NUREG-1430 

 Vol 2, Rev. 3.0 

Standard Technical Specifications 

Babcock and Wilcox Plants

Bases 

Manuscript Completed: March 2004 

Date Published: June 2004

Division of Regulatory Improvement Programs 

Office of Nuclear Reactor Regulation 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001
 

Availability of Reference Materials 

in NRC Publications

NRC Reference Material 

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC’s Public Electronic Reading Room at 

www.nrc.gov/NRC/ADAMS/index.htm. 

Publicly released documents include, to name a few, 

NUREG-series publications; Federal Register notices; 

applicant, licensee, and vendor documents and 

correspondence; NRC correspondence and internal 

memoranda; bulletins and information notices; 

inspection and investigation reports; licensee event 

reports; and Commission papers and their attachments. 

NRC publications in the NUREG series, NRC 

regulations, and Title 10, Energy, of the Code of 

Federal Regulations, may be purchased from one of 

these two sources: 

1. The Superintendent of Documents 

 U.S. Government Printing Office 

 Mail Stop SSOP 

 Washington, DC 20402-0001 

 Internet: bookstore.gpo.gov 

 Telephone : 202-512-1800 

 Fax: 202-512-2250 

2. The National Technical Information Service 

 Springfield, VA 22161-0002 

 www.ntis.gov 

 1-800-553-6847 or locally 703-605-6000 

A single copy of each NRC draft report for comment is 

available free, to the extent of supply, upon written 

request as follows: 

Address: Office of the Chief Information Officer 

 Reproduction and Distribution 

 Services Section 

 U.S. Nuclear Regulatory Commission 

 Washington, DC 20555-0001 

E-mail: DISTRIBUTION@nrc.gov 

Facsimile: 301-415-2289 

Some publications in the NUREG series that are 

posted at the NRC’s Web site address 

www.nrc.gov/NRC/NUREGS/indexnum.html 

are updated periodically and may differ from the last 

printed version. Although references to material found 

on a Web site bear the date the material was accessed, 

the material available on the date cited may 

subsequently be removed from the site. 

Non-NRC Reference Material 

Documents available from public and special 

technical libraries include all open literature items, 

such as books, journal articles, and transactions, 

Federal Register notices, Federal and State 

legislation, and congressional reports. Such 

documents as theses, dissertations, foreign reports 

and translations, and non-NRC conference 

proceedings may be purchased from their 

sponsoring organization. 

Copies of industry codes and standards used in a 

substantive manner in the NRC regulatory process 

are maintained at - 

The NRC Library 

Two White Flint North 

11545 Rockville Pike 

Rockville, MD 20852-2738 

These standards are available in the library for 

reference use by the public. Codes and standards 

are usually copyrighted and may be purchased from 

the originating organization or, if they are American 

National Standards, from— 

 American National Standards Institute 

 11 West 42nd Street 

 New York, NY 10036-8002 

 <http://www.ansi.org> 

 212-642-4900 

Legally binding regulatory requirements are 

stated only in laws; NRC regulations; licenses, 

including technical specifications; or orders, not 

in NUREG-series publications. The views 

expressed in contractor-prepared publications 

in this series are not necessarily those of the 

NRC. 

The NUREG series comprises (1) technical 

and administrative books prepared by the staff 

(NUREG-XXXX) or agency contractors 

(NUREG/CR-XXXX), (2) proceedings of 

conferences (NUREG/CP-XXXX), (3) reports 

resulting from international agreements 

(NUREG/IA-XXXX), (4) brochures 

(NUREG/BR-XXXX), and (5) compilations of 

legal decisions and orders of the Commission 

and Atomic and Safety Licensing Boards and 

of Director’s decisions under Section 2.206 of 

NRC’s regulations (NUREG-0750). 
BWOG STS iii Rev. 3.0, 03/31/04 

PREFACE 

This NUREG contains the improved Standard Technical Specifications (STS) for Babcock and 

Wilcox (B&W) plants. Revision 3 incorporates the cumulative changes to Revision 1 and 2, 

which were published in April 1995 and April 2001, respectively. The changes reflected in 

Revision 3 result from the experience gained from license amendment applications to convert to 

these improved STS or to adopt partial improvements to existing technical specifications. This 

publication is the result of extensive public technical meetings and discussions among the 

Nuclear Regulatory Commission (NRC) staff and various nuclear power plant licensees, Nuclear 

Steam Supply System (NSSS) Owners Groups, and the Nuclear Energy Institute (NEI). The 

improved STS were developed based on the criteria in the Final Commission Policy Statement 

on Technical Specifications Improvements for Nuclear Power Reactors, dated July 22, 1993 

(58 FR 39132), which was subsequently codified by changes to Section 36 of Part 50 of Title 10 

of the Code of Federal Regulations (10 CFR 50.36) (60 FR 36953). Licensees are encouraged 

to upgrade their technical specifications consistent with those criteria and conforming, to the 

practical extent, to Revision 3 to the improved STS. The Commission continues to place the 

highest priority on requests for complete conversions to the improved STS. Licensees adopting 

portions of the improved STS to existing technical specifications should adopt all related 

requirements, as applicable, to achieve a high degree of standardization and consistency. 

The Table of Contents is now a Table of Contents / Revision Summary where the revision 

number and date are listed for each specification and bases, in lieu of traditional page numbers. 

Each limiting condition for operation (LCO) starts with page 1, with a specification, e.g., "2.0" or 

bases "B 2.0" number prefix. Subsequent approved revisions to sections will be noted in the 

Table of Contents, as well as on each affected page, using a decimal number to indicate the 

number of revisions to that section, along with the date, e.g., (Rev 3.3, 04/01/04) indicates the 

third approved change and date since Revision 3.0 was published. Additionally, the final page 

of each LCO section will be a historical listing of the changes affecting that section. This 

publication will be maintained in electronic format. Subsequent revisions will not be printed in 

hard copy. Users may access the subsequent revisions to the STS in the PDF format at 

(http://www.nrc.gov/NRR/sts/sts.htm). This Web site will be updated as needed and the 

contents may differ from the last printed version. Users may print or download copies from the 

NRC Web site. 

PAPERWORK REDUCTION ACT STATEMENT 

The information collections contained in this NUREG are covered by the requirements of 

10 CFR Part 50, which were approved by the Office of Management and Budget, approval 

number 3150-0011. 

PUBLIC PROTECTION NOTIFICATION 

If a means used to impose an information collection does not display a currently valid OMB 

control number, the NRC may not conduct or sponsor, and a person is not required to respond 

to, the information collection. 
BWOG STS v Rev. 3.0, 03/31/04 

TABLE OF CONTENTS / REVISION SUMMARY Revision - Date 

B 2.0 SAFETY LIMITS (SLs) 

B 2.1.1 Reactor Core SLs.............................................................................3.0, 03/31/04 

B 2.1.2 Reactor Coolant System (RCS) Pressure SL ..................................3.0, 03/31/04 

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY.......3.0, 03/31/04 

B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY......................3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.1 SHUTDOWN MARGIN (SDM) .........................................................3.0, 03/31/04 

B 3.1.2 Reactivity Balance............................................................................3.0, 03/31/04 

B 3.1.3 Moderator Temperature Coefficient (MTC) ......................................3.0, 03/31/04 

B 3.1.4 CONTROL ROD Group Alignment Limits ........................................3.0, 03/31/04 

B 3.1.5 Safety Rod Insertion Limit................................................................3.0, 03/31/04 

B 3.1.6 AXIAL POWER SHAPING ROD (APSR) Alignment Limits..............3.0, 03/31/04 

B 3.1.7 Position Indicator Channels .............................................................3.0, 03/31/04 

B 3.1.8 PHYSICS TESTS Exceptions Systems - MODE 1 ..........................3.0, 03/31/04 

B 3.1.9 PHYSICS TESTS Exceptions - MODE 2 .........................................3.0, 03/31/04 

B 3.2 POWER DISTRIBUTION LIMITS 

B 3.2.1 Regulating Rod Insertion Limits .......................................................3.0, 03/31/04 

B 3.2.2 AXIAL POWER SHAPING ROD (APSR) Insertion Limits................3.0, 03/31/04 

B 3.2.3 AXIAL POWER IMBALANCE Operating Limits ...............................3.0, 03/31/04 

B 3.2.4 QUADRANT POWER TILT (QPT) ...................................................3.0, 03/31/04 

B 3.2.5 Power Peaking Factors....................................................................3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.1 Reactor Protection System (RPS) Instrumentation..........................3.0, 03/31/04 

B 3.3.2 Reactor Protection System (RPS) Manual Reactor Trip ..................3.0, 03/31/04 

B 3.3.3 Reactor Protection System (RPS) - Reactor Trip Module (RTM).....3.0, 03/31/04 

B 3.3.4 CONTROL ROD Drive (CRD) Trip Devices .....................................3.0, 03/31/04 

B 3.3.5 Engineered Safety Feature Actuation System (ESFAS) 

 Instrumentation............................................................................3.0, 03/31/04 

B 3.3.6 Engineered Safety Feature Actuation System (ESFAS) 

 Manual Initiation ..........................................................................3.0, 03/31/04 

B 3.3.7 Engineered Safety Feature Actuation System (ESFAS) 

 Automatic Actuation Logic...........................................................3.0, 03/31/04 

B 3.3.8 Emergency Diesel Generator (EDG) Loss of Power Start 

 (LOPS) ........................................................................................3.0, 03/31/04 

B 3.3.9 Source Range Neutron Flux.............................................................3.0, 03/31/04 

B 3.3.10 Intermediate Range Neutron Flux....................................................3.0, 03/31/04 

B 3.3.11 Emergency Feedwater Initiation and Control (EFIC) 

 Instrumentation............................................................................3.0, 03/31/04 

B 3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual 

 Initiation.......................................................................................3.0, 03/31/04 

B 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Logic..............3.0, 03/31/04 

B 3.3.14 Emergency Feedwater Initiation and Control (EFIC) – 

 Emergency Feedwater (EFW) - Vector Valve Logic....................3.0, 03/31/04 
BWOG STS vi Rev. 3.0, 03/31/04 

TABLE OF CONTENTS / REVISION SUMMARY Revision - Date 

B 3.3 INSTRUMENTATION (continued) 

B 3.3.15 Reactor Building (RB) Purge Isolation - High Radiation...................3.0, 03/31/04 

B 3.3.16 Control Room Isolation - High Radiation..........................................3.0, 03/31/04 

B 3.3.17 Post Accident Monitoring (PAM) Instrumentation ............................3.0, 03/31/04 

B 3.3.18 Remote Shutdown System...............................................................3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from 

 Nucleate Boiling (DNB) Limits .....................................................3.0, 03/31/04 

B 3.4.2 RCS Minimum Temperature for Criticality........................................3.0, 03/31/04 

B 3.4.3 RCS Pressure and Temperature (P/T) Limits ..................................3.0, 03/31/04 

B 3.4.4 RCS Loops - MODES 1 and 2 .........................................................3.0, 03/31/04 

B 3.4.5 RCS Loops - MODE 3......................................................................3.0, 03/31/04 

B 3.4.6 RCS Loops - MODE 4......................................................................3.0, 03/31/04 

B 3.4.7 RCS Loops - MODE 5, Loops Filled ................................................3.0, 03/31/04 

B 3.4.8 RCS Loops - MODE 5, Loops Not Filled..........................................3.0, 03/31/04 

B 3.4.9 Pressurizer.......................................................................................3.0, 03/31/04 

B 3.4.10 Pressurizer Safety Valves................................................................3.0, 03/31/04 

B 3.4.11 Pressurizer Power Operated Relief Valve (PORV)..........................3.0, 03/31/04 

B 3.4.12 Low Temperature Overpressure Protection (LTOP) System ...........3.0, 03/31/04 

B 3.4.13 RCS Operational LEAKAGE ............................................................3.0, 03/31/04 

B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage..................................3.0, 03/31/04 

B 3.4.15 RCS Leakage Detection Instrumentation.........................................3.0, 03/31/04 

B 3.4.16 RCS Specific Activity........................................................................3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 

B 3.5.1 Core Flood Tanks (CFTs) ................................................................3.0, 03/31/04 

B 3.5.2 ECCS - Operating ............................................................................3.0, 03/31/04 

B 3.5.3 ECCS - Shutdown............................................................................3.0, 03/31/04 

B 3.5.4 Borated Water Storage Tank (BWST)..............................................3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1 Containment.....................................................................................3.0, 03/31/04 

B 3.6.2 Containment Air Locks.....................................................................3.0, 03/31/04 

B 3.6.3 Containment Isolation Valves...........................................................3.0, 03/31/04 

B 3.6.4 Containment Pressure .....................................................................3.0, 03/31/04 

B 3.6.5 Containment Air Temperature..........................................................3.0, 03/31/04 

B 3.6.6 Containment Spray and Cooling Systems .......................................3.0, 03/31/04 

B 3.6.7 Spray Additive System.....................................................................3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.1 Main Steam Safety Valves (MSSVs)................................................3.0, 03/31/04 

B 3.7.2 Main Steam Isolation Valves (MSIVs)..............................................3.0, 03/31/04 

[ B 3.7.3 Main Feedwater Stop Valves (MFSVs), Main Feedwater 

 Control Valves (MFCVs), and Associated Startup 

 Feedwater Control Valves (SFCVs) ] ........................................3.0, 03/31/04 ] 
BWOG STS vii Rev. 3.0, 03/31/04 

TABLE OF CONTENTS / REVISION SUMMARY Revision - Date 

B 3.7 PLANT SYSTEMS (continued) 

B 3.7.4 Atmospheric Vent Valves (AVVs).....................................................3.0, 03/31/04 

B 3.7.5 Emergency Feedwater (EFW) System.............................................3.0, 03/31/04 

B 3.7.6 Condensate Storage Tank (CST).....................................................3.0, 03/31/04 

B 3.7.7 Component Cooling Water (CCW) System......................................3.0, 03/31/04 

B 3.7.8 Service Water System (SWS)..........................................................3.0, 03/31/04 

B 3.7.9 Ultimate Heat Sink (UHS) ................................................................3.0, 03/31/04 

B 3.7.10 Control Room Emergency Ventilation System (CREVS) .................3.0, 03/31/04 

B 3.7.11 Control Room Emergency Air Temperature Control System 

 (CREATCS).................................................................................3.0, 03/31/04 

B 3.7.12 Emergency Ventilation System (EVS)..............................................3.0, 03/31/04 

B 3.7.13 Fuel Storage Pool Ventilation System (FSPVS) ..............................3.0, 03/31/04 

B 3.7.14 Fuel Storage Pool Water Level ........................................................3.0, 03/31/04 

[ B 3.7.15 Spent Fuel Pool Boron Concentration............................................3.0, 03/31/04 ] 

[ B 3.7.16 Spent Fuel Assembly Storage........................................................3.0, 03/31/04 ] 

B 3.7.17 Secondary Specific Activity..............................................................3.0, 03/31/04 

B 3.7.18 Steam Generator Level....................................................................3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.1 AC Sources - Operating...................................................................3.0, 03/31/04 

B 3.8.2 AC Sources - Shutdown...................................................................3.0, 03/31/04 

B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air........................................3.0, 03/31/04 

B 3.8.4 DC Sources - Operating...................................................................3.0, 03/31/04 

B 3.8.5 DC Sources - Shutdown...................................................................3.0, 03/31/04 

B 3.8.6 Battery Parameters ..........................................................................3.0, 03/31/04 

B 3.8.7 Inverters - Operating ........................................................................3.0, 03/31/04 

B 3.8.8 Inverters - Shutdown........................................................................3.0, 03/31/04 

B 3.8.9 Distribution Systems - Operating .....................................................3.0, 03/31/04 

B 3.8.10 Distribution Systems - Shutdown .....................................................3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.1 Boron Concentration ........................................................................3.0, 03/31/04 

B 3.9.2 Nuclear Instrumentation...................................................................3.0, 03/31/04 

B 3.9.3 Containment Penetrations................................................................3.0, 03/31/04 

B 3.9.4 Decay Heat Removal (DHR) and Coolant Circulation - High 

 Water Level .................................................................................3.0, 03/31/04 

B 3.9.5 Decay Heat Removal (DHR) and Coolant Circulation - Low 

 Water Level .................................................................................3.0, 03/31/04 

B 3.9.6 Refueling Canal Water Level ...........................................................3.0, 03/31/04 
Reactor Core SLs 

B 2.1.1 

BWOG STS B 2.1.1-1 Rev. 3.0, 03/31/04 

B 2.0 SAFETY LIMITS (SLs) 

B 2.1.1 Reactor Core SLs 

BASES 

BACKGROUND GDC 10 (Ref. 1) requires that reactor core SLs ensure specified 

acceptable fuel design limits are not exceeded during steady state 

operation, normal operational transients, and anticipated operational 

occurrences (AOOs). This is accomplished by having a departure from 

nucleate boiling (DNB) design basis, which corresponds to a 95% 

probability at a 95% confidence level (95/95 DNB criterion) that DNB will 

not occur and by requiring that the fuel centerline temperature stays 

below the melting temperature. 

The restrictions of this SL prevent overheating of the fuel and cladding 

and possible cladding perforation that would result in the release of 

fission products to the reactor coolant. Overheating of the fuel is 

prevented by maintaining the steady state peak linear heat rate (LHR) 

below the level at which fuel centerline melting occurs. Overheating of 

the fuel cladding is prevented by restricting fuel operation to within the 

nucleate boiling regime, where the heat transfer coefficient is large and 

the cladding surface temperature is slightly above the coolant saturation 

temperature. 

Fuel centerline melting occurs when the local LHR, or power peaking, in a 

region of the fuel is high enough to cause the fuel centerline temperature 

to reach the melting point of the fuel. Expansion of the pellet upon 

centerline melting may cause the pellet to stress the cladding to the point 

of failure, allowing an uncontrolled release of activity to the reactor 

coolant. 

Operation above the boundary of the nucleate boiling regime could result 

in excessive cladding temperature because of the onset of DNB and the 

resultant sharp reduction in heat transfer coefficient. Inside the steam 

film, high cladding temperatures are reached, and a cladding water 

(zirconium water) reaction may take place. This chemical reaction 

results in oxidation of the fuel cladding to a structurally weaker form. This 

weaker form may lose its integrity, resulting in an uncontrolled release of 

activity to the reactor coolant. 

The proper functioning of the Reactor Protection System (RPS) and main 

steam safety valves (MSSVs) prevents violation of the reactor core SLs. 
Reactor Core SLs 

B 2.1.1 

BWOG STS B 2.1.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The fuel cladding must not sustain damage as a result of normal 

SAFETY operation and AOOs. The reactor core SLs are established to preclude 

ANALYSES violation of the following fuel design criteria: 

a. There must be at least 95% probability at a 95% confidence level 

(95/95 DNB criterion) that the hot fuel rod in the core does not 

experience DNB and 

b. The hot fuel pellet in the core must not experience fuel centerline 

melting. 

The RPS setpoints (Ref. 2), in combination with all the LCOs, is designed 

to prevent any anticipated combination of transient conditions for Reactor 

Coolant System (RCS) temperature, pressure, and THERMAL POWER 

level that would result in a departure from nucleate boiling ratio (DNBR) of 

less than the DNBR limit and preclude the existence of flow instabilities. 

Automatic enforcement of these reactor core SLs is provided by the 

following: 

a. RCS High Pressure trip, 

b. RCS Low Pressure trip, 

c. Nuclear Overpower trip, 

d. RCS Variable Low Pressure trip, 

e. Reactor Coolant Pump to Power trip, 

f. Nuclear Overpower RCS Flow and Axial Power Imbalance trip, and 

g. MSSVs. 

The SL represents a design requirement for establishing the RPS trip 

setpoints identified previously. 

SAFETY LIMITS SL 2.1.1.1, SL 2.1.1.2, and SL 2.1.1.3 ensure that the minimum DNBR is 

not less than the safety analyses limit and that fuel centerline temperature 

stays below the melting point, or the average enthalpy in the hot leg is 

less than or equal to the enthalpy of saturated liquid, or the exit quality is 

within the limits defined by the DNBR correlation. In addition, SL 2.1.1.3 

shows the pressure/temperature operating region that keeps the reactor 

from reaching an SL when operating up to design power, and it defines 

the safe operating region from brittle fracture concerns. 
Reactor Core SLs 

B 2.1.1 

BWOG STS B 2.1.1-3 Rev. 3.0, 03/31/04 

BASES 

SAFETY LIMITS (continued) 

The SLs are preserved by monitoring the process variable AXIAL 

POWER IMBALANCE to ensure that the core operates within the fuel 

design criteria. AXIAL POWER IMBALANCE protective limits are 

provided in the COLR. The trip setpoints are derived by adjusting the 

measurement system independent AXIAL POWER IMBALANCE 

protective limit given in the COLR to allow for measurement system 

observability and instrumentation errors. 

Operation within these limits is ensured by compliance with the AXIAL 

POWER IMBALANCE protective limits preserved by their corresponding 

RPS setpoints in LCO 3.3.1, "Reactor Protection System (RPS) 

Instrumentation," as specified in the COLR. The AXIAL POWER 

IMBALANCE protective limits are separate and distinct from the AXIAL 

POWER IMBALANCE operating limits defined by LCO 3.2.3, "AXIAL 

POWER IMBALANCE Operating Limits." The AXIAL POWER 

IMBALANCE operating limits in LCO 3.2.3, also specified in the COLR, 

preserve initial conditions of the safety analyses but are not reactor core 

SLs. 

APPLICABILITY SL 2.1.1.1, SL 2.1.1.2, and SL 2.1.1.3 only apply in MODES 1 and 2 

because these are the only MODES in which the reactor is critical. 

Automatic protection functions are required to be OPERABLE during 

MODES 1 and 2 to ensure operation within the reactor core SLs. The 

MSSVs, or automatic protection actions, serve to prevent RCS heatup to 

reactor core SL conditions or to initiate a reactor trip function, which 

forces the unit into MODE 3. Setpoints for the reactor trip functions are 

specified in LCO 3.3.1. 

In MODES 3, 4, 5, and 6, Applicability is not required, since the reactor is 

not generating significant THERMAL POWER. 

SAFETY LIMIT The following SL violation responses are applicable to the reactor core 

VIOLATIONS SLs. 

2.2.1 and 2.2.2

If SL 2.1.1.1, SL 2.1.1.2, or SL 2.1.1.3 is violated, the requirement to go to 

MODE 3 places the plant in a MODE in which these SLs are not 

applicable. 
Reactor Core SLs 

B 2.1.1 

BWOG STS B 2.1.1-4 Rev. 3.0, 03/31/04 

BASES 

SAFETY LIMIT VIOLATIONS (continued) 

The allowed Completion Time of 1 hour recognizes the importance of 

bringing the plant to a MODE of operation where these SLs are not 

applicable and reduces the probability of fuel damage. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10. 

 2. FSAR, Section [ ]. 
RCS Pressure SL 

B 2.1.2 

BWOG STS B 2.1.2-1 Rev. 3.0, 03/31/04 

B 2.0 SAFETY LIMITS (SLs) 

B 2.1.1 Reactor Coolant System (RCS) Pressure SL 

BASES 

BACKGROUND According to 10 CFR 50, Appendix A, GDC 14, "Reactor Coolant 

Pressure Boundary," and GDC 15, "Reactor Coolant System Design" 

(Ref. 1), the reactor coolant pressure boundary (RCPB) design conditions 

are not to be exceeded during normal operation nor during anticipated 

operational occurrences (AOOs). GDC 28, "Reactivity Limits" (Ref. 1), 

specifies that reactivity accidents including rod ejection do not result in 

damage to the RCPB greater than limited local yielding. 

The design pressure of the RCS is 2500 psig. During normal operation 

and AOOs, the RCS pressure is kept from exceeding the design pressure 

by more than 10% in order to remain in accordance with Section III of the 

ASME Code (Ref. 2). Hence, the safety limit is 2750 psig. To ensure 

system integrity, all RCS components are hydrostatically tested at 125% 

of design pressure prior to initial operation, according to the ASME Code 

requirements. Inservice operational hydrotesting at 100% of design 

pressure is also required whenever the reactor vessel head has been 

removed or if other pressure boundary joint alterations have occurred. 

Following inception of unit operation, RCS components shall be pressure 

tested, in accordance with the requirements of ASME Code, Section XI 

(Ref. 3). 

APPLICABLE The RCS pressurizer safety valves, operating in conjunction with the 

SAFETY Reactor Protection System trip settings, ensure that the RCS pressure 

ANALYSES SL will not be exceeded. 

The RCS pressurizer safety valves are sized to prevent system pressure 

from exceeding the design pressure by more than 10%, in accordance 

with Section III of the ASME Code for Nuclear Power Plant Components 

(Ref. 2). The transient that is most influential for establishing the required 

relief capacity, and hence the valve size requirements and lift settings, is 

a rod withdrawal from low power. During the transient, no control actions 

are assumed except that the safety valves on the secondary plant are 

assumed to open when the steam pressure reaches the secondary plant 

safety valve settings, and nominal feedwater supply is maintained. 

The overpressure protection analyses (Ref. 4) and the safety analyses 

(Ref. 5) are performed using conservative assumptions relative to 

pressure control devices. 
RCS Pressure SL 

B 2.1.2 

BWOG STS B 2.1.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

More specifically, no credit is taken for operation of the following: 

a. Pressurizer power operated relief valves (PORVs), 

b. Steam line turbine bypass valves, 

c. Control system runback of reactor and turbine power, and 

d. Pressurizer spray valve. 

SAFETY LIMIT The maximum transient pressure allowed in the RCS pressure vessel 

under the ASME Code, Section III, is 110% of design pressure. The 

maximum transient pressure allowed in the RCS piping, valves, and 

fittings under USAS, Section B31.1 (Ref. 6), is 120% of design pressure. 

The most limiting of these two allowances is the 110% of design 

pressure; therefore, the SL on maximum allowable RCS pressure is 

2750 psig. 

Overpressurization of the RCS can result in a breach of the RCPB. If 

such a breach occurs in conjunction with a fuel cladding failure, fission 

products could enter the containment atmosphere, raising concerns 

relative to limits on radioactive releases specified in 10 CFR 100, 

"Reactor Site Criteria" (Ref. 7). 

APPLICABILITY SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be 

approached or exceeded in these MODES during overpressurization 

events. The SL is not applicable in MODE 6 because the reactor vessel 

head closure bolts are not fully tightened, making it unlikely that the RCS 

can be pressurized. 

SAFETY LIMIT The following SL violation responses are applicable to the RCS pressure 

VIOLATIONS SL. 

2.2.3

If the RCS pressure SL is violated when the reactor is in MODE 1 or 2, 

the requirement is to restore compliance and be in MODE 3 within 1 hour. 

Exceeding the RCS pressure SL may cause immediate RCS failure and 

create a potential for radioactive releases in excess of 10 CFR 100, 

"Reactor Site Criteria," limits (Ref 7). 
RCS Pressure SL 

B 2.1.2 

BWOG STS B 2.1.2-3 Rev. 3.0, 03/31/04 

BASES 

SAFETY LIMIT VIOLATIONS (continued) 

The allowed Completion Time of 1 hour is based on the importance of 

reducing power level to a MODE of operation where the potential for 

challenges to safety systems is minimized. 

2.2.4

If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure 

must be restored to within the SL value within 5 minutes. 

Exceeding the RCS pressure SL in MODE 3, 4, or 5 is potentially more 

severe than exceeding this SL in MODE 1 or 2, since the reactor vessel 

temperature may be lower and the vessel material, consequently, less 

ductile. As such, pressure must be reduced to less than the SL within 

5 minutes. This action does not require reducing MODES, since this 

would require reducing temperature, which would compound the problem 

by adding thermal gradient stresses to the existing pressure stress. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28, 1988. 

 2. ASME Boiler and Pressure Vessel Code, Section III, Article NB-7000. 

 3. ASME Boiler and Pressure Vessel Code, Section XI, Article IW-5000. 

 4. BAW-10043, May 1972. 

 5. FSAR, Section [14]. 

 6. ASME USAS B31.1, Standard Code for Pressure Piping, 1967. 

 7. 10 CFR 100. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-1 Rev. 3.0, 03/31/04 

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY 

BASES 

LCOs LCO 3.0.1 through LCO 3.0.7 establish the general requirements 

applicable to all Specifications and apply at all times, unless otherwise 

stated. 

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual 

Specification as the requirement for when the LCO is required to be met 

(i.e., when the unit is in the MODES or other specified conditions of the 

Applicability statement of each Specification). 

LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, 

the associated ACTIONS shall be met. The Completion Time of each 

Required Action for an ACTIONS Condition is applicable from the point in 

time that an ACTIONS Condition is entered. The Required Actions 

establish those remedial measures that must be taken within specified 

Completion Times when the requirements of an LCO are not met. This 

Specification establishes that: 

a. Completion of the Required Actions within the specified Completion 

Times constitutes compliance with a Specification and 

b. Completion of the Required Actions is not required when an LCO is 

met within the specified Completion Time, unless otherwise specified. 

There are two basic types of Required Actions. The first type of Required 

Action specifies a time limit in which the LCO must be met. This time limit 

is the Completion Time to restore an inoperable system or component to 

OPERABLE status or to restore variables to within specified limits. If this 

type of Required Action is not completed within the specified Completion 

Time, a shutdown may be required to place the unit in a MODE or 

condition in which the Specification is not applicable. (Whether stated as 

a Required Action or not, correction of the entered Condition is an action 

that may always be considered upon entering ACTIONS.) The second 

type of Required Action specifies the remedial measures that permit 

continued operation of the unit that is not further restricted by the 

Completion Time. In this case, compliance with the Required Actions 

provides an acceptable level of safety for continued operation. 

Completing the Required Actions is not required when an LCO is met or 

is no longer applicable, unless otherwise stated in the individual 

Specifications. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-2 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.2 (continued) 

The nature of some Required Actions of some Conditions necessitates 

that, once the Condition is entered, the Required Actions must be 

completed even though the associated Conditions no longer exist. The 

individual LCO's ACTIONS specify the Required Actions where this is the 

case. An example of this is in LCO 3.4.3, "RCS Pressure and 

Temperature (P/T) Limits." 

The Completion Times of the Required Actions are also applicable when 

a system or component is removed from service intentionally. Reasons 

for intentionally relying on the ACTIONS include, but are not limited to, 

performance of Surveillances, preventive maintenance, corrective 

maintenance, or investigation of operational problems. Entering 

ACTIONS for these reasons must be done in a manner that does not 

compromise safety. Intentional entry into ACTIONS should not be made 

for operational convenience. Additionally, if intentional entry into 

ACTIONS would result in redundant equipment being inoperable, 

alternatives should be used instead. Doing so limits the time both 

subsystems/trains of a safety function are inoperable and limits the time 

conditions exist which may result in LCO 3.0.3 being entered. Individual 

Specifications may specify a time limit for performing an SR when 

equipment is removed from service or bypassed for testing. In this case, 

the Completion Times of the Required Actions are applicable when this 

time limit expires, if the equipment remains removed from service or 

bypassed. 

