minimum system flow rate, combined HEPA filter and charcoal adsorber pressure drop, and heater dissipation.

The frequencies for performing the SGT System filter tests are in accordance with Regulatory Guide 1.52 (Ref. 4) and include testing initially, after 720 hours0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months of system operation, once per 24 months, and following painting, fire, or chemical release in any ventilation zone communicating with the system. The laboratory test results will be verified to be within limits within 31 days of removal of the sample from the system. Additional information is discussed in detail in the VFTP.

With regard to filter testing values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 11).

(continued)

CLINTON B 3.6-99 Revision No. 20-2

SGT System B 3.6.4.3 BASES SURVEILLANCE SR 3.6.4.3.3 REQUIREMENTS (continued) This SR requires verification that each 1 SGT subsystem automatically starts upon receipt of an actual or simulated initiation signal.

The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.4.3.4 This SR requires verification that the SGT filter cooling bypass damper can be opened and the fan started. This ensures that the ventilation mode of SGT System operation is available. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 41.

2. USAR, Section 6.2.3.

3. USAR, Section 15. 6. 5.

4. Regulatory Guide 1.52.

5. USAR, Section 6.5.1.

6. USAR, Section 15. 6. 4.

7. USAR Appendix A.

8. ASME/ANSI N510-1980.

9. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002

10. Calculation IP-0-0086.

11. Calculation IP-0-0087.

CLINTON B 3.6-100 Revision No. 20-2

Drywell B 3.6.5.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.1 Drywell BASES BACKGROUND The drywell houses the reactor pressure vessel (RPV), the reactor ~oolant recirculating loops, and branch connections of the Reactor Coolant System (RCS), which have isolation valves at the primary containment boundary. The function of the drywell is to maintain a pressure boundary that channels steam from a loss of coolant accident (LOCA) to the suppression pool, where it is condensed. Air forced from the drywell is released into the primary containment through the suppression pool. The pressure suppression capability of the suppression pool assures that peak LOCA temperature and pressure in the primary containment are within design limits. The drywell also protects accessible areas of the containment from radiation originating in the reactor core and RCS.

To ensure the drywell pressure suppression capability, the drywell bypass leakage must be minimized to prevent overpressurization of the primary containment during the drywell pressurization phase of a LOCA. This requires periodic testing of the drywell bypass leakage, confirmation that the drywell air lock is*leak tight, OPERABILITY of the drywell isolation valves, and confirmation that the drywell vacuum relief valves are closed.

The drywell air lock forms part of the drywell pressure boundary. Not maintaining air lock OPERABILITY may result in degradation of the pressure suppression capability, which is assumed to be functional in the unit safety analyses.

The drywell air lock does not need to meet the requirements of 10 CFR 50, Appendix J (Ref. 2), since it is not part of the primary containment leakage boundary. However, it is prudent to specify a leakage rate requirement for the drywell air lock. A seal leakage rate limit and an air lock overall leakage rate limit have been established to assure the integrity of the seals.

The isolation devices for the drywell penetrations are a part of the drywell barrier. To maintain this barrier:

a. The drywell air lock is OPERABLE except as provided in LCO 3.6.5.2, ftDrywell Air Lock";

(continued)

CLINTON B 3.6-101 Revision No. 20-2

Drywell B 3.6.5.1 BASES BACKGROUND b. The drywell penetrations required to be closed during (continued) accident conditions are either:

1. capable of being closed by an OPERABLE automatic drywell isolation valve, or

2. closed by a manual valve, blind flange, or de-activated automatic valve secured in the closed position except as provided in LCO 3.6.5.3, "Drywell Isolation Valves";

c. All drywell equipment hatches are closed;

d. The Drywell Post-LOCA Vacuum Relief System is OPERABLE except as provided 'in LCO 3. 6. 5. 6, "Drywell Post-LOCA Vacuum Relief System";

e. The suppression pool is OPERABLE, except as provided in LCO 3.6.2.2, "Suppression Pool Water Level"; and

f. The drywell leakage rate is within the limits of this LCO.

This Specification is intended to ensure that the performance of the drywell in the event of a OBA meets the assumptions used in the safety analyses (Ref. 1).

APPLICABLE Analytical methods and assumptions involving the drywell are SAFETY ANALYSES presentep in Reference 1. The safety analyses assume that for a high energy line break inside the drywell, the steam is directed to the suppression pool through the horizontal vents where it is condensed. Maintaining the pressure suppression capability assures that safety analyses remain valid and that the peak LOCA temperature and pressure in the primary containment are within design limits.

The drywell satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO Maintaining the drywell OPERABLE is required to ensure that the pressure suppression design functions assumed in the safety analyses are met. The drywell is OPERABLE if the drywell structural integrity is intact and the bypass (continued)

CLINTON B 3.6-102 Revision No. 20-2

Drywell B 3.6.5.1 BASES LCO leakage is within limits, except prior to the first startup (continued) after performing a required drywell bypass leakage test. At this time, the drywell bypass leakage must be-~ 10% of the drywell bypass leakage limit.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, the drywell is not required to be OPERABLE in MODES 4 and 5.

ACTIONS A.1 In the event the drywell is inoperable, it must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time provides a period of time to correct the problem commensurate with the importance of maintaining the drywell OPERABLE during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring drywell OPERABILITY) occurring during periods when the drywell is inoperable is minimal. Also, the Completion Time is the same as that applied to inoperability of the primary containment in LCO 3. 6. 1.1, "Primary Containment."

B.1 and B.2 If the drywell cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.5.1.1 REQUIREMENTS This SR requires a test to be performed to verify seal leakage of the drywell air lock doors at pressures~ 3.0 psig. A seal leakage rate limit of~ 2 scfh has been established to ensure the integrity of the seals. The (continued)

CLINTON B 3.6-103 Revision No. 20-2

Drywell B 3.6.5.1 BASES SURVEILLANCE SR 3.6.5.1.1 (continued)

REQUIREMENTS Surveillance is only required to be performed once within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after each closing. The Frequency of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is based on operating experience.

With regard to seal leakage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).

SR 3.6.5.1.2 This SR requires a test to be performed to verify overall air lock leakage of the drywell air lock at pressures~

3.0 psig. Prior to performance of this test, the air lock must be pressurized to 19.7 psid. This differential pressure is the assumed peak drywell pressure expected from the accident analysis. Since the drywell pressure rapidly returns to a steady state maximum differential pressure of 3.0 psid (due to suppression pool vent clearing), the overall air lock leakage is allowed to be measured at this pressure.

An overall air lock leakage limit of~ 2 scfh has been established to ensure the integrity of the seals. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR has been modified by a Note indicating that an inoperable air lock door does not invalidate the previous successful performance of an overall air lock leakage test.

This is considered reasonable, since either air lock-door is capable of providing a fission product barrier in the event of a OBA.

With regard to air lock leakage values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).

(continued)

CLINTON B 3.6-104 Revision No. 20-2

Drywell B 3.6.5.l BASES SURVEILLANCE SR 3.6.5.1.3 REQUIREMENTS (continued) The analyses in Reference 1 are based on a maximum drywell bypass leakage. This Surveillance ensures that the actual dr¥well bypass leakage is less than or equal to the acceptable A!../k design value of 1. 0 ft 2 assumed in the safety analysis. As left drywell bypass leakage, prior to the first startup after performing a required drywell bypass leakage test, is required to be~ 10% of the drywell bypass leakage limit. At all other times between required drywell leakage rate tests, the acceptance criteria is based on the design A/../k . At the design A/../k the containment temperature and pressurization response a~e bounded by the assumptions of the safety analysis. One drywell air lock door is left open during each ~rywell bypass leakage test

~uch that each drywell air lock door is leak tested during at least every other drywell bypass leakage test. This ensures that the leakage through the drywell air lock is properly accounted for in the measured bypass leakage and that each air lock door is tested periodically.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This Frequency is modified by a note that allows for a one-time deferral of this surveillance unti~ November 23, 2008. If during the performance of this required Surveillance the drywell bypass leakage is determined to be greater than the leakage limit, the Surveillance Frequency is increased to at least once every 48 months. If during the p~rformanc~ of the subsequent consecutive Surveillance the drywell bypass leakage is determined to be less than or equal to the drywell bypass leakage limit, the Frequency specified in the Surveillance Frequency Control Program may be resumed. If during the performance of the subsequent consecutive Surveillance the drywell bypass leakage is determined to be greater than the drywell bypass leakage limit, the Surveillance Frequency is increased to at least once every 24 months. The 24-month Frequency must be maintained until the drywell bypass leakage is determined to (continued)

CLINTON B 3.6-105 Revision No. 20-2

Drywell B 3.6.5.1 BASES SURVEILLANCE SR 3.6.5.1.3 (continued)

REQUIREMENTS be less than or equal to the leakage limit during the performance of tw~ consecutive Surveillances, at which time the Frequency specified in the .Surveillance Frequency Control Program may be resumed. For two Surveillances to be considered consecutive, the Surveillances must be performed at least 12 months apart.

With regard to bypass leakage values obtained pursuant to

'this SR, as read from plant .indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).

SR 3.6.5.1.4 The exposed accessible drywell interior and exterior surfaces are inspected to ensure there are no apparent physical defects that would prevent the drywell from performing its intended function. This SR ensures that drywell structural integrity is maintained. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. USAR, Chapter 6 and Chapter 15.

2. 10 CFR 50, Appendix J, Option B.

3. Calculation IP-0-0088.

CLINTON B 3.6-106 Revision No. 20-2

Drywell Air Lock B 3.6.5.2 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.2 Drywell Air L9ck BASES BACKGROUND The drywell air lock forms part of the drywell boundary and provides a means for personnel access during MODES 2 and 3 during low power phase'of unit startup. For this purpose, one double door drywell air lock has been provided, which maintains drywell isolation during personnel entry and exiJ from the drywell. Under the normal unit operation, the drywell air lock is kept sealed.

The drywell air lock is designed to the same standards as the drywell boundary. Thus, the drywell air lock must withstand the pressure and temperature transients associated with the rupture of any primary system line inside the drywell and also the rapid reversal in pressure when the steam in the drywell is condensed by the Emergency Core Cooling* System flow following loss of coolant accident flooding of the reactor pressure vessel (RPV). It is also designed to withstand the high temperature as~ociated with the break of a small steam line in the drywell that does not result in rapid depressurization of the RPV.

The air lock is nominally a right circular cylinder, 9 ft 10 inches in diameter, with doors at each end that are interlocked to prevent simultaneous opening. During periods when the drywell is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of the air lock to remain open for extended periods when frequent drywell entry is necessary. Each air lock door has been designed and tested to certify its ability to

withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (OBA). The drywell air lock forms part of the drywell pressure boundary. Not maintaining air lock OPERABILITY may result in degradation of the pressure suppression capability, which is assumed to be functional in the unit safety analyses.

(continued)

CLINTON B 3.6-107 Revision No. 20~2

Drywell Air Lock B 3.6.5.2 BASES (continued)

APPLICABLE Analytical methods and assumptions involving the drywell are SAFETY ANALYSES presented in Reference 2. The safety analyses assume that for a high energy line break inside the drywell, the steam is directed to the suppression pool through the horizontal vents where it is condensed, Since the drywell air lock is part of the drywell pressure boundary, its design and maintenance are essential to support drywell OPERABILITY, which assures that the safety analyses are met.

The drywell air lock satisfies Criterion 3 of the NRC Policy Statement.

LCO The drywell air lock forms part of the drywell pressure boundary. "The air lock safety function assures that steam resulting from a OBA is directed to the suppression pool.

Thus, the air lock's structural integrity is essential to the successful mitigation.of such an event.

The air lock is required to be OPERABLE. For the air lock to be considered OPERABLE, the air lock interlock mechanism must be OPERABLE, and both air lock doors must be OPERABLE.

The interlock allows only one air lock door of an air lock to be opened at one time. This provision ensures that a gross breach of the drywell does not exist when the drywell is required to be OPERABLE.

Air lock leakage is excluded from this Specification. The air lock leakage rate is part of the drywell leakage rate and is controlled as part of OPERABILITY of the drywell in LCO 3.6.5.1, "Drywell."

Closure of a single door in the air lock is necessary to support drywell OPERABILITY following postulated events.

Nevertheless, both doors _are kept closed when the air lock is not being used for entry into and exit from the drywell.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of radioact,iye material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are (continued)

CLINTON B 3.6-108 Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES APPLICABILITY reduced due to the pressure and temperature limitations in (continued these MODES. Therefore, the drywell air lock is not required to be OPERABLE in MODES 4 and 5.

ACTIONS The ACTIONS are modified by a Note which allows entry and exit to perform repairs on the affected air lock component.

If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is inoperable, however, then there is a short time during which the drywell boundary is not intact (during access through the outer door). The ability to open the OPERABLE door, even if it means the drywell boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the drywell during the short time in which the OPERABLE door is expected to be open. The OPERABLE door must be immediately closed after each entry and exit.

A.l, A.2, and A.3 With one drywell air lock door inoperable, the OPERABLE door must be verified closed (Required Action A.1). This ensures that a leak tight drywell barrier is maintained by the use of an OPERABLE air lock door. This action must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.5.1, which requires that the drywell be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The Completion Time is considered reasonable for locking the OPERABLE air lock door, considering that the OPERABLE door is being maintained closed; (continued)

CLINTON B 3.6-109 Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES ACTIONS A.1, A.2, and A.3 (continued)

Required Action A.3 verifies that the air lock has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable drywell boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls that ensure that the OPERABLE air lock door remains closed.

The Required Actions are modified by two Notes. Note 1 ensures only the Required Actions and associated Completion Times of Condition Care required if both doors in the air lock are inoperable. The exception of the Note does not affect tracking the Completion Times from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls.

Drywell entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside the drywell that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-required activities) if the drywell was entered, using the inoperable air lock, to perform an allowed activity listed above. The administrative controls required consist of the stationing of a dedicated individual to assure closure of the OPERABLE door except during the entry and exit, and assuring the OPERABLE door is relocked after completion of the drywell entry and exit. In addition, Note 2 allows an OPERABLE air lock door to remain unlocked, but closed, when the door is under the control of a dedicated individual stationed at the air lock. This allowance is acceptable due to the low probability of an event that could pressurize the drywell during the short time that the OPERABLE door is expected to be open.

B.1, B.2, and B.3 With the drywell air lock interlock mechanism inoperable, the Required Actions and associated Completion Times consistent with Condition A are applicable.

(continued)

CLINTON B 3.6-110 Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES ACTIONS B.l, B.2, and B.3 (continued)

The Required Actions are modified by two Notes. Note 1 ensures only the Required Actions and associated Completion Times of Condition Care required if both doors in the air lock are inoperable. Note 2 allows entry and exit into the drywell under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time (i.e., the individual performs the function of the interlock). In addition, Note 2 allows an OPERABLE air lock door to remain unlocked, but closed, when the door is under the control of a dedicated individual stationed at the air lock.

C.l and C.2 With the air lock inoperable for reasons other than those described in Condition A or B, Required Action C.l requires that one door in the drywell air lock must be*verified to be closed. This Required Action must be completed within the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time. This specified time period is consistent with the ACTIONS of LCO 3. 6.. 5. 1, which requires that the drywell be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable for restoring an inoperable air lock to OPERABLE status, considering that at least one door is maintained closed in the air lock.

(continued)

CLINTON B 3.6-111 Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES ACTIONS D. l and D.2 (continued)

If the inoperable ~rywell air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

- SURVEILLANCE SR 3.6.5.2.1 REQUIREMENTS The air lock door interlock is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of the air lock are designed to withstand the maximum expected post accident drywell pressure, closure of either door will support drywell OPERABILITY. Thus, the door interlock feature supports drywell OPERABILITY while the air lock is being used for personnel transit in and out of the drywell. *Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous.inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3.6-112 Revision No. 20-2

Drywell Air Lock B 3.6.5.2 BASES (continued)

SURVEILLANCE SR 3.6.5.2.1 (continued)

REQUIREMENTS The Surveillance is modified by a Note requiring the Surveillance to be performed only upon entry into the drywell.

REFERENCES 1. 10 CFR 50, Appendix J, Option B.

2. USAR, Chapters 6 and 15, CLINTON B 3. 6-113 Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.3 Drywell Isolation Valves BASES BACKGROUND The drywell isolation valve(s), in combination with other accident mitigation systems, function to ensure that steam and water releases to the drywell are channeled to the suppression pool to maintain the pressure suppression function of the drywell.

The OPERABILITY requirements for drywell isolation valves help ensure that valves are closed, when required, and isolation occurs within the time limits specified for those isolation valves designed to close automatically.

Therefore, the OPERABILITY requirements support maintaining the drywell boundary and minimizing drywell bypass leakage*

below the value assumed :\.n the safety analysis (Ref. 1) for a DB.A. Typically, two barriers in series are provided for each penetration so that no credible single failure or malfunction of an active component can result in a loss of isolation. The isolation devices addressed by this LCO are either passive or active (automatic). Manual valves, de-activated automatic valves secured in their closed position, check valves with flow through the valve secured, and blihd flanges are considered passive devices. Check valves and automatic valves designed to close without operator action following an accident, are considered active devices.

The drywell post-LOCA vacuum relief subsystems serve a dual function, one of which is drywell isolation. However, since the other function of vacuum relief would not be available if the normal drywell isolation ACTIONS were taken, the drywell isolation valve OPERABILITY requirements are not applicable'to the drywell post-LOCA vacuum relief subsystems. Similar surveillance requirements provide assurance that the isolation capability is available* without conflicting with the vacuum relief function.