When a change in MODE or other specified condition is required to 

comply with Required Actions, the unit may enter a MODE or other 

specified condition in which another Specification becomes applicable. In 

this case, the Completion Times of the associated Required Actions 

would apply from the point in time that the new Specification becomes 

applicable and the ACTIONS Condition(s) are entered. 

LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an 

LCO is not met and either: 

a. An associated Required Action and Completion Time is not met and 

no other Condition applies or 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-3 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.3 (continued) 

b. The condition of the unit is not specifically addressed by the 

associated ACTIONS. This means that no combination of Conditions 

stated in the ACTIONS can be made that exactly corresponds to the 

actual condition of the unit. Sometimes, possible combinations of 

Conditions are such that entering LCO 3.0.3 is warranted; in such 

cases, the ACTIONS specifically state a Condition corresponding to 

such combinations and also that LCO 3.0.3 be entered immediately. 

This Specification delineates the time limits for placing the unit in a safe 

MODE or other specified condition when operation cannot be maintained 

within the limits for safe operation as defined by the LCO and its 

ACTIONS. It is not intended to be used as an operational convenience 

that permits routine voluntary removal of redundant systems or 

components from service in lieu of other alternatives that would not result 

in redundant systems or components being inoperable. 

Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly 

shutdown before initiating a change in unit operation. This includes time 

to permit the operator to coordinate the reduction in electrical generation 

with the load dispatcher to ensure the stability and availability of the 

electrical grid. The time limits specified to reach lower MODES of 

operation permit the shutdown to proceed in a controlled and orderly 

manner that is well within the specified maximum cooldown rate and 

within the capabilities of the unit, assuming that only the minimum 

required equipment is OPERABLE. This reduces thermal stresses on 

components of the Reactor Coolant System and the potential for a plant 

upset that could challenge safety systems under conditions to which this 

Specification applies. The use and interpretation of specified times to 

complete the actions of LCO 3.0.3 are consistent with the discussion of 

Section 1.3, Completion Times. 

A unit shutdown required in accordance with LCO 3.0.3 may be 

terminated and LCO 3.0.3 exited if any of the following occurs: 

a. The LCO is now met, 

b. A Condition exists for which the Required Actions have now been 

performed, or 

c. ACTIONS exist that do not have expired Completion Times. These 

Completion Times are applicable from the point in time that the 

Condition is initially entered and not from the time LCO 3.0.3 is 

exited. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-4 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.3 (continued) 

The time limits of LCO 3.0.3 allow 37 hours for the unit to be in MODE 5 

when a shutdown is required during MODE 1 operation. If the unit is in a 

lower MODE of operation when a shutdown is required, the time limit for 

reaching the next lower MODE applies. If a lower MODE is reached in 

less time than allowed, however, the total allowable time to reach 

MODE 5, or other applicable MODE, is not reduced. For example, if 

MODE 3 is reached in 2 hours, then the time allowed for reaching 

MODE 4 is the next 11 hours, because the total time for reaching 

MODE 4 is not reduced from the allowable limit of 13 hours. Therefore, if 

remedial measures are completed that would permit a return to MODE 1, 

a penalty is not incurred by having to reach a lower MODE of operation in 

less than the total time allowed. 

In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not 

covered in other Specifications. The requirements of LCO 3.0.3 do not 

apply in MODES 5 and 6 because the unit is already in the most 

restrictive Condition required by LCO 3.0.3. The requirements of 

LCO 3.0.3 do not apply in other specified conditions of the Applicability 

(unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual 

Specifications sufficiently define the remedial measures to be taken. 

Exceptions to LCO 3.0.3 are provided in instances where requiring a unit 

shutdown, in accordance with LCO 3.0.3, would not provide appropriate 

remedial measures for the associated condition of the unit. An example 

of this is in LCO 3.7.14, "Fuel Storage Pool Water Level." LCO 3.7.14 

has an Applicability of "During movement of irradiated fuel assemblies in 

fuel storage pool." Therefore, this LCO can be applicable in any or all 

MODES. If the LCO and the Required Actions of LCO 3.7.14 are not met 

while in MODE 1, 2, 3, or 4, there is no safety benefit to be gained by 

placing the unit in a shutdown condition. The Required Action of 

LCO 3.7.14 of "Suspend movement of irradiated fuel assemblies in fuel 

storage pool" is the appropriate Required Action to complete in lieu of the 

actions of LCO 3.0.3. These exceptions are addressed in the individual 

Specifications. 

LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other 

specified conditions in the Applicability when an LCO is not met. It allows 

placing the unit in a MODE or other specified condition stated in that 

Applicability (e.g., the Applicability desired to be entered) when unit 

conditions are such that the requirements of the LCO would not be met, in 

accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-5 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.4 (continued) 

 LCO 3.0.4.a allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met when the associated ACTIONS to be 

entered permit continued operation in the MODE or other specified 

condition in the Applicability for an unlimited period of time. Compliance 

with Required Actions that permit continued operation of the unit for an 

unlimited period of time in a MODE or other specified condition provides 

an acceptable level of safety for continued operation. This is without 

regard to the status of the unit before or after the MODE change. 

Therefore, in such cases, entry into a MODE or other specified condition 

in the Applicability may be made in accordance with the provisions of the 

Required Actions. 

LCO 3.0.4.b allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met after performance of a risk assessment 

addressing inoperable systems and components, consideration of the 

results, determination of the acceptability of entering the MODE or other 

specified condition in the Applicability, and establishment of risk 

management actions, if appropriate. 

The risk assessment may use quantitative, qualitative, or blended 

approaches, and the risk assessment will be conducted using the plant 

program, procedures, and criteria in place to implement 

10 CFR 50.65(a)(4), which requires that risk impacts of maintenance 

activities to be assessed and managed. The risk assessment, for the 

purposes of LCO 3.0.4.b, must take into account all inoperable Technical 

Specification equipment regardless of whether the equipment is included 

in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk 

assessments will be conducted using the procedures and guidance 

endorsed by Regulatory Guide 1.182, “Assessing and Managing Risk 

Before Maintenance Activities at Nuclear Power Plants.” Regulatory 

Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, 

“Industry Guideline for Monitoring the Effectiveness of Maintenance at 

Nuclear Power Plants.” These documents address general guidance for 

conduct of the risk assessment, quantitative and qualitative guidelines for 

establishing risk management actions, and example risk management 

actions. These include actions to plan and conduct other activities in a 

manner that controls overall risk, increased risk awareness by shift and 

management personnel, actions to reduce the duration of the condition, 

actions to minimize the magnitude of risk increases (establishment of 

backup success paths or compensatory measures), and determination 

that the proposed MODE change is acceptable. Consideration should 

also be given to the probability of completing restoration such that the 

requirements of the LCO would be met prior to the expiration of ACTIONS 

Completion Times that would require exiting the Applicability. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-6 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.4 (continued) 

LCO 3.0.4.b may be used with single, or multiple systems and 

components unavailable. NUMARC 93-01 provides guidance relative to 

consideration of simultaneous unavailability of multiple systems and 

components. 

The results of the risk assessment shall be considered in determining the 

acceptability of entering the MODE or other specified condition in the 

Applicability, and any corresponding risk management actions. The 

LCO 3.0.4.b risk assessments do not have to be documented. 

The Technical Specifications allow continued operation with equipment 

unavailable in MODE 1 for the duration of the Completion Time. Since 

this is allowable, and since in general the risk impact in that particular 

MODE bounds the risk of transitioning into and through the applicable 

MODES or other specified conditions in the Applicability of the LCO, the 

use of the LCO 3.0.4.b allowance should be generally acceptable, as long 

as the risk is assessed and managed as stated above. However, there is 

a small subset of systems and components that have been determined to 

be more important to risk and use of the LCO 3.0.4.b allowance is 

prohibited. The LCOs governing these systems and components contain 

Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not 

applicable. 

LCO 3.0.4.c allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met based on a Note in the Specification 

which states LCO 3.0.4.c is applicable. These specific allowances permit 

entry into MODES or other specified conditions in the Applicability when 

the associated ACTIONS to be entered do not provide for continued 

operation for an unlimited period of time and a risk assessment has not 

been performed. This allowance may apply to all the ACTIONS or to a 

specific Required Action of a Specification. The risk assessments 

performed to justify the use of LCO 3.0.4.b usually only consider systems 

and components. For this reason, LCO 3.0.4.c is typically applied to 

Specifications which describe values and parameters (e.g., [Containment 

Air Temperature, Containment Pressure, MCPR, Moderator Temperature 

Coefficient]), and may be applied to other Specifications based on NRC 

plant specific approval. 

The provisions of this Specification should not be interpreted as 

endorsing the failure to exercise the good practice of restoring systems or 

components to OPERABLE status before entering an associated MODE 

or other specified condition in the Applicability. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-7 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.4 (continued) 

The provisions of LCO 3.0.4 shall not prevent changes in MODES or 

other specified conditions in the Applicability that are required to comply 

with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent 

changes in MODES or other specified conditions in the Applicability that 

result from any unit shutdown. In this context, a unit shutdown is defined 

as a change in MODE or other specified condition in the Applicability 

associated with transitioning from MODE 1 to MODE 2, MODE 2 to 

MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5. 

Upon entry into a MODE or other specified condition in the Applicability 

with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the 

applicable Conditions and Required Actions until the Condition is 

resolved, until the LCO is met, or until the unit is not within the 

Applicability of the Technical Specification. 

Surveillances do not have to be performed on the associated inoperable 

equipment (or on variables outside the specified limits), as permitted by 

SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or 

SR 3.0.4 for any Surveillances that have not been performed on 

inoperable equipment. However, SRs must be met to ensure 

OPERABILITY prior to declaring the associated equipment OPERABLE 

(or variable within limits) and restoring compliance with the affected LCO. 

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service 

under administrative controls when it has been removed from service or 

declared inoperable to comply with ACTIONS. The sole purpose of this 

Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply 

with the applicable Required Action(s)) to allow the performance of 

required testing to demonstrate either: 

a. The OPERABILITY of the equipment being returned to service or 

b. The OPERABILITY of other equipment. 

The administrative controls ensure the time the equipment is returned to 

service in conflict with the requirements of the ACTIONS is limited to the 

time absolutely necessary to perform the required testing to demonstrate 

OPERABILITY. This Specification does not provide time to perform any 

other preventive or corrective maintenance. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-8 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.5 (continued) 

An example of demonstrating the OPERABILITY of other equipment is 

taking an inoperable channel or trip system out of the tripped condition to 

prevent the trip function from occurring during the performance of 

required testing on another channel in the other trip system. A similar 

example of demonstrating the OPERABILITY of other equipment is taking 

an inoperable channel or trip system out of the tripped condition to permit 

the logic to function and indicate the appropriate response during the 

performance of required testing on another channel in the same trip 

system. 

LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that 

have an LCO specified in the Technical Specifications (TS). This 

exception is provided because LCO 3.0.2 would require that the 

Conditions and Required Actions of the associated inoperable supported 

system LCO be entered solely due to the inoperability of the support 

system. This exception is justified because the actions that are required 

to ensure the unit is maintained in a safe condition are specified in the 

support system LCO's Required Actions. These Required Actions may 

include entering the supported system's Conditions and Required Actions 

or may specify other Required Actions. 

When a support system is inoperable and there is an LCO specified for it 

in the TS, the supported system(s) are required to be declared inoperable 

if determined to be inoperable as a result of the support system 

inoperability. However, it is not necessary to enter into the supported 

systems' Conditions and Required Actions unless directed to do so by the 

support system's Required Actions. The potential confusion and 

inconsistency of requirements related to the entry into multiple support 

and supported systems' LCOs' Conditions and Required Actions are 

eliminated by providing all the actions that are necessary to ensure the 

unit is maintained in a safe condition in the support system's Required 

Actions. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-9 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.6 (continued) 

However, there are instances where a support system's Required Action 

may either direct a supported system to be declared inoperable or direct 

entry into Conditions and Required Actions for the supported system. 

This may occur immediately or after some specified delay to perform 

some other Required Action. Regardless of whether it is immediate or 

after some delay, when a support system's Required Action directs a 

supported system to be declared inoperable or directs entry into 

Conditions and Required Actions for a supported system, the applicable 

Conditions and Required Actions shall be entered in accordance with 

LCO 3.0.2. 

Specification 5.5.15, "Safety Function Determination Program (SFDP)," 

ensures loss of safety function is detected and appropriate actions are 

taken. Upon entry into LCO 3.0.6, an evaluation shall be made to 

determine if loss of safety function exists. Additionally, other limitations, 

remedial actions, or compensatory actions may be identified as a result of 

the support system inoperability and corresponding exception to entering 

supported system Conditions and Required Actions. The SFDP 

implements the requirements of LCO 3.0.6. 

Cross train checks to identify a loss of safety function for those support 

systems that support multiple and redundant safety systems are required. 

The cross train check verifies that the supported systems of the remaining 

OPERABLE support systems are OPERABLE, thereby ensuring safety 

function is retained. [ A loss of safety function may exist when a support 

system is inoperable, and: 

a. A required system redundant to system(s) supported by the 

inoperable support system is also inoperable (EXAMPLE B 3.0.6-1), 

b. A required system redundant to system(s) in turn supported by the 

inoperable supported system is also inoperable (EXAMPLE 

B 3.0.6-2), or 

c. A required system redundant to support system(s) for the supported 

systems (a) and (b) above is also inoperable (EXAMPLE B 3.0.6-3). 

EXAMPLE B 3.0.6-1

If System 2 of Train A is inoperable and System 5 of Train B is 

inoperable, a loss of safety function exists in supported System 5. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-10 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.6 (continued) 

EXAMPLE B 3.0.6-2

If System 2 of Train A is inoperable, and System 11 of Train B is 

inoperable, a loss of safety function exists in System 11 which is in turn 

supported by System 5. 

EXAMPLE B 3.0.6-3

If System 2 of Train A is inoperable, and System 1 of Train B is 

inoperable, a loss of safety function exists in Systems 2, 4, 5, 8, 9, 10 and 

11. ] 

If this evaluation determines that a loss of safety function exists, the 

appropriate Conditions and Required Actions of the LCO in which the loss 

of safety function exists are required to be entered. 

[ Figure B 3.0-1 

Configuration of Trains and Systems ]
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-11 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.6 (continued) 

This loss of safety function does not require the assumption of additional 

single failures or loss of offsite power. Since operations is being 

restricted in accordance with the ACTIONS of the support system, any 

resulting temporary loss of redundancy or single failure protection is taken 

into account. Similarly, the ACTIONS for inoperable offsite circuit(s) and 

inoperable diesel generator(s) provide the necessary restriction for cross 

train inoperabilities. This explicit cross train verification for inoperable AC 

electrical power sources also acknowledges that supported system(s) are 

not declared inoperable solely as a result of inoperability of a normal or 

emergency electrical power source (refer to the definition of 

OPERABILITY). 

When loss of safety function is determined to exist, and the SFDP 

requires entry into the appropriate Conditions and Required Actions of the 

LCO in which the loss of safety function exists, consideration must be 

given to the specific type of function affected. Where a loss of function is 

solely due to a single Technical Specification support system (e.g., loss of 

automatic start due to inoperable instrumentation, or loss of pump suction 

source due to low tank level) the appropriate LCO is the LCO for the 

support system. The ACTIONS for a support system LCO adequately 

addresses the inoperabilities of that system without reliance on entering 

its supported system LCO. When the loss of function is the result of 

multiple support systems, the appropriate LCO is the LCO for the 

supported system. 

LCO 3.0.7 There are certain special tests and operations required to be performed at 

various times over the life of the unit. These special tests and operations 

are necessary to demonstrate select unit performance characteristics, to 

perform special maintenance activities, and to perform special evolutions. 

Test Exception LCOs [3.1.8, 3.1.9, and 3.4.19] allow specified Technical 

Specification (TS) requirements to be changed to permit performances of 

these special tests and operations, which otherwise could not be 

performed if required to comply with the requirements of these TS. 

Unless otherwise specified, all the other TS requirements remain 

unchanged. This will ensure all appropriate requirements of the MODE or 

other specified condition not directly associated with or required to be 

changed to perform the special test or operation will remain in effect. 
LCO APPLICABILITY 

B 3.0 

BWOG STS B 3.0-12 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.7 (continued) 

The Applicability of a Test Exception LCO represents a condition not 

necessarily in compliance with the normal requirements of the TS. 

Compliance with Test Exception LCOs is optional. A special operation 

may be performed either under the provisions of the appropriate Test 

Exception LCO or under the other applicable TS requirements. If it is 

desired to perform the special operation under the provisions of the Test 

Exception LCO, the requirements of the Test Exception LCO shall be 

followed. 
SR Applicability 

B 3.0 

BWOG STS B 3.0-13 Rev. 3.0, 03/31/04 

B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY 

BASES 

SRs SR 3.0.1 through SR 3.0.4 establish the general requirements applicable 

to all Specifications and apply at all times, unless otherwise stated. 

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the 

MODES or other specified conditions in the Applicability for which the 

requirements of the LCO apply, unless otherwise specified in the 

individual SRs. This Specification is to ensure that Surveillances are 

performed to verify the OPERABILITY of systems and components, and 

that variables are within specified limits. Failure to meet a Surveillance 

within the specified Frequency, in accordance with SR 3.0.2, constitutes a 

failure to meet an LCO. Surveillances may be performed by means of 

any series of sequential, overlapping, or total steps provided the entire 

Surveillance is performed within the specified Frequency. Additionally, 

the definitions related to instrument testing (e.g., CHANNEL 

CALIBRATION) specify that these tests are performed by means of any 

series of sequential, overlapping, or total steps. 

Systems and components are assumed to be OPERABLE when the 

associated SRs have been met. Nothing in this Specification, however, is 

to be construed as implying that systems or components are OPERABLE 

when: 

a. The systems or components are known to be inoperable, although 

still meeting the SRs or 

b. The requirements of the Surveillance(s) are known to be not met 

between required Surveillance performances. 

Surveillances do not have to be performed when the unit is in a MODE or 

other specified condition for which the requirements of the associated 

LCO are not applicable, unless otherwise specified. The SRs associated 

with a Special Test Exception (STE) LCO are only applicable when the 

STE LCO is used as an allowable exception to the requirements of a 

Specification. 

Unplanned events may satisfy the requirements (including applicable 

acceptance criteria) for a given SR. In this case, the unplanned event 

may be credited as fulfilling the performance of the SR. This allowance 

includes those SRs whose performance is normally precluded in a given 

MODE or other specified condition. 
SR Applicability 

B 3.0 

BWOG STS B 3.0-14 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.1 (continued) 

Surveillances, including Surveillances invoked by Required Actions, do 

not have to be performed on inoperable equipment because the 

ACTIONS define the remedial measures that apply. Surveillances have 

to be met and performed in accordance with SR 3.0.2, prior to returning 

equipment to OPERABLE status. 

Upon completion of maintenance, appropriate post maintenance testing is 

required to declare equipment OPERABLE. This includes ensuring 

applicable Surveillances are not failed and their most recent performance 

is in accordance with SR 3.0.2. Post maintenance testing may not be 

possible in the current MODE or other specified conditions in the 

Applicability due to the necessary unit parameters not having been 

established. In these situations, the equipment may be considered 

OPERABLE provided testing has been satisfactorily completed to the 

extent possible and the equipment is not otherwise believed to be 

incapable of performing its function. This will allow operation to proceed 

to a MODE or other specified condition where other necessary post 

maintenance tests can be completed. 

Some examples of this process are: 

a. Emergency feedwater (EFW) pump turbine maintenance during 

refueling that requires testing at steam pressures > 800 psi. 

However, if other appropriate testing is satisfactorily completed, the 

EFW System can be considered OPERABLE. This allows startup 

and other necessary testing to proceed until the plant reaches the 

steam pressure required to perform the EFW pump testing. 

b. High pressure injection (HPI) maintenance during shutdown that 

requires system functional tests at a specified pressure. Provided 

other appropriate testing is satisfactorily completed, startup can 

proceed with HPI considered OPERABLE. This allows operation to 

reach the specified pressure to complete the necessary post 

maintenance testing. 

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified 

Frequency for Surveillances and any Required Action with a Completion 

Time that requires the periodic performance of the Required Action on a 

"once per ..." interval. 

SR 3.0.2 permits a 25% extension of the interval specified in the 

Frequency. This extension facilitates Surveillance scheduling and 

considers plant operating conditions that may not be suitable for 

conducting the Surveillance (e.g., transient conditions or other ongoing 

Surveillance or maintenance activities). 
SR Applicability 

B 3.0 

BWOG STS B 3.0-15 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.2 (continued) 

The 25% extension does not significantly degrade the reliability that 

results from performing the Surveillance at its specified Frequency. This 

is based on the recognition that the most probable result of any particular 

Surveillance being performed is the verification of conformance with the 

SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 

25% extension of the interval specified in the Frequency does not apply. 

These exceptions are stated in the individual Specifications. The 

requirements of regulations take precedence over the TS. An example of 

where SR 3.0.2 does not apply is in the Containment Leakage Rate 

Testing Program. This program establishes testing requirements and 

Frequencies in accordance with the requirements of regulations. The TS 

cannot in and of themselves extend a test interval specified in the 

regulations. 

As stated in SR 3.0.2, the 25% extension also does not apply to the initial 

portion of a periodic Completion Time that requires performance on a 

"once per ..." basis. The 25% extension applies to each performance 

after the initial performance. The initial performance of the Required 

Action, whether it is a particular Surveillance or some other remedial 

action, is considered a single action with a single Completion Time. One 

reason for not allowing the 25% extension to this Completion Time is that 

such an action usually verifies that no loss of function has occurred by 

checking the status of redundant or diverse components or accomplishes 

the function of the inoperable equipment in an alternative manner. 

The provisions of SR 3.0.2 are not intended to be used repeatedly merely 

as an operational convenience to extend Surveillance intervals (other 

than those consistent with refueling intervals) or periodic Completion 

Time intervals beyond those specified. 

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment 

inoperable or an affected variable outside the specified limits when a 

Surveillance has not been completed within the specified Frequency. A 

delay period of up to 24 hours or up to the limit of the specified 

Frequency, whichever is greater, applies from the point in time that it is 

discovered that the Surveillance has not been performed in accordance 

with SR 3.0.2, and not at the time that the specified Frequency was not 

met. 
SR Applicability 

B 3.0 

BWOG STS B 3.0-16 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.3 (continued) 

This delay period provides an adequate time to complete Surveillances 

that have been missed. This delay period permits the completion of a 

Surveillance before complying with Required Actions or other remedial 

measures that might preclude completion of the Surveillance. 

The basis for this delay period includes consideration of unit conditions, 

adequate planning, availability of personnel, the time required to perform 

the Surveillance, the safety significance of the delay in completing the 

required Surveillance, and the recognition that the most probable result of 

any particular Surveillance being performed is the verification of 

conformance with the requirements. 

When a Surveillance with a Frequency based not on time intervals, but 

upon specified unit conditions, operating situations, or requirements of 

regulations (e.g., prior to entering MODE 1 after each fuel loading, or in 

accordance with 10 CFR 50, Appendix J, as modified by approved 

exemptions, etc.) is discovered to not have been performed when 

specified, SR 3.0.3 allows for the full delay period of up to the specified 

Frequency to perform the Surveillance. However, since there is not a 

time interval specified, the missed Surveillance should be performed at 

the first reasonable opportunity. 

SR 3.0.3 provides a time limit for, and allowances for the performance of, 

Surveillances that become applicable as a consequence of MODE 

changes imposed by Required Actions. 

Failure to comply with specified Frequencies for SRs is expected to be an 

infrequent occurrence. Use of the delay period established by SR 3.0.3 is 

a flexibility which is not intended to be used as an operational 

convenience to extend Surveillance intervals. While up to 24 hours or the 

limit of the specified Frequency is provided to perform the missed 

Surveillance, it is expected that the missed Surveillance will be performed 

at the first reasonable opportunity. The determination of the first 

reasonable opportunity should include consideration of the impact on 

plant risk (from delaying the Surveillance as well as any plant 

configuration changes required or shutting the plant down to perform the 

Surveillance) and impact on any analysis assumptions, in addition to unit 

conditions, planning, availability of personnel, and the time required to 

perform the Surveillance. This risk impact should be managed through 

the program in place to implement 10 CFR 50.65(a)(4) and its 

implementation guidance, NRC Regulatory Guide 1.182, “Assessing and 

Managing Risk Before Maintenance Activities at Nuclear Power Plants.” 

This Regulatory Guide addresses consideration of temporary and 
SR Applicability 

B 3.0 

BWOG STS B 3.0-17 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.3 (continued) 

aggregate risk impacts, determination of risk management action 

thresholds, and risk management action up to and including plant 

shutdown. The missed Surveillance should be treated as an emergent 

condition as discussed in the Regulatory Guide. The risk evaluation may 

use quantitative, qualitative, or blended methods. The degree of depth 

and rigor of the evaluation should be commensurate with the importance 

of the component. Missed Surveillances for important components 

should be analyzed quantitatively. If the results of the risk evaluation 

determine the risk increase is significant, this evaluation should be used 

to determine the safest course of action. All missed Surveillances will be 

placed in the licensee’s Corrective Action Program. 

If a Surveillance is not completed within the allowed delay period, then 

the equipment is considered inoperable or the variable is considered 

outside the specified limits and the Completion Times of the Required 

Actions for the applicable LCO Conditions begin immediately upon 

expiration of the delay period. If a Surveillance is failed within the delay 

period, then the equipment is inoperable, or the variable is outside the 

specified limits and the Completion Times of the Required Actions for the 

applicable LCO Conditions begin immediately upon the failure of the 

Surveillance. 

Completion of the Surveillance within the delay period allowed by this 

Specification, or within the Completion Time of the ACTIONS, restores 

compliance with SR 3.0.1. 

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met 

before entry into a MODE or other specified condition in the Applicability. 

This Specification ensures that system and component OPERABILITY 

requirements and variable limits are met before entry into MODES or 

other specified conditions in the Applicability for which these systems and 

components ensure safe operation of the unit. The provisions of this 

Specification should not be interpreted as endorsing the failure to 

exercise the good practice of restoring systems or components to 

OPERABLE status before entering an associated MODE or other 

specified condition in the Applicability. 

A provision is included to allow entry into a MODE or other specified 

condition in the Applicability when an LCO is not met due to a 

Surveillance not being met in accordance with LCO 3.0.4. 
SR Applicability 

B 3.0 

BWOG STS B 3.0-18 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.4 (continued) 

However, in certain circumstances, failing to meet an SR will not result in 

SR 3.0.4 restricting a MODE change or other specified condition change. 

When a system, subsystem, division, component, device, or variable is 

inoperable or outside its specified limits, the associated SR(s) are not 

required to be performed, per SR 3.0.1, which states that surveillances do 

not have to be performed on inoperable equipment. When equipment is 

inoperable, SR 3.0.4 does not apply to the associated SR(s) since the 

requirement for the SR(s) to be performed is removed. Therefore, failing 

to perform the Surveillance(s) within the specified Frequency does not 

result in an SR 3.0.4 restriction to changing MODES or other specified 

conditions of the Applicability. However, since the LCO is not met in this 

instance, LCO 3.0.4 will govern any restrictions that may (or may not) 

apply to MODE or other specified condition changes. SR 3.0.4 does not 

restrict changing MODES or other specified conditions of the Applicability 

when a Surveillance has not been performed within the specified 

Frequency, provided the requirement to declare the LCO not met has 

been delayed in accordance with SR 3.0.3. 

The provisions of SR 3.0.4 shall not prevent entry into MODES or other 

specified conditions in the Applicability that are required to comply with 

ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent 

changes in MODES or other specified conditions in the Applicability that 

result from any unit shutdown. In this context, a unit shutdown is defined 

as a change in MODE or other specified condition in the Applicability 

associated with transitioning from MODE 1 to MODE 2, MODE 2 to 

MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5. 

The precise requirements for performance of SRs are specified such that 

exceptions to SR 3.0.4 are not necessary. The specific time frames and 

conditions necessary for meeting the SRs are specified in the Frequency, 

in the Surveillance, or both. This allows performance of Surveillances 

when the prerequisite condition(s) specified in a Surveillance procedure 

require entry into the MODE or other specified condition in the 

Applicability of the associated LCO prior to the performance or completion 

of a Surveillance. A Surveillance that could not be performed until after 

entering the LCO’s Applicability, would have its Frequency specified such 

that it is not "due" until the specific conditions needed are met. 

Alternately, the Surveillance may be stated in the form of a Note, as not 

required (to be met or performed) until a particular event, condition, or 

time has been reached. Further discussion of the specific formats of SRs' 

annotation is found in Section 1.4, Frequency. 
SDM 

B 3.1.1 

BWOG STS B 3.1.1-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.1 SHUTDOWN MARGIN (SDM) 

BASES 

BACKGROUND The reactivity control systems must be redundant and capable of holding 

the reactor core subcritical when shut down under cold conditions 

GDC 26 (Ref. 1). SDM requirements provide sufficient reactivity margin 

to ensure that acceptable fuel design limits will not be exceeded for 

normal shutdown and anticipated operational occurrences (AOOs). In 

MODES 3, 4, and 5, the SDM defines the degree of subcriticality that 

would be obtained immediately following the insertion of all safety and 

regulating rods, assuming the single CONTROL ROD assembly of 

highest reactivity worth is fully withdrawn. 

The system design requires that two independent reactivity control 

systems be provided, and that one of these systems be capable of 

maintaining the core subcritical under cold conditions. These 

requirements are provided by the use of movable control assemblies and 

soluble boric acid in the Reactor Coolant System (RCS). The CONTROL 

RODS can compensate for the reactivity effects of the fuel and water 

temperature changes accompanying power level changes over the range 

from full load to no load. In addition, the CONTROL RODS, together with 

the Chemical Addition and Makeup System, provide SDM during power 

operation and are capable of making the core subcritical rapidly enough 

to prevent exceeding acceptable fuel damage limits, assuming that the 

rod of highest reactivity worth remains fully withdrawn. 

The Chemical Addition and Makeup System can compensate for fuel 

depletion, during operation and all xenon burnout reactivity changes, and 

maintain the reactor subcritical under cold conditions. 

During power operation, SDM control is ensured by operating with the 

safety rods fully withdrawn (LCO 3.1.5, "Safety Rod Insertion Limits") and 

the regulating rods within the limits of LCO 3.2.1, "Regulating Rod 

Insertion Limits." When the unit is in the shutdown and refueling modes, 

the SDM requirements are met by means of adjustments to the RCS 

boron concentration. Adjusted SDM limits defined in the COLR preclude 

recriticality in the event of a main steam line break (MSLB) in MODE 3, 4, 

or 5 when high steam generator levels exist. 
SDM 

B 3.1.1 

BWOG STS B 3.1.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The minimum required SDM is assumed as an initial condition in safety 

SAFETY analysis. The safety analysis (Ref. 2) establishes an SDM that ensures 

ANALYSES specified acceptable fuel design limits are not exceeded for normal 

operation and AOOs, with assumption of the highest worth rod stuck out 

following a reactor trip. 