The Drywell Vent and Purge System is a high capacity system with 24-inch drywell penetrations, which have isolation valves covered by this LCO. The drywell vent and purge supply penetration contains two 24-inch isolation valves (lVQOOlA and lVQOOlB), one inside the drywell and the other outside the drywell. The drywell vent and purge exhaust (continued)

.CLINTON B 3.6-114 Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES BACKGROUND penetration contains a 24-inch (1VQ002) and a 10-inch (continued) (1VQ005) isolation valve in parallel inside the drywell and a 36-inch (1VQ003) drywell isolation valve outside the drywell in parallel with a 36-inch containment isolation valve (1VQ004B) which is connected to the containment ventilation system. The system is used to remove trace radioactive airborne products prior to personnel entry. The Drywell Vent and Purge System is seldom used in MODE 1, 2, or 3; therefore, the drywell purge isolation valves are seldom open during power operation.

The drywell vent and purge isolation valves fail closed on loss of instrument air or power. The drywell vent and purge exhaust isolatio_n valves are fast closing valVE?S (approximately 2 to 4 seconds). These valves are qualified to close against the differential pressure induced by a loss of coolant accident (LOCA) . The d*rywell vent and purge supply isolation valves are required to be sealed closed in MODES 1, 2, and 3.

APPLICABLE This LCO is intended to ensure that releases from the core SAFETY ANALYSESdo not bypass the suppression pool so that the pressure suppression capability of the drywell is maintained. Therefore, as part of the drywell boundary, drywell isolation valve OPERABILITY minimizes drywell bypass leakage. Therefore, the safety analysis of any event requiring isolation of the drywell is applicable to this LCO.

The limiting OBA resulting in a release of steam, water, or radioactive material within the drywell is a LOCA. In the analysis for this accident, it is assumed that drywell isolation valves either are closed or function to close within the required isolation time following event initiation.

The drywell isolation valves and drywell vent and purge isolation valves satisfy Criterion 3 of the NRC Policy Statement.

LCO The drywell isolation valve safety function is to form a part of the drywell boundary.

The power operated drywell isolation valves are required to have isolation times within limits. Power operated automatic drywell isolation valves are also required to (continued)

CLINTON B 3.6-115 Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES LCO actuate on an automatic isolation signal. Additionally, (continued) drywell vent and purge supply valves are required to be sealed closed. While drywell post-LOCA vacuum relief system valves isolate drywell penetrations, they are excluded from this Specification. Controls on their isolation function are adequately addressed in LCO 3.6.5.6, "Drywell post-LOCA Vacuum Relief System."

The normally closed isolation valves or blind flanges are considered OPERABLE when, as applicable, manual valves are closed or opened in accordance with applicable administrative controls, automatic valves are de-activated and secured in their closed position, check valves with flow through the valve secured, or blind flanges are in place.

The valves covered by this LCO are included (with their associated stroke time, if applicable, for automatic valves) in Reference 2.

Drywell isolation valve leakage is excluded from this Specification. The drywell isolation valve leakage rates are part of the drywell leakage rate and are controlled* as part of OPERABILITY of the drywell in LCO 3.6.5.1, "Drywell."

For the purpose of meeting this LCO, only one drywell isolation valve or blind flange is required to be OPERABLE in each drywell penetration flow path (with the exception of drywell vent*and purge valves, and Drywell Post-LOCA Vacuum Relief System valves). This single isolation is acceptable on the basis that these lines do not communicate directly with the drywell or containment atmospheres. Thus, steam bypass of the suppression pool is not possible without failure of the required isolation valve in conjunction with failures of the piping both inside the drywell and outside the drywell within the containment. Further, failure of multiple flow paths would be required to exceed the containment design limitations.

APPLICABILITY In MODES 1, 2, and 3, a OBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the drywell isolation valves are not required to be OPERABLE in MODES 4 and 5.

(continued)

CLINTON B 3.6-116 Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES (continued)

ACTIONS The ACTIONS are modified by three Notes. The first Note allows penetration flow paths, except for the drywell vent and purge supply and exhaust penetration flow paths, to be unisolated intermittently under administrative controls.

Due to the size of the drywell vent and purge line penetrations and the fact that they communicate directly with the containment atmosphere, bypassing the*suppression pool, these flow paths are not allowed to be unisolated under administrative controls. These controls consist of stationing a dedicated individual, who is in continuous communication with the control room, at the controls of the valve. In this way, the penetration can be rapidly isolated when a need for drywell isolation is indicated.

The second Note provides clarification that for the purpose of this LCO separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable drywell isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable drywell isolation valves are governed by subsequent Condition entry and application of associated Required Actions.

The third Note requires the OPERABILITY of affected systems to be evaluated when a drywell isolation valve is inoperable. This ensures appropriate remedial actions are taken, if necessary, if the affected system(s) are rendered inoperable by an inoperable drywell isolat~on valve.

A.landA.2 With one or more penetration flow paths with one required drywell isolation valve inoperable, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure.

Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. In this condition, the remaining OPERABLE drywell isolation valve is adequate to perform the isolation function for drywell vent and purge system penetrations.

(continued)

CLINTON B 3.6-117 Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES ACTIONS A.1 and A.2 (continued)

The associated system piping is adequate to perform the isolation function for other drywell penetrations. However, the overall reliability is reduced because a single failure could result in a loss of drywell isolation. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable, due to the low probability of the inoperable valve resulting in excessive drywell leakage and the low probability of the limiting event for drywell leakage occurring during this short time. In addition, the Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting drywell OPERABILITY during MODES 1, 2, and 3.

For affected penetration £low paths that have been isolated in accordance with Required Action A.1, the affected penetrations must be verified to be isolated on a periodic basis. This is necessary to ensure that drywell .

penetrations that are required to be isolated following an accident, and are no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or valve manipulation; rather, it involves verification that those devices outside drywell and capable of potentially being mispositioned are in the correct position. Since these devices are inside primary containment, the time period specified as "prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days," is based on engineering judgment and is considered reasonable in view of the inaccessibility of the devices and other administrative controls that will ensure that misalignment is an unlikely possibility. Also, this Completion Time is consistent with the Completion Time specified for PCIVs in LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs) ."

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls.

Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

(continued)

CLINTON B 3.6-118 Revision No. 20-2

Dry0ell Isolation Valves B 3.6.5.3 BASES ACTIONS B.l (continued)

With one or more drywell vent and purge penetration flow paths with two drywell isolation valves inoperable, the affected penetration flow path must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is acceptable, due to the low probability of the inoperable valves resulting in excessive drywell leakage and the low probability of the limiting event for drywell leakage occurring during this short time. In addition, the Completion Time is reasonable, considering the time required

. to isolate the penetration, and the probability of a OBA, which requires the drywell isolation valves to close, occurring during this short time is very low.

Condition Bis modified by a Note ~ndicating this Condition is only applicable to drywell vent and purge penetration flow paths. For other penetration flow paths, only one drywell *isolation valve is required OPERABLE and, Condition A provides the appropriate Required Actions.

C.1 and C.2 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a MODE,in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.5.3.1 REQUIREMENTS Each 24-inch drywell vent and purge -s~pply isolation valve is required to be periodically verified sealed closed. This Surveillance applies to drywell vent and purge supply isolation valves since they are not qualified to close under accident conditions. This SR is designed to ensure that a gross breach of drywell is not caused by an inadvertent or spurious drywell vent and purge isolation (continued)

CLINTON B 3.6-119 Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES SURVEILLANCE SR 3.6.5.3.l (continuedl REQUIREMENTS valve opening. Detailed analysis of these 24-inch drywell vent and purge supply valves failed to conclusively demonstrate their ability to close during a LOCA in time to support drywell OPERABILITY. Therefore, these valves are required to be in the sealed closed position during MODES 1, 2, and 3. These 24-inch drywell vent and purge supply valves that are sealed closed must be under administrative control to assure that they cannot be inadvertently opened.

Administrative control includes mechanical devices to seal or lock the valve closed, or to prevent power from being supplied to the valve operator. This can be accomplished by removing the ,air supply to the valve operator or tagging the control switches in the main control room in the closed position. In this application, the term "sealed" has no connotation of l~akage within limits, The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.5.3.2 This SR ensures that the 36-inch and either the 10-inch or the 24-inch drywell vent and purge exhaust isol_ation valves are closed as required or, if open, open for an allowable reason. These drywell vent and purge isolation valves are fully qualified to close under accident conditions; therefore, these valves are allowed to be open for limited periods of time. This SR has been modified by a Note indicating the SR is not required to be met when the 36-inch and either the 10-inch or the 24-inch drywell vent and purge exhaust valves are open for pressure control, ALARA or air quality considerations for personnel entry, or Surveillances or special testing of the purge system that require the valves to be open (e.g., testing of the containment and drywell ventilation radiation monitors) provided both the 12-inch and 36-inch primary containment purge system supply and exhausi lines are isolated. Normally, the 36-inch drywell vent and purge exhaust isolation valve is open to support operation of the 12-inch Continuous Containment Purge System. This is considered to be within the allowances of the Note. The Surveillance Frequency is controlled under the Surveillance Frequency Control, Program.

( continued)

CLINTON B 3.6-120 ,Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES SURVEILLANCE SR 3.6.5.3.3 REQUIREMENTS (continued) This SR requires verification that each drywell isolation manual valve and blind flange that is required to be closed during accident conditions is closed. The SR hel~s to

~nsure that drywell bypass leakage is maintained to a minimum. Due to the location of these devices, the Frequency specified as "prior to entering MODE 2 or 3 from MODE 4, if not performed in the previous 92 days," is appropriate because of the inaccessibility of the devices and because these devices are operated under administrative controls and the probability of their misalignment is low.

Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable* since access to these areas is typically restricted during MODES 1, 2, and 3. Therefore, the probability of.misalignment of these devices, once they have been verified to be in their proper position, is low. A seco~d Note is included to clarify that the drywell isolation valves that are open under administrative controls are not required to meet the SR during the time that the devices are open.

SR 3.6.5.3.4 Verifying that the isolation time of each power operated and each automatic drywell isolation valve is within limits is required to demonstrate OPERABILITY. The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the INSERVICE TESTING PROGRAM.

With regard to isolation time values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 3).

(continued)

CLINTON B 3.6-121 Revision No. 20-2

Drywell Isolation Valves B 3.6.5.3 BASES SURVEILLANCE SR 3.6.5.3.5 REQUIREMENTS (continued) Verifying that each automatic drywell isolation valve closes on a drywell isolation signal is .required to prevent bypass leakage from the drywell following a DBA. This SR ensures each automatic drywell isolation valve will actuate to its isolation position on a drywell isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. USAR, Section 6.2.4.

2. CPS ISI Manual.

3. Calculation IP-0-0091.

CLINTON B 3.6-122 Revision No. 20-2

Drywell Pressure B 3.6.5.4 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.4 Drywell Pressure BASES BACKGROUND Dryweli-to-primary containment differential pressure is an

.assumed initial condition in the analyses that determine the primary containment thermal hydraulic and dynamic loads during a postulated loss of coolant accident (LOCA) ..

If drywell pressure is less than the primary containment airspace pressure, the water level in the weir annulus will increase ~nd, consequently, the liquid inertia above the top vent will increase. This will cause top vent clearing during a postulated LOCA to be delayed, and that would increase the peak drywell pressure; In addition, an inadvertent upper pool dump occurring with a negative drywell-to-primary containment differential pressure could result in overflow over the weir wall.

The limitation on negative drywell-to-primary containment differential pressure ensures that changes in calculated peak LOCA drywell pressures due to differences in water level of the suppression pool and the drywell weir annulus are negligible. It also ensures that the possibility of weir wall overflow after an inadvertent upper pool dump is minimized. The limitation on positive drywell-to-primary containment differential pressure helps ensure that the horizontal vents are not cleared with normal weir annulus water level and limits drywell pressure during an accident to less than the drywell design pressure.

APPLICABLE Primary containment performance is evaluated for the entire SAFETY ANALYSES spectrum of break sizes for postulated LOCAs. Among the inputs to the design basis analysis is the initial drywell internal pressure (Ref. 1). The initial drywell internal pressure affects the drywell pressure response to a LOCA (Ref. 1) and the suppression pool swell load definition (Ref. 2).

Additional analyses (Refs. 3, 4, and 5) have been performed to show that if initial drywell pressure does not exceed the negative pressure limit, the suppression pool swell and vent clearing loads will not be significantly increased and the

( continued)

CLINTON B 3.6-123 Revision No. 20-2

Drywell Pressure B 3.6.5.4 BASES APPLICABLE probability of weir wall overflow is minimized after an SAFETY ANALYSES inadvertent upper pool dump.

(continued)

Drywell pressure satisfies Criterion 2 of the NRC Policy Statement.

LCO A limitation on the drywell-to-primary containment differential pressure of~ -0.2 and~ +1.0 psid is required to ensure that suppression pool water is not forced over the weir wall, vent clearing does not occur during normal operation, containment conditions are consistent with the safety analyses, and LOCA drywell pressures and pool swell loads are within design values.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining the drywell-to-primary containment differential pressure limitation is not required in MODE 4 or 5.

ACTIONS A.1 With drywell-to-primary containment differential pressure not within the limits of the LCO, it must be restored within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Required Action is necessary to return operation to within the bounds of the safety analyses. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LCO 3.6.5.1, "Drywell," which requires that the drywell be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

B.1* and B.2 If drywell-to-primary containment differential pressure cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and (continued)

CLINTON B 3.6-124 Revision No. 20-2

Drywell Pressure B 3.6.5.4 BASES ACTIONS B.land B.2 (continued) to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.5.4.1 REQUIREMENTS This SR provides assurance that the limitations *on drywell-to-primary containment differential pressure stated in the LCO are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

With regard to drywell-to-primary containment differential pressure values obtained pursuant to this SR, as read from plant inqication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 6).

REFERENCES 1. USAR, Section 6. 2 .1.

2. USAR, Section 3. 8.

3. USAR, Section 6.2.1.1.6.

4. USAR, Section 6. 2. 7.

5. USAR, Section 3. 8, Attachment A3. 8..

6. Calc.ulation IP-0-0092.

CLINTON B 3.6-125 Revision No. 20-2

Drywell Air Temperature B 3.6.5.5 B 3.6 CONTAINMENT SYSTEMS B 3 .. 6. 5. 5 Drywell Air Temperature BASES BACKGROUND The drywell contains the reactor vessel and piping, which add heat to the airspace. Drywell coolers remove heat and maintain a suitable environment. The drywell average air temperature affects equipment OPERABILITY, personnel access, and the calculated response to postulated Design Ba~is Accidents (DBAs). The limitation on drywell average air temperature ensures that the peak drywell temperature during a design basis loss of coolant accident (LOCA) does not exceed the design temperature of 330°F. The limiting OBA for drywell atmosphere temperature is a small steam line break, assuming no heat transfer to the passive steel and concrete heat sinks in the drywell.

APPLICABLE Primary containment performance for the OBA is evaluated for SAFETY ANALYSES the ent.ire spectrum- of break sizes for postulated LOCAs inside containment (Ref. 1). Among the inputs to the design basis analysis is the initial drywell average air temperature. Increasing the initial drywell average air temperature could change the calculated results of the design bases analysis. The safety analyses (Ref .. 1) assume an initial average drywell air temperature of 150°F. This limitation ensures that the safety analyses remain valid by maintaining the expected initial conditions and ensures that the peak LOCA drywell temperature does not exceed the maximum allowable temperature of 330°F. The cons.equence of exceeding this design temperature may result in the degradation of the drywell structure under accident loads.

Equipment ~nside the drywell that is required to mitigate the effects of a DBA is designed and qualified to operate under environmental conditions expected for the accident.

Drywell average air temperature satisfies Criterion 2 of the NRC Policy Statement.

LCO If the initial drywell average air temperature is less than or equal to the LCO temperature limit, the peak acciµent temperature can be maintained below the drywell design (continued)

CLINTON B 3.6-126 Revision No. 20-2

Drywell Air Temperature B 3.6.5.5 BASES LCO temperature during a DBA. This ensures the ability of the (continued) drywell to perform its design function.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, maintaining drywell average air temperature within the limit is not required in MODE 4 or 5.

ACTIONS A.l When the drywell average air temperature is not within the limit of the LCO, it must be restored within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . The Required Action is necessary to return operation to within the bounds of the safety analyses. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable, considering the sensitivity of the analyses to variations in thi,s parameter, anq. provides sufficient time to correct minor problems.

B. l and B. 2 If drywell average air temperature cannot be restored to within limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.5.5.1 REQUIREMENTS Verifying that the drywell average air temperature is within the LCO limit ensures that operation remains within the limits assumed for the drywell analysis. In order to determine the drywell average air temperature, an arithmetic average is calculated, using measurements taken at locations within the drywell selected to provide a representative sample of the overall drywell atmosphere. The arithmetical (continued)

CLINTON B 3.6-127 Revision No. 20-2

Drywell Air Temperature B 3.6.5.5 BASES SURVEILLANCE SR 3.6.5.5.1 (continued)

REQUIREMENTS ayerage must consist of at least one reading from each elevation (with the exception that elevations 729 ft. 0 inches and 732 ft. 0 inches may be considered the same elevation) as described in Ref. 3. However, all available instruments should be used in determining the arithmetical average.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

With regard to drywell average air temperature values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is not considered to be a nominal value with respect to instrument uncertainties.

This requires additional margin to be added t6 the limit to compensate for instrument uncertainties, for implementation in the associated plant procedures (Ref. 4).

REFERENCES 1. USAR, Section 6.2.1.

2. USAR, Section 9.4.7.

3. USAR, Section 7.5.1.4.2.4.

4. Calculation IP-0-0093.

CLINTON B 3.6-128 Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 B 3.6 CONTAINMENT SYSTEMS B 3.6.5.6 Drywell Post-LOCA Vacuum Relief System BASES BACKGROUND The Mark III pressure suppression containment is designed to condense, in the suppression pool, the steam released into the drywell in the event of a los~ of coolant accident (LOCA). The steam discharging to the pool carries the noncondensibles from the drywell. Therefore, the drywell atmosphere changes from low humidity air to nearly 100%

steam (no air) as the event progresses. When the drywell subsequently cools and depressurizes, noncondensibles in the drywell must be replaced to avoid excessive weir wall overflow into the drywell. Rapid weir wall overflow must be controlled in a large break LOCA, so that essential equipment and systems located above the weir wall in the drywell are not subjected to excessive drag and impact loads. The drywell post-LOCA vacuum relief subsystems are the means by which noncondensibles are transferred from the primary containment back to the drywell during operation of the hydrogen mixing compressors. At least two 10 inch lines must be available for opening to support operation of the hydrogen mixing system. Three 10-inch lines were assumed to open for reducing post-LOCA suppression pool drag and impact loadings.