The acceptance criteria for SDM requirements are that specified 

acceptable fuel design limits are maintained. The SDM requirements 

must ensure that: 

a. The reactor can be made subcritical from all operating conditions, 

transients, and Design Basis Events, 

b. The reactivity transients associated with postulated accident 

conditions are controllable with acceptable limits (departure from 

nucleate boiling ratio (DNBR), fuel centerline temperature limits for 

AOOs, and ≤ 280 cal/gm energy deposition for the rod ejection 

accident), and 

c. The reactor will be maintained sufficiently subcritical to preclude 

inadvertent criticality in the shutdown condition. 

The most limiting accident for the SDM requirements is based on an 

MSLB, as described in the accident analysis (Ref. 2). 

In addition to the limiting MSLB transient, the SDM requirement must also 

protect against: 

a. Inadvertent boron dilution, 

b. An uncontrolled rod withdrawal from a subcritical or low power 

condition, 

c. Startup of an inactive reactor coolant pump, 

d. Rod ejection, and 

e. Return to criticality if an MSLB occurs during high steam generator 

level operations in MODE 3, 4, or 5. 
SDM 

B 3.1.1 

BWOG STS B 3.1.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The basis for the shutdown requirement when high steam generator 

levels exist is the heat removal potential in the secondary system fluid 

and the negative reactivity added via MTC. At any given initial primary 

system temperature and its associated secondary system pressure, the 

secondary system liquid levels can be equated to a final primary system 

temperature assuming the entire mass is boiled. The resulting RCS 

temperature determines the required SDM. 

SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO Shutdown boron concentration requirements assume the highest worth 

rod is stuck in the fully withdrawn position to account for a postulated 

inoperable or untrippable rod prior to reactor shutdown. 

SDM is a core design condition that can be ensured through CONTROL 

ROD positioning (control and shutdown groups) and through the soluble 

boron concentration. 

The MSLB (Ref. 2) accident is the most limiting analysis that establishes 

the SDM value of the LCO. 

For MSLB accidents, if the LCO is violated, there is a potential to exceed 

the DNBR limit and to exceed 10 CFR 100 limits (Ref. 3). 

To compensate for the potential heat removal associated with an MSLB 

accident when high steam generator levels exist during secondary system 

chemistry control and steam generator cleaning, the initial SDM in the 

core must be adjusted. The Figure in the COLR represents a series of 

initial conditions that ensure the core will remain subcritical following an 

MSLB accident from those conditions. 

APPLICABILITY In MODES 3, 4, and 5, the SDM requirements are applicable to provide 

sufficient negative reactivity to meet the assumptions of the safety 

analysis discussed above. The Figure in the COLR is used to define the 

SDM when high steam generator levels exist during secondary system 

chemistry control and steam generator cleaning in MODES 3, 4, and 5. 

In MODES 1 and 2, SDM is ensured by complying with LCO 3.1.5 and 

LCO 3.2.1. In MODE 6, the shutdown reactivity requirements are given in 

LCO 3.9.1, "Boron Concentration." 
SDM 

B 3.1.1 

BWOG STS B 3.1.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

If the SDM requirements are not met, boration must be initiated promptly. 

A Completion Time of 15 minutes is adequate for an operator to correctly 

align and start the required systems and components. It is assumed that 

boration will be continued until the SDM requirements are met. If the 

SDM is below the limit for the steam generator level and RCS 

temperature specified in the COLR, RCS boration must be continued until 

the limit specified in the COLR is met. 

In the determination of the required combination of boration flow rate and 

boron concentration, there is no unique requirement that must be 

satisfied. Since it is imperative to raise the boron concentration of the 

RCS as soon as possible, the boron concentration should be a highly 

concentrated solution, such as that normally found in the boric acid 

storage tank or the borated water storage tank. The operator should 

borate with the best source available for the plant conditions. 

In determining the boration flow rate, the time in core life must be 

considered. For instance, the most difficult time in core life to increase 

the RCS boron concentration is at the beginning of cycle, when the boron 

concentration may approach or exceed 2000 ppm. Assuming that a value 

of [1]% ∆k/k must be recovered and a boration flow rate is [ ] gpm, it is 

possible to increase the boron concentration of the RCS by 100 ppm in 

approximately 35 minutes. If a boron worth of 10 pcm/ppm is assumed, 

this combination of parameters will increase the SDM by [1]% ∆k/k. 

These boration parameters of [ ] gpm and [ ] ppm represent typical 

values and are provided for the purpose of offering a specific example. 

SURVEILLANCE SR 3.1.1.1

REQUIREMENTS 

The SDM is verified by performing a reactivity balance calculation, 

considering the listed reactivity effects: 

a. RCS boron concentration, 

b. Regulating rod position, 

c. RCS average temperature, 

d. Fuel burnup based on gross thermal energy generation, 

e. Xenon concentration, 
SDM 

B 3.1.1 

BWOG STS B 3.1.1-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

f. Samarium concentration, and 

g. Isothermal temperature coefficient (ITC). 

Using the ITC accounts for Doppler reactivity in this calculation because 

the reactor is subcritical, and the fuel temperature will be changing at the 

same rate as the RCS. 

The Frequency of 24 hours is based on the generally slow change in 

required boron concentration, and also allows sufficient time for the 

operator to collect the required data, which includes performing a boron 

concentration analysis, and complete the calculation. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 

 2. FSAR, Chapter [14]. 

 3. 10 CFR 100, "Reactor Site Criteria." 
Reactivity Balance 

B 3.1.2 

BWOG STS B 3.1.2-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.2 Reactivity Balance 

BASES 

BACKGROUND According to GDC 26, GDC 28, and GDC 29 (Ref. 1), reactivity shall be 

controllable, such that subcriticality is maintained under cold conditions, 

and acceptable fuel design limits are not exceeded during normal 

operation and anticipated operational occurrences. Therefore, the 

reactivity balance is used as a measure of the predicted versus measured 

core reactivity during power operation. The periodic confirmation of core 

reactivity is necessary to ensure that safety analyses of design basis 

transients and accidents remain valid. A large reactivity difference could 

be the result of unanticipated changes in fuel, CONTROL ROD, or 

burnable poison worth, or operation at conditions not consistent with 

those assumed in the predictions of core reactivity. These could 

potentially result in a loss of SDM or violation of acceptable fuel design 

limits. Comparing predicted versus measured core reactivity validates the 

nuclear methods used in the safety analysis and supports the SDM 

demonstrations (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") in ensuring 

the reactor can be brought safely to cold, subcritical conditions. 

When the reactor core is critical or in normal power operation, a reactivity 

balance exists and the net reactivity is zero. A comparison of predicted 

and measured reactivity is convenient under such a balance, since 

parameters are being maintained relatively stable under steady state 

power conditions. The positive reactivity inherent in the core design is 

balanced by the negative reactivity of the control components, thermal 

feedback, neutron leakage, and materials in the core that absorb 

neutrons, such as burnable absorbers, producing zero net reactivity. 

Excess reactivity can be inferred from the boron letdown curve (or critical 

boron curve), which provides an indication of the soluble boron 

concentration in the Reactor Coolant System (RCS) versus cycle burnup. 

Periodic measurement of the RCS boron concentration for comparison 

with the predicted value with other variables fixed, (such as rod height, 

temperature, pressure, and power), provides a convenient method of 

ensuring that core reactivity is within design expectations, and that the 

calculational models used to generate the safety analysis are adequate. 
Reactivity Balance 

B 3.1.2 

BWOG STS B 3.1.2-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

In order to achieve the required fuel cycle energy output, the uranium 

enrichment in the new fuel loading and the fuel remaining from the 

previous cycle provides excess positive reactivity beyond that required to 

sustain steady state operation throughout the cycle. When the reactor is 

critical at RTP and moderator temperature, the excess positive reactivity 

is compensated by burnable absorbers (if any), CONTROL RODS, 

whatever neutron poisons (mainly xenon and samarium) are present in 

the fuel, and the RCS boron concentration. 

When the core is producing THERMAL POWER, the fuel is being 

depleted and excess reactivity is decreasing. As the fuel depletes, the 

RCS boron concentration is reduced to decrease negative reactivity and 

maintain constant THERMAL POWER. The boron letdown curve is 

based on steady state operation at RTP. Therefore, deviations from the 

predicted boron letdown curve may indicate deficiencies in the design 

analysis, deficiencies in the calculational models, or abnormal core 

conditions, and must be evaluated. 

APPLICABLE The acceptance criteria for core reactivity are the establishment of 

SAFETY the reactivity balance limit to ensure that plant operation is maintained 

ANALYSES within the assumptions of the safety analyses. 

Accurate prediction of core reactivity is either an explicit or implicit 

assumption in the accident analysis evaluations. Every accident 

evaluation (Ref. 2) is, therefore, dependent upon accurate evaluation of 

core reactivity. In particular, SDM and reactivity transients, such as 

CONTROL ROD withdrawal accidents or rod ejection accidents, are very 

sensitive to accurate prediction of core reactivity. These accident 

analysis evaluations rely on computer codes which have been qualified 

against available test data, operating plant data, and analytical 

benchmarks. Monitoring reactivity balance ensures that the nuclear 

methods provide an accurate representation of the core reactivity. 

Design calculations and safety analyses are performed for each fuel cycle 

for the purpose of predetermining reactivity behavior and the RCS boron 

concentration requirements for reactivity control during fuel depletion. 

The comparison between measured and predicted initial core reactivity 

provides a normalization for the calculational models used to predict core 

reactivity. If the measured and predicted RCS boron concentrations for 

identical core conditions at beginning of cycle (BOC) do not agree, then 

the assumptions used in the reload cycle design analysis or the 
Reactivity Balance 

B 3.1.2 

BWOG STS B 3.1.2-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

calculational models used to predict soluble boron requirements may not 

be accurate. If reasonable agreement between measured and predicted 

core reactivity exists at BOC, then the prediction may be normalized to 

the measured boron concentration. Thereafter, any significant deviations 

in the measured boron concentration from the predicted boron letdown 

curve, which is developed during fuel depletion, may be an indication that 

the calculational model is not adequate for core burnups beyond BOC, or 

that an unexpected change in core conditions has occurred. 

The normalization of predicted RCS boron concentration to the measured 

value is typically performed after reaching RTP following startup from a 

refueling outage, with the CONTROL RODS in their normal positions for 

power operation. The normalization is performed at BOC conditions, so 

that core reactivity relative to predicted values can be continually 

monitored and evaluated, as core conditions change during the cycle. 

Reactivity balance satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO Long term core reactivity behavior is a result of the core physics design 

and cannot be easily controlled, once the core design is fixed. During 

operation, therefore, the conditions of the LCO can only be ensured 

through measurement and tracking, and appropriate actions taken as 

necessary. Large differences between actual and predicted core 

reactivity may indicate that the assumptions of the Design Basis Accident 

(DBA) and transient analyses are no longer valid, or that the uncertainties 

in the nuclear design methodology are larger than expected. A limit on 

the reactivity of ± 1% ∆k/k has been established, based on engineering 

judgment. A ± 1% ∆k/k deviation in reactivity from that predicted is larger 

than expected for normal operation and should therefore be evaluated. 

When measured core reactivity is within 1% ∆k/k of the predicted value at 

steady state thermal conditions, the core is considered to be operating 

within acceptable design limits. Since deviations from the limit are 

normally detected by comparing predicted and measured steady state 

RCS critical boron concentrations, the difference between measured and 

predicted values would be approximately 100 ppm (depending on the 

boron worth) before the limit is reached. These values are well within the 

uncertainty limits for analysis of boron concentration samples, so that 

spurious violations of the limit due to uncertainty in measuring the RCS 

boron concentration are unlikely. 
Reactivity Balance 

B 3.1.2 

BWOG STS B 3.1.2-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1 and 2 during fuel cycle operation with keff ≥ 1, the limits on 

core reactivity must be maintained because a reactivity balance must 

exist when the reactor is critical or producing THERMAL POWER. As the 

fuel depletes, core conditions are changing, and confirmation of the 

reactivity balance ensures the core is operating as designed. 

This Specification does not apply in MODES 3, 4, and 5, because the 

reactor is shutdown and changes to core reactivity due to fuel depletion 

cannot occur. 

In MODE 6, fuel loading results in a continually changing core reactivity. 

Boron concentration requirements (LCO 3.9.1, "Refueling Boron 

Concentration") ensure that fuel movements are performed within the 

bounds of the safety analysis, and an SDM demonstration is required 

during the first startup following operations that could have altered core 

reactivity (e.g., fuel movement or CONTROL ROD replacement or 

shuffling). 

ACTIONS A.1 and A.2

Should an anomaly develop between measured and predicted core 

reactivity, an evaluation of the core design and safety analysis must be 

performed. Core conditions are evaluated to determine their consistency 

with input to design calculations. Measured core and process parameters 

are evaluated to determine that they are within the bounds of the safety 

analysis, and safety analysis calculational models are reviewed to verify 

that they are adequate for representation of the core conditions. The 

required Completion Time of 7 days is based on the low probability of a 

DBA occurring during this period, and allows sufficient time to assess the 

physical condition of the reactor and complete the evaluation of the core 

design and safety analysis. 

Following evaluations of the core design and safety analysis, the cause of 

the reactivity anomaly may be resolved. If the cause of the reactivity 

anomaly is a mismatch in core conditions at the time of RCS boron 

concentration sampling, then a recalculation of the RCS boron 

concentration requirements may be performed to demonstrate that core 

reactivity is behaving as expected. If an unexpected physical change in 

the condition of the core has occurred, it must be evaluated and 

corrected, if possible. If the cause of the reactivity anomaly is in the 

calculation technique, then the calculational models must be revised to 

provide more accurate predictions. If any of these results are 
Reactivity Balance 

B 3.1.2 

BWOG STS B 3.1.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

demonstrated, and it is concluded that the reactor core is acceptable for 

continued operation, then the boron letdown curve may be renormalized, 

and power operation may continue. If operational restrictions or 

additional surveillance requirements are necessary to ensure the reactor 

core is acceptable for continued operation, then they must be defined. 

The required Completion Time of 7 days is adequate for preparing 

operating restrictions or surveillances that may be required to allow 

continued reactor operation. 

B.1

If the core reactivity cannot be restored to within the 1% ∆k/k limit, the unit 

must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the unit must be brought to at least MODE 3 within 

6 hours. If the SDM for MODE 3 is not met, then boration required by 

Required Action A.1 of LCO 3.1.1 would occur. The allowed Completion 

Time of 6 hours is reasonable, based on operating experience to reach 

the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 

SURVEILLANCE SR 3.1.2.1

REQUIREMENTS 

Core reactivity is verified by periodic comparisons of measured and 

predicted RCS boron concentrations. The comparison is made 

considering that other core conditions are fixed or stable, including 

CONTROL ROD positions, moderator temperature, fuel temperature, fuel 

depletion, xenon concentration, and samarium concentration. The 

Surveillance is performed prior to entering MODE 1 as an initial check on 

core conditions and design calculations at BOC. A Note is included in the 

SR to indicate that the normalization of predicted core reactivity to the 

measured value must take place within the first 60 effective full power 

days (EFPD) after each fuel loading. This allows sufficient time for core 

conditions to reach steady state, but prevents operation for a large 

fraction of the fuel cycle without establishing a benchmark for the design 

calculations. The required subsequent Frequency of 31 EFPD, following 

the initial 60 EFPD after entering MODE 1 is acceptable, based on the 

slow rate of core reactivity changes due to fuel depletion and the 

presence of other indicators (QPT, etc.) for prompt indication of an 

anomaly. Another Note is included in the SRs to indicate that the 

performance of the Surveillance is not required for entry into MODE 2. 
Reactivity Balance 

B 3.1.2 

BWOG STS B 3.1.2-6 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29. 

 2. FSAR, Chapter [14]. 
MTC 

B 3.1.3 

BWOG STS B 3.1.3-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.3 Moderator Temperature Coefficient (MTC) 

BASES 

BACKGROUND According to GDC 11 (Ref. 1), the reactor core and its interaction with the 

Reactor Coolant System (RCS) must be designed for inherently stable 

power operation, even in the possible event of an accident. In particular, 

the net reactivity feedback in the system must compensate for any 

unintended reactivity increases. 

The MTC relates a change in core reactivity to a change in reactor 

coolant temperature (a positive MTC means that reactivity increases with 

increasing moderator temperature; conversely, a negative MTC means 

that reactivity decreases with increasing moderator temperature). The 

reactor is designed to operate with a negative MTC over the largest 

possible range of fuel cycle operation. Therefore, a coolant temperature 

increase will cause a reactivity decrease, so that the coolant temperature 

tends to return toward its initial value. Reactivity increases that cause a 

coolant temperature increase will thus be self limiting, and stable power 

operation will result. The same characteristic is true when the MTC is 

positive and coolant temperature decreases occur. 

MTC values are predicted at selected burnups during the safety 

evaluation analysis and are confirmed to be acceptable by 

measurements. Both initial and reload cores are designed so that the 

beginning of cycle (BOC) MTC is less than zero when THERMAL 

POWER is 95% RTP or greater. The actual value of the MTC is 

dependent on core characteristics, such as fuel loading and reactor 

coolant soluble boron concentration. The core design may require 

additional burnable absorbers to yield an MTC at BOC within the range 

analyzed in the plant accident analysis. The end of cycle (EOC) MTC is 

also limited by the requirements of the accident analysis. Fuel cycles that 

are designed to achieve high burnups or that have changes to other 

characteristics are evaluated to ensure the MTC does not exceed the 

EOC limit. 

APPLICABLE Reference 2 contains analyses of accidents that result in both 

SAFETY overheating and overcooling of the reactor core. MTC is one of the 

ANALYSES controlling parameters for core reactivity in these accidents. Both the 

most positive value and most negative value of the MTC are initial 

conditions in the safety analyses, and both values must be bounded. 

Values used in the analyses consider worst case conditions, such as very 

large soluble boron concentrations, to ensure the accident results are 

bounding (Ref. 3). 
MTC 

B 3.1.3 

BWOG STS B 3.1.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The acceptance criteria for the specified MTC are: 

a. The MTC values must remain within the bounds of those used in the 

accident analysis (Ref. 2) and 

b. The MTC must be such that inherently stable power operations result 

during normal operation and accidents, such as overheating and 

overcooling events. 

Accidents that cause core overheating (either decreased heat removal or 

increased power production) must be evaluated for results when the MTC 

is positive. Reactivity accidents that cause increased power production 

include the CONTROL ROD withdrawal transient from either zero or full 

THERMAL POWER. The limiting overheating event relative to plant 

response is based on the maximum difference between core power and 

steam generator heat removal during a transient. The most limiting event 

with respect to positive MTC is a [rod withdrawal accident from zero 

power, also referred to as a startup accident (Ref. 4)]. 

Accidents that cause core overcooling must be evaluated for results when 

the MTC is most negative. The event that produces the most rapid 

cooldown of the RCS, and is therefore the most limiting event with 

respect to the negative MTC, is a steam line break (SLB) event. 

Following the reactor trip for the postulated EOC SLB event, the large 

moderator temperature reduction, combined with the large negative MTC, 

may produce reactivity increases that are as much as the shutdown 

reactivity. When this occurs, a substantial fraction of core power is 

produced with all CONTROL ROD assemblies inserted, except the most 

reactive one. Even if the reactivity increase produces slightly subcritical 

conditions, a large fraction of core power may be produced through the 

effects of subcritical neutron multiplication. 

MTC values are bounded in reload safety evaluations, assuming steady 

state conditions at BOC and EOC. A near EOC measurement is 

conducted at conditions when the RCS boron concentration reaches 

approximately 300 ppm. The measured value may be extrapolated to 

project the EOC value, in order to confirm reload design predictions. 

MTC satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
MTC 

B 3.1.3 

BWOG STS B 3.1.3-3 Rev. 3.0, 03/31/04 

BASES 

LCO LCO 3.1.3 requires the MTC to be within specified limits in the COLR to 

ensure the core operates within the assumptions of the accident analysis. 

During the reload core safety evaluation, the MTC is analyzed to 

determine that its values remain within the bounds of the original accident 

analysis during operation. The LCO establishes a maximum positive 

value that can not be exceeded. The limit of +0.9E-4 (% ∆k/k)/°F on 

positive MTC, when THERMAL POWER is < 95% RTP, ensures that core 

overheating accidents will not violate the accident analysis assumptions. 

The requirement for a negative MTC, when THERMAL POWER is 

≥ 95% RTP, ensures that core operation will be stable. The negative 

MTC limit for EOC specified in the COLR ensures that core overcooling 

accidents will not violate the accident analysis assumptions. 

MTC is a core physics parameter determined by the fuel and fuel cycle 

design and cannot be easily controlled once the core design is fixed 

during operation, therefore, the LCO can only be ensured through 

measurement. The surveillance checks at BOC and EOC on MTC 

provide confirmation that the MTC is behaving as anticipated, so that the 

acceptance criteria are met. 

APPLICABILITY In MODE 1, the limits on MTC must be maintained to ensure that any 

accident initiated from THERMAL POWER operation will not violate the 

design assumptions of the accident analysis. In MODE 2, the limits must 

also be maintained to ensure that startup and subcritical accidents, such 

as the uncontrolled CONTROL ROD assembly or group withdrawal, will 

not violate the assumptions of the accident analysis. In MODES 3, 4, 5, 

and 6, this LCO is not applicable, since no Design Basis Accidents 

(DBAs) using the MTC as an analysis assumption are initiated from these 

MODES. However, the variation of MTC with temperature in MODES 3, 

4, and 5 for DBAs initiated in MODES 1 and 2 is accounted for in the 

subject accident analysis. The variation of MTC with temperature 

assumed in the safety analysis, is accepted as valid once the BOC and 

middle of cycle measurements are used for normalization. 

ACTIONS A.1

MTC is a function of the fuel and fuel cycle designs, and cannot be 

controlled directly once the designs have been implemented in the core. 

If MTC exceeds its limits, the reactor must be placed in MODE 3. This 

eliminates the potential for violation of the accident analysis bounds. The 

associated Completion Time of 6 hours is reasonable, considering the 

probability of an accident occurring during the time period that would 

require an MTC value within the LCO limits, for reaching MODE 3 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 
MTC 

B 3.1.3 

BWOG STS B 3.1.3-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE The following two SRs for measurement of the MTC at the beginning and 

REQUIREMENTS end of each fuel cycle provide for confirmation of the limiting MTC values. 

The MTC changes slowly from most positive (least negative) to most 

negative value during fuel cycle operation, as the RCS boron 

concentration is reduced with fuel depletion. 

SR 3.1.3.1

The requirement for measurement, prior to initial operation above 

5% RTP, satisfies the confirmatory check on the most positive (least 

negative) MTC value. 

SR 3.1.3.2

The requirement for measurement, within 7 effective full power days 

(EFPD) after reaching an equilibrium boron concentration of 300 ppm for 

RTP, satisfies the confirmatory check on the most negative (least 

positive) MTC value. The measurement is performed at any THERMAL 

POWER equivalent to an RCS boron concentration of 300 ppm (for 

steady state operation at RTP with all CONTROL RODS fully withdrawn) 

so that the projected EOC MTC may be evaluated before the reactor 

actually reaches the EOC condition. MTC values are extrapolated and 

compensated to permit direct comparison to the specified MTC limits. 

The SR is modified by a Note. The Note indicates that SR 3.1.3.2 may be 

repeated, and shutdown must occur, prior to exceeding the minimum 

allowable boron concentration at which MTC is projected to exceed the 

lower limit. The minimum allowable boron concentration is obtained from 

the EOC MTC versus boron concentration slope with appropriate 

conservatisms. Thus, the projected EOC MTC is evaluated before the 

lower limit is actually reached. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 11. 

 2. FSAR, Chapter [14]. 

 3. FSAR, Section [ ] . 

 4. FSAR, Section [ ] . 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.4 CONTROL ROD Group Alignment Limits 

BASES 

BACKGROUND The OPERABILITY (i.e., trippability) of the CONTROL RODS (safety rods 

and regulating rods) is an initial condition assumption in all safety 

analyses that assume rod insertion upon reactor trip. Maximum rod 

misalignment is an initial condition assumption in the safety analysis that 

directly affects core power distributions and assumptions of available 

SDM. 

The applicable criteria for these design requirements are 10 CFR 50, 

Appendix A, GDC 10, "Reactor Design," and GDC 26, "Reactivity Control 

System Redundancy-and Capability" (Ref. 1), and 10 CFR 50.46, 

"Acceptance Criteria for Emergency Core Cooling Systems for Light 

Water Nuclear Power Plants" (Ref. 2). 

Mechanical or electrical failures may cause a CONTROL ROD to become 

inoperable or to become misaligned from its group. CONTROL ROD 

inoperability or misalignment may cause increased power peaking, due to 

the asymmetric reactivity distribution and a reduction in the total available 

rod worth for reactor shutdown. Therefore, CONTROL ROD alignment 

and OPERABILITY are related to core operation within design power 

peaking limits and the core design requirement of a minimum SDM. 

Limits on CONTROL ROD alignment and OPERABILITY have been 

established, and all rod positions are monitored and controlled during 

power operation to ensure that the power distribution and reactivity limits 

defined by the design power peaking and SDM limits are preserved. 

CONTROL RODS are moved by their CONTROL ROD drive mechanisms 

(CRDMs). Each CRDM moves its rod 3⁄4 inch for one revolution of the 

leadscrew, but at varying rates depending on the signal output from the 

Control Rod Drive Control System (CRDCS). 

The CONTROL RODS are arranged into rod groups that are radially 

symmetric. Therefore, movement of the CONTROL RODS does not 

introduce radial asymmetries in the core power distribution. The safety 

rods and the regulating rods provide required reactivity worth for 

immediate reactor shutdown upon a reactor trip. The regulating rods 

provide reactivity (power level) control during normal operation and 

transients, and their movement is normally governed by the automatic 

control system. 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The axial position of safety rods and regulating rods is indicated by two 

separate and independent systems, which are the relative position 

indicator transducers and the absolute position indicator transducers (see 

LCO 3.1.7, "Position Indicator Channels"). 

The relative position indicator transducer is a potentiometer that is driven 

by electrical pulses from the CRDCS. There is one counter for each 

CONTROL ROD drive. Individual rods in a group all receive the same 

signal to move; therefore, the counters for all rods in a group should 

indicate the same position. The Relative Position Indicator System is 

considered highly precise (one rotation of the leadscrew is 3⁄4 inch in rod 

motion). If a rod does not move for each demand pulse, the counter will 

still count the pulse and incorrectly reflect the position of the rod. 

The Absolute Position Indicator System provides a highly accurate 

indication of actual CONTROL ROD position, but at a lower precision 

than relative position indicators. This system is based on inductive 

analog signals from a series of reed switches spaced along a tube with a 

center to center distance of 3.75 inches. 

APPLICABLE CONTROL ROD misalignment and inoperability accidents are analyzed in 

SAFETY the safety analysis (Ref. 3). The acceptance criteria for addressing 

ANALYSES CONTROL ROD inoperability or misalignment are that: 

a. There shall be no violations of: 

1. Specified acceptable fuel design limits or 

2. Reactor Coolant System (RCS) pressure boundary damage and 

b. The core must remain subcritical after accident transients. 

Three types of misalignment are distinguished. During movement of a 

CONTROL ROD group, one rod may stop moving, while the other rods in 

the group continue. This condition may cause excessive power peaking. 

The second type of misalignment occurs if one rod fails to insert upon a 

reactor trip and remains stuck fully withdrawn. This condition requires an 

evaluation to determine that sufficient reactivity worth is held in the 

CONTROL RODS to meet the SDM requirement with the maximum worth 

rod stuck fully withdrawn. If a CONTROL ROD is stuck in the fully 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

withdrawn position, its worth is accounted for in the calculation of SDM, 

since the safety analysis does not take two stuck rods into account. The 

third type of misalignment occurs when one rod drops partially or fully into 

the reactor core. This event causes an initial power reduction followed by 

a return towards the original power due to positive reactivity feedback 

from the negative moderator temperature coefficient. Increased peaking 

during the power increase may result in excessive local linear heat rates 

(LHRs). 

The accident analysis and reload safety evaluations define regulating rod 

insertion limits that ensure the required SDM can always be achieved if 

the maximum worth CONTROL ROD is stuck fully withdrawn (Ref. 4). If a 

CONTROL ROD is stuck in or dropped in, continued operation is 

permitted if the increase in local LHR is within the design limits. The 

Required Action statements in the LCOs provide conservative reductions 

in THERMAL POWER and verification of SDM to ensure continued 

operation remains within the bounds of the safety analysis (Ref. 5). 

Continued operation of the reactor with a misaligned or dropped 

CONTROL ROD is allowed if the FQ(Z) and the H

N F∆ are verified to be 

within their limits in the COLR. When a CONTROL ROD is misaligned, 

the assumptions that are used to determine the regulating rod insertion 

limits, APSR insertion limits, AXIAL POWER IMBALANCE limits, and 

QPT limits are not preserved. Therefore, the limits may not preserve the 

design peaking factors, and FQ(Z) and H

N F∆ must be verified directly by 

incore mapping. Bases Section 3.2, Power Distribution Limits, contains a 

more complete discussion of the relation of FQ(Z) and H N F∆ to the 

operating limits. 

The CONTROL ROD group alignment limits and OPERABILITY 

requirements satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The limits on CONTROL ROD group alignment, safety rod insertion, and 

APSR alignment, together with the limits on regulating rod insertion, 

APSR insertion, AXIAL POWER IMBALANCE, and QPT, ensure the 

reactor will operate within the fuel design criteria. The Required Actions 

in these LCOs ensure that deviations from the alignment limits will either 

be corrected or that THERMAL POWER will be adjusted, so that 

excessive local LHRs will not occur and the requirements on SDM and 

ejected rod worth are preserved. 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The requirements on rod OPERABILITY ensure that upon reactor trip, the 

assumed reactivity will be available and will be inserted. The rod 

OPERABILITY requirements (i.e., trippability) are separate from the 

alignment requirements. The rod OPERABILITY requirement is satisfied 

provided the rod will fully insert in the required rod drop time assumed in 

the safety analysis. Rod control malfunctions that result in the inability to 

move a rod (e.g., rod lift coil failures), but that do not impact trippability, 

do not result in rod inoperability. 

The limit for individual CONTROL ROD misalignment is [6.5]% (9 inches) 

deviation from the group average position. This value is established, 

based on the distance between reed switches, with additional allowances 

for uncertainty in the absolute position indicator amplifiers, group 

maximum or minimum synthesizer, and asymmetric alarm or fault 

detector outputs. The position of an inoperable rod is not included in the 

calculation of the rod group average position. 