The vacuum relief subsystems are a potential source of drywell bypass leakage (i.e., some of the steam released into the drywell from a LOCA bypasses the suppression pool and leaks directly to the primary containment airspace).

Since excessive drywell bypass leakage could degrade the pressure suppression function, the Drywell Post-LOCA Vacuum Relief System has been designed with two valves in series in each vacuum relief line. This minimizes the potential for a stuck open valve to threaten drywell OPERABILITY. The four drywell post-LOCA_vacuum relief subsystems use separate 10 inch lines penetrating the drywell, and each subsystem consists of a series arrangement of two check valves.

APPLICABLE The Drywell Post-LOCA Vacuum Relief System must function in SAFETY ANALYSES the event of a large break LOCA to control rapid weir wall overflow that could cause drag and impact loadings on essential equipment and systems in the drywell above the weir wall.

(continued)

CLINTON B 3.6-129 Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES APPLICABLE The drywell post-LOCA vacuum relief subsystems are required SAFETY ANALYSIS to assist in hydrogen dilution but not to protect the (continued) structural integrity of the drywell following a large break LOCA. Their passive operation (remaining closed and not leaking during drywell pressurization) is implicit in all of the LOCA analyses (Ref. 1).

The Drywell Post-LOCA Vacuum Relief System satisfies Criterion 3 of the NRC Policy Statement.

LCO The LCO ensures that in the event of a LOCA, four drywell post-LOCA vacuum relief subsystems are available to support operation of the hydrogen mixing system and to reduce suppression pool drag ahd impact loads in the event of a large break LOCA. Each vacuum relief subsystem is OPERABLE when capable of opening at the required setpoint but is maintained in the closed position during normal operation.

APPLICABILITY In MODES 1, 2, and 3, a Design Basis Accident could cause pressurization of primary containment. Therefore, drywell post-LOCA vacuum relief subsystem OPERABILITY is required during these MODES. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pre'Ssure and temperature limitations in these MODES. Therefore, maintaining the drywell post-LOCA vacuum relief subsystem OPERABLE is not required in MODE 4 or 5.

ACTIONS The ACTIONS are modified by a Note, which ensures appropriate remedial actions are taken, if necessary, if the drywell is rendered inoperable by inoperable drywell post-LOCA vacuum relief subsystems.

A.1 With one or more drywell post-LOCA vacuum relief subsystems open, the affected penetration flow path must.be closed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This assures that drywell leakage would not result if a postulated LOCA were to occur. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is acceptable, since the drywell design bypass leakage ( Al-./k) of 1. 0 ft 2 is maintained, and is considered a reasonable length of time needed to complete the Required Action.

(continued)

CLINTON B 3.6-130 Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES ACTIONS A.l (continued)

A Note has been added to provide clarification that separate Condition entry is allowed for each vacuum relief subsystem not closed.

B. l With one drywell post-LOCA vacuum r_elief subsystem inoperable for reasons other than Condition A, the inoperable subsystem must be restored to OPERABLE status within 30 days. In these Conditions, the remaining OPERABLE vacuum relief subsystems are adequate to perform the depressurization mitigation function since three 10-inch lines remain available. The 30 day Completion Time takes into account the redundant capability afforded by the remaining subsystems, a reasonable time for repairs, and the low probability of an event requiring the vacuum relief subsystems to function occurring during this period.

C.1 With two or more drywell post-LOCA vacuum relief subsystems inoperable for reasons other than Condition A, the inoperable subsystems must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time takes into account a reasonable time for repairs, and the low probability of an event requiring the vacuum relief subsystems to function occurring during this period.

D.1 and D.2 If the inoperable drywell post-LOCA vacuum relief subsystem(s) cannot be closed within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach (continued)

CLINTON B 3.6-131 Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES ACTIONS D.l (continued) the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.l If one drywell post-LOCA v~cuum relief subsystem is inoperable for reasons other than Condition A or tw9 or more drywell post-LOCA vacuum relief subsystems are inoperable for reasons other than Condition A, and not restored within the provided Completion Time, the plant must be brought to a condition in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the requi~ed plant conditions from full power conditions in an orderly manner and without challenging plant systems.

Required Action E.l is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.

However, where allowed, a risk as'sessment may be performed in accordance with LCO 3.0.4.b. Consideration o{ the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.

SURVEILLANCE SR 3.6.5.6.1 REQUIREMENTS Each drywell post-LOCA vacuum relief valve is verified to be closed (except when being tested in accordance with SR 3.6.5.6.2 and SR 3.6.5.6.3 or when the drywell post-LOCA vacuum relief valves are performing their intended design function) to ensure that this potential large drywell bypass leakage path is not present. This Surveillance is normally performed by observing the drywell post-LOCA vacuum relief valve position indication. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3.6-132 Revision No. 20-2

Drywell Post-LOCA Vacuum Relief System B 3.6.5.6 BASES (continued)

SURVEILLANCE SR 3.6.5.6.1 (continued)

REQUIREMENTS Two Notes are added to this SR. The first Note allows drywell post-LOCA vacuum relief valves opened in conjunction wit~ the performance of a Surveillance to not be considered as failing this SR. These periods of opening drywell post-LOCA vacuum relief valves are controlled by plant procedures and do not represent inoperable drywell post-LOCA vacuum relief valves. A second Note is included to clarify that valves open due to an actual differential pressure, are not considered as failing this SR.

SR 3.6.5.6.2 Each drywell post-LOCA vacuum relief valve must be cycled to ensure that it opens adequately to perform its design function and returns to the fully closed position. This provides assurance that the safety analysis assumptions are valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.5.6.3 Verification of the drywell post-LOCA vacuum relief valve opening differential pressure is hecessary to ensure that the safety analysis assumptions of< 0.2 psid for drywell vacuum relief are valid. The safety analysis assumes that the drywell post-LOCA vacuum relief valves will start opening when the dry well pressure is approximately 0.2 psid less than the containment and will be fully open when this differential pressure is 0.5 psid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. USAR, Section 6.2.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

CLINTON B 3.6-133 Revision No. 20-2

Division 3 SX Subsystem B 3.7.2 BASES LCO pump; and an OPERABLE Division 3 SX flow path, capable of (continued) taking suction from the UHS source and transferring the water to the appropriate unit equipment.

The OPERABILITY of the Division 1 and 2 SX subsystems and the UHS is discussed is LCO 3.7.1.

APPLICABILITY In MODES 1, 2, and 3, the UHS and Division 3 SX subsystem is required to be OPERABLE to support OPERABILITY of the HPCS System since it is required to be OPERABLE in these MODES.

In MODES 4 and 5, the OPERABILITY requirements of the Division 3 SX subsystem and the UHS are determined by the HPCS System.

ACTIONS A.1 When the Division 3 SX subsystem is inoperable, the capability of the HPCS System to perform its intended function cannot be ensured. Therefore, if the Division 3 SX subsystem is inoperable, the HPCS System must pe declared inoperable immediately and the applicable Condition(s) of LCO 3.5.1, "ECCS-Operating," or LCO 3.5.2, "RPV Water Inventory Control," entered.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS Verifying the correct alignment for each required manual, power operated, and automatic valve in the Division 3 SX subsystem flow,path provides assurance that the proper flow paths will exist for Division 3 SX subsystem operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in correct position prior to locking, sealing, or securing.

A valve is also allowed to be in the nonaccident position and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

(continued)

CLINTON B 3.7-9 Revision No. 20-2

Control Room Ventilation System B 3.7.3 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, the Control Room Ventilation System must be OPERABLE to ensure that the CRE will remain habitable during and following a OBA, since the OBA could lead to a fission product release.

In MODES 4 and 5, the probability and consequences of a OBA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room Ventilation System OPERABLE is not required in MODE 4 or 5, except during C_ORE ALTERATIONS, and during movement of irradiated fuel ass'emblies in the primary or secondary containment.

ACTIONS A.1 With one Control Room Ventilation subsystem inoperable for reasons other than an inoperable CRE boundary, the inoperable Control Room Ventilation subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE Control Room Ventilation_ subsystem is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE subsystem could result in loss of Control Room Ventilation System function. "The 7 day Completion Time is based on the low.probability of a OBA occurring during this time period, and that the remaining subsystem can provide the required capabilities.

B.1 In MODE 1, 2, or 3, if the inoperable Control Room Ventilation subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes overall plant risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicab~lity of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 7) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be'made as it is also an acceptable low-risk state. The allowed (continued)

CLINTON B 3.7-14 Revision No. 20-2

Control Room Ventilation System B 3.7.3 BASES ACTIONS C.l, C.2, and C3 (continued) reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability the CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a DBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possibly repair, and test most problems with the CRE boundary.