Failure to meet the requirements of this LCO may produce unacceptable 

power peaking factors and LHRs, or unacceptable SDM or ejected rod 

worth, all of which may constitute initial conditions inconsistent with the 

safety analysis. 

APPLICABILITY The requirements on CONTROL ROD OPERABILITY and alignment are 

applicable in MODES 1 and 2 because these are the only MODES in 

which neutron (or fission) power is generated, and the OPERABILITY 

(i.e., trippability) and alignment of rods have the potential to affect the 

safety of the plant. In MODES 3, 4, 5, and 6, the alignment limits do not 

apply because the CONTROL RODS are typically bottomed, and the 

reactor is shut down and not producing fission power. In the shutdown 

MODES, the OPERABILITY of the safety and regulating rods has the 

potential to affect the required SDM, but this effect can be compensated 

for by an increase in the boron concentration of the RCS. See LCO 3.1.1, 

"SHUTDOWN MARGIN (SDM)," for SDM in MODES 3, 4, and 5, and 

LCO 3.9.1, "Boron Concentration," for boron concentration requirements 

during refueling. 

ACTIONS A.1

Alignment of the misaligned CONTROL ROD may be accomplished by 

either moving the single CONTROL ROD to the group average position, 

or by moving the remainder of the group to the position of the single 

misaligned CONTROL ROD. Either action can be used to restore the 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

CONTROL RODS to a radially symmetric pattern. However, this must be 

done without violating the CONTROL ROD group sequence, overlap, and 

insertion limits of LCO 3.2.1, "Regulating Rod Insertion Limits," given in 

the COLR. THERMAL POWER must also be restricted, as necessary, to 

the value allowed by the insertion limits of LCO 3.2.1. The required 

Completion Time of 1 hour is acceptable because local xenon 

redistribution during this short interval will not cause a significant increase 

in LHR. This option is not available if a safety rod is misaligned, since the 

limits of LCO 3.1.5, "Safety Rod Insertion Limits," would be violated. 

A.2.1.1

Compliance with Required Actions A.2.1.1 through A.2.5 allows for 

continued power operation with one CONTROL ROD misaligned from its 

group average position. These Required Actions comprise the final 

alternate for Condition A. 

Since the rod may be inserted farther than the group average insertion for 

a long time, SDM must be evaluated. Ensuring the SDM meets the 

minimum requirement within 1 hour is adequate to determine that further 

degradation of the SDM is not occurring. 

A.2.1.2

Restoration of the required SDM requires increasing the RCS boron 

concentration, since the CONTROL ROD may remain misaligned and not 

be providing its normal negative reactivity on tripping. RCS boration must 

occur as described in Bases Section 3.1.1. The required Completion 

Time of 1 hour to initiate boration is reasonable, based on the time 

required for potential xenon redistribution, the low probability of an 

accident occurring, and the steps required to complete the action. This 

allows the operator sufficient time for aligning the required valves and 

starting the boric acid pumps. Boration will continue until the required 

SDM is restored. 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.2.2

Reduction of THERMAL POWER to ≤ 60% ALLOWABLE THERMAL 

POWER ensures that local LHR increases, due to a misaligned rod, will 

not cause the core design criteria to be exceeded. The required 

Completion Time of 2 hours allows the operator sufficient time for 

reducing THERMAL POWER. 

A.2.3

Reduction of the nuclear overpower trip setpoint to ≤ 70% ALLOWABLE 

THERMAL POWER, after THERMAL POWER has been reduced to 60% 

ALLOWABLE THERMAL POWER, maintains both core protection and an 

operating margin at reduced power similar to that at RTP. The required 

Completion Time of 10 hours allows the operator 8 additional hours after 

completion of the THERMAL POWER reduction in Required Action A.2.2 

to adjust the trip setpoint. 

A.2.4

The existing CONTROL ROD configuration must not cause an ejected 

rod to exceed the limit of 0.65% ∆k/k at RTP or 1.00% ∆k/k at zero power 

(Ref. 6). This evaluation may require a computer calculation of the 

maximum ejected rod worth based on nonstandard configurations of the 

CONTROL ROD groups. The evaluation must determine the ejected rod 

worth for the remainder of the fuel cycle to ensure a valid evaluation, 

should fuel cycle conditions at some later time become more bounding 

than those at the time of the rod misalignment. The required Completion 

Time of 72 hours is acceptable because LHRs are limited by the 

THERMAL POWER reduction and sufficient time is provided to perform 

the required evaluation. 

A.2.5

Performance of SR 3.2.5.1 provides a determination of the power peaking 

factors using the Incore Detector System. Verification of the FQ(Z) and 

H N F∆ from an incore power distribution map is necessary to ensure that 

excessive local LHRs will not occur due to CONTROL ROD 

misalignment. This is necessary because the assumption that all 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

CONTROL RODS are aligned (used to determine the regulating rod 

insertion, AXIAL POWER IMBALANCE, and QPT limits) is not valid when 

the CONTROL RODS are not aligned. The required Completion Time of 

72 hours is acceptable because LHRs are limited by the THERMAL 

POWER reduction and adequate time is allowed to obtain an incore 

power distribution map. 

Required Action A.2.5 is modified by a Note that requires the 

performance of SR 3.2.5.1 only when THERMAL POWER is greater than 

20% RTP. This establishes a Required Action that is consistent with the 

Applicability of LCO 3.2.5, "Power Peaking Factors." 

B.1

If the Required Actions and associated Completion Times for Condition A 

cannot be met, the plant must be brought to a MODE in which the LCO 

does not apply. To achieve this status, the plant must be brought to at 

least MODE 3 within 6 hours. The allowed Completion Time of 6 hours is 

reasonable, based on operating experience, for reaching MODE 3 from 

full power conditions in an orderly manner and without challenging plant 

systems. 

C.1.1

More than one CONTROL ROD becoming misaligned, is not expected 

and may violate the minimum SDM requirement. Therefore, SDM must 

be evaluated. Ensuring the SDM meets the minimum requirement within 

1 hour allows the operator adequate time to determine the SDM. 

C.1.2

Restoration of the required SDM requires increasing the RCS boron 

concentration to provide negative reactivity. RCS boration must occur as 

described in Bases Section 3.1.1. The required Completion Time of 

1 hour for initiating boration is reasonable, based on the time required for 

potential xenon redistribution, the low probability of an accident occurring, 

and the steps required to complete the action. This allows the operator 

sufficient time for aligning the required valves and starting the boric acid 

pumps. Boration will continue until the required SDM is restored. 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.2

If more than one CONTROL ROD is misaligned, continued operation of 

the reactor may cause the misalignment to increase, as the regulating 

rods insert or withdraw to control reactivity. If the CONTROL ROD 

misalignment increases, local power peaking may also increase, and 

local LHRs will also increase if the reactor continues operation at 

THERMAL POWER. The SDM is decreased when one or more 

CONTROL RODS become misaligned by insertion from the group 

average position. 

Therefore, it is prudent to place the reactor in MODE 3. LCO 3.1.4 does 

not apply in MODE 3 since excessive power peaking cannot occur and 

the minimum required SDM is ensured. The allowed Completion Time of 

6 hours is reasonable, based on operating experience, for reaching 

MODE 3 from full power conditions in an orderly manner and without 

challenging plant systems. 

D.1.1 and D.1.2

When one or more rods are inoperable, the SDM may be adversely 

affected. Under these conditions, it is important to determine the SDM 

and, if it is less than the required value, initiate boration until the required 

SDM is recovered. The Completion Time of 1 hour is adequate for 

determining SDM and, if necessary, for initiating emergency boration to 

restore SDM. 

In this situation, SDM verification must include the worth of the inoperable 

rod(s) as well as a rod of maximum worth. 

D.2

If the inoperable rod(s) cannot be restored to OPERABLE status, the 

plant must be brought to a MODE or condition in which the LCO 

requirements are not applicable. To achieve this status, the plant must 

be brought to at least MODE 3 within 6 hours. 

The allowed Completion Time is reasonable, based on operating 

experience, for reaching MODE 3 from full power conditions in an orderly 

manner and without challenging plant systems. 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.1.4.1

REQUIREMENTS 

Verification that individual rods are aligned within [6.5]% of their group 

average height limits at a 12 hour Frequency allows the operator to detect 

a rod that is beginning to deviate from its expected position. The 

specified Frequency takes into account other rod position information that 

is continuously available to the operator in the control room, so that 

during actual rod motion, deviations can immediately be detected. 

SR 3.1.4.2

Verifying each CONTROL ROD is OPERABLE would require that each 

rod be tripped. However, in MODES 1 and 2, tripping each CONTROL 

ROD could result in radial tilts. Exercising each individual CONTROL 

ROD every 92 days provides increased confidence that all rods continue 

to be OPERABLE without exceeding the alignment limit, even if they are 

not regularly tripped. Moving each CONTROL ROD by 3% will not cause 

radial or axial power tilts, or oscillations, to occur. The 92 day Frequency 

takes into consideration other information available to the operator in the 

control room and SR 3.1.4.1, which is performed more frequently and 

adds to the determination of OPERABILITY of the rods. Between 

required performances of SR 3.1.4.2 (determination of CONTROL ROD 

OPERABILITY by movement), if a CONTROL ROD(S) is discovered to be 

immovable, but is determined to be trippable, the CONTROL ROD(S) is 

considered to be OPERABLE. At any time, if a CONTROL ROD(S) is 

immovable, a determination of the trippability (OPERABILITY) of the 

CONTROL ROD(S) must be made, and appropriate action taken. 

SR 3.1.4.3

Verification of rod drop time allows the operator to determine that the 

maximum rod drop time permitted is consistent with the assumed rod 

drop time used in the safety analysis. The rod drop time given in the 

safety analysis is 1.4 seconds to b insertion. Using the identical rod drop 

curve gives a value of [1.66] seconds to 3⁄4 insertion. The latter value is 

used in the Surveillance because the zone reference lights are located at 

25% insertion intervals. The zone reference lights will activate at 3⁄4

insertion to give an indication of the rod drop time and rod location. 

Measuring rod drop times, prior to reactor criticality after reactor vessel 

head removal and after CONTROL ROD drive system maintenance or 

modification, ensures that the reactor internals and CRDM will not 
CONTROL ROD Group Alignment Limits 

B 3.1.4 

BWOG STS B 3.1.4-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

interfere with CONTROL ROD motion or rod drop time. This Surveillance 

is performed during a plant outage, due to the plant conditions needed to 

perform the SR and the potential for an unplanned plant transient if the 

Surveillance were performed with the reactor at power. 

This testing is normally performed with all reactor coolant pumps 

operating and average moderator temperature ≥ 525°F to simulate a 

reactor trip under actual conditions. However, if the rod drop times are 

determined with less than four reactor coolant pumps operating, a Note 

allows power operation to continue, provided operation is restricted to the 

pump combination utilized during the rod drop time determination. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26. 

 2. 10 CFR 50.46. 

 3. FSAR, Chapter [14]. 

 4. FSAR, Section [ ] . 

 5. FSAR, Section [ ] . 

 6. FSAR, Section [ ] . 
Safety Rod Insertion Limit 

B 3.1.5 

BWOG STS B 3.1.5-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.5 Safety Rod Insertion Limit 

BASES 

BACKGROUND The insertion limits of the safety and regulating rods are initial condition 

assumptions in all safety analyses that assume rod insertion upon reactor 

trip. The insertion limits directly affect core power distributions and 

assumptions of available SDM, ejected rod worth, and initial reactivity 

insertion rate. 

The applicable criteria for the reactivity and power distribution design 

requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," 

GDC 26, "Reactivity Control System Redundancy-and Capability," GDC 

28, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria 

for Emergency Core Cooling Systems for Light Water Nuclear Power 

Reactors" (Ref. 2). 

Limits on safety rod insertion have been established, and all rod positions 

are monitored and controlled during power operation to ensure that the 

reactivity limits, ejected rod worth, and SDM limits are preserved. 

The regulating groups are used for precise reactivity control of the 

reactor. The positions of the regulating groups are normally automatically 

controlled by the automatic control system, but they can also be manually 

controlled. They are capable of adding negative reactivity very quickly 

(compared to borating). The regulating groups must be maintained above 

designed insertion limits and are typically near the fully withdrawn position 

during normal operations. Hence, they are not capable of adding a large 

amount of positive reactivity. Boration or dilution of the Reactor Coolant 

System (RCS) compensates for the reactivity changes associated with 

large changes in RCS temperature and fuel burnup. 

The safety groups can be fully withdrawn without the core going critical. 

This provides available negative reactivity in the event of boration errors. 

The safety groups are controlled manually by the control room operator. 

During normal full power operation, the safety groups are fully withdrawn. 

The safety groups must be completely withdrawn from the core prior to 

withdrawing any regulating groups during an approach to criticality. The 

safety groups remain in the fully withdrawn position until the reactor is 

shut down. They add negative reactivity to shut down the reactor upon 

receipt of a reactor trip signal. 
Safety Rod Insertion Limit 

B 3.1.5 

BWOG STS B 3.1.5-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE On a reactor trip, all rods (safety groups and regulating groups), except 

SAFETY the most reactive rod, are assumed to insert into the core. The safety 

ANALYSES groups shall be at their fully withdrawn limits and available to insert the 

maximum amount of negative reactivity on a reactor trip signal. The 

regulating groups may be partially inserted in the core as allowed by 

LCO 3.2.1, "Regulating Rod Insertion Limits." The safety group and 

regulating rod insertion limits are established to ensure that a sufficient 

amount of negative reactivity is available to shut down the reactor and 

maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN 

(SDM)") following a reactor trip from full power. The combination of 

regulating groups and safety groups (less the most reactive rod, which is 

assumed to be fully withdrawn) is sufficient to take the reactor from full 

power conditions at rated temperature to zero power and to maintain the 

required SDM at rated no load temperature (Ref. 3). The safety group 

insertion limit also limits the reactivity worth of an ejected safety rod. 

The acceptance criteria for addressing safety and regulating rod group 

insertion limits and inoperability or misalignment are that: 

a. There shall be no violations of: 

1. Specified acceptable fuel design limits or 

2. RCS pressure boundary integrity and 

b. The core must remain subcritical after accident transients. 

The safety rod insertion limits satisfy Criteria 2 and 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The safety groups must be fully withdrawn any time the reactor is critical 

or approaching criticality. This ensures that a sufficient amount of 

negative reactivity is available to shut down the reactor and maintain the 

required SDM following a reactor trip. 

This LCO has been modified by a Note indicating the LCO requirement is 

suspended for those safety rods which are inserted solely due to testing 

in accordance with SR 3.1.4.2. This SR verifies the freedom of the rods 

to move, and requires the safety group to move below the LCO limits, 

which would normally violate the LCO. 
Safety Rod Insertion Limit 

B 3.1.5 

BWOG STS B 3.1.5-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The safety groups must be within their insertion limits with the reactor in 

MODES 1 and 2. This ensures that a sufficient amount of negative 

reactivity is available to shut down the reactor and maintain the required 

SDM following a reactor trip. Refer to LCO 3.1.1 for SDM requirements in 

MODES 3, 4, and 5. LCO 3.9.1, "Boron Concentration," ensures 

adequate SDM in MODE 6. 

ACTIONS A.1.1, A.1.2, and A.2

The safety rod must be declared inoperable within a 1 hour time frame. 

This requires entry into LCO 3.1.4, "CONTROL ROD Group Alignment 

Limits." In addition, since the safety rod may be inserted farther than the 

group average insertion for a long time, SDM must be evaluated. 

Ensuring the SDM meets the minimum requirement within 1 hour is 

adequate to determine that further degradation of the SDM is not 

occurring. 

Restoration of the required SDM requires increasing the boron 

concentration, since the safety rod may remain misaligned and not be 

providing its normal negative reactivity on tripping. RCS boration must 

occur as described in Bases Section 3.1.1. The required Completion 

Time of 1 hour for initiating boration is reasonable, based on the time 

required for potential xenon redistribution, the low probability of an 

accident occurring, and the steps required to complete the action. This 

allows the operator sufficient time for aligning the required valves and 

starting the boric acid pumps. Boration will continue until the required 

SDM is restored. 

The allowed Completion Time of 1 hour provides an acceptable time for 

evaluating and repairing minor problems without allowing the plant to 

remain in an unacceptable condition for an extended period of time. 

B.1.1 and B.1.2

When more than one safety rod is inoperable, there is a possibility that 

the required SDM may be adversely affected. Under these conditions, it 

is important to determine the SDM, and if it is less than the required 

value, initiate boration until the required SDM is recovered. The 

Completion Time of 1 hour is adequate for determining SDM and, if 

necessary, for initiating emergency boration to restore SDM. 

In this situation, SDM verification must include the worth of the 

untrippable rod as well as the rod of maximum worth. 
Safety Rod Insertion Limit 

B 3.1.5 

BWOG STS B 3.1.5-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.2

If more than one safety rod is inoperable the unit must be brought to a 

MODE where the LCO is not applicable. The allowed Completion Time of 

6 hours is reasonable, based on operating experience, for reaching the 

required MODE from full power conditions in an orderly manner and 

without challenging plant systems. 

SURVEILLANCE SR 3.1.5.1

REQUIREMENTS 

Verification that each safety rod is fully withdrawn ensures the rods are 

available to provide reactor shutdown capability. 

Verification that individual safety rod positions are fully withdrawn at a 

12 hour Frequency allows the operator to detect a rod beginning to 

deviate from its expected position. Also, the 12 hour Frequency takes 

into account other information available in the control room for the 

purpose of monitoring the status of the safety rods. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26. 

 2. 10 CFR 50.46. 

 3. FSAR, Section [ ] . 
APSR Alignment Limits 

B 3.1.6 

BWOG STS B 3.1.6-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.6 AXIAL POWER SHAPING ROD (APSR) Alignment Limits 

BASES 

BACKGROUND The OPERABILITY of the APSRs and rod misalignment are initial 

condition assumptions in the safety analysis that directly affect core 

power distributions. The applicable criteria for these power distribution 

design requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor 

Design," and GDC 26, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, 

"Acceptance Criteria for Emergency Core Cooling Systems for Light 

Water Nuclear Power Reactors" (Ref. 2). 

Mechanical or electrical failures may cause an APSR to become 

inoperable or to become misaligned from its group. APSR inoperability or 

misalignment may cause increased power peaking, due to the 

asymmetric reactivity distribution. Therefore, APSR alignment and 

OPERABILITY are related to core operation within design power peaking 

limits. 

Limits on APSR alignment and OPERABILITY have been established, 

and all rod positions are monitored and controlled during power operation 

to ensure that the power distribution limits defined by the design peaking 

limits are preserved. 

CONTROL RODS and APSRs are moved by their CONTROL ROD drive 

mechanisms (CRDMs). Each CRDM moves its rod 3⁄4 inch for one 

revolution of the leadscrew at varying rates depending on the signal 

output from the Rod Control System. 

The APSRs are arranged into rod groups that are radially symmetric. 

Therefore, movement of the APSRs does not introduce radial 

asymmetries in the core power distribution. The APSRs, which control 

the axial power distribution, are positioned manually and do not trip. 

LCO 3.1.6 is conservatively based on use of black (Ag-In-Cd) APSRs and 

bounds use of gray (Inconel) APSRs. The reactivity worth of black 

APSRs is greater than that of gray APSRs; thus the impact of black 

APSR misalignment on the core power distribution is greater. 
APSR Alignment Limits 

B 3.1.6 

BWOG STS B 3.1.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE APSR misalignment and inoperability are analyzed in the safety analysis 

SAFETY (Ref. 3). The acceptance criteria for addressing APSR inoperability or 

ANALYSES misalignment are that there shall be no violations of: 

a. Specified acceptable fuel design limits and 

b. Reactor Coolant System (RCS) pressure boundary integrity. 

Two types of misalignment or inoperability are distinguished. During 

movement of an APSR group, one rod may stop moving while the other 

rods in the group continue. This condition may cause excessive power 

peaking. The second type of misalignment occurs when one rod drops 

partially or fully into the reactor core. This event causes an initial power 

reduction, followed by a return towards the original power, due to positive 

reactivity feedback from the negative moderator temperature coefficient. 

Increased peaking during the power increase may result in excessive 

local linear heat rates (LHRs). The accident analysis and reload safety 

evaluations define APSR insertion limits that ensure that if an APSR is 

stuck in or dropped in, the increase in local LHR is within the design 

limits. The Required Action statement in the LCO provides a 

conservative approach to ensure that continued operation remains within 

the bounds of the safety analysis (Ref. 4). 

Continued operation of the reactor with a misaligned APSR is allowed if 

AXIAL POWER IMBALANCE limits are preserved. 

The APSR alignment limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The limits on CONTROL ROD group alignment, safety rod insertion, and 

APSR alignment, together with the limits on regulating rod insertion, 

APSR insertion, AXIAL POWER IMBALANCE, and QPT, ensure the 

reactor will operate within the fuel design criteria. The Required Action in 

this LCO ensures deviations from the alignment limits will be adjusted so 

that excessive local LHRs will not occur. 

The limit for individual APSR misalignment is [6.5]% (9 inches) deviation 

from the group average position. This value is established based on the 

distance between reed switches, with additional allowances for 

uncertainty in the absolute position indicator amplifiers, group maximum 

or minimum synthesizer, and asymmetric alarm or fault detector outputs. 

The position of an inoperable rod is not included in the calculation of the 

rod group's average position. 
APSR Alignment Limits 

B 3.1.6 

BWOG STS B 3.1.6-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Failure to meet the requirements of this LCO may produce unacceptable 

power peaking factors, and LHRs, which may constitute initial conditions 

inconsistent with the safety analysis. 

APPLICABILITY The requirements on APSR OPERABILITY and alignment are applicable 

in MODES 1 and 2 because these are the only MODES in which neutron 

(or fission) power is generated and the OPERABILITY and alignment of 

rods have the potential to affect the safety of the plant. In MODES 3, 4, 

5, and 6, the alignment limits do not apply because the reactor is shut 

down and not producing fission power, and excessive local LHRs cannot 

occur from APSR misalignment. 

ACTIONS A.1

The ACTIONS described below are required if one APSR is inoperable. 

The plant is not allowed to operate with more than one inoperable APSR. 

This would require the reactor to be shut down, in accordance with 

LCO 3.0.3. 

An alternate to realigning a single misaligned APSR to the group average 

position is to align the remainder of the APSR group to the position of the 

misaligned or inoperable APSR, while maintaining APSR insertion, in 

accordance with the limits in the COLR. This restores the alignment 

requirements. Deviations up to 2 hours will not cause significant xenon 

redistribution to occur. This alternative assumes the APSR group 

movement does not cause the limits of LCO 3.2.2, "AXIAL POWER 

SHAPING ROD (APSR) Insertion Limits," to be exceeded. For this 

reason, APSR group movement is only practical for instances where 

small movements of the APSR group are sufficient to re-establish APSR 

alignment. 

The reactor may continue in operation with the APSR misaligned if the 

limits on AXIAL POWER IMBALANCE are surveilled within 2 hours to 

determine if the AXIAL POWER IMBALANCE is still within limits. Also, 

since any additional movement of the APSRs may result in additional 

imbalance, Required Action A.1 also requires the AXIAL POWER 

IMBALANCE Surveillance to be performed again within 2 hours after 

each APSR movement. The required Completion Time of up to 2 hours 

will not cause significant xenon redistribution to occur. 
APSR Alignment Limits 

B 3.1.6 

BWOG STS B 3.1.6-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

The plant must be brought to a MODE in which the LCO does not apply if 

the Required Actions and associated Completion Times cannot be met. 

To achieve this status, the plant must be brought to at least MODE 3 

within 6 hours. The Completion Time of 6 hours is reasonable, based on 

operating experience, for reaching MODE 3 from RTP in an orderly 

manner and without challenging plant systems. In MODE 3, APSR group 

alignment limits are not required because the reactor is not generating 

THERMAL POWER and excessive local LHRs cannot occur from APSR 

misalignment. 

SURVEILLANCE SR 3.1.6.1

REQUIREMENTS 

Verification at a 12 hour Frequency that individual APSR positions are 

within [6.5]% of the group average height limits allows the operator to 

detect an APSR beginning to deviate from its expected position. In 

addition, APSR position is continuously available to the operator in the 

control room so that during actual rod motion, deviations can immediately 

be detected. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26. 

 2. 10 CFR 50.46. 

 3. FSAR, Section [ ] . 

 4. FSAR, Section [ ] . 
Position Indicator Channels 

B 3.1.7 

BWOG STS B 3.1.7-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.7 Position Indicator Channels 

BASES 

BACKGROUND According to GDC 13 (Ref. 1), instrumentation to monitor variables and 

systems over their operating ranges during normal operation, anticipated 

operational occurrences, and accident conditions must be OPERABLE. 

LCO 3.1.7 is required to ensure OPERABILITY of the CONTROL ROD 

and APSR position indicators, and thereby ensure compliance with the 

CONTROL ROD and APSR alignment and insertion limits. 

The OPERABILITY, including position indication, of the safety and 

regulating rods is an initial condition assumption in all safety analyses that 

assume rod insertion upon reactor trip. Maximum rod misalignment for 

the safety rods, regulating rods, and APSRs is assumed in the safety 

analysis, which directly affect core power distributions and assumptions of 

available SDM. 

Mechanical or electrical failures may cause a CONTROL ROD or APSR 

to become misaligned from its group. CONTROL ROD or APSR 

misalignment may cause increased power peaking, due to the 

asymmetric reactivity distribution and a reduction in the total available rod 

worth for reactor shutdown. Therefore, CONTROL ROD and APSR 

alignment are related to core operation within design power peaking limits 

and the core design requirement of a minimum SDM. Rod position 

indication is needed to assess rod OPERABILITY and alignment. 

Limits on CONTROL ROD alignment, APSR alignment, and safety rod 

position have been established, and all rod positions are monitored and 

controlled during power operation to ensure that the power distribution 

and reactivity limits defined by the design power peaking and SDM limits 

are preserved. 

Two methods of CONTROL ROD and APSR position indication are 

provided in the CONTROL ROD Drive Control System. The two means 

are by absolute position indicator and relative position indicator 

transducers. The absolute position indicator transducer consists of a 

series of magnetically operated reed switches mounted in a tube parallel 

to the CONTROL ROD drive mechanism (CRDM) motor tube extension. 

Switch contacts close when a permanent magnet mounted on the upper 

end of the CONTROL ROD assembly (CRA) leadscrew extension comes 

near. As the leadscrew and CRA move, the switches operate 
Position Indicator Channels 

B 3.1.7 

BWOG STS B 3.1.7-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

sequentially, producing an analog voltage proportional to position. Other 

reed switches included in the same tube with the position indicator matrix 

provide full in and full out limit indications, and absolute position 

indications at 0%, 25%, 50%, 75%, and 100% travel (called zone 

reference indicators). The relative position indicator transducer is a 

potentiometer, driven by a step motor that produces a signal proportional 

to CONTROL ROD position, based on the electrical pulse steps that drive 

the CRDM. 

Two absolute position indicator channel designs may be used in the unit: 

type A absolute position indicators and type A-R4C absolute position 

indicators. The type A absolute position indicator transducer is a voltage 

divider circuit made up of 48 resistors of equal value connected in series. 

One end of 48 reed switches is connected at a junction between each of 

the resistors, so that as the magnet mounted on the leadscrew moves, 

either one or two reed switches are closed in the vicinity of the magnet. 

The type A-R4C (redundant four channel) absolute position indicator 

transducer has two parallel sets of voltage divider circuits made up of 

36 resistors each, connected in series (channels A and B). One end of 

36 reed switches is connected at a junction between each of the resistors 

of the two parallel circuits. The reed switches making up each circuit are 

offset, such that the switches for channel A are staggered with the 

switches for channel B. The type A-R4C is designed such that either two 

or three reed switches are closed in the vicinity of the magnet. By its 

design, the type A-R4C absolute position indicator provides redundancy, 

with the two three sequence of pickup and drop out of reed switches to 

enable a continuity of position signal when a single reed switch fails to 

close. 

CONTROL ROD position indicating readout devices located in the control 

room consist of single CRA position meters on a wall mounted position 

indication panel and four group average position meters on the console. 

A selector switch permits either relative or absolute position indication to 

be displayed on all of the single rod meters. Indicator lights are provided 

on the single CRA meter panel to indicate when each CRA is fully 

withdrawn, fully inserted, enabled, or transferred, and whether a CRA 

position asymmetry alarm condition is present. Indicators on the console 

show full insertion, full withdrawal, and enabled for motion for each 

CONTROL ROD group. Identical instrumentation and devices exist for 

the APSR group. The consequence of continued operation with an 

inoperable absolute position indicator or relative position indicator 

channel is a decreased reliability in determining CONTROL ROD position. 

Therefore, the potential for operation in violation of design peaking factors 

or SDM is increased. 
Position Indicator Channels 

B 3.1.7 

BWOG STS B 3.1.7-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE CONTROL ROD and APSR position accuracy is essential during power 

SAFETY operation. Power peaking, ejected rod worth, or SDM limits may be 

ANALYSES violated in the event of a Design Basis Accident (Ref. 2) with CONTROL 

RODS or APSRs operating outside their limits undetected. Regulating 

rod, safety rod, and APSR positions must be known in order to verify the 

core is operating within the group sequence, overlap, design peaking 

limits, ejected rod worth, and with minimum SDM (LCO 3.1.5, "Safety Rod 

Insertion Limits," LCO 3.2.1, "Regulating Rod Insertion Limits," and 

LCO 3.2.2, "AXIAL POWER SHAPING ROD (APSR) Insertion Limits"). 

The rod positions must also be known in order to verify the alignment 

limits are preserved (LCO 3.1.4, "CONTROL ROD Group Alignment 

Limits," and LCO 3.1.6, "AXIAL POWER SHAPING ROD (APSR) 

Alignment Limits"). CONTROL ROD and APSR positions are 

continuously monitored to provide operators with information that ensures 

the plant is operating within the bounds of the accident analysis 

assumptions. The CONTROL ROD position indicator channels satisfy 

Criterion 2 of 10 CFR 50.36(c)(2)(ii). The CONTROL ROD position 

indicators monitor CONTROL ROD position, which is an accident initial 

condition. 

LCO LCO 3.1.7 specifies that one absolute position indicator channel and one 

relative position indicator channel be OPERABLE for each CONTROL 

ROD and APSR. 

The agreement between the relative position indicator channel and the 

absolute position indicator channel, within the limit given in the COLR, 

indicates that relative position indicators are adequately calibrated and 

can be used for indication of the measurement of CONTROL ROD group 

position. A deviation of less than the allowable limit, given in the COLR, 

in position indication for a single CONTROL ROD or APSR, ensures 

confidence that the position uncertainty of the corresponding CONTROL 

ROD group or APSR group is within the assumed values used in the 

analysis that specifies CONTROL ROD group and APSR insertion limits. 