D.1 and D.2 In MODE 1, 2, or 3, if the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes accident risk.

To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

E.1, E.2.1, and E.2.2 The Required Actions of Condition E are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

During movement of irradiated fuel assemblies in the primary or secondary containment or during CORE ALTERATIONS, if the inoperable Control Room Ventilation subsystem cannot be restored to OPERABLE status within the required Completion Time, the OPERABLE Control Room Ventilation subsystem may be placed in the high radiation mode. This action ensures that the remaining subsystem is OPERABLE, that no failures that would prevent automatic actuation will occur, and that any active failure will be readily detected.

An alternative to Required Action E.1 is to immediately suspend activities that present a potent{al for releasing radioactivity that might require the Control Room Ventilation subsystem to be in the high radiation mode of operation. This places the unit in a condition that minimizes the accident risk.

(continued)

CLINTON B 3.7-16 Revision No. 20-2

Control Room Ventilation System B 3.7.3 BASES ACTIONS E.l, E.2.1, and E.2.2 (continued)

If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment must be suspended immediately. Suspension of _these activities shall not preclude completion of movement of a component to a safe position.

F.1 If both Control Room Ventilation subsystems are inoperable in MODE 1, 2, or 3 for reasons other than an inoperable CRE boundary (i.e., Condition C), the Control Room Ventilation System may not be capable of performing the intended function and the unit is in a condition outside of the accident analyses. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 7) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions is an orderly manner and without challenging plant systems.

Required Action F.1 is modified by a Note that prohibits the application of LCO 3.0.4.a. This Note clarifies the intent of the Required Action by indicating that it is not permissible under LCO 3.0.4.a to enter MODE 3 from MODE 4 with the LCO not met. While remaining in MODE 3 presents an acceptable level of risk, it is not the intent of the Required Action to allow entry into, and continue operation in, MODE 3 from MODE 4 in accordance with LCO 3.0.4.a.

However, where allowed, a risk assessment may be performed in accordance with LCO 3.0.4.b. Consideration of the results of this risk assessment is required to determine the acceptability of entering MODE 3 from MODE 4 when this LCO is not met.

(continued)

CLINTON B 3.7-17 Revision No. 20-2

Control Room Ventilation System B 3.7.3 BASES ACTIONS G. l and G.2 (continued)

During movement of irradiated fuel assemblies in the primary or secondary containment or during CORE ALTERATIONS with two Control Room Ventilation subsystems inoperable or with one or more Control Room Ventilation subsystems inoperable due to an inoperable CRE boundary, action must be taken immediately to suspend activities that present a potential for releasing radioactivity that might require treatment of the control room air. This places the unit in a condition that minimizes the accident risk.

If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a .safe position.

SURVEILLANCE SR 3.7.3.1 and SR 3.7.3.2 REQUIREMENTS This SR verifies that a subsystem in a standby mode starts on demand and continues to operate. Standby systems should be checked periodically to ensure that they start and function properly. As the environmental and normal operating conditions of this system are ~ot severe, testing each subsystem provides an adequate check on this system.

Operation with the heaters on for~ 15 continuous minutes demonstrates OPERABILITY of the system .. Periodic operation ensures that heater failure, blockage, fan or motor failure, or excessive vibration can be detected for corrective action. The Recirculation Filter System (without heaters) need only be operated for~ 15 minutes to demonstrate the function of the system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

CLINTON B 3.7-18 Revision No. 20-2

Control Room AC System B 3.7.4 BASES APPLICABLE ,capable of removing sensible and latent heat loads from the SAFETY ANALYSES control room, including consideration of equipment (continued) heat loads and personnel occupancy requirements to ensure equipment OPERABILITY.

The Control Room AC System satisfies Criterion 3 of the NRC Policy Statement.

LCO Two independent and redundant subsystems of the Control Room AC System are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other subsystem. Total system failure could result in the equipment operating temperature exceeding limits.

The Control Room AC System is considered OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both subsystems. These components include the cooling coils, fans, chillers, compressors, ductwork, dampers, and associated instrumentation and controls. The heating coils and humidification equipment are not required for Control Room AC System OPERABILITY.

APPLICABILITY In MODE 1, 2,*or 3, the Control Room AC Syste~ must be OPERABLE to ensure that the control room te~perature will not exceed equipment OPERABILITY limits.

In MODES 4 and 5, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room AC System OPERABLE _is not required in MODE 4 or 5, except during CORE ALTERATIONS and during movement of irradiated fuel assemblies in the primary or secondary containment.

(continued)

CLINTON B 3.7-23 Revision No. 20-2

Control Room AC System B 3.7.4 BASES ACTIONS D.l, D.2.1, and D.2.2 (continued)

The Required Actions of Condition Dare modified by a Note indicating that LCO 3.0.3 does not apply.

If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

During movement of irradiated fuel assemblies in the primary or secondary containment or during CORE ALTERATIONS, if Required Action A.l cannot be completed within the required Completion Time, the OPERABLE control room AC subsystem may be placed immediately in operation.

This action ensures that the remaining subsystem i~

OPERABLE, that no failures that would prevent actuation will occur, and that any active failure will be readily detected.

An alternative to Required Action D.l is to immediately suspend activities that present a potential for releasing radioactivity that might require operation of the Control Room Ventilation System in the high radiation mode. This places the unit in a condition that minimizes risk.

If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

E.l and E.2 The Required Actions of Condition E.l are modified by a Note indicating that LCO 3.0.3 does not apply. If moving -

irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations.

Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

(continued)

CLINTON B 3.7-26 Revision No. 20-2

Control Room AC System B 3.7.4 BASES ACTIONS E.l and E.2 (continued)

During movement of irradiated fuel assemblies in the primary or secondary containment, during CORE ALTERATIONS, if the Required Action and associated Completion Time of Condition Bis not met, action must be taken to immediately suspend activities that present a potential for releasing radioactivity that might require operation of the Control Room Ventilation System in the high radiation mode. This places the unit in a condition that minimizes risk.

If applicable, CORE ALTERATIONS and handling of irradiated fuel in the primary and secondary containment must be suspended immediately. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.7.4.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the control room heat load assumed in the safety analysis. The SR consists of a combination of testing and calculation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

With regard to heat removal capability values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 4).

REFERENCES 1. USAR, Section 6.4.

2. USAR, Section 9.4.1.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

4. Calculation IP-0-0102.

CLINTON B 3.7-27 Revision No. 20-2

AC Sources~Operating B 3.8.1 BASES ACTIONS B.2 (continued)

The remaining OPERABLE DGs and offsite circuits are adequate to supply electrical power to the onsite Class lE Distribution System. Thus, on a component basis, single failure protection for the required feature's function may have been lost; however, function has not been lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the component OPERABILITY of the redundant counterpart to the inoperable required feature. Additionally, the 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and low probability of a OBA occurring during this period.

B.3.1 and B.3.2 Required Action B.3.1 provides an allowance to avoid unnecessary testing of OPERABLE DGs. If it can be determined that the cause of the inoperable DG does not exist on the OPERABLE DG(s), SR 3.8.1.2 does not have to be performed. If the cause of inoperability exists on other DG(s), the other DG(s) are declared inoperable upon discovery, and Condition E and potentially Condition G of LCO 3.8.1 is entered. Once the failure is repaired, and the common cause failure no longer exists, Required Action B.3.1 is satisfied. If the cause of the initial inoperable DG cannot be confirmed not to exist on the remaining DG(s),

performance of SR 3.8.1.2 suffices to provide assurance of continued OPERABILITY of those DG(s).

In the event the inoperable DG is restored to OPERABLE status prior to completing either B.3.1 or B.3.2, the Corrective Action Program will continue to evaluate the common cause possibility. This continued evaluation, however, is no longer under the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months constraint imposed while in Condition B.

If while a DG is inoperable, a new problem with the DG is discovered that would have prevented the DG from performing its specified safety function, a separate entry into Condition Bis not required. The new DG problem should be addressed in accordance with the Corrective Action Program.

According to Generic Letter 84-15 (Ref. 7), 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is reasonable time to confirm that the OPERABLE DG(s) are not affected by the same problem as the inoperable DG.

(continued)

CLINTON B 3.8-8 Revision No. 20-4

AC Sources-Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources-Shutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3. 8 .1, "AC Sources-Operating,"

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 4 SAFETY ANALYSES and 5 and during movement of irradiated fuel assemblies in the primary and secondary containment ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.

In gen,eral, when the unit is shut down the Technical Specifications (TS) requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assum{ng a single failure and concurrent loss of all offsite or loss of all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no specific analyses in MODES 4 and 5. Worst case bounding events are deemed not credible in MODES 4 and 5 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses result in the probabilities of occurrence significantly reduced or eliminated, and minimal consequences. These deviations from OBA analysis assumptions and design requirements during shutdown conditions are allowed by the LCOs for required systems.