These requirements ensure that CONTROL ROD position indication 

during power operation and PHYSICS TESTS is accurate, and that 

design assumptions are not challenged. OPERABILITY of the position 

indicator channels ensures that inoperable, misaligned, or mispositioned 

CONTROL RODS or APSRs can be detected. Therefore, power peaking 

and SDM can be controlled within acceptable limits. 
Position Indicator Channels 

B 3.1.7 

BWOG STS B 3.1.7-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1 and 2, OPERABILITY of position indicator channels is 

required, since the reactor is, or is capable of, generating THERMAL 

POWER in these MODES. In MODES 3, 4, 5, and 6, Applicability is not 

required because the reactor is shut down with the required minimum 

SDM and is not generating THERMAL POWER. 

ACTIONS A.1

If the relative position indicator channel is inoperable for one or more 

rods, the position of the rod(s) is still monitored by the absolute position 

indicator channel for each affected rod. The absolute position indicator 

channel may be used if it is determined to be OPERABLE. The required 

Completion Time of 8 hours is reasonable to provide adequate time for 

the operator to determine position indicator channel status. Continuing 

the verification every 8 hours thereafter in the applicable condition is 

acceptable, based on the fact that during normal power operation 

excessive movement of the groups is not required. Also, if the rod is out 

of position during this 8 hour period, the simultaneous occurrence of an 

event sensitive to the rod position has a small probability. 

B.1.1

If the absolute position indicator channel is inoperable for one or more 

rods, the position of the rod(s) is monitored by the relative position 

indicator channel for each affected rod. However, the relative position 

indicator channel is not as reliable a method of monitoring rod position as 

the absolute position indicator because it counts electrical pulse steps 

driving the CRDM motor rather than actuating a switch located at a known 

elevation. Therefore, the affected rod's position can be determined with 

more certainty by actuating one of its zone reference indicator switches 

located at discrete elevations. The required Completion Time of 8 hours 

provides the operator adequate time for adjusting the affected rod's 

position to an appropriate zone reference indicator location. If the rod is 

out of position during this 8 hour period, the simultaneous occurrence of 

an event sensitive to the rod position has a small probability. 

B.1.2

To allow continued operation, the rods with inoperable absolute position 

indicator channels are maintained at the zone reference indicator 

position. In addition, the affected rods are maintained within the limits of 

LCO 3.1.5 (when the affected rod is a safety rod), LCO 3.2.1 (when the 

affected rod is a regulating rod), or LCO 3.2.2 (when the affected rod is 
Position Indicator Channels 

B 3.1.7 

BWOG STS B 3.1.7-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

an APSR). This Required Action ensures safety rods remain fully 

withdrawn, and that regulating rods and APSRs remain aligned within 

their insertion limits. The required Completion Time of 8 hours is 

reasonable for allowing the operator adequate time to determine the 

affected rods are in compliance with these LCOs. Continuing to verify the 

rod positions every 8 hours thereafter is reasonable for ensuring that rod 

alignment and insertion are not changing, and provides the operator 

adequate time to correct any deviation that may occur. Continuing the 

verification every 8 hours thereafter in the applicable condition is 

acceptable, based on the fact that during normal power operation 

excessive movement of the groups is not required. Also, if the rod is out 

of position during this 8 hour period, the simultaneous occurrence of an 

event sensitive to the rod position has a small probability. 

B.2.1

If the absolute position indicator is inoperable for one or more rods, the 

position of the rod is monitored by the relative position indicator channel 

for each affected rod. However, the relative position indicator channel is 

not as reliable a method of monitoring rod position as the absolute 

position indicator because it counts electrical pulse steps. The fixed 

incore system can be used to indirectly determine the absolute position of 

the affected rod. The fixed incore instrumentation can provide a continual 

update of CONTROL ROD position, therefore this method can be used to 

allow continued operation of the reactor with a manual CONTROL ROD 

movement, while maintaining verification of CONTROL ROD insertion 

and alignment. Required Action B.2.1. restricts rod motion by placing the 

groups with nonindicating rods in manual control; thus, even if the rod 

fails to move in alignment with the group, misalignment is limited. The 

required Completion Time of 8 hours provides the operator adequate time 

for placing the rods in manual control, and is consistent with the required 

Completion Time for Required Action B.1.1. If the rod is out of position 

during this 8 hour period, the simultaneous occurrence of an event 

sensitive to the rod position has a small probability. 
Position Indicator Channels 

B 3.1.7 

BWOG STS B 3.1.7-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.2.2

Continuing to verify the rod positions every 8 hours is reasonable for 

ensuring that rod alignment and insertion are not changing, and provides 

the operator adequate time to correct any deviation that may occur. The 

additional Completion Time of 1 hour after motion of nonindicating rods, 

which exceeds 15 inches in one direction since the last determination of 

the rod's position, ensures that the rod with inoperable position indication 

will not be misaligned for a significant period of time, in the event the rod 

is moved. The specified Completion Times are acceptable because the 

simultaneous occurrence of a mispositioned rod and an event sensitive to 

the rod position has a small probability. 

C.1

If both the absolute position indicator channel and relative position 

indicator channel are inoperable for one or more rods, or if the Required 

Actions and associated Completion Times are not met, the position of the 

rod(s) is not known with certainty. Therefore, each affected rod must be 

declared inoperable, and the limits of LCO 3.1.4 or LCO 3.1.6 apply. The 

required Completion Time for declaring the rod(s) inoperable is 

immediately. Therefore LCO 3.1.4 or LCO 3.1.6 is entered immediately, 

and the required Completion Times for the appropriate Required Actions 

in those LCOs apply without delay. 

SURVEILLANCE SR 3.1.7.1

REQUIREMENTS 

Verification is required that the Absolute Position Indicator channels and 

Relative Position Indicator channels agree within the limit given in the 

COLR. This verification ensures that the Relative Position Indicator 

channels, which are regarded as the potentially less reliable means of 

position indication, remain OPERABLE and accurate. The required 

Frequency of 12 hours is adequate for verifying that no degradation in 

system OPERABILITY has occurred. 
Position Indicator Channels 

B 3.1.7 

BWOG STS B 3.1.7-7 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 13. 

 2. FSAR, Section [14.1.2.2], Section [14.1.2.3], Section [14.1.2.6], 

Section [14.1.2.7], Section [14.2.2.4], and Section [14.2.2.5]. 
PHYSICS TESTS Exceptions - MODE 1 

B 3.1.8 

BWOG STS B 3.1.8-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.8 PHYSICS TESTS Exceptions Systems - MODE 1 

BASES 

BACKGROUND The purpose of this MODE 1 LCO is to permit PHYSICS TESTS to be 

conducted by providing exemptions from the requirements of other LCOs. 

Establishment of a test program to verify that structures, systems, and 

components will perform satisfactorily in service is required by Section XI 

of 10 CFR 50, Appendix B (Ref. 1). Testing is required as an integral part 

of the design, fabrication, construction, and operation of the power plant. 

All functions necessary to ensure that specified design conditions are not 

violated during normal operation and anticipated operational occurrences 

must be tested. Requirements for notification of the NRC, for the purpose 

of conducting tests and experiments, are specified in 10 CFR 50.59 

(Ref. 2). 

The key objectives of a test program are to (Ref. 3): 

a. Ensure that the facility has been adequately designed, 

b. Validate the analytical models used in the design and analysis, 

c. Verify the assumptions used to predict unit response, 

d. Ensure that installation of equipment in the facility has been 

accomplished in accordance with the design, and 

e. Verify that the operating and emergency procedures are adequate. 

To accomplish these objectives, testing is performed prior to initial 

criticality; during startup, low power operations, and power ascension; at 

high powers; and after each fueling. The PHYSICS TESTS requirements 

for reload fuel cycles ensure that the operating characteristics of the core 

are consistent with the design predictions, and that the core can be 

operated as designed (Ref. 4). 

PHYSICS TESTS procedures are written and approved in accordance 

with established guidelines. The procedures include all information 

necessary to permit a detailed execution of testing required to ensure the 

design intent is met. PHYSICS TESTS are performed in accordance with 
PHYSICS TESTS Exceptions - MODE 1 

B 3.1.8 

BWOG STS B 3.1.8-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

these procedures, and test results are approved prior to continued power 

escalation and long term power operation. Examples of PHYSICS 

TESTS include determination of critical boron concentration, CONTROL 

ROD group worths, reactivity coefficients, flux symmetry, and core power 

distribution. 

APPLICABLE It is acceptable to suspend certain LCOs for PHYSICS TESTS because 

SAFETY reactor protection criteria are preserved by the LCOs still in effect and by 

ANALYSES the SRs. Even if an accident occurs during PHYSICS TESTS with one or 

more LCOs suspended, fuel damage criteria are preserved because the 

limits on nuclear hot channel factors, ejected rod worth, and shutdown 

capability are maintained during the PHYSICS TESTS. 

Reference 5 defines requirements for initial testing of the facility, including 

PHYSICS TESTS. Tables 13-3 and 13-4 (Ref. 6) summarize the zero, 

low power, and power tests. Requirements for reload fuel cycle 

PHYSICS TESTS are given in Table 1 ANSI/ANS-19.6.1-1985 (Ref. 4). 

Although these PHYSICS TESTS are generally accomplished within the 

limits of all LCOs, one or more LCOs must sometimes be suspended to 

make completion of PHYSICS TESTS possible or practical. 

This is acceptable as long as the fuel design criteria are not violated. 

When one or more of the limits specified in: 

LCO 3.1.4, "CONTROL ROD Group Alignment Limits," 

LCO 3.1.5, "Safety Rod Insertion Limits," 

LCO 3.1.6, "AXIAL POWER SHAPING ROD (APSR) Alignment Limits," 

LCO 3.2.1, "Regulating Rod Insertion Limits," for the restricted operation 

region only, 

LCO 3.2.3, "AXIAL POWER IMBALANCE Operating Limits," or 

LCO 3.2.4, "QUADRANT POWER TILT (QPT)" 

are suspended for PHYSICS TESTS, the fuel design criteria are 

preserved by maintaining the nuclear hot channel factors (in MODE 1 

PHYSICS TESTS) within their limits, maintaining ejected rod worth within 

limits by restricting regulating rod insertion to within the acceptable 

operating region or the restricted operating region, by limiting maximum 

THERMAL POWER and by maintaining SDM within the limits specified in 

the COLR. Therefore, surveillance of the FQ(Z), the H

N F∆ , and SDM is 
PHYSICS TESTS Exceptions - MODE 1 

B 3.1.8 

BWOG STS B 3.1.8-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

required to verify that their limits are not exceeded. The limits for the 

nuclear hot channel factors are specified in the COLR. Refer to the 

Bases for LCO 3.2.5 for a complete discussion of FQ(Z) and H N F∆ . During 

PHYSICS TESTS, one or more of the LCOs that normally preserve the 

FQ(Z) and H N F∆ limits may be suspended. However, the results of the 

safety analysis are not adversely impacted if verification that FQ(Z) and 

H N F∆ are within their limits is obtained, while one or more of the LCOs is 

suspended. Therefore, SRs are placed on FQ(Z) and H N F∆ during MODE 1 

PHYSICS TESTS when THERMAL POWER exceeds 20% RTP to verify 

that these factors remain within their limits. Periodic verification of these 

factors allows PHYSICS TESTS to be conducted while continuing to 

maintain the design criteria. 

PHYSICS TESTS include measurement of core nuclear parameters or 

exercise of control components that affect process variables. Among the 

process variables involved are AXIAL POWER IMBALANCE and QPT, 

which represent initial condition input (power peaking) for the accident 

analysis. Also involved are the movable control components, i.e., the 

regulating rods and the APSRs, which affect power peaking and are 

required for shutdown of the reactor. The limits for these variables are 

specified for each fuel cycle in the COLR. 

As described in LCO 3.0.7, compliance with Test Exceptions LCOs is 

optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test 

Exceptions LCOs provide flexibility to perform certain operations by 

appropriately modifying requirements of other LCOs. A discussion of the 

criteria satisfied for the other LCOs is provided in their respective Bases. 

LCO This LCO permits individual CONTROL RODS to be positioned outside of 

their specified group alignment and withdrawal limits and to be assigned 

to other than specified CONTROL ROD groups, and permits AXIAL 

POWER IMBALANCE and QPT limits to be exceeded during the 

performance of PHYSICS TESTS. In addition, this LCO permits 

verification of the fundamental core characteristics and nuclear 

instrumentation operation. 

The requirements of LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, LCO 3.2.1 (for the 

restricted operation region only), LCO 3.2.3, and LCO 3.2.4 may be 

suspended during the performance of PHYSICS TESTS provided: 
PHYSICS TESTS Exceptions - MODE 1 

B 3.1.8 

BWOG STS B 3.1.8-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

a. THERMAL POWER is maintained ≤ 85% RTP, 

b. Nuclear overpower trip setpoint is ≤ 10% RTP higher than the 

THERMAL POWER at which the test is performed, with a maximum 

setting of 90% RTP, 

c. FQ(Z) and H

N F∆ are maintained within limits specified in the COLR 

while operating at greater than 20% RTP, and 

d. SDM is maintained within the limits specified in the COLR. 

Operation with THERMAL POWER ≤ 85% RTP during PHYSICS TESTS 

provides an acceptable thermal margin when one or more of the 

applicable LCOs is out of specification. Eighty-five percent RTP is 

consistent with the maximum power level for conducting the intermediate 

core power distribution test specified in Reference 4. The nuclear 

overpower trip setpoint is reduced so that a similar margin exists between 

the steady state condition and trip setpoint as exists during normal 

operation at RTP. 

LCO provision c is modified by a Note that requires the adherence to 

power peaking factor requirements only when THERMAL POWER is 

greater than 20% RTP. This establishes an LCO provision that is 

consistent with the Applicability of LCO 3.2.5, "Power Peaking Factors." 

APPLICABILITY This LCO is applicable in MODE 1, when the reactor has completed low 

power testing and is in power ascension, or during power operation with 

THERMAL POWER > 5% RTP but ≤ 85% RTP. This LCO is applicable 

for power ascension testing, as defined by Regulatory Guide 1.68 

(Ref. 3). In MODE 2, Applicability of this LCO is not required because 

LCO 3.1.9, "PHYSICS TESTS Exceptions - MODE 2," addresses 

PHYSICS TESTS exceptions in MODE 2. In MODES 3, 4, 5, and 6, 

Applicability is not required because PHYSICS TESTS are not performed 

in these MODES. 
PHYSICS TESTS Exceptions - MODE 1 

B 3.1.8 

BWOG STS B 3.1.8-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1 and A.2

If the SDM requirements are not met, boration must be initiated promptly. 

A Completion Time of 15 minutes is adequate for an operator to correctly 

align and start the required systems and components. The operator 

should begin boration with the best source available for the plant 

conditions. Boration will be continued until SDM is within limit. In the 

determination of the required combination of boration flow rate and boron 

concentration, there is no unique requirement that must be satisfied. 

Suspension of PHYSICS TESTS exceptions requires restoration of each 

of the applicable LCOs to within specification. 

B.1

If THERMAL POWER exceeds 85% RTP, then 1 hour is allowed for the 

operator to reduce THERMAL POWER to within limits or to complete an 

orderly suspension of PHYSICS TESTS exceptions. Suspension of 

PHYSICS TESTS exceptions requires restoration of each of the 

applicable individual LCOs to within specification. This required 

Completion Time is consistent with, or more conservative than, those 

specified for the individual LCO, addressed by PHYSICS TESTS 

exceptions. 

If the nuclear overpower trip setpoint is not within the specified limits, then 

1 hour is allowed for the operator to restore the nuclear overpower trip 

setpoint within limits or to complete an orderly suspension of PHYSICS 

TESTS exceptions. Suspension of PHYSICS TESTS exceptions requires 

restoration of each of the applicable individual LCOs to within 

specification. This required Completion Time is consistent with, or more 

conservative than, those specified for the individual LCO, addressed by 

these PHYSICS TESTS exceptions. 

If the results of the incore flux map indicate that either FQ(Z) or H

N F∆ has 

exceeded its limit when THERMAL POWER is greater than 20% RTP, 

then PHYSICS TESTS are suspended. This action is required because 

of direct indication that the core peaking factors, which are fundamental 

initial conditions for the safety analysis, are excessive. Suspension of 

PHYSICS TESTS exceptions requires restoration of each of the 

applicable LCOs to within specification. 

This Condition is modified by a Note that requires performance of the 

Required Action only when THERMAL POWER is greater than 20% RTP. 

This establishes an ACTIONS entry Condition that is consistent with LCO 

provision c and the Applicability of LCO 3.2.5, "Power Peaking Factors." 
PHYSICS TESTS Exceptions - MODE 1 

B 3.1.8 

BWOG STS B 3.1.8-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.1.8.1

REQUIREMENTS 

Verification that THERMAL POWER is ≤ 85% RTP ensures that the 

required additional thermal margin has been established prior to and 

during PHYSICS TESTS. The required Frequency of once per hour 

allows the operator adequate time to determine any degradation of the 

established thermal margin during PHYSICS TESTS. 

SR 3.1.8.2

Verification that FQ(Z) and H N F∆ are within their limits ensures that core 

local linear heat rate and departure from nucleate boiling ratio will remain 

within their limits, while one or more of the LCOs that normally control 

these design limits are out of specification. The required Frequency of 

2 hours allows the operator adequate time for collecting a flux map and 

for performing the hot channel factor verifications, based on operating 

experience. If SR 3.2.5.1 is not met, PHYSICS TESTS are suspended 

and LCO 3.2.5 applies. This Frequency is more conservative than the 

Completion Time for restoration of the individual LCOs that preserve the 

FQ(Z) and H

N F∆ limits. 

This SR is modified by a Note that requires performance only when 

THERMAL POWER is greater than 20% RTP. This establishes a 

performance requirement that is consistent with the Applicability of 

LCO 3.2.5, "Power Peaking Factors." 

SR 3.1.8.3

Verification that the nuclear overpower trip setpoint is within the limit 

specified for each PHYSICS TEST ensures that core protection at the 

reduced power level is established and will remain in place during the 

PHYSICS TESTS. Performing the verification once every 8 hours allows 

the operator adequate time for determining any degradation of the 

established trip setpoint margin before and during PHYSICS TESTS and 

for adjusting the nuclear overpower trip setpoint. 
PHYSICS TESTS Exceptions - MODE 1 

B 3.1.8 

BWOG STS B 3.1.8-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.1.8.4

The SDM is verified by performing a reactivity balance calculation, 

considering the following reactivity effects: 

a. Reactor Coolant System (RCS) boron concentration, 

b. CONTROL ROD position, 

c. Doppler defect, 

d. Fuel burnup based on gross thermal energy generation, 

e. Samarium concentration, 

f. Xenon concentration, and 

g. Moderator defect. 

The Frequency of 24 hours is based on the generally slow change in 

required boron concentration and on the low probability of an accident 

occurring without the required SDM. 

REFERENCES 1. 10 CFR 50, Appendix B, Section XI. 

 2. 10 CFR 50.59. 

 3. Regulatory Guide 1.68, Revision 2, August 1978. 

 4. ANSI/ANS-19.6.1-1985, December 13, 1985. 

 5. FSAR, Section [13.4.8]. 

 6. FSAR, Section [13.4.8], [Tables 13-3 and 13-4, Am. 49, 

September 30, 1976]. 
PHYSICS TESTS Exceptions - MODE 2 

B 3.1.9 

BWOG STS B 3.1.9-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.9 PHYSICS TESTS Exceptions - MODE 2 

BASES 

BACKGROUND The purpose of this MODE 2 LCO is to permit PHYSICS TESTS to be 

conducted by providing exemptions from the requirements of other LCOs. 

Establishment of a test program to verify that structures, systems, and 

components will perform satisfactorily in service is required by 

10 CFR 50, Appendix B (Ref. 1). Testing is required as an integral part of 

the design, fabrication, construction, and operation of the power plant. All 

functions necessary to ensure that specified design conditions are not 

violated during normal operation and anticipated operational occurrences 

must be tested. Requirements for notification of the NRC, for the purpose 

of conducting tests and experiments, are specified in 10 CFR 50.59 

(Ref. 2). 

The key objectives of a test program are to (Ref. 3): 

a. Ensure that the facility has been adequately designed, 

b. Validate the analytical models used in the design and analysis, 

c. Verify the assumptions used to predict unit response, 

d. Ensure that installation of equipment in the facility has been 

accomplished in accordance with the design, and 

e. Verify that the operating and emergency procedures are adequate. 

To accomplish these objectives, testing is performed prior to initial 

criticality; during startup, low power operations, and power ascension; at 

high powers; and after each refueling. The PHYSICS TESTS 

requirements for reload fuel cycles ensure that the operating 

characteristics of the core are consistent with the design predictions, and 

that the core can be operated as designed (Ref. 4). 

PHYSICS TESTS procedures are written and approved in accordance 

with established guidelines. The procedures include all information 

necessary to permit a detailed execution of testing required to ensure that 

the design intent is met. PHYSICS TESTS are performed in accordance 

with these procedures, and test results are approved prior to continued 

power escalation and long term power operation. 
PHYSICS TESTS Exceptions - MODE 2 

B 3.1.9 

BWOG STS B 3.1.9-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Examples of MODE 2 PHYSICS TESTS include determination of critical 

boron concentration, CONTROL ROD group worth, and reactivity 

coefficients. 

APPLICABLE Reference 5 defines requirements for initial testing of the facility, including 

SAFETY PHYSICS TESTS. Tables 13-3 and 13-4 (Ref. 6) summarize the zero, 

ANALYSES low power, and power tests. Requirements for reload fuel cycle 

PHYSICS TESTS are given in Table 1 of ANSI/ANS-19.6.1-1985 (Ref. 4). 

Although these PHYSICS TESTS are generally accomplished within the 

limits of all LCOs, conditions may occur when one or more of the LCOs 

must be suspended to make completion of PHYSICS TESTS possible or 

practical. 

It is acceptable to suspend the following LCOs for PHYSICS TESTS 

because reactor protection criteria are preserved by the LCOs still 

maintained and by the SRs: 

LCO 3.1.3, "Moderator Temperature Coefficient (MTC)," 

LCO 3.1.4, "CONTROL ROD Group Alignment Limits," 

LCO 3.1.5, "Safety Rod Insertion Limits," 

LCO 3.1.6, "AXIAL POWER SHAPING ROD (APSR) Alignment Limits," 

LCO 3.2.1, "Regulating Rod Insertion Limits" for the restricted operation 

region only, and 

LCO 3.4.2, "RCS Minimum Temperature for Criticality." 

Even if an accident occurs during PHYSICS TESTS with one or more 

LCOs suspended, fuel damage criteria are preserved because the limits 

on THERMAL POWER and shutdown capability are maintained during 

the PHYSICS TESTS. 

Shutdown capability is preserved by limiting maximum obtainable 

THERMAL POWER and maintaining adequate SDM, when in MODE 2 

PHYSICS TESTS. In MODE 2, the Reactor Coolant System (RCS) 

temperature must be within the narrow range instrumentation for plant 

control. The narrow range temperature instrumentation goes on scale at 

520°F. Therefore, it is considered safe to allow the minimum RCS 

temperature to decrease to 520°F during MODE 2 PHYSICS TESTS, 

based on the low probability of an accident occurring and on prior 

operating experience. 
PHYSICS TESTS Exceptions - MODE 2 

B 3.1.9 

BWOG STS B 3.1.9-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

PHYSICS TESTS include measurement of core nuclear parameters or 

exercise of control components that affect process variables. 

As described in LCO 3.0.7, compliance with Test Exceptions LCOs is 

optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test 

Exceptions LCOs provide flexibility to perform certain operations by 

appropriately modifying requirements of other LCOs. A discussion of the 

criteria satisfied for the other LCOs is provided in their respective Bases. 

LCO This LCO permits individual CONTROL RODS to be positioned outside of 

their specified group alignment and withdrawal limits and to be assigned 

to other than specified CONTROL ROD groups during the performance of 

PHYSICS TESTS. In addition, this LCO permits verification of the 

fundamental core characteristics. 

This LCO also allows suspension of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, 

LCO 3.1.6, LCO 3.2.1, and LCO 3.4.2, provided: 

a. THERMAL POWER is ≤ 5% RTP, 

b. Nuclear overpower trip setpoints on the OPERABLE nuclear power 

range channels are set to ≤ 25% RTP, 

c. Nuclear instrumentation high startup rate CONTROL ROD withdrawal 

inhibit is OPERABLE, and 

d. SDM is maintained within the limits specified in the COLR. 

The limits of LCO 3.2.3 and LCO 3.2.4 do not apply in MODE 2. 

Inhibiting CONTROL ROD withdrawal, based on startup rate, also limits 

local linear heat rate (LHR), departure from nucleate boiling ratio (DNBR), 

and peak RCS pressure during accidents initiated from low power. 

APPLICABILITY This LCO is applicable when the reactor is either subcritical or critical with 

THERMAL POWER ≤ 5% RTP. The Applicability is stated as "during 

PHYSICS TESTS initiated in MODE 2" to ensure that the 5% RTP 

maximum power level is not exceeded. Should the THERMAL POWER 

exceed 5% RTP, and consequently the unit enter MODE 1, this 
PHYSICS TESTS Exceptions - MODE 2 

B 3.1.9 

BWOG STS B 3.1.9-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

Applicability statement prevents exiting this Specification and its Required 

Actions. This LCO is applicable for initial criticality or low power testing, 

as defined by Regulatory Guide 1.68 (Ref. 3). In MODE 1, Applicability of 

this LCO is not required because LCO 3.1.8, "PHYSICS TESTS 

Exceptions," addresses PHYSICS TESTS exceptions in MODE 1. In 

MODES 3, 4, 5, and 6, Applicability is not required because physics 

testing is not performed in these MODES. 

ACTIONS A.1

If THERMAL POWER exceeds 5% RTP, a positive reactivity addition 

could be occurring, and a nuclear excursion could result. To ensure that 

local LHR, DNBR, and RCS pressure limits are not violated, the reactor is 

tripped. The necessary prompt action requires manual operator action to 

open the CONTROL ROD drive trip breakers without attempts to reduce 

THERMAL POWER by actuating the control system (i.e., CONTROL 

ROD insertion or RCS boration). 

B.1 and B.2

If the SDM requirements are not met, boration must be initiated promptly. 

A Completion Time of 15 minutes is adequate for an operator to correctly 

align and start the required systems and components. The operator 

should begin boration with the best source available for the plant 

conditions. Boration will be continued until SDM is within limit. In the 

determination of the required combination of boration flow rate and boron 

concentration, there is no unique requirement that must be satisfied. 

Suspension of PHYSICS TESTS exceptions requires restoration of each 

of the applicable LCOs to within specification. 

C.1

If the nuclear overpower trip setpoint is > 25% RTP, then 1 hour is 

allowed for the operator to restore the nuclear overpower trip setpoint 

within limits or to complete an orderly suspension of PHYSICS TESTS 

exceptions. Suspension of PHYSICS TESTS exceptions requires 

restoration of each of the applicable individual LCOs to within 
PHYSICS TESTS Exceptions - MODE 2 

B 3.1.9 

BWOG STS B 3.1.9-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

specification, in order to ensure that continuity of reactor operation is 

within initial condition limits. This required Completion Time is consistent 

with, or more conservative than, those specified for the individual LCOs 

addressed by PHYSICS TESTS exceptions. 

If the nuclear instrumentation high startup rate CONTROL ROD 

withdrawal inhibit function is inoperable, then 1 hour is allowed for the 

operator to restore the function to OPERABLE status or to complete an 

orderly suspension of PHYSICS TESTS exceptions. Suspension of 

PHYSICS TESTS exceptions requires restoration of each of the 

applicable individual LCOs to within specification. This required 

Completion Time is consistent with, or more conservative than, those 

specified for the individual LCOs addressed by PHYSICS TESTS 

exceptions. 

The nuclear instrumentation high startup rate CONTROL ROD withdrawal 

inhibit function is not required when the reactor power level is above the 

operating range of the instrumentation channel. For example, if the 

reactor power level is above the source range channel operating range, 

then only the intermediate range high startup rate CONTROL ROD 

withdrawal inhibit is required to be functional. 

SURVEILLANCE SR 3.1.9.1

REQUIREMENTS 

Performing a CHANNEL FUNCTIONAL TEST on each nuclear 

instrumentation source and intermediate range high startup rate 

CONTROL ROD withdrawal inhibit and nuclear overpower channel, 

ensures that the instrumentation required to detect a deviation from 

THERMAL POWER or to detect a high startup rate is OPERABLE. 

Performing the test once within 24 hours, prior to initiating PHYSICS 

TESTS, ensures that the instrumentation is OPERABLE shortly before 

PHYSICS TESTS begin and allows the operator to correct any 

instrumentation problems. 

SR 3.1.9.2

Verification that THERMAL POWER is ≤ 5% RTP ensures that an 

adequate margin is maintained between the THERMAL POWER level 

and the nuclear overpower trip setpoint. Hourly verification is adequate 

for the operator to determine any change in core conditions, such as 

xenon redistribution occurring after a THERMAL POWER reduction, that 

could cause THERMAL POWER to exceed the specified limit. 
PHYSICS TESTS Exceptions - MODE 2 

B 3.1.9 

BWOG STS B 3.1.9-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.1.9.3

Verification that the nuclear overpower trip setpoint is within the limit 

specified for PHYSICS TESTS ensures that core protection at the 

reduced power level is established and will remain in place during 

PHYSICS TESTS. Performing the verification once per 8 hours allows 

the operator adequate time for determining any degradation of the 

established trip setpoint margin before and during PHYSICS TESTS and 

for adjusting the nuclear overpower trip setpoint. 

SR 3.1.9.4

The SDM is verified by performing a reactivity balance calculation, 

considering the following reactivity effects: 

a. RCS boron concentration, 

b. CONTROL ROD position, 

c. RCS average temperature, 

d. Fuel burnup based on gross thermal energy generation, 

e. Samarium concentration, 

f. Xenon concentration, 

g. Isothermal temperature coefficient (ITC), when below the point of 

adding heat (POAH), 

h. Moderator defect, when above the POAH, and 

i. Doppler defect, when above the POAH. 

Using the ITC accounts for Doppler reactivity in this calculation when the 

reactor is subcritical or critical but below the POAH, and the fuel 

temperature will be changing at the same rate as the RCS. 

The Frequency of 24 hours is based on the generally slow change in 

required boron concentration and on the low probability of an accident 

occurring without the required SDM. 
PHYSICS TESTS Exceptions - MODE 2 

B 3.1.9 

BWOG STS B 3.1.9-7 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 50, Appendix B, Section XI. 

 2. 10 CFR 50.59. 

 3. Regulatory Guide 1.68, Revision 2, August 1978. 

 4. ANSI/ANS-19.6.1-1985, December 13, 1985. 

 5. FSAR, Section [13.4.8]. 

 6. FSAR, Section [13.4.8], [Table 13-3 and Table 13-4]. 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTION LIMITS 

B 3.2.1 Regulating Rod Insertion Limits 

BASES 

BACKGROUND The insertion limits of the regulating rods are initial condition assumptions 

used in all safety analyses that assume rod insertion upon reactor trip. 

The insertion limits directly affect the core power distributions, the worth 

of a potential ejected rod, the assumptions of available SDM, and the 

initial reactivity insertion rate. 

The applicable criteria for these reactivity and power distribution design 

requirements are described in 10 CFR 50, Appendix A, GDC 10, "Reactor 

Design," GDC-26, "Reactivity Control System Redundancy-and 

Capability," GDC 28, "Reactivity Limits" (Ref. 1), and in 10 CFR 50.46, 

"Acceptance Criteria for Emergency Core Cooling Systems for Light 

Water Nuclear Power Plants" (Ref. 2). 

Limits on regulating rod insertion have been established, and all rod 

positions are monitored and controlled during power operation to ensure 

that the power distribution and reactivity limits defined by the design 

power peaking and SDM limits are not violated. 

The regulating rod groups operate with a predetermined amount of 

position overlap, in order to approximate a linear relation between rod 

worth and rod position (integral rod worth). To achieve this approximately 

linear relationship, the regulating rod groups are withdrawn and operated 

in a predetermined sequence. The automatic control system controls 

reactivity by moving the regulating rod groups in sequence within 

analyzed ranges. The group sequence and overlap limits are specified in 

the COLR. 

The regulating rods are used for precise reactivity control of the reactor. 

The positions of the regulating rods are normally controlled automatically 

by the automatic control system but can also be controlled manually. 

They are capable of adding reactivity quickly compared with borating or 

diluting the Reactor Coolant System (RCS). 

The power density at any point in the core must be limited to maintain 

specified acceptable fuel design limits, including limits that ensure that the 

criteria specified in 10 CFR 50.46 (Ref. 2) are not violated. Together, 

LCO 3.2.1, "Regulating Rod Insertion Limits," LCO 3.2.2, "AXIAL POWER 

SHAPING ROD (APSR) Insertion Limits," LCO 3.2.3, "AXIAL POWER 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

IMBALANCE Operating Limits," and LCO 3.2.4, "QUADRANT POWER 

TILT (QPT)," provide limits on control component operation and on 

monitored process variables to ensure that the core operates within the 

FQ(Z) and H N F∆ limits in the COLR. Operation within the FQ(Z) limits given 

in the COLR prevents power peaks that would exceed the loss of coolant 

accident (LOCA) limits derived from the analysis of the Emergency Core 

Cooling Systems (ECCS). Operation within the H

N F∆ limits given in the 

COLR prevents departure from nucleate boiling (DNB) during a loss of 

forced reactor coolant flow accident. In addition to the FQ(Z) and H N F∆

limits, certain reactivity limits are met by regulating rod insertion limits. 

The regulating rod insertion limits also restrict the ejected CONTROL 

ROD worth to the values assumed in the safety analysis and maintain the 

minimum required SDM in MODES 1 and 2. 

This LCO is required to minimize fuel cladding failures that breach the 

primary fission product barrier and release fission products into the 

reactor coolant in the event of a LOCA, loss of flow accident, ejected rod 

accident, or other postulated accidents requiring termination by a Reactor 

Protection System trip function. 

APPLICABLE The fuel cladding must not sustain damage as a result of normal 

SAFETY operation (Condition 1) or anticipated operational occurrences 

ANALYSES (Condition 2). The LCOs governing regulating rod insertion, APSR 

position, AXIAL POWER IMBALANCE, and QPT preclude core power 

distributions that violate the following fuel design criteria: 

a. During a large break LOCA, the peak cladding temperature must not 

exceed 2200°F (Ref. 2). 

b. During a loss of forced reactor coolant flow accident, there must be at 

least 95% probability at the 95% confidence level (the 95/95 DNB 

criterion) that the hot fuel rod in the core does not experience a DNB 

condition (Ref. 1). 

c. During an ejected rod accident, the fission energy input to the fuel 

must not exceed 280 cal/gm (Ref. 3). 

d. The CONTROL RODS must be capable of shutting down the reactor 

with a minimum required SDM with the highest worth CONTROL 

ROD stuck fully withdrawn (Ref. 1). 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

Fuel cladding damage does not occur when the core is operated outside 

the conditions of these LCOs during normal operation. However, fuel 

cladding damage could result if an accident occurs with the simultaneous 

violation of one or more of the LCOs limiting the regulating rod position, 

the APSR position, the AXIAL POWER IMBALANCE, and the QPT. This 

potential for fuel cladding damage exists because changes in the power 

distribution can cause increased power peaking and correspondingly 

increased local linear heat rates (LHRs). 

The SDM requirement is met by limiting the regulating and safety rod 

insertion limits such that sufficient inserted reactivity is available in the 

rods to shut down the reactor to hot zero power with a reactivity margin 

that assumes that the maximum worth rod remains fully withdrawn upon 

trip (Ref. 4). Operation at the SDM based regulating rod insertion limit 

may also indicate that the maximum ejected rod worth could be equal to 

the limiting value. 

Operation at the regulating rod insertion limits may cause the local core 

power to approach the maximum linear heat generation rate or peaking 

factor with the allowed QPT present. 

The regulating rod and safety rod insertion limits ensure that the safety 

analysis assumptions for SDM, ejected rod worth, and power distribution 

peaking factors remain valid (Refs. 3, 5, and 6). 

The regulating rod insertion limits LCO satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO The limits on CONTROL ROD sequence, including group overlap, and 

insertion positions as defined in the COLR, must be maintained because 

they ensure that the resulting power distribution is within the range of 

analyzed power distributions and that the SDM and ejected rod worth are 

maintained. 

The overlap between regulating groups provides more uniform rates of 

reactivity insertion and withdrawal and is imposed to maintain acceptable 

power peaking during regulating rod motion. 

Error adjusted maximum allowable setpoints for regulating rod insertion 

are provided in the COLR. The setpoints are derived by an adjustment of 

the measurement system independent limits to allow for THERMAL 

POWER level uncertainty and rod position errors. 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Actual alarm setpoints implemented in the unit may be more restrictive 

than the maximum allowable setpoint values to provide additional 

conservatism between the actual alarm setpoint and the measurement 

system independent limit. 

LCO 3.2.1 has been modified by a Note that suspends the LCO 

requirement for those regulating rods not within the limits of the COLR 

solely due to testing in accordance with SR 3.1.4.2, which verifies the 

freedom of the rods to move. This SR may require the regulating rods to 

move below the LCO limit, which would otherwise violate the LCO. 

APPLICABILITY The regulating rod sequence, overlap, and physical insertion limits shall 

be maintained with the reactor in MODES 1 and 2. These limits maintain 

the validity of the assumed power distribution, ejected rod worth, SDM, 

and reactivity insertion rate assumptions used in the safety analyses. 

Applicability in MODES 3, 4, and 5 is not required, because neither the 

power distribution nor ejected rod worth assumptions are exceeded in 

these MODES. SDM in MODES 3, 4, and 5 is governed by LCO 3.1.1, 

"SHUTDOWN MARGIN (SDM)." 

ACTIONS The regulating rod insertion alarm setpoints provided in the COLR are 

based on both the initial conditions assumed in the accident analyses and 

on the SDM. Specifically, separate insertion limits are specified to 

determine whether the unit is operating in violation of the initial conditions 

(e.g., the range of power distributions) assumed in the accident analyses 

or whether the unit is in violation of the SDM or ejected rod worth limits. 

Separate insertion limits are provided because different Required Actions 

and Completion Times apply, depending on which insertion limit has been 

violated. The area between the boundaries of acceptable operation and 

unacceptable operation, illustrated on the regulating rod insertion limit 

figures in the COLR, is the restricted region. The actions required when 

operation occurs in the restricted region are described under Condition A. 

The actions required when operation occurs in the unacceptable region 

are described under Condition C. 

A.1

Operation with the regulating rods in the restricted region shown on the 

regulating rod insertion figures specified in the COLR or with any group 

sequence or overlap outside the limits specified in the COLR potentially 

violates the LOCA LHR limits (FQ(Z) limits), or the loss of flow accident 

DNB peaking limits H N F∆ limits). The design calculations assume no 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

deviation in nominal overlap between regulating rod groups. However, 

deviations of 5% of the core height above or below the nominal overlap 

may be typical and do not cause significant differences in core reactivity, 

in power distribution, or in rod worth, relative to the design calculations. 

The group sequence must be maintained because design calculations 

assume the regulating rods withdraw and insert in a predetermined order. 

For verification that FQ(Z) and H

N F∆ are within their limits, SR 3.2.5.1 is 

performed using the Incore Detector System to obtain a three 

dimensional power distribution map. Verification that FQ(Z) and H N F∆ are 

within their limits ensures that operation with the regulating rods inserted 

into the restricted region does not violate the ECCS or DNB criteria 

(Ref. 7). The required Completion Time of 2 hours is acceptable in that it 

allows the operator sufficient time for obtaining a power distribution map 

and for verifying the power peaking factors. Repeating SR 3.2.5.1 every 

2 hours is acceptable because it ensures that continued verification of the 

power peaking factors is performed as core conditions (primarily 

regulating rod insertion and induced xenon redistribution) change. 

Monitoring the power peaking factors FQ(Z) and H N F∆ does not provide 

verification that the reactivity insertion rate on the rod trip or the ejected 

rod worth limit is maintained, because worth is a reactivity parameter 

rather than a power peaking parameter. However, if the COLR figures do 

not show that a rod insertion limit is ejected rod worth limited, then the 

ejected rod worth is no more limiting than the SDM based rod insertion 

limit in the core design (Ref. 8). Ejected rod worth limits are 

independently maintained by the Required Actions of Conditions A and C. 

Required Action A.1 is modified by a Note that requires the performance 

of SR 3.2.5.1 only when THERMAL POWER is greater than 20% RTP. 

This establishes a Required Action that is consistent with the Applicability 

of LCO 3.2.5, "Power Peaking Factors." 

A.2

Indefinite operation with the regulating rods inserted in the restricted 

region, or in violation of the group sequence or overlap limits, is not 

prudent. Even if power peaking monitoring per Required Action A.1 is 

continued, reactivity limits may not be met and the abnormal regulating 

rod insertion or group configuration may cause an adverse xenon 

redistribution, may cause the limits on AXIAL POWER IMBALANCE to be 

exceeded, or may adversely affect the long term fuel depletion pattern. 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Therefore, power peaking monitoring is allowed for up to 24 hours after 

discovery of failure to meet the requirements of this LCO. This required 

Completion Time is reasonable based on the low probability of an event 

occurring simultaneously with the limit out of specification in this relatively 

short time period. In addition, it precludes long term depletion with 

abnormal group insertions or configurations, thereby limiting the potential 

for an adverse xenon redistribution. 

B.1

If the regulating rods cannot be restored within the acceptable operating 

limits shown on the figures in the COLR within the required Completion 

Time (i.e., Required Action A.2 not met), then the limits can be restored 

by reducing the THERMAL POWER to a value allowed by the regulating 

rod insertion limits in the COLR. The required Completion Time of 

2 hours is sufficient to allow the operator to complete the power reduction 

in an orderly manner and without challenging the plant systems. 

Operation for up to 2 hours more in the restricted region shown in the 

COLR is acceptable, based on the low probability of an event occurring 

simultaneously with the limit out of specification in this relatively short 

time period. In addition, it precludes long term depletion with abnormal 

group insertions or configurations and limits the potential for an adverse 

xenon redistribution. 

C.1

Operation in the unacceptable region shown on the figures in the COLR 

corresponds to power operation with an SDM less than the minimum 

required value or with the ejected rod worth greater than the allowable 

value. The regulating rods may be inserted too far to provide sufficient 

negative reactivity insertion following a reactor trip and the ejected rod 

worth may exceed its initial condition limit. Therefore, the RCS boron 

concentration must be increased to restore the regulating rod insertion to 

a value that preserves the SDM and ejected rod worth limits. The RCS 

boration must occur as described in Section B 3.1.1. The required 

Completion Time of 15 minutes to initiate boration is reasonable, based 

on limiting the potential xenon redistribution, the low probability of an 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

accident occurring in this relatively short time period, and the number of 

steps required to complete this Action. This period allows the operator 

sufficient time for aligning the required valves and for starting the boric 

acid pumps. Boration continues until the regulating rod group positions 

are restored to at least within the restricted operational region, which 

restores the minimum SDM capability and reduces the potential ejected 

rod worth to within its limit. 

C.2.1

The required Completion Time of 2 hours from initial discovery of a 

regulating rod group in the unacceptable region until its restoration to 

within the restricted operating region shown on the figures in the COLR 

allows sufficient time for borated water to enter the RCS from the 

chemical addition and makeup systems, thereby allowing the regulating 

rods to be withdrawn to the restricted region. Operation in the restricted 

region for up to an additional 2 hours is reasonable, based on limiting the 

potential for an adverse xenon redistribution, the low probability of an 

accident occurring in this relatively short time period, and the number of 

steps required to complete this Action. 

C.2.2

The SDM and ejected rod worth limit can also be restored by reducing the 

THERMAL POWER to a value allowed by the regulating rod insertion 

limits in the COLR. The required Completion Time of 2 hours is sufficient 

to allow the operator to complete the power reduction in an orderly 

manner and without challenging the plant systems. Operation for up to 

2 hours more in the restricted region shown in the COLR is acceptable, 

based on the low probability of an event occurring simultaneously with the 

limit out of specification in this relatively short time period. In addition, it 

precludes long term depletion with abnormal group insertions or 

configurations and limits the potential for an adverse xenon redistribution. 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1

If the regulating rods cannot be restored to within the acceptable 

operating limits for the original THERMAL POWER, or if the power 

reduction cannot be completed within the required Completion Time, then 

the reactor is placed in MODE 3, in which this LCO does not apply. This 

Action ensures that the reactor does not continue operating in violation of 

the peaking limits, the ejected rod worth, the reactivity insertion rate 

assumed as initial conditions in the accident analyses, or the required 

minimum SDM assumed in the accident analyses. The required 

Completion Time of 6 hours is reasonable, based on operating 

experience regarding the amount of time required to reach MODE 3 from 

RTP without challenging plant systems. 

SURVEILLANCE SR 3.2.1.1

REQUIREMENTS 

This Surveillance ensures that the sequence and overlap limits are not 

violated. A Surveillance Frequency of 12 hours is acceptable because 

little rod motion occurs in 12 hours due to fuel burnup and the probability 

of a deviation occurring simultaneously with an inoperable sequence 

monitor in this relatively short time frame is low. Also, the Frequency 

takes into account other information available in the control room for 

monitoring the status of the regulating rods. 

SR 3.2.1.2

With an OPERABLE regulating rod insertion limit alarm, verification of the 

regulating rod insertion limits as specified in the COLR at a Frequency of 

12 hours is sufficient to ensure the OPERABILITY of the regulating rod 

insertion limit alarm and to detect regulating rod banks that may be 

approaching the group insertion limits, because little rod motion due to 

fuel burnup occurs in 12 hours. Also, the Frequency takes into account 

other information available in the control room for monitoring the status of 

the regulating rods. 
Regulating Rod Insertion Limits 

B 3.2.1 

BWOG STS B 3.2.1-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.2.1.3

Prior to achieving criticality, an estimated critical position for the 

CONTROL RODS is determined. Verification that SDM meets the 

minimum requirements ensures that sufficient SDM capability exists with 

the CONTROL RODS at the estimated critical position if it is necessary to 

shut down or trip the reactor after criticality. The Frequency of 4 hours 

prior to criticality provides sufficient time to verify SDM capability and 

establish the estimated critical position. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26. 

 2. 10 CFR 50.46. 

 3. FSAR, Section [ ] . 

 4. FSAR, Section [ ] . 

 5. FSAR, Section [ ] . 

 6. FSAR, Section [ ] . 

 7. FSAR, Section [ ] . 

 8. FSAR, Section [ ] . 
APSR Insertion Limits 

B 3.2.2 

BWOG STS B 3.2.2-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTION LIMITS 

B 3.2.2 AXIAL POWER SHAPING ROD (APSR) Insertion Limits 

BASES 

BACKGROUND The insertion limits of the APSRs are initial condition assumptions in all 

safety analyses that are affected by core power distributions. The 

applicable criterion for these power distribution design requirements are 

10 CFR 50, Appendix A, GDC 10, "Reactor Design" (Ref. 1), and 

10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling 

Systems for Light Water Nuclear Power Plants" (Ref. 2). 

Limits on APSR insertion have been established, and all APSR positions 

are monitored and controlled during power operation to ensure that the 

power distribution defined by the design power peaking limits is 

maintained. 

The power density at any point in the core must be limited to maintain 

specified acceptable fuel design limits, including limits that meet the 

criteria specified in Reference 2. Together, LCO 3.2.1, "Regulating Rod 

Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING ROD (APSR) 

Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE Operating 

Limits," and LCO 3.2.4, "QUADRANT POWER TILT (QPT)," provide limits 

on control component operation and on monitored process variables to 

ensure that the core operates within the FQ(Z) and H N F∆ limits in the 

COLR. Operation within the FQ(Z) limits given in the COLR prevents 

power peaks that exceed the loss of coolant accident (LOCA) limits 

derived from the analysis of the Emergency Core Cooling Systems 

(ECCS). Operation within the H N F∆ limits given in the COLR prevents 

departure from nucleate boiling (DNB) during a loss of forced reactor 

coolant flow accident. The APSRs are not required for reactivity insertion 

rate on trip or SDM and, therefore, they do not trip upon a reactor trip. 

This LCO is required to minimize fuel cladding failures that would breach 

the primary fission product barrier and release fission products to the 

reactor coolant in the event of a LOCA, loss of flow accident, ejected rod 

accident, or other postulated accident requiring termination by a Reactor 

Protection System trip function. 
APSR Insertion Limits 

B 3.2.2 

BWOG STS B 3.2.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The fuel cladding must not sustain damage as a result of normal 

SAFETY operation (Condition 1) or anticipated operational occurrences 

ANALYSES (Condition 2). Acceptance criteria for the safety and regulating rod 

insertion, APSR position, AXIAL POWER IMBALANCE, and QPT LCOs 

preclude core power distributions that violate the following fuel design 

criteria: 

a. During a large break LOCA, the peak cladding temperature must not 

exceed 2200°F (Ref. 2), 

b. During a loss of forced reactor coolant flow accident, there must be at 

least 95% probability at the 95% confidence level (the 95/95 DNB 

criterion) that the hot fuel rod in the core does not experience a DNB 

condition, 

c. During an ejected rod accident, the fission energy input to the fuel 

must not exceed 280 cal/gm (Ref. 3), and 

d. CONTROL RODS must be capable of shutting down the reactor with 

a minimum required SDM with the highest worth CONTROL ROD 

stuck fully withdrawn (GDC 26, Ref. 1). 

Fuel cladding damage does not occur when the core is operated outside 

these LCOs during normal operation. However, fuel cladding damage 

could result should an accident occur simultaneously with violation of one 

or more of these LCOs. This potential for fuel cladding damage exists 

because changes in the power distribution can cause increased power 

peaking and corresponding increased local linear heat rates. 

Operation at the APSR insertion limits may approach the maximum 

allowable linear heat generation rate or peaking factor with the allowed 

QPT present. 

The APSR insertion limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
APSR Insertion Limits 

B 3.2.2 

BWOG STS B 3.2.2-3 Rev. 3.0, 03/31/04 

BASES 

LCO The limits on APSR physical insertion as defined in the COLR must be 

maintained because they serve the function of controlling the power 

distribution within an acceptable range. 

The fuel cycle design assumes APSR withdrawal at the effective full 

power days (EFPD) burnup window specified in the COLR. Prior to this 

window, the APSRs cannot be maintained fully withdrawn in steady state 

operation. After this window, the APSRs are not allowed to be reinserted 

for the remainder of the fuel cycle. 

Error adjusted maximum allowable setpoints for APSR insertion are 

provided in the COLR. The setpoints are derived by adjustment of the 

measurement system independent limits to allow for THERMAL POWER 

level uncertainty and rod position errors. 

Actual alarm setpoints implemented in the unit may be more restrictive 

than the maximum allowable setpoint values to allow for additional 

conservatism between the actual alarm setpoints and the measurement 

system independent limits. 

APPLICABILITY The APSR physical insertion limits shall be maintained with the reactor in 

MODES 1 and 2. These limits maintain the power distribution within the 

range assumed in the accident analyses. In MODE 1, the limits on APSR 

insertion specified by this LCO maintain the axial fuel burnup design 

conditions assumed in the reload safety evaluation analysis. In MODE 2, 

applicability is required because keff ≥ 0.99. Applicability in MODES 3, 4, 

and 5 is not required, because the power distribution assumptions in the 

accident analyses would not be exceeded in these MODES. 

ACTIONS For steady state power operation, a normal position for APSR insertion is 

specified in the station operating procedures. The APSRs may be 

positioned as necessary for transient AXIAL POWER IMBALANCE 

control until the fuel cycle design requires them to be fully withdrawn. 

(Not all fuel cycles may incorporate APSR withdrawal.) APSR position 

limits are not imposed for gray APSRs, with two exceptions. If the fuel 

cycle design incorporates an APSR withdrawal (usually near end of cycle 

(EOC)), the APSRs may not be maintained in the fully withdrawn position 

prior to the fuel cycle burnup for the APSR withdrawal. If this occurs, the 

APSRs must be restored to their normal inserted position. Conversely, 

after the fuel cycle burnup for the APSR withdrawal occurs, the APSRs 

may not be reinserted for the remainder of the fuel cycle. These 

restrictions apply to ensure the axial burnup distribution that accumulates 

in the fuel will be consistent with the expected (as designed) distribution. 
APSR Insertion Limits 

B 3.2.2 

BWOG STS B 3.2.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

For verification that the core parameters FQ(Z) and H N F∆ are within their 

limits, SR 3.2.5.1 is performed using the Incore Detector System to obtain 

a three dimensional power distribution map. Successful verification that 

FQ(Z) and H

N F∆ are within their limits ensures that operation with the 

APSRs inserted or withdrawn in violation of the times specified in the 

COLR do not violate either the ECCS or DNB criteria (Ref. 4). The 

required Completion Time of 2 hours is reasonable to allow the operator 

to obtain a power distribution map and to verify the power peaking 

factors. Repeating SR 3.2.5.1 every 2 hours is reasonable to ensure that 

continued verification of the power peaking factors is obtained as core 

conditions (primarily the regulating rod insertion and induced xenon 

redistribution) change. 

Required Action A.1 is modified by a Note that requires the performance 

of SR 3.2.5.1 only when THERMAL POWER is greater than 20% RTP. 

This establishes a Required Action that is consistent with the Applicability 

of LCO 3.2.5, "Power Peaking Factors." 

A.2

Indefinite operation with the APSRs inserted or withdrawn in violation of 

the times specified in the COLR is not prudent. Even if power peaking 

monitoring per Required Action A.1 is continued, the abnormal APSR 

insertion or withdrawal may cause an adverse xenon redistribution, may 

cause the limits on AXIAL POWER IMBALANCE to be exceeded, or may 

affect the long term fuel depletion pattern. Therefore, power peaking 

monitoring is allowed for up to 24 hours. This required Completion Time 

is reasonable based on the low probability of an event occurring 

simultaneously with the APSR limit out of specification. In addition, it 

precludes long term depletion with the APSRs in positions that have not 

been analyzed, thereby limiting the potential for an adverse xenon 

redistribution. This time limit also ensures that the intended burnup 

distribution is maintained, and allows the operator sufficient time to 

reposition the APSRs to correct their positions. 

Because the APSRs are not operated by the automatic control system, 

manual action by the operator is required to restore the APSRs to the 

positions specified in the COLR. 
APSR Insertion Limits 

B 3.2.2 

BWOG STS B 3.2.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

If the APSRs cannot be restored to their intended positions within the 

required Completion Time of 24 hours, the reactor must be placed in 

MODE 3, in which this LCO does not apply. This action ensures that the 

fuel does not continue to be depleted in an unintended burnup 

distribution. The required Completion Time of 6 hours is reasonable, 

based on operating experience regarding the time required to reach 

MODE 3 from RTP in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE SR 3.2.2.1

REQUIREMENTS 

Fuel cycle designs that allow APSR withdrawal near EOC do not permit 

reinsertion of APSRs after the time of withdrawal. When the plant 

computer is OPERABLE, the operator will receive a computer alarm if the 

APSRs insert after that time in core life when the APSR withdrawal 

occurs. Verification that the APSRs are within their insertion limits at a 

12 hour Frequency is sufficient to ensure that the APSR insertion limits 

are preserved and the computer alarm remains OPERABLE. The 

12 hour Frequency required for performing this verification is sufficient 

because APSRs are positioned by manual control and are normally 

moved infrequently. The probability of a deviation occurring 

simultaneously with an inoperable computer alarm is low in this relatively 

short time frame. Also, the Frequency takes into account other 

information available in the control room for monitoring the axial power 

distribution in the reactor core. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26. 

 2. 10 CFR 50.46. 

 3. FSAR, Chapter [ ] . 

 4. FSAR, Chapter [ ] . 
AXIAL POWER IMBALANCE Operating Limits 

B 3.2.3 

BWOG STS B 3.2.3-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTION LIMITS 

B 3.2.3 AXIAL POWER IMBALANCE Operating Limits 

BASES 

BACKGROUND This LCO is required to limit the core power distribution based on 

accident initial condition criteria. 

The power density at any point in the core must be limited to maintain 

specified acceptable fuel design limits, including limits that satisfy the 

criteria specified in 10 CFR 50.46 (Ref. 1). This LCO provides limits on 

AXIAL POWER IMBALANCE to ensure that the core operates within the 

FQ(Z) and H N F∆ limits given in the COLR. Operation within the FQ(Z) limits 

given in the COLR prevents power peaks that exceed the loss of coolant 

accident (LOCA) limits derived from the analysis of the Emergency Core 

Cooling Systems (ECCS). Operation within the H N F∆ limits given in the 

COLR prevents departure from nucleate boiling (DNB) during a loss of 

forced reactor coolant flow accident. 

This LCO is required to limit fuel cladding failures that breach the primary 

fission product barrier and release fission products into the reactor 

coolant in the event of a LOCA, loss of forced reactor coolant flow 

accident, or other postulated accident requiring termination by a Reactor 

Protection System trip function. This LCO limits the amount of damage to 

the fuel cladding during an accident by maintaining the validity of the 

assumptions in the safety analyses related to the initial power distribution 

and reactivity. 

Fuel cladding failure during a postulated LOCA is limited by restricting the 

maximum linear heat rate (LHR) so that the peak cladding temperature 

does not exceed 2200°F (Ref. 2). Peak cladding temperatures > 2200°F 

cause severe cladding failure by oxidation due to a Zircaloy water 

reaction. Other criteria must also be met (e.g., maximum cladding 

oxidation, maximum hydrogen generation, coolable geometry, and long 

term cooling). However, peak cladding temperature is usually most 

limiting. 

Proximity to the DNB condition is expressed by the departure from 

nucleate boiling ratio (DNBR), defined as the ratio of the cladding surface 

heat flux required to cause DNB to the actual cladding surface heat flux. 

The minimum DNBR value during both normal operation and anticipated 

transients is limited to the DNBR correlation limit for the particular fuel 

design in use and is accepted as an appropriate margin to DNB. The 

DNB correlation limit ensures that there is at least 95% probability at the 

95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the 

core does not experience DNB. 
AXIAL POWER IMBALANCE Operating Limits 

B 3.2.3 

BWOG STS B 3.2.3-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The measurement system independent limits on AXIAL POWER 

IMBALANCE are determined directly by the reload safety evaluation 

analysis without adjustment for measurement system error and 

uncertainty. Operation beyond these limits could invalidate the 

assumptions used in the accident analyses regarding the core power 

distribution. 

APPLICABLE The fuel cladding must not sustain damage as a result of normal 

SAFETY operation (Condition 1) and anticipated operational occurrences 

ANALYSES (Condition 2). The LCOs based on power distribution, LCO 3.2.1, 

"Regulating Rod Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING 

ROD (APSR) Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE 

Operating Limits," and LCO 3.2.4, "QUADRANT POWER TILT (QPT)," 

preclude core power distributions that would violate the following fuel 

design criteria: 

a. During a large break LOCA, peak cladding temperature must not 

exceed 2200°F (Ref. 1). 

b. During a loss of forced reactor coolant flow accident, there must be at 

least a 95% probability at the 95% confidence level (the 95/95 DNB 

criterion) that the hot fuel rod in the core does not experience a DNB 

condition. 

The regulating rod positions, the APSR positions, the AXIAL POWER 

IMBALANCE, and the QPT are process variables that characterize and 

control the three dimensional power distribution of the reactor core. 

Fuel cladding damage does not occur when the core is operated outside 

this LCO during normal operation. However, fuel cladding damage could 

result should an accident occur with simultaneous violation of one or 

more of the LCOs governing the four process variables cited above. This 

potential for fuel cladding damage exists because changes in the power 

distribution can cause increased power peaking and corresponding 

increased local LHRs. 
AXIAL POWER IMBALANCE Operating Limits 

B 3.2.3 

BWOG STS B 3.2.3-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The regulating rod insertion, the APSR positions, the AXIAL POWER 

IMBALANCE, and the QPT are monitored and controlled during power 

operation to ensure that the power distribution is within the bounds set by 

the safety analyses. The axial power distribution is maintained primarily 

by the AXIAL POWER IMBALANCE and the APSR position limits; and 

the radial power distribution is maintained primarily by the QPT limits. 

The regulating rod insertion limits affect both the radial and axial power 

distributions. 

The dependence of the core power distribution on burnup, regulating rod 

insertion, APSR position, and spatial xenon distribution is taken into 

account when the reload safety evaluation analysis is performed. 

Operation at the AXIAL POWER IMBALANCE limit must be interpreted as 

operating the core at the maximum allowable FQ(Z) or H N F∆ peaking 

factors assumed as initial conditions for the accident analyses with the 

allowed QPT present. 

AXIAL POWER IMBALANCE satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO The power distribution LCO limits have been established based on 

correlations between power peaking and easily measured process 

variables: regulating rod position, APSR position, AXIAL POWER 

IMBALANCE, and QPT. The AXIAL POWER IMBALANCE envelope 

contained in the COLR represents the setpoints for which the core power 

distribution would either exceed the LOCA LHR limits or cause a 

reduction in the DNBR below the Safety Limit during the loss of flow 

accident with the allowable QPT present and with the APSR positions 

consistent with the limitations on APSR withdrawal determined by the fuel 

cycle design and specified by LCO 3.2.2. 