During MODES 1, 2, and 3, various deviations from the analysis assumptions and design requirements are allowed within the ACTIONS. This allowance is in recognition that (continued)

CLINTON B 3.8-33 Revision No. 20-2

AC Sources~Shutdown B 3.8.2 BASES LCO electrical power support, assuming a loss of the offsite (continued) circuit. Similarly, when the high pressure core spray (HPCS) is required to be OPERABLE, a separate offsite circuit to the Division 3 Class lE onsite electrical power distribution subsystem, or an OPERABLE Division 3 DG, ensure an additional source of power for the HPCS. Together, OPERABILITY of the required offsite circuit(s) and DG(s) ensure the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents) .

The qualified offsite circuit(s) must be capable of maintaining rated frequency and voltage while connected to their respective ESF bus(es), and accepting required loads during an accident. Qualified offsite circuits are those that are described in the USAR and are part of the licensing basis for the plant. The offsite circuit consists of incoming breaker and disconnect to the respective reserve auxiliary transformer (RAT) or emergency reserve auxiliary transformer (ERAT), and the respective circuit path including feeder breakers to all 4.16 kV ESF buses required by LCO 3.8.10. In addition, an onsite, permanently installed static VAR compensator (SVC) is available for connection to the offsite circuits to support required voltage for the ESF busses. Connection of the SVC to the offsite circuit is via circuit breakers to the secondary side of the RAT and/or ERAT.

Connection and operation of the SVC(s) is dictated by the existing need for voltage support of the offsite electrical power source(s) based on prevailing grid conditions. Thus, OPERABILITY of the offsite electrical power source(s) is normally supported by, but is not necessarily dependent on, connection and operation of the SVC(s). The resultant impact on OPERABILITY of the offsite electrical source(s) from disconnecting the SVC(s) from the offsite circuit(s) can be determined by analysis based on use of an established model of the offsite transmission network and existing grid conditions, including available generating sources, which can be updated on a daily or more frequent basis. The model provides the capability to predict or determine what ,the onsite voltages would be at the.RAT and/or ERAT (while connected to the offsite electrical.sources) under maximum postulated load conditions.

(continued)

CLINTON B 3.8-35 Revision No. 20-2

AC Sources~Shutdown B 3.8.2 BASES LCO The required DG must be capable of starting, accelerating to (continued) rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage, and accepting required loads. This sequence must be accomplished within 12 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as: DG in standby with the engine hot and DG 1n standby with the engine at ambient conditions. Additional DG capabilities must be demonstrated .to meet required Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while *operating in parallel test mode.

Proper sequencing of loads, including tripping of nonessential loads, is a required function for DG OPERABILITY.

It is acceptable for divisions to be cross tied during shutdown conditions, permitting a single offsite power circuit to supply all required AC electrical power distribution subsystems. No fast transfer capability is required for offsite circuits to be considered OPERABLE for this LCO.

As described in Applicable Safety Analyses, in the event of an accident during shutdown, the TS are designed to maintain the plant in a condition such that, even with a single failure, the plant wi,11 not be in immediate difficulty.

APPLICABILITY The AC sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment provide assurance that:

a. Systems that provide core cooling are available;

b. Systems needed to mitigate a fuel handling accident are available; (continued)

CLINTON B 3.8-36 Revision No. 20-2

AC Sources~Shutdown B 3.8.2 BASES APPLICABILITY c. Systems necessary to mitigate the effects of events (continued) that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The AC power requirements for MODES 1, 2, and 3 are covered in LCO 3 . 8 . 1.

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.

A.l A required offsite circuit is co.nsidered inoperable if no qualified circuit is supplying power to one required ESF division. If two or more ESF 4.16 kV buses are required per LCO 3.8.10, division(s) with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and movement of irradiated fuel. By the allowance of the'option to declare required features inoperable which are not powered from offsite power, appropriate restrictions can be implemented in accordance with the required feature(s) LCOs' ACTIONS.

Required features remaining powered from offsite power (even though that circuit may be inoperable due to failing to power other features) are not declared inoperable by this Required Action.

A.2.1, A.2.2, A.2.3, B.1, B.2, and B.3 With the offsite circuit not available to all required divisions, the option still exists to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC

( continued)

CLINTON B 3.8-37 Revision No. 20-2

AC Sources~Shutdown B 3.8.2 BASES ACTIONS A.2.1, A.2.2, A.2.3, B.l, B.2, and B.3 (continued) power sources is not. available. It is, therefore, required to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize probability of the occurrence of postulated events. It is further required to initiate action immediately to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the plant safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.

Pursuant to LCO 3.0.6, the Distribution System ACTIONS are not entered even if all AC sources to it are inoperable, resulting in de-energization. Therefore, the Required Actions of Condition A have been modified by a Note to indicate that when Condition A is entered with no AC power to any required ESF bus, ACTIONS for LCO 3.8.10 must be immediately entered. This Note allows Condition A to provide requirements for the loss of the offsite circuit whether or not a division is de-energized. LCO 3.8.10 provides the appropriate restrictions for the situation involving a de-energized division.

C.l When the HPCS is required to be OPERABLE, and the additional required Division 3 AC source is inoperable, the required diversity of AC power sources to the HPCS is not available.

Since these sources only affect the HPCS, the HPCS is declared inoperable and the Required Actions of the affected Emergency Core Cooling Systems LCO entered.

(continued)

CLINTON B 3.8-38 Revision No. 20-2

DC Sources~Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.2 (continued)

REQUIREMENTS This level of loading may not normally be available following the battery service test and will need to be supplemented with additional loads. The duration for this test may be longer than the charger sizing criteria since the battery recharge is affected by float voltage, temperature, and the exponential decay in charging current.

The battery is recharged when the measured charging current is~ 2 amps.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

With regard to minimum required amperes and duration values obtained pursuant to this SR, as read from plant indication instrumentation, the specified limit is considered to be a nominal value and therefore does not require compensation for instrument indication uncertainties (Ref. 13).

SR 3.8.4.3 A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length are established with a dummy load that corresponds to the design duty cycle requirements as specified in Reference 4.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 allows the performance of a modified performance discharge test SR 3.8.6.6 in lieu of SR 3.8.4.3. This substitution is acceptable because SR 3.8.6.6 represents an equivalent test of battery capability as SR 3.8.4.3. The reason for Note 2 is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. Credit may be taken for unplanned events that satisfy the Surveillance. Examples of unplanned events may include:

(continued)

CLINTON B 3.8-57 Revision No. 20-2

DC Sources-Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources-Shutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3. 8. 4, "DC Sources -Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume that Engineered Safety Feature systems are OPERABLE. The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements .for the supported systems' OPERABILITY.

The OPERABILITY of the minimum DC electrical power sources during MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.

The DC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO One DC electrical power subsystem (consisting of one battery, one battery charger, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the division) associated with the (continued)

CLINTON B 3.8-59 Revision No. 20-2

DC Sources~Shutdown B 3.8.5 BASES LCO Division 1 or Division 2 onsite Class lE DC electrical power (continued) distribution subsystem(s) required OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown," is required to be OPERABLE. Similarly, when the High Pressure Core Spray (HPCS) System is required to be OPERABLE, the Division 3 and Division 4 DC electrical power subsystems associated with the Division 3 and Division 4 onsite Class lE DC electrical

power distribution subsystems required OPERABLE by LCO 3.8.10 are required to be OPERABLE. In addition to the preceding subsystems required to be OPERABLE, a Class lE battery or battery charger and the associated control equipment and interconnecting cabling capable of supplying power to the remaining Division 1 or Division 2 onsite Class lE DC electrical power distribution subsystem(s), when portions of both Division 1 and Division 2 DC electrical power distribution subsystems are required to be OPERABLE by LCO 3.8.10. This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment provide assurance that:

a. Required features to provide core cooling are available;

b. Required features needed to mitigate a fuel handling accident are available;

c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The DC electrical power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.4.

(continued)

CLINTON B 3.8-60 Revision No. 20-2

DC Sources~Shutdown B 3.8.5 BASES ACTIONS A.1, A.2, and A.3 (continued)

(continued) this case is a function of the battery charger capacity, the amount of loads on the associated DC system, the amount of the previous discharge, and the recharge characteristic of the battery. The charge time can be extensive, and there is not adequate assurance that it can be recharged within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (Required Action A.2).

Required Action A.2 requires that the battery float current be verified as less than or equal to 2 amps. This indicates that, if the battery and been discharged as the results of the inoperable battery charger, it has now been fully recharged. If, at the expiration of the initial 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months period, the battery float current is not less than or equal

'to 2 amps, this indicates there may be additional battery problems and the battery must be declared inoperable.

Required Action A.3 limits the restoration time for the inoperable battery charger to 7 days. This action is applicable if an alternate means of restoring battery terminal voltage to greater than or equal to the minimum established float voltage has been used (e.g., balance of plant non-Class lE battery charger). The 7 day completion time reflects a reasonable time to effect restoration of the qualified battery charger to operable status.