Operation beyond the power distribution based LCO limits for the 

corresponding ALLOWABLE THERMAL POWER and simultaneous 

occurrence of either the LOCA or loss of forced reactor coolant flow 

accident has an acceptably low probability. Therefore, if the LCO limits 

are violated, a short time is allowed for corrective action before a 

significant power reduction is required. 
AXIAL POWER IMBALANCE Operating Limits 

B 3.2.3 

BWOG STS B 3.2.3-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The AXIAL POWER IMBALANCE maximum allowable setpoints 

(measurement system dependent limits) applicable for the full Incore 

Detector System, the Minimum Incore Detector System, and the Excore 

Detector System are provided in the COLR. 

Actual alarm setpoints implemented in the unit may be more restrictive 

than the maximum allowable setpoint values to provide additional 

conservatism between the actual alarm setpoints and the measurement 

system independent limit. 

APPLICABILITY In MODE 1, the limits on AXIAL POWER IMBALANCE must be 

maintained when THERMAL POWER is > 40% RTP to prevent the core 

power distribution from exceeding the LOCA and loss of flow assumptions 

used in the accident analyses. Applicability of these limits at < 40% RTP 

in MODE 1 is not required. This operation is acceptable because the 

combination of AXIAL POWER IMBALANCE with the maximum allowable 

THERMAL POWER level will not result in LHRs sufficiently large to 

violate the fuel design limits. In MODES 2, 3, 4, 5, and 6, this LCO is not 

applicable because the reactor is not generating sufficient THERMAL 

POWER to produce fuel damage. 

In MODE 1, it may be necessary to suspend the AXIAL POWER 

IMBALANCE limits during PHYSICS TESTS per LCO 3.1.8, "PHYSICS 

TESTS Exceptions - MODE 1." Suspension of these limits is permissible 

because the reactor protection criteria are maintained by the remaining 

LCOs governing the three dimensional power distribution and by the 

Surveillances required by LCO 3.1.8. 

ACTIONS A.1

The AXIAL POWER IMBALANCE operating limits that maintain the 

validity of the assumptions regarding the power distributions in the 

accident analyses of the LOCA and the loss of flow accident are provided 

in the COLR. Operation within the AXIAL POWER IMBALANCE limits 

given in the COLR is the acceptable region of operation. Operation in 

violation of the AXIAL POWER IMBALANCE limits given in the COLR is 

the restricted region of operation. 

Operation with AXIAL POWER IMBALANCE in the restricted region 

shown on the AXIAL POWER IMBALANCE figures in the COLR 

potentially violates the LOCA LHR limits (FQ(Z) limits) or the loss of flow 

accident DNB peaking limits H N F∆ limits) or both. For verification that 
AXIAL POWER IMBALANCE Operating Limits 

B 3.2.3 

BWOG STS B 3.2.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

FQ(Z) and H

N F∆ are within their specified limits, SR 3.2.5.1 is performed 

using the Incore Detector System to obtain a three dimensional power 

distribution map. Verification that FQ(Z) and H N F∆ are within their specified 

limits ensures that operation with the AXIAL POWER IMBALANCE in the 

restricted region does not violate the ECCS or 95/95 DNB criteria. The 

required Completion Time of 2 hours provides reasonable time for the 

operator to obtain a power distribution map and to determine and verify 

that the power peaking factors are within their specified limits. The 2 hour 

Frequency provides reasonable time to ensure that continued verification 

of the power peaking factors is obtained as core conditions (primarily 

regulating rod insertion and induced xenon redistribution) change, 

because little rod motion occurs in 2 hours due to fuel burnup, the 

potential for xenon redistribution is limited, and the probability of an event 

occurring in this short time frame is low. 

A.2

Indefinite operation with the AXIAL POWER IMBALANCE in the restricted 

region is not prudent. Even if power peaking monitoring per Required 

Action A.1 is continued, excessive AXIAL POWER IMBALANCE over an 

extended period of time may cause a potentially adverse xenon 

redistribution to occur. Therefore, power peaking monitoring is only 

allowed for a maximum of 24 hours. This required Completion Time is 

reasonable based on the low probability of a limiting event occurring 

simultaneously with the AXIAL POWER IMBALANCE outside the limits of 

this LCO. In addition, this limited Completion Time precludes long term 

depletion of the reactor fuel with excessive AXIAL POWER IMBALANCE 

and gives the operator sufficient time to reposition the APSRs or 

regulating rods to reduce the AXIAL POWER IMBALANCE because 

adverse effects of xenon redistribution and fuel depletion are limited. 

B.1

If the Required Actions and the associated Completion Times of 

Condition A cannot be met, the AXIAL POWER IMBALANCE may exceed 

its specified limits and the reactor may be operating with a global axial 

power distribution mismatch. Continued operation in this configuration 

may induce an axial xenon oscillation and may result in an increased 

linear heat generation rate when the xenon redistributes. Reducing 
AXIAL POWER IMBALANCE Operating Limits 

B 3.2.3 

BWOG STS B 3.2.3-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

THERMAL POWER to ≤ 40% RTP reduces the maximum LHR to a value 

that does not exceed the FQ(Z) and H

N F∆ initial condition limits assumed in 

the accident analyses. The required Completion Time of 2 hours is 

reasonable based on limiting a potentially adverse xenon redistribution, 

the low probability of an accident occurring in this relatively short time 

period, and the number of steps required to complete this Action. 

SURVEILLANCE The AXIAL POWER IMBALANCE can be monitored by both the Incore 

REQUIREMENTS and Excore Detector Systems. The AXIAL POWER IMBALANCE 

maximum allowable setpoints are derived from their corresponding 

measurement system independent limits by adjusting for both the system 

observability errors and instrumentation errors. Although they may be 

based on the same measurement system independent limits, the 

setpoints for the different systems are not identical because of differences 

in the errors applicable for each of these systems. The uncertainty 

analysis that defines the required error adjustment to convert the 

measurement system independent limits to alarm setpoints assumes that 

75% of the detectors in each quadrant are OPERABLE. Detectors 

located on the core major axes are assumed to contribute one half of their 

output to each quadrant; detectors in the center assembly are assumed to 

contribute one quarter of their output to each quadrant. For AXIAL 

POWER IMBALANCE measurements using the Incore Detector System, 

the Minimum Incore Detector System consists of OPERABLE detectors 

configured as follows: 

a. Nine detectors shall be arranged such that there are three detectors 

in each of three strings and there are three detectors lying in the 

same axial plane, with one plane at the core midplane and one plane 

in each axial core half, 

b. The axial planes in each core half shall be symmetrical about the 

core midplane, and 

c. The detector strings shall not have radial symmetry. 

Figure B 3.2.3-1 (Minimum Incore Detector System for AXIAL POWER 

IMBALANCE Measurement) depicts an example of this configuration. 

This arrangement is chosen to reduce the uncertainty in the 

measurement of the AXIAL POWER IMBALANCE by the Minimum Incore 

Detector System. For example, the requirement for placing one detector 

of each of the three strings at the core midplane puts three detectors in 
AXIAL POWER IMBALANCE Operating Limits 

B 3.2.3 

BWOG STS B 3.2.3-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

the central region of the core where the neutron flux tends to be higher. It 

also helps prevent measuring an AXIAL POWER IMBALANCE that is 

excessively large when the reactor is operating at low THERMAL 

POWER levels. The third requirement for placement of detectors (i.e., 

radial asymmetry) reduces uncertainty by measuring the neutron flux at 

core locations that are not radially symmetric. 

SR 3.2.3.1

Verification of the AXIAL POWER IMBALANCE indication every 12 hours 

ensures that the AXIAL POWER IMBALANCE limits are not violated and 

takes into account other information and alarms available to the operator 

in the control room. This Surveillance Frequency is acceptable because 

the mechanisms that can cause AXIAL POWER IMBALANCE, such as 

xenon redistribution or CONTROL ROD drive mechanism malfunctions 

that cause slow AXIAL POWER IMBALANCE increases, can be 

discovered by the operator before the specified limits are violated. 

REFERENCES 1. 10 CFR 50.46. 

2. FSAR, Chapter [15]. 
AXIAL POWER IMBALANCE Operating Limits 

B 3.2.3 

BWOG STS B 3.2.3-8 Rev. 3.0, 03/31/04 

(f) 

w 

z 

<( 

_j 

Q_ 

z 

0 

I-

<( 

1--

z 

w 

~ 

::> 

a: 

1--

(f) 

z 

w 

a: 

0 

0 

z 

------ ~ 

This figure for illustration only. 

Do not use for operation. 

-Lack of Radial Symmetr ----------- Top Axial Core Half 

Axial Midplane 

Bottom Axial Core Half 

Figure B 3.2.3-1 (page 1 of 1) 

Minimum lncore System for AXIAL POWER IMBALANCE Measurement 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTION LIMITS 

B 3.2.4 QUADRANT POWER TILT (QPT) 

BASES 

BACKGROUND This LCO is required to limit the core power distribution based on 

accident initial condition criteria. 

The power density at any point in the core must be limited to maintain 

specified acceptable fuel design limits, including limits that preserve the 

criteria specified in 10 CFR 50.46 (Ref. 1). Together, LCO 3.2.1, 

"Regulating Rod Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING 

ROD (APSR) Insertion Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE 

Operating Limits," and LCO 3.2.4, "QUADRANT POWER TILT (QPT)," 

provide limits on control component operation and on monitored process 

variables to ensure that the core operates within the FQ(Z) and H

N F∆ limits 

given in the COLR. Operation within the FQ(Z) limits given in the COLR 

prevents power peaks that exceed the loss of coolant accident (LOCA) 

limits derived by Emergency Core Cooling Systems (ECCS) analysis. 

Operation within the H

N F∆ limits given in the COLR prevents departure 

from nucleate boiling (DNB) during a loss of forced reactor coolant flow 

accident. 

This LCO is required to limit fuel cladding failures that breach the primary 

fission product barrier and release fission products to the reactor coolant 

in the event of a LOCA, loss of forced reactor coolant flow, or other 

accident requiring termination by a Reactor Protection System trip 

function. This LCO limits the amount of damage to the fuel cladding 

during an accident by maintaining the validity of the assumptions used in 

the safety analysis related to the initial power distribution and reactivity. 

Fuel cladding failure during a postulated LOCA is limited by restricting the 

maximum linear heat rate (LHR) so that the peak cladding temperature 

does not exceed 2200°F (Ref. 2). Peak cladding temperatures > 2200°F 

cause severe cladding failure by oxidation due to a Zircaloy water 

reaction. Other criteria must also be met (e.g., maximum cladding 

oxidation, maximum hydrogen generation, coolable geometry, and long 

term cooling). However, peak cladding temperature is usually most 

limiting. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Proximity to the DNB condition is expressed by the departure from 

nucleate boiling ratio (DNBR), defined as the ratio of the cladding surface 

heat flux required to cause DNB to the actual cladding surface heat flux. 

The minimum DNBR value during both normal operation and anticipated 

transients is limited to the DNBR correlation limit for the particular fuel 

design in use, and is accepted as an appropriate margin to DNB. The 

DNBR correlation limit ensures that there is at least 95% probability at the 

95% confidence level (the 95/95 DNB criterion) that the hot fuel rod in the 

core does not experience DNB. 

The measurement system independent limits on QPT are determined 

directly by the reload safety evaluation analysis without adjustment for 

measurement system error and uncertainty. Operation beyond these 

limits could invalidate core power distribution assumptions used in the 

accident analysis. The error adjusted maximum allowable alarm 

setpoints (measurement system dependent limits) for QPT are specified 

in the COLR. 

APPLICABLE The fuel cladding must not sustain damage as a result of normal 

SAFETY operation (Condition 1) and anticipated operational occurrences 

ANALYSES (Condition 2). The LCOs based on power distribution (LCO 3.2.1, 

LCO 3.2.2, LCO 3.2.3, and LCO 3.2.4) preclude core power distributions 

that violate the following fuel design criteria: 

a. During a large break LOCA, the peak cladding temperature must not 

exceed 2200°F (Ref. 3). 

b. During a loss of forced reactor coolant flow accident, there must be at 

least 95% probability at the 95% confidence level (the 95/95 DNB 

criterion) that the hot fuel rod in the core does not experience a DNB 

condition. 

QPT is one of the process variables that characterize and control the 

three dimensional power distribution of the reactor core. 

Fuel cladding damage does not occur when the core is operated outside 

this LCO during normal operation. However, fuel cladding damage could 

result if an accident occurs with simultaneous violation of one or more of 

the LCOs governing the core power distribution. Changes in the power 

distribution can cause increased power peaking and correspondingly 

increased local LHRs. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The dependence of the core power distribution on burnup, regulating rod 

insertion, APSR position, and spatial xenon distribution is taken into 

account during the reload safety evaluation analysis. An allowance for 

QPT is accommodated in the analysis and resultant LCO limits. The 

increase in peaking taken for QPT is developed from a database of full 

core power distribution calculations (Ref. 4). The calculations consist of 

simulations of many power distributions with tilt causing mechanisms 

(e.g., dropped or misaligned CONTROL RODS, broken APSR fingers 

fully inserted, misloaded assemblies, and burnup gradients). An increase 

of < 2% peak power per 1% QPT is supported by the analysis, therefore a 

value of 2% peak power increase per 1% QPT is used to bound peak 

power increases due to QPT. 

Operation at the AXIAL POWER IMBALANCE or rod insertion limits must 

be interpreted as operating the core at the maximum allowable FQ(Z) or 

H N F∆ peaking factors for accident initial conditions with the allowed QPT 

present. 

QPT satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The power distribution LCO limits have been established based on 

correlations between power peaking and easily measured process 

variables: regulating rod position, APSR position, AXIAL POWER 

IMBALANCE, and QPT. The regulating rod insertion limits and the AXIAL 

POWER IMBALANCE boundaries contained in the COLR represent the 

measurement system independent limits at which the core power 

distribution either exceeds the LOCA LHR limits or causes a reduction in 

DNBR below the safety limit during a loss of flow accident with the 

allowable QPT present and with an APSR position consistent with the 

limitations on APSR withdrawal determined by the fuel cycle design and 

specified by LCO 3.2.2. 

Operation beyond the power distribution based LCO limits for the 

corresponding allowable THERMAL POWER and simultaneous 

occurrence of one of a LOCA, loss of forced reactor coolant flow accident, 

or ejected rod accident has an acceptably low probability. Therefore, if 

these LCO limits are violated, a short time is allowed for corrective action 

before a significant power reduction is required. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The maximum allowable setpoints for steady state, transient, and 

maximum limits for QPT applicable for the full symmetrical Incore 

Detector System, Minimum Incore Detector System, and Excore Detector 

System are provided; the setpoints are given in the COLR. The setpoints 

for the three systems are derived by adjustment of the measurement 

system independent QPT limits given in the COLR to allow for system 

observability and instrumentation errors. 

Actual alarm setpoints implemented in the plant may be more restrictive 

than the maximum allowable setpoint values to allow for additional 

conservatism between the actual alarm setpoint and the measurement 

system independent limit. 

It is desirable for an operator to retain the ability to operate the reactor 

when a QPT exists. In certain instances, operation of the reactor with a 

QPT may be helpful or necessary to discover the cause of the QPT. The 

combination of power level restriction with QPT in each Required Action 

statement restricts the local LHR to a safe level, allowing movement 

through the specified applicability conditions in the exception to 

Specification 3.0.3. 

APPLICABILITY In MODE 1, the limits on QPT must be maintained when THERMAL 

POWER is > 20% RTP to prevent the core power distribution from 

exceeding the design limits. The minimum power level of 20% RTP is 

large enough to obtain meaningful QPT indications without compromising 

safety. Operation at or below 20% RTP with QPT up to 20% is 

acceptable because the resulting maximum LHR is not high enough to 

cause violation of the LOCA LHR limit (FQ(Z) limit) or the initial condition 

DNB allowable peaking limit ( H N F∆ limit) during accidents initiated from this 

power level. 

In MODE 2, the combination of QPT with maximum ALLOWABLE 

THERMAL POWER level does not result in LHRs sufficiently large to 

violate the fuel design limits, and therefore, applicability in this MODE is 

not required. Although not specifically addressed in the LCO, QPTs 

> 20% in MODE 1 with THERMAL POWER < 20% RTP are allowed for 

the same reason. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

In MODES 3, 4, 5, and 6, this LCO is not applicable, because the reactor 

is not generating THERMAL POWER and QPT is indeterminate. 

In MODE 1, it may be necessary to suspend the QPT limits during 

PHYSICS TESTS per LCO 3.1.8, "PHYSICS TESTS Exceptions - 

MODE 1." Suspension of these limits is permissible because the reactor 

protection criteria are maintained by the remaining LCOs governing the 

three dimensional power distribution and by the Surveillances required by 

LCO 3.1.8. 

ACTIONS A.1.1

The steady state limit specified in the COLR provides an allowance for 

QPT that may occur during normal operation. A peaking increase to 

accommodate QPTs up to the steady state limit is allowed by the 

regulating rod insertion limits of LCO 3.2.1 and the AXIAL POWER 

IMBALANCE limits of LCO 3.2.3. 

Operation with QPT greater than the steady state limit specified in the 

COLR potentially violates the LOCA LHR limits (FQ(Z) limits), or loss of 

flow accident DNB peaking limits ( H

N F∆ limits), or both. For verification 

that FQ(Z) and H N F∆ are within their specified limits, SR 3.1.5.2 is 

performed using the Incore Detector System to obtain a three 

dimensional power distribution map. Verification that FQ(Z) and H

N F∆ are 

within their limits ensures that operation with QPT greater than the steady 

state limit does not violate the ECCS or 95/95 DNB criteria. The required 

Completion Time of once per 2 hours is a reasonable amount of time to 

allow the operator to obtain a power distribution map and to verify the 

power peaking factors. Repeating SR 3.2.5.1 every 2 hours is a 

reasonable Frequency at which to ensure that continued verification of 

the power peaking factors is obtained as core conditions that influence 

QPT change. 

A.1.2.1

The safety analysis has shown that a conservative corrective action is to 

reduce THERMAL POWER by 2% RTP or more from the ALLOWABLE 

THERMAL POWER for each 1% of QPT in excess of the steady state 

limit. This action limits the local LHR to a value corresponding to steady 

state operation, thereby reducing it to a value within the assumed 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

accident initial condition limits. The required Completion Time of 2 hours 

is reasonable, based on limiting the potential for xenon redistribution, the 

low probability of an accident occurring, and the steps required to 

complete the Required Action. 

If QPT can be reduced to less than or equal to the steady state limit in 

< 2 hours, the reactor may return to normal operation without undergoing 

a power reduction. Significant radial xenon redistribution does not occur 

within this amount of time. 

The required Completion Time of 2 hours after the last performance of 

SR 3.5.2.1 allows reduction of THERMAL POWER in the event the 

operators cannot or choose not to continue to perform SR 3.5.2.1 as 

required by Required Action A.1.1. 

A.1.2.2

Power operation is allowed to continue if THERMAL POWER is reduced 

in accordance with Required Action A.1.2.1. The same reduction (i.e., 

2% RTP or more) is also applicable to the nuclear overpower trip setpoint 

and the nuclear overpower based on Reactor Coolant System (RCS) flow 

and AXIAL POWER IMBALANCE trip setpoint, for each 1% of QPT in 

excess of the steady state limit. This reduction maintains both core 

protection and an OPERABILITY margin at the reduced THERMAL 

POWER level similar to that at RTP. The required Completion Time of 

10 hours is reasonable based on the need to limit the potentially adverse 

xenon redistribution, the low probability of an accident occurring while 

operating out of specification, and the number of steps required to 

complete the Required Action. 

A.2

Although the actions directed by Required Action A.1.2.1 restore margins, 

if the source of the QPT is not established and corrected, it is prudent to 

establish increased margins. A required Completion Time of 24 hours to 

reduce QPT to less than the steady state limit is a reasonable time for 

investigation and corrective measures. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

If QPT exceeds the transient limit but is equal to or less than the 

maximum limit due to a misaligned CONTROL ROD or APSR, then power 

operation is allowed to continue if the THERMAL POWER is reduced 

2% RTP or more from the ALLOWABLE THERMAL POWER for each 1% 

of QPT in excess of the steady state limit. Thus, the transient limit is the 

upper bound within which the 2% for 1% power reduction rule may be 

applied, but only for QPTs caused by CONTROL ROD or APSR 

misalignment. The required Completion Time of 30 minutes ensures that 

the operator completes the THERMAL POWER reduction before 

significant xenon redistribution occurs. 

B.2

When a misaligned CONTROL ROD or APSR occurs, a local xenon 

redistribution may occur. The required Completion Time of 2 hours 

allows the operator sufficient time to relatch or realign a CONTROL ROD 

or APSR, but is short enough to limit xenon redistribution so that large 

increases in the local LHR do not occur due to xenon redistribution 

resulting from the QPT. 

C.1

If the Required Action and associated Completion Time of Condition A 

or B are not met, a further power reduction is required. Power reduction 

to < 60% RTP provides conservative protection from increased peaking 

due to xenon redistribution. The required Completion Time of 2 hours is 

reasonable to allow the operator to reduce THERMAL POWER to < 60% 

of ALLOWABLE THERMAL POWER without challenging plant systems. 

C.2

Reduction of the nuclear overpower trip setpoint to ≤ 65.5% of 

ALLOWABLE THERMAL POWER after THERMAL POWER has been 

reduced to < 60% of ALLOWABLE THERMAL POWER maintains both 

core protection and OPERABILITY margin at reduced power similar to 

that at full power. The required Completion Time of 10 hours allows the 

operator sufficient time to reset the trip setpoint and is reasonable based 

on operating experience. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1

Power reduction to 60% of the ALLOWABLE THERMAL POWER is a 

conservative method of limiting the maximum core LHR for QPTs up to 

20%. Although the power reduction is based on the correlation used in 

Required Actions A.1.2.1 and B.1, the database for a power peaking 

increase as a function of QPT is less extensive for tilt mechanisms other 

than misaligned CONTROL RODS and APSRs. Because greater 

uncertainty in the potential power peaking increase exists with the less 

extensive database, a more conservative action is taken when the tilt is 

caused by a mechanism other than a misaligned CONTROL ROD or 

APSR. The required Completion Time of 2 hours allows the operator to 

reduce THERMAL POWER to < 60% of the ALLOWABLE THERMAL 

POWER without challenging plant systems. 

D.2

Reduction of the nuclear overpower trip setpoint to ≤ 65.5% of the 

ALLOWABLE THERMAL POWER after THERMAL POWER has been 

reduced to < 60% of the ALLOWABLE THERMAL POWER maintains 

both core protection and an operating margin at reduced power similar to 

that at full power. The required Completion Time of 10 hours allows the 

operator sufficient time to reset the trip setpoint and is reasonable based 

on operating experience. 

E.1

If the Required Actions for Condition C or D cannot be met within the 

required Completion Time, then the reactor will continue in power 

operation with significant QPT. Either the power level has not been 

reduced to comply with the Required Action or the nuclear overpower trip 

setpoint has not been reduced within the required Completion Time. To 

preclude risk of fuel damage in any of these conditions, THERMAL 

POWER is reduced further. Specification 3.0.3 normally requires a 

shutdown to MODE 3. However, operation at 20% RTP allows the 

operator to investigate the cause of the QPT and to correct it. Local 

LHRs with a large QPT do not violate the fuel design limits at or below 

20% RTP. The required Completion Time of 2 hours is acceptable based 

on limiting the potential increase in local LHRs that could occur due to 

xenon redistribution with the QPT out of specification. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-9 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

F.1

The maximum limit of 20% QPT is set as the upper bound within which 

power reduction to 60% of ALLOWABLE THERMAL POWER or power 

reduction of 2% for 1% (for misaligned CONTROL RODS only) applies 

(Ref. 4). 

The maximum limit of 20% QPT is consistent with allowing power 

operation up to 60% of ALLOWABLE THERMAL POWER when QPT 

setpoints are exceeded. QPT in excess of the maximum limit can be an 

indication of a severe power distribution anomaly, and a power reduction 

to at most 20% RTP ensures local LHRs do not exceed allowable limits 

while the cause is being determined and corrected. 

The required Completion Time of 2 hours is reasonable to allow the 

operator to reduce THERMAL POWER to ≤ 20% RTP without challenging 

plant systems. 

SURVEILLANCE QPT can be monitored by both the incore and excore detector systems. 

REQUIREMENTS The QPT setpoints are derived from their corresponding measurement 

system independent limits by adjustment for system observability errors 

and instrumentation errors. Although they may be based on the same 

measurement system independent limit, the setpoints for the different 

systems are not identical because of differences in the errors applicable 

for these systems. For QPT measurements using the Incore Detector 

System, the Minimum Incore Detector System consists of OPERABLE 

detectors configured as follows: 

a. Two sets of four detectors shall lie in each core half. Each set of 

detectors shall lie in the same axial plane. The two sets in the same 

core half may lie in the same axial plane. 

b. Detectors in the same plane shall have quarter core radial symmetry. 

Figure B 3.2.4-2 (Minimum Incore Detector System for QPT 

Measurement) depicts an example of this configuration. The symmetric 

incore system for QPT uses the Incore Detector System as described 

above and is configured such that at least 75% of the detectors in each 

core quadrant are OPERABLE. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.2.4.1

Checking the QPT indication every 7 days ensures that the operator can 

determine whether the plant computer software and Incore Detector 

System inputs for monitoring QPT are functioning properly and takes into 

account other information and alarms available to the operator in the 

control room. This procedure allows the QPT mechanisms, such as 

xenon redistribution, burnup gradients, and CONTROL ROD drive 

mechanism malfunctions, which can cause slow development of a QPT, 

to be detected. Operating experience has confirmed the acceptability of a 

Surveillance Frequency of 7 days. 

Following restoration of the QPT to within the steady state limit, operation 

at ≥ 95% RTP may proceed provided the QPT is determined to remain 

within the steady state limit at the increased THERMAL POWER level. In 

case QPT exceeds the steady state limit for more than 24 hours or 

exceeds the transient limit (Condition A, B, or D), the potential for xenon 

redistribution is greater. Therefore, the QPT is monitored for 

12 consecutive hourly intervals to determine whether the period of any 

oscillation due to xenon redistribution causes the QPT to exceed the 

steady state limit again. 

REFERENCES 1. 10 CFR 50.46. 

 2. FSAR, Section [ ] . 

 3. ANSI N18.2-1973, American National Standards Institute, 

August 6, 1973. 

4. BAW 10122A, Rev. 1, May 1984. 
QPT 

B 3.2.4 

BWOG STS B 3.2.4-11 Rev. 3.0, 03/31/04 

(f) 

w 

z 

<( 

_j 

0.... 

z 

0 

I-

<( 

1---

z 

w 

~ 

=> 

a: 

1---

(f) 

z 

w 

a: 

0 

u 

z 

This figure for illustration only. 

Do not use for ope ration. 

I 

: Radial 

I 

1 1)! Core _______________ L _____________ _ 

I 

I 

I 

I 

I 

I 

Figure B 3.2.4-1 (page 1 of 1) 

Radial Symmetry 

In This Plane 

Radial Symmetry 

In This Plane 

Minimum lncore S stem for QUADRANT POWER TILT Measurement 
Power Peaking Factors 

B 3.2.5 

BWOG STS B 3.2.5-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTION LIMITS 

B 3.2.5 Power Peaking Factors 

BASES 

BACKGROUND The purpose of this LCO is to establish limits that constrain the core 

power distribution within design limits during normal operation 

(Condition 1) and during anticipated operational occurrences 

(Condition 2) such that accident initial condition protection criteria are 

preserved. The accident initial condition criteria are preserved by 

bounding operation at THERMAL POWER within specified acceptable 

fuel design limits. 

FQ(Z) is a specified acceptable fuel design limit that preserves the initial 

conditions for the Emergency Core Cooling Systems (ECCS) analysis. 

FQ(Z) is defined as the maximum local fuel rod linear power density 

divided by the average fuel rod linear power density, assuming nominal 

fuel pellet and rod dimensions. Because FQ(Z) is a ratio of local power 

densities, it is related to the maximum local (pellet) power density in a fuel 

rod. Operation within the FQ(Z) limits given in the COLR prevents power 

peaking that would exceed the loss of coolant accident (LOCA) linear 

heat rate (LHR) limits derived from the analysis of the ECCS. 

The H N F∆ limit is a specified acceptable fuel design limit that preserves the 

initial conditions for the limiting loss of flow transient. H N F∆ is defined as 

the ratio of the integral of linear power along the fuel rod on which the 

minimum departure from nucleate boiling ratio (DNBR) occurs to the 

average integrated rod power. Because H N F∆ is a ratio of integrated 

powers, it is related to the maximum total power produced in a fuel rod. 

Operation within the H

N F∆ limits given in the COLR prevents departure 

from nucleate boiling (DNB) during a postulated loss of forced reactor 

coolant flow accident. 

Measurement of the core power peaking factors using the Incore Detector 

System to obtain a three dimensional power distribution map provides 

direct confirmation that FQ(Z) and H

N F∆ are within their limits, and may be 

used to verify that the power peaking factors remain bounded when one 

or more normal operating parameters exceed their limits. 
Power Peaking Factors 

B 3.2.5 

BWOG STS B 3.2.5-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The limits on FQ(Z) are determined by the ECCS analysis in order to limit 

SAFETY peak cladding temperatures to 2200°F during a LOCA. The maximum 

ANALYSES acceptable cladding temperature is specified by 10 CFR 50.46 (Ref. 1). 

Higher cladding temperatures could cause severe cladding failure by 

oxidation due to a Zircaloy water reaction. Other criteria must also be 

met (e.g., maximum cladding oxidation, maximum hydrogen generation, 

coolable geometry, and long term cooling). However, peak cladding 

temperature is usually most limiting. 

The limits on H

N F∆ provide protection from DNB during a limiting loss of 

flow transient. Proximity to the DNB condition is expressed by the DNBR, 

defined as the ratio of the cladding surface heat flux required to cause 

DNB to the actual cladding surface heat flux. The minimum DNBR value 

during both normal operation and anticipated transients is limited to the 

DNBR correlation limit for the particular fuel design in use, and is 

accepted as an appropriate margin to DNB. The DNBR correlation limit 

ensures that there is at least 95% probability at the 95% confidence level 

(the 95/95 DNB criterion) that the hot fuel rod in the core does not 

experience DNB. 

This LCO precludes core power distributions that violate the following fuel 

design criteria: 

a. During a large break LOCA, peak cladding temperature must not 

exceed 2200°F (Ref. 1). 

b. During a loss of forced reactor coolant flow accident, there must be at 

least 95% probability at the 95% confidence level (the 95/95 DNB 

criterion) that the hot fuel rod in the core does not experience a DNB 

condition. 

The reload safety evaluation analysis determines limits on global core 

parameters that characterize the core power distribution. The primary 

parameters used to monitor and control the core power distribution are 

the regulating rod position, the APSR position, the AXIAL POWER 

IMBALANCE, and the QPT. These parameters are normally used to 

monitor and control the core power distribution because their 

measurements are continuously observable. Limits are placed on these 

parameters to ensure that the core power peaking factors remain 
Power Peaking Factors 

B 3.2.5 

BWOG STS B 3.2.5-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

bounded during operation in MODE 1 with THERMAL POWER greater 

than 20% RTP. Nuclear design model calculational uncertainty, 

manufacturing tolerances (e.g., the engineering hot channel factor), 

effects of fuel densification and rod bow, and modeling simplifications 

(such as treatment of the spacer grid effects) are accommodated through 

use of peaking augmentation factors in the reload safety evaluation 

analysis. 