B . 1, B . 2 . 1, B . 2 . 2 , and B . 2 . 3 If more than one DC distribution subsystem is required according to LCO 3.8.10, the DC subsystems remaining OPERABLE with one or more DC power sources inoperable may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By allowing the option to declare required features inoperable with associated DC power source(s) inoperable, appropriate restri_ctions are implemented in accordance with the affected system LCOs' ACTIONS. In many instances this option may involve undesired administrative efforts. Therefore, the allowance for .sufficiently conservative actions is made (i.e.,. to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies).

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the plant safety systems.

(continued)

CLINTON B 3.8-62 Revision No. 20-2

Inverters-Shutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Inverters-Shutdown BASES BACKGROUND A description of the inverters is provided in the Bases for LCO 3. 8. 7, "Inverters-Operating ..n APPLICABLE The initial conditions of Design Basis Accident (OBA) and SAFETY ANALYSES transient accident analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. The DC to AC divisional inverters are designed to provide the required capacity, capability, redundancy, and reliability to ensure the availability.of necessary power to the Reactor Protection System (RPS) and Emergency Core Cooling Systems instrumentation and controls so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the inverters is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum inverters to each uninterruptible AC bus during MODES 4 and 5, and during movement of irradiated fuel assemblies in the primary or secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability are available for monitoring and maintaining the unit status; and

c. Adequate power is available to mitigate events postulated during shutdown, such as a fuel handling accident.

The inverters were previously identified as part of the Distribution System and, as such, satisfy Criterion 3 of the NRC ~olicy Statement.

(continued)

CLINTON B 3.8-74 Revision No. 20-2

Inverters~Shutdown B 3.8.8 BASES (continued)

LCO One Divisional inverter associated with the Division 1 or Division 2 onsite Class lE uninterruptible AC bus electrical power distribution subsystem(s) required OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown," is required to be OPERABLE. Similarly, when the High Pressure Core Spray (HPCS) System is required to be OPERABLE, the Division 3 and Division 4 inverters associated with the Division 3 and Division 4 onsite Class lE uninterruptible AC bus electrical power distribution subsystems required OPERABLE by LCO 3.8.10 are required to be OPERABLE.

The inverters ensure the availability of electrical power for the instrumentation for systems required to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence or postulated DBA. The four battery powered divisional inverters provide uninterruptibie supply of AC electrical power to the uninterruptible AC buses even if the 4.16 kV safety buses are de-energized. OPERABLE NSPS inverters require the associated bus be powered by the inverter through inverted DC voltage from the required Class lE DC bus, with the output within the design voltage and frequency tolerances.

This ensures the availability of sufficient inverter power sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).

APPLICABILITY The divisional inverters required to be OPERABLE in MODES 4 and 5 and also any time during movement of irradiated fuel assemblies in the primary or secondary containment provide assurance that:

a. Systems that provide core cooling are available;

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and (continued)

CLINTON B 3.8-75 Revision No. 20-2

Inverters-Shutdown B 3.8.8 BASES APPLICABILITY d. Instrumentation and control capability is available (continued) for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

Inverter requirements for MODES 1, 2, and 3 are covered in LCO 3.8.7.

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel* assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require reactor shutdown.

A.l, A.2.1, A.2.2, and A.2.3 If two divisions are required by LCO 3.8.10, "Distribution Systems-Shutdown," the remaining OPERABLE divisional inverters may be capable of supporting sufficient required feature(s) to allow continuation of CORE ALTERATIONS and fuel movement. By the allowance of the option to declare required feature(s) inoperable with the associated divisional inverter(s) inoperable, appropriate restrictions are implemented in accordance with the affected required feature(s) of the LCOs' ACTIONS. In many instances, this option may involve undesired administrative efforts.

Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment).

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize the probability of the occurrence of postulated events. :tt is further required to immediately initiate action to restore the required divisional inverters and to continue this action until restoration is accomplished in order to provide the necessary divisional inverter power to the plant safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required divisional inverters should be (continued)

CLINTON B 3.8-76 Revision No. 20-2

Distribution Systems-Shutdown B 3.8.10 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.10 Distribution Systems-Shutdown BASES BACKGROUND A description of the AC, DC, and uninterruptible AC bus electrical power distribution systems is provided in the Bases for LCO 3.8.9,. "Distribution Systems-Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the USAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref. 2), assume Engineered Safety Feature (ESF) systems are OPERABLE. The AC, DC, and uninterruptible AC bus electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the AC, DC, and uninterruptible AC bus electrical power distribution systems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum AC, DC, and uninterruptible AC bus electrical power sources and associated power distribution subsystems during MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident.

The AC and DC electrical power distribution systems satisfy Criterion 3 of the NRC Policy Statement.

(continued)

CLINTON B 3.8-89 Revision No. 20-2

Distribution Systems~Shutdown B 3.8.10 BASES (continued)

LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of Technical Specifications' required systems, equipment, and components~both specifically addressed by their own LCOs, and implicitly required by the definition of OPERABILITY.

OPERABILITY of the power sources for the electrical power distribution subsystem(s) addressed by this LCO are addressed by their respective LCOs.

Maintaining these portions of the distribution system energized to the proper voltages ensures the availability of sufficient power to operate the plant in a safe manner to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents).

APPLICABILITY The AC, DC, and uninterruptible AC bus electrical power dis-tribution subsystems required to be OPERABLE in MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary and secondary containment provide assurance that:

a. Systems that provide core cooling are available;

b. Systems needed to mitigate a fuel handling accident are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown or refueling condition.

The AC, DC, and uninterruptible AC bus electrical power distribution subsystem requirements for MODES 1, 2, and 3

.are covered in LCO 3.8.9.

(continued)

CLINTON B 3.8-90 Revision No. 20-2

Distribution Systems~Shutdown B 3.8.10 BASES (continued)

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor* operations. Therefore, inability to suspend movement of irradiated fuel assemblies~is not sufficient

~eason to require reactor shutdown.

A.1, A.2.1, A.2.2, A.2.3, and A.2.4 Although redundant required features may require redundant divisions of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem division may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected di 9 tribution subsystem LCO's Required Actions.

In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and secondary containment).

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition.

These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems.

Notwithstanding performance of the above conservative Required Actions, a required residual heat removal-shutdown cooling (RHR-SDC) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR-SDC ACTIONS would not be entered. Therefore, Required Action A.2.5 is provided to direct declaring RHR-SDC inoperable, which results in taking the appropriate RHR-SDC ACTIONS.

(continued)

CLINTON B 3.8-91 Revision No. 20-2

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES BACKGROUND test can be impractical. Removal of heat addition from (continued) recirculation pump operation and reactor core decay heat is coarsely controlled by control rod drive hydraulic system flow and reactor water cleanup system non-regenerative heat exchanger operation. Test conditions are focused on maintaining a steady state pressure, and tightly limited temperature control poses an unnecessary burden on the operator and may not be achievable in certain instances.

The hydrostatic and/or RCS system leakage tests require increasing pressure to 1025 - 1040 psig. Scram time testing required by SR 3.1.4.1 and SR 3.1.4.4 requires reactor pressures ~950 psig.

Other testing may be performed in conjuction with the allowances for dnservice leak or hydrostatic tests and control rod scram time tests.

APPLICABLE Allowing the reactor to be considered in MODE 4 when the SAFETY ANALYSES reactor coolant temperature is> 200°F, during, or as a consequence of, hydrostatic or leak testing, or as a consequence of control rod scram time testing initiated in conjunction with an inservice leak or hydrostatic test, effectively provides an exception to MODE 3 requirements, including OPERABILITY of primary containment and the full complement of redundant Emergency Core Cooling Systems (ECCS). Since the tests are performed nearly water solid, at low decay heat values, and near MODE 4 conditions, the stored energy in the reactor core will be very low. Under these conditions, the potential for failed fuel and a subsequent'increase in coolant activity above the limits of LCO 3.4.8, "Reactor Coolant System (RCS) Specifiic Activity,"

are minimized. In addition, the secondary containment will be* OPERABLE, in accordance with this Special Operations LCO, and will be capable of handling any airborne radioactivity or steam leaks that could occur during the performance of hydrostatic or leak testing. The required pressure testing conditions provide adequate assurance that the consequences of a steam leak will be conservatively bounded by the consequences of the postulated main steam line break outside of primary containment described in Reference 2. Therefore, these requirements will conservatively limit radiation releases to the environment.

In the unlikely event of any primary system leak that could result in the draining of the RPV, the reactor vessel*would rapidly depressurize. The make-up capability required in MODE 4 by LCO 3.5.2, "RPV Water Inventory Control," would be more than adequate to keep the RPV water level above the TAF under this low decay heat load condition. Small system leaks would be detected by leakage inspections before significant inventory loss occurred.

(continued)

CLINTON B 3.10-2 Revision No. 20-2

U-604454, Transmittal of Revision 20 to Technical Specification Bases: Difference between revisions

Revision as of 07:43, 6 November 2019

Text

Subject:

Navigation menu

U-604454, Transmittal of Revision 20 to Technical Specification Bases: Difference between revisions

Revision as of 07:43, 6 November 2019

Text

Subject:

Navigation menu

Search