FQ(Z) and H N F∆ satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO This LCO for the power peaking factors FQ(Z) and H N F∆ ensures that the 

core operates within the bounds assumed for the ECCS and thermal 

hydraulic analyses. Verification that FQ(Z) and H N F∆ are within the limits of 

this LCO as specified in the COLR allows continued operation at 

THERMAL POWER when the Required Actions of LCO 3.1.4, 

"CONTROL ROD Group Alignment Limits," LCO 3.2.1, "Regulating Rod 

Insertion Limits," LCO 3.2.2, "AXIAL POWER SHAPING ROD Insertion 

Limits," LCO 3.2.3, "AXIAL POWER IMBALANCE Operating Limits," and 

LCO 3.2.4, "QUADRANT POWER TILT," are entered. Conservative 

THERMAL POWER reductions are required if the limits on FQ(Z) and H N F∆

are exceeded. Verification that FQ(Z) and H

N F∆ are within limits is also 

required during MODE 1 PHYSICS TESTS per LCO 3.1.8, "PHYSICS 

TESTS Exceptions - MODE 1." 

Measurement uncertainties are applied when FQ(Z) and H N F∆ are 

determined using the Incore Detector System. The measurement 

uncertainties applied to the measured values of FQ(Z) and H

N F∆ account 

for uncertainties in observability and instrument string signal processing. 

APPLICABILITY In MODE 1 with THERMAL POWER greater than 20% RTP, the limits on 

FQ(Z) and H

N F∆ must be maintained in order to prevent the core power 

distribution from exceeding the limits assumed in the analyses of the 

LOCA and loss of flow accidents. In MODE 1 with THERMAL POWER 

less than or equal to 20% RTP and in MODES 2, 3, 4, 5, and 6, this LCO 

is not applicable because the reactor has insufficient stored energy in the 

fuel or energy being transferred to the coolant to require a limit on the 

distribution of core power. 
Power Peaking Factors 

B 3.2.5 

BWOG STS B 3.2.5-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

The minimum THERMAL POWER level of 20% RTP was chosen based 

on the ability of the Incore Detector System to satisfactorily obtain 

meaningful power distribution data. 

ACTIONS The operator must take care in interpreting the relationship of the power 

peaking factors FQ(Z) and H N F∆ to their limits. Limit values of FQ(Z) and 

H

N F∆ in the COLR may be expressed in either LHR or in peaking units. 

Because FQ(Z) and H N F∆ are power peaking factors, constant LHR is 

maintained as THERMAL POWER is reduced, thereby allowing power 

peaking to be increased in inverse proportion to THERMAL POWER. 

Therefore, the FQ(Z) and H N F∆ limits increase as THERMAL POWER 

decreases (assuming FQ(Z) and H N F∆ are expressed in peaking units) so 

that a constant LHR limit is maintained. 

A.1

When FQ(Z) is determined not to be within its specified limit as 

determined by a three dimensional power distribution map, a THERMAL 

POWER reduction is taken to reduce the maximum LHR in the core. 

Design calculations have verified that a conservative THERMAL POWER 

reduction is 1% RTP or more for each 1% by which FQ(Z) exceeds its limit 

(Ref. [ ] ). The Completion Time of 15 minutes provides an acceptable 

time to reduce power in an orderly manner and without allowing the plant 

to remain in an unacceptable condition for an extended period of time. 

A.2

Power operation is allowed to continue by Required Action A.1 if 

THERMAL POWER is reduced by 1% RTP or more from the 

ALLOWABLE THERMAL POWER for each 1% by which FQ(Z) exceeds 

its limit. The same reduction in nuclear overpower trip setpoint and 

nuclear overpower based on the Reactor Coolant System (RCS) flow and 

the AXIAL POWER IMBALANCE trip setpoint is required for each 1% by 

which FQ(Z) is in excess of its limit. These reductions maintain both core 

protection and OPERABILITY margin at the reduced THERMAL POWER. 

The required Completion Time of 8 hours is reasonable based on the low 

probability of an accident occurring in this short time period and the 

number of steps required to complete the Required Action. 
Power Peaking Factors 

B 3.2.5 

BWOG STS B 3.2.5-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.3

Continued operation with FQ(Z) exceeding its limit is not permitted, 

because the initial conditions assumed in the accident analyses are no 

longer valid. The required Completion Time of 24 hours to restore FQ(Z) 

within its limits at the reduced THERMAL POWER level is reasonable 

based on the low probability of a limiting event occurring simultaneously 

with FQ(Z) exceeding its limit. In addition, it precludes long term depletion 

with local LHRs higher than the limiting values, and limits the potential for 

inducing an adverse perturbation in the axial xenon distribution. 

B.1

When H N F∆ is determined not to be within its acceptable limit as 

determined by a three dimensional power distribution map, a THERMAL 

POWER reduction is taken to reduce the maximum LHR in the core. The 

parameter RH by which THERMAL POWER is decreased per 1% 

increase in H

N F∆ above the limit has been verified to be conservative by 

design calculations, and is defined in the COLR. The parameter RH is 

the inverse of the increase in H N F∆ allowed as THERMAL POWER 

decreases by 1% RTP, and is based on an analysis of the DNBR during 

the limiting loss of forced reactor coolant flow transient from various initial 

THERMAL POWER levels. The required Completion Time of 15 minutes 

is reasonable for the operator to take the actions necessary to reduce the 

unit power. 

B.2

When a decrease in THERMAL POWER is required because H N F∆ has 

exceeded its limit, Required Action B.2 requires reduction of the high flux 

trip setpoint and the nuclear overpower based on RCS flow and AXIAL 

POWER IMBALANCE trip setpoint. The amount of reduction of these trip 

setpoints is governed by the same factor (RH(%) for each 1% that H

N F∆

exceeds its limit) that determines the THERMAL POWER reduction. This 

process maintains core protection by providing margin to the trip setpoints 

at the reduced THERMAL POWER similar to that at RTP. The parameter 

RH is specified in the COLR. The required Completion Time of 8 hours is 

reasonable based on the low probability of an accident occurring in this 

short time period and the number of steps required to complete this 

Action. 
Power Peaking Factors 

B 3.2.5 

BWOG STS B 3.2.5-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.3

Continued operation with H N F∆ exceeding its limit is not permitted, 

because the initial conditions assumed in the accident analyses are no 

longer valid. The required Completion Time of 24 hours to restore H N F∆

within its limit at the reduced THERMAL POWER level is reasonable 

based on the low probability of a limiting event occurring simultaneously 

with H N F∆ exceeding its limit. In addition, this Completion Time precludes 

long term depletion with an unacceptably high local power and limits the 

potential for inducing an adverse perturbation in the radial xenon 

distribution. 

C.1

If a THERMAL POWER reduction is not sufficient to restore FQ(Z) or H

N F∆

within its limit (i.e., the Required Actions and associated Completion 

Times for Condition A or B are not met), then THERMAL POWER 

operation should be significantly reduced. The reactor is placed in 

MODE 1 with THERMAL POWER less than or equal to 20% RTP in 

which this LCO does not apply. The required Completion Time of 2 hours 

is a reasonable amount of time for the operator to reduce THERMAL 

POWER in an orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.2.5.1

REQUIREMENTS 

Core monitoring is performed using the Incore Detector System to obtain 

a three dimensional power distribution map. Maximum values of FQ(Z) 

and H

N F∆ obtained from this map may then be compared with the FQ(Z) 

and limits in the COLR to verify that the limits have not been exceeded. 

Measurement of the core power peaking factors in this manner may be 

used to verify that the measured values of FQ(Z) and H

N F∆ remain within 

their specified limits when one or more of the limits specified by 

LCO 3.1.4, LCO 3.2.1, LCO 3.2.2, LCO 3.2.3, or LCO 3.2.4 is exceeded, 

or when LCO 3.1.8 is applicable. If FQ(Z) and H N F∆ remain within their 

limits when one or more of these parameters exceed their limits, 

operation at THERMAL POWER may continue because the true initial 

conditions (the power peaking factors) remain within their specified limits. 
Power Peaking Factors 

B 3.2.5 

BWOG STS B 3.2.5-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Because the limits on FQ(Z) and H

N F∆ are preserved when the parameters 

specified by LCO 3.1.4, LCO 3.2.1, LCO 3.2.2, LCO 3.2.3, and LCO 3.2.4 

are within their limits, a Note is provided in the SR to indicate that 

monitoring of the power peaking factors is required only when complying 

with the Required Actions of these LCOs and when LCO 3.1.8 is 

applicable. 

Frequencies for monitoring of the power peaking factors are specified in 

the Action statements of the individual LCOs. These Frequencies are 

reasonable based on the low probability of a limiting event occurring 

simultaneously with either FQ(Z) or H N F∆ exceeding its limit, and they 

provide sufficient time for the operator to obtain a power distribution map 

from the Incore Detector System. Indefinite THERMAL POWER 

operation in a Required Action of LCO 3.1.4, LCO 3.2.1, LCO 3.2.2, 

LCO 3.2.3, or LCO 3.2.4 is not permitted, in order to limit the potential for 

exceeding both the power peaking factors assumed in the accident 

analyses due to operation with unanalyzed core power distributions and 

spatial xenon distributions beyond their analyzed ranges. 

REFERENCES 1. 10 CFR 50.46. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.1 Reactor Protection System (RPS) Instrumentation 

BASES 

BACKGROUND The RPS initiates a reactor trip to protect against violating the core fuel 

design limits and the Reactor Coolant System (RCS) pressure boundary 

during anticipated operational occurrences (AOOs). By tripping the 

reactor, the RPS also assists the Engineered Safety Feature (ESF) 

Systems in mitigating accidents. 

The protection and monitoring systems have been designed to assure 

safe operation of the reactor. This is achieved by specifying limiting 

safety system settings (LSSS) in terms of parameters directly monitored 

by the RPS, as well as the LCOs on other reactor system parameters and 

equipment performance. 

Technical Specifications are required by 10 CFR 50.36 to contain LSSS 

defined by the regulation as "...settings for automatic protective 

devices...so chosen that automatic protective actions will correct the 

abnormal situation before a Safety Limit (SL) is exceeded." The Analytic 

Limit is the limit of the process variable at which a safety action is 

initiated, as established by the safety analysis, to ensure that a SL is not 

exceeded. Any automatic protection action that occurs on reaching the 

Analytic Limit therefore ensures that the SL is not exceeded. However, in 

practice, the actual settings for automatic protective devices must be 

chosen to be more conservative than the Analytic Limit to account for 

instrument loop uncertainties related to the setting at which the automatic 

protective action would actually occur. 

The trip setpoint is a predetermined setting for a protective device chosen 

to ensure automatic actuation prior to the process variable reaching the 

Analytic Limit and thus ensuring that the SL would not be exceeded. As 

such, the trip setpoint accounts for uncertainties in setting the device 

(e.g., calibration), uncertainties in how the device might actually perform 

(e.g., repeatability), changes in the point of action of the device over time 

(e.g., drift during surveillance intervals), and any other factors which may 

influence its actual performance (e.g., harsh accident environments). In 

this manner, the trip setpoint plays an important role in ensuring that SLs 

are not exceeded. As such, the trip setpoint meets the definition of an 

LSSS (Ref. 1) and could be used to meet the requirement that they be 

contained in the Technical Specifications. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Technical Specifications contain values related to the OPERABILITY of 

equipment required for safe operation of the facility. OPERABLE is 

defined in Technical Specifications as "...being capable of performing its 

safety function(s)." For automatic protective devices, the required safety 

function is to ensure that a SL is not exceeded and therefore the LSSS as 

defined by 10 CFR 50.36 is the same as the OPERABILITY limit for these 

devices. However, use of the trip setpoint to define OPERABILITY in 

Technical Specifications and its corresponding designation as the LSSS 

required by 10 CFR 50.36 would be an overly restrictive requirement if it 

were applied as an OPERABILITY limit for the "as found" value of a 

protective device setting during a Surveillance. This would result in 

Technical Specification compliance problems, as well as reports and 

corrective actions required by the rule which are not necessary to ensure 

safety. For example, an automatic protective device with a setting that 

has been found to be different from the trip setpoint due to some drift of 

the setting may still be OPERABLE since drift is to be expected. This 

expected drift would have been specifically accounted for in the setpoint 

methodology for calculating the trip setpoint and thus the automatic 

protective action would still have ensured that the SL would not be 

exceeded with the "as found" setting of the protective device. Therefore, 

the device would still be OPERABLE since it would have performed its 

safety function and the only corrective action required would be to reset 

the device to the trip setpoint to account for further drift during the next 

surveillance interval. 

Use of the trip setpoint to define "as found" OPERABILITY and its 

designation as the LSSS under the expected circumstances described 

above would result in actions required by both the rule and Technical 

Specifications that are clearly not warranted. However, there is also 

some point beyond which the device would have not been able to perform 

its function due, for example, to greater than expected drift. This value 

needs to be specified in the Technical Specifications in order to define 

OPERABILITY of the devices and is designated as the Allowable Value 

which, as stated above, is the same as the LSSS. 

The Allowable Value specified in Table 3.3.1-1 serves as the LSSS such 

that a channel is OPERABLE if the trip setpoint is found not to exceed the 

Allowable Value during the CHANNEL FUNCTIONAL TEST (CFT). As 

such, the Allowable Value differs from the trip setpoint by an amount 

primarily equal to the expected instrument loop uncertainties, 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

such as drift, during the surveillance interval. In this manner, the actual 

setting of the device will still meet the LSSS definition and ensure that a 

SL is not exceeded at any given point of time as long as the device has 

not drifted beyond that expected during the surveillance interval. If the 

actual setting of the device is found to have exceeded the Allowable 

Value the device would be considered inoperable from a Technical 

Specification perspective. This requires corrective action including those 

actions required by 10 CFR 50.36 when automatic protective devices do 

not function as required. Note that, although the channel is "OPERABLE" 

under these circumstances, the trip setpoint should be left adjusted to a 

value within the established trip setpoint calibration tolerance band, in 

accordance with uncertainty assumptions stated in the referenced 

setpoint methodology (as-left criteria), and confirmed to be operating 

within the statistical allowances of the uncertainty terms assigned. 

During AOOs, which are those events expected to occur one or more 

times during the unit's life, the acceptable limits are: 

a. The departure from nucleate boiling ratio (DNBR) shall be maintained 

above the SL value, 

b. Fuel centerline melt shall not occur, and 

c. The RCS pressure SL of 2750 psia shall not be exceeded. 

Maintaining the parameters within the above values ensures that the 

offsite dose will be within the 10 CFR 20 and 10 CFR 100 criteria during 

AOOs. 

Accidents are events that are analyzed even though they are not 

expected to occur during the unit's life. The acceptable limit during 

accidents is that the offsite dose shall be maintained within 10 CFR 100 

limits. Meeting the acceptable dose limit for an accident category is 

considered having acceptable consequences for that event. 

RPS Overview

The RPS consists of four separate redundant protection channels that 

receive inputs of neutron flux, RCS pressure, RCS flow, RCS 

temperature, RCS pump status, reactor building (RB) pressure, main 

feedwater (MFW) pump status, and turbine status. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-4 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Figure [ ] , FSAR, Chapter [7] (Ref. 2), shows the arrangement of a 

typical RPS protection channel. A protection channel is composed of 

measurement channels, a manual trip channel, a reactor trip module 

(RTM), and CONTROL ROD drive (CRD) trip devices. LCO 3.3.1 

provides requirements for the individual measurement channels. These 

channels encompass all equipment and electronics from the point at 

which the measured parameter is sensed through the bistable relay 

contacts in the trip string. LCO 3.3.2, "Reactor Protection System (RPS) 

Manual Reactor Trip," LCO 3.3.3, "Reactor Protection System (RPS) - 

Reactor Trip Module (RTM)," and LCO 3.3.4, "CONTROL ROD Drive 

(CRD) Trip Devices," discuss the remaining RPS elements. 

The RPS instrumentation measures critical unit parameters and 

compares these to predetermined setpoints. If the setpoint is exceeded, 

a channel trip signal is generated. The generation of any two trip signals 

in any of the four RPS channels will result in the trip of the reactor. 

The Reactor Trip System (RTS) contains multiple CRD trip devices, two 

AC trip breakers, and two DC trip breaker pairs that provide a path for 

power to the CRD System. Additionally, the power for most of the CRDs 

passes through electronic trip assembly (ETA) relays. The system has 

two separate paths (or channels), with each path having either two 

breakers or a breaker and an ETA relay in series. Each path provides 

independent power to the CRDs. Either path can provide sufficient power 

to operate all CRDs. Two separate power paths to the CRDs ensure that 

a single failure that opens one path will not cause an unwanted reactor 

trip. 

The RPS consists of four independent protection channels, each 

containing an RTM. The RTM receives signals from its own 

measurement channels that indicate a protection channel trip is required. 

The RTM transmits this signal to its own two-out-of-four trip logic and to 

the two-out-of-four logic of the RTMs in the other three RPS channels. 

Whenever any two RPS channels transmit channel trip signals, the RTM 

logic in each channel actuates to remove 120 VAC power from its 

associated CRD trip breaker. 

The reactor is tripped by opening circuit breakers that interrupt the power 

supply to the CRDs. Six breakers are installed to increase reliability and 

allow testing of the trip system. A one-out-of-two taken twice logic is used 

to interrupt power to the rods. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-5 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The RPS has two bypasses: a shutdown bypass and a channel bypass. 

Shutdown bypass allows the withdrawal of safety rods for SDM 

availability and rapid negative reactivity insertion during unit cooldowns or 

heatups. Channel bypass is used for maintenance and testing. Test 

circuits in the trip strings allow complete testing of all RPS trip Functions. 

The RPS operates from the instrumentation channels discussed next. 

The specific relationship between measurement channels and protection 

channels differs from parameter to parameter. Three basic configurations 

are used: 

a. Four completely redundant measurements (e.g., reactor coolant flow) 

with one channel input to each protection channel, 

b. Four channels that provide similar, but not identical, measurements 

(e.g., power range nuclear instrumentation where each RPS channel 

monitors a different quadrant), with one channel input to each 

protection channel, and 

c. Redundant measurements with combinational trip logic outside of the 

protection channels and the combined output provided to each 

protection channel (e.g., main turbine trip instrumentation). 

These arrangements and the relationship of instrumentation channels to 

trip Functions are discussed next to assist in understanding the overall 

effect of instrumentation channel failure. 

Power Range Nuclear Instrumentation

Power Range Nuclear Instrumentation channels provide inputs to the 

following trip Functions: 

1. Nuclear Overpower 

 a. Nuclear Overpower - High Setpoint, 

 b. Nuclear Overpower - Low Setpoint, 

7. Reactor Coolant Pump to Power, 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-6 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

8. Nuclear Overpower RCS Flow and Measured AXIAL POWER 

IMBALANCE (Power Imbalance Flow), 

9. Main Turbine Trip (Control Oil Pressure), and 

10. Loss of Main Feedwater (LOMFW) Pumps (Control Oil Pressure). 

The power range instrumentation has four linear level channels, one for 

each core quadrant. Each channel feeds one RPS protection channel. 

Each channel originates in a detector assembly containing two 

uncompensated ion chambers. The ion chambers are positioned to 

represent the top half and bottom half of the core. The individual currents 

from the chambers are fed to individual linear amplifiers. The summation 

of the top and bottom is the total reactor power. The difference of the top 

minus the bottom neutron signal is the measured AXIAL POWER 

IMBALANCE of the reactor core. 

Reactor Coolant System Outlet Temperature

The Reactor Coolant System Outlet Temperature provides input to the 

following Functions: 

2. RCS High Outlet Temperature and 

5. RCS Variable Low Pressure. 

The RCS Outlet Temperature is measured by two resistance elements in 

each hot leg, for a total of four. One temperature detector is associated 

with each protection channel. 

Reactor Coolant System Pressure

The Reactor Coolant System Pressure provides input to the following 

Functions: 

3. RCS High Pressure, 

4. RCS Low Pressure, 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-7 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

5. RCS Variable Low Pressure, and 

11. Shutdown Bypass RCS High Pressure. 

The RPS inputs of reactor coolant pressure are provided by two pressure 

transmitters in each hot leg, for a total of four. One sensor is associated 

with each protection channel. 

Reactor Building Pressure

The Reactor Building Pressure measurements provide input only to the 

Reactor Building High Pressure trip, Function 6. There are four RB High 

Pressure sensors, one associated with each protection channel. 

Reactor Coolant Pump Power Monitoring

Reactor coolant pump power monitors are inputs to the Reactor Coolant 

Pump to Power trip, Function 7. Each RCP, operating current, and 

voltage is measured by four current transformers and four potential 

transformers driving four overpower and four underpower relays. Each 

power monitoring channel consists of an overpower relay and an 

underpower relay. One channel for each pump is associated with each 

protection channel. 

Reactor Coolant System Flow

The Reactor Coolant System Flow measurements are an input to the 

Nuclear Overpower RCS Flow and Measured AXIAL POWER 

IMBALANCE trip, Function 8. The reactor coolant flow inputs to the RPS 

are provided by eight high accuracy differential pressure transmitters, four 

on each loop, which measure flow through calibrated flow tubes. One 

flow input in each loop is associated with each protection channel. 

Main Turbine Automatic Stop Oil Pressure

Main Turbine Automatic Stop Oil Pressure is an input to the Main Turbine 

Trip (Control Oil Pressure) reactor trip, Function 9. Each of the four 

protection channels receives turbine status information from the same 

four pressure switches monitoring main turbine automatic stop oil 

pressure. An open indication will be provided to the RPS on a turbine 

trip. Contact buffers in each protection channel continuously monitor the 

status of the contact inputs and initiate an RPS trip when a turbine trip is 

indicated. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-8 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Feedwater Pump Control Oil Pressure

Feedwater Pump Control Oil Pressure is an input to the Loss of Main 

Feedwater Pumps (Control Oil Pressure) trip, Function 10. Control oil 

pressure is measured by four switches on each feedwater pump. One 

switch on each pump is associated with each protection channel. 

RPS Bypasses

The RPS is designed with two types of bypasses: channel bypass and 

shutdown bypass. 

Channel bypass provides a method of placing all Functions in one RPS 

protection channel in a bypassed condition, and shutdown bypass 

provides a method of leaving the safety rods withdrawn during cooldown 

and depressurization of the RCS. Each bypass is discussed next. 

Channel Bypass

A channel bypass provision is provided to allow for maintenance and 

testing of the RPS. The use of channel bypass keeps the protection 

channel trip relay energized regardless of the status of the 

instrumentation channel of the bistable relay contacts. To place a 

protection channel in channel bypass, the other three channels must not 

be in channel bypass. This is ensured by contacts from the other 

channels being in series with the channel bypass relay. If any contact is 

open, the second channel cannot be bypassed. The second condition is 

the closing of the key switch. When the bypass relay is energized, the 

bypass contact closes, maintaining the channel trip relay in an energized 

condition. All RPS trips are reduced to a two-out-of-three logic in channel 

bypass. 

Shutdown Bypass

During unit cooldown, it is desirable to leave the safety rods withdrawn to 

provide shutdown capabilities in the event of unusual positive reactivity 

additions (moderator dilution, etc.). 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-9 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

However, the unit is also depressurized as coolant temperature is 

decreased. If the safety rods are withdrawn and coolant pressure is 

decreased, an RCS Low Pressure trip will occur at 1800 psig and the 

rods will fall into the core. To avoid this, the protection system allows the 

operator to bypass the low pressure trip and maintain shutdown 

capabilities. During the cooldown and depressurization, the safety rods 

are inserted prior to the low pressure trip of 1800 psig. The RCS 

pressure is decreased to less than 1720 psig, then each RPS channel is 

placed in shutdown bypass. 

In shutdown bypass, a normally closed contact opens and the operator 

closes the shutdown bypass key switch. This action bypasses the RCS 

Low Pressure trip, Nuclear Overpower RCS Flow and Measured AXIAL 

POWER IMBALANCE trip, Reactor Coolant Pump to Power trip, and the 

RCS Variable Low Pressure trip, and inserts a new RCS High Pressure, 

1720 psig trip. The operator can now withdraw the safety rods for 

additional SDM. 

The insertion of the new high pressure trip performs two functions. First, 

with a trip setpoint of 1720 psig, the bistable prevents operation at normal 

system pressure, 2155 psig, with a portion of the RPS bypassed. The 

second function is to ensure that the bypass is removed prior to normal 

operation. When the RCS pressure is increased during a unit heatup, the 

safety rods are inserted prior to reaching 1720 psig. The shutdown 

bypass is removed, which returns the RPS to normal, and system 

pressure is increased to greater than 1800 psig. The safety rods are then 

withdrawn and remain at the full out condition for the rest of the heatup. 

In addition to the Shutdown Bypass RCS High Pressure trip, the high flux 

trip setpoint is administratively reduced to 5% RTP while the RPS is in 

shutdown bypass. This provides a backup to the Shutdown Bypass RCS 

High Pressure trip and allows low temperature physics testing while 

preventing the generation of any significant amount of power. 

Module Interlock and Test Trip Relay

Each channel and each trip module is capable of being individually 

tested. When a module is placed into the test mode, it causes the test 

trip relay to open and to indicate an RPS channel trip. Under normal 

conditions, the channel to be tested is placed in bypass before a module 

is tested. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-10 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Trip Setpoints/Allowable Value

The trip setpoints are the normal values at which the bistables are set. 

Any bistable is considered to be properly adjusted when the "as left" 

value is within the band for CHANNEL CALIBRATION accuracy (i.e., 

± [rack calibration + comparator setting accuracy]). 

The trip setpoints used in the bistables are based on the analytical limits 

stated in FSAR, Chapter [14] (Ref. 3). The selection of these trip 

setpoints is such that adequate protection is provided when all sensor 

and processing time delays are taken into account. To allow for 

calibration tolerances, instrumentation uncertainties, instrument drift, and 

severe environment errors for those RPS channels that must function in 

harsh environments as defined by 10 CFR 50.49 (Ref. 4), the Allowable 

Values specified in Table 3.3.1-1 in the accompanying LCO are 

conservatively adjusted with respect to the analytical limits. A detailed 

description of the methodology used to calculate the trip setpoints, 

including their explicit uncertainties, is provided in "[Unit Specific Setpoint 

Methodology]" (Ref. 5). The actual nominal trip setpoint entered into the 

bistable is more conservative than that specified by the Allowable Value 

to account for changes in random measurement errors detectable by a 

CHANNEL FUNCTIONAL TEST. One example of such a change in 

measurement error is drift during the Surveillance Frequency. A channel 

is inoperable if its actual trip setpoint is not within its required Allowable 

Value. 

Setpoints in accordance with the Allowable Value ensure that the limits of 

Chapter 2.0, "Safety Limits," in the Technical Specifications are not 

violated during AOOs and that the consequences of DBAs will be 

acceptable, providing the unit is operated from within the LCOs at the 

onset of the AOO or DBA and the equipment functions as designed. Note 

that in LCO 3.3.1 the Allowable Values listed in Table 3.3.1-1 are the 

LSSS. 

Each channel can be tested online to verify that the signal and setpoint 

accuracy are within the specified allowance requirements of Reference 5. 

Once a designated channel is taken out of service for testing, a simulated 

signal is injected in place of the field instrument signal. The process 

equipment for the channel in test is then tested, verified, and calibrated. 

Surveillances for the channels are specified in the SR section. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-11 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The Allowable Values listed in Table 3.3.1-1 are based on the 

methodology described in "[Unit Specific Setpoint Methodology]" (Ref. 5), 

which incorporates all of the known uncertainties applicable for each 

channel. The magnitudes of those uncertainties are factored into the 

determination of each trip setpoint. All field sensors and signal 

processing equipment for these channels are assumed to operate within 

the allowances of these uncertainty magnitudes. 

APPLICABLE Each of the analyzed accidents and transients can be detected by one 

SAFETY or more RPS Functions. The accident analysis contained in Reference 6 

ANALYSES, LCO, takes credit for most RPS trip Functions. Functions not specifically 

and APPLICABILITY credited in the accident analysis were qualitatively credited in the safety 

analysis and the NRC staff approved licensing basis for the unit. These 

Functions are high RB pressure, high temperature, turbine trip, and loss 

of main feedwater. These Functions may provide protection for 

conditions that do not require dynamic transient analysis to demonstrate 

Function performance. These Functions also serve as backups to 

Functions that were credited in the safety analysis. 

The LCO requires all instrumentation performing an RPS Function to be 

OPERABLE. Failure of any instrument renders the affected channel(s) 

inoperable and reduces the reliability of the affected Functions. The four 

channels of each Function in Table 3.3.1-1 of the RPS instrumentation 

shall be OPERABLE during its specified Applicability to ensure that a 

reactor trip will be actuated if needed. Additionally, during shutdown 

bypass with any CRD trip breaker closed, the applicable RPS Functions 

must also be available. This ensures the capability to trip the withdrawn 

CONTROL RODS exists at all times that rod motion is possible. The trip 

Function channels specified in Table 3.3.1-1 are considered OPERABLE 

when all channel components necessary to provide a reactor trip are 

functional and in service for the required MODE or Other Specified 

Condition listed in Table 3.3.1-1. 

Required Actions allow maintenance (protection channel) bypass of 

individual channels, but the bypass activates interlocks that prevent 

operation with a second channel bypass. Bypass effectively places the 

unit in a two-out-of-three logic configuration that can still initiate a reactor 

trip, even with a single failure within the system. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-12 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Only the Allowable Values are specified for each RPS trip Function in the 

LCO. Nominal trip setpoints are specified in the unit specific setpoint 

calculations. The nominal setpoints are selected to ensure that the 

setpoint measured by CHANNEL FUNCTIONAL TESTS does not exceed 

the Allowable Value if the bistable is performing as required. Operation 

with a trip setpoint less conservative than the nominal trip setpoint, but 

within its Allowable Value, is acceptable provided that operation and 

testing are consistent with the assumptions of the unit specific setpoint 

calculations. Each Allowable Value specified is more conservative than 

instrument uncertainties appropriate to the trip Function. These 

uncertainties are defined in the "[Unit Specific Setpoint Methodology]" 

(Ref. 5). 

For most RPS Functions, the trip setpoint Allowable Value is to ensure 

that the departure from nucleate boiling (DNB) or RCS pressure SLs are 

not challenged. Cycle specific figures for use during operation are 

contained in the COLR. 

Certain RPS trips function to indirectly protect the SLs by detecting 

specific conditions that do not immediately challenge SLs but will 

eventually lead to challenge if no action is taken. These trips function to 

minimize the unit transients caused by the specific conditions. The 

Allowable Value for these Functions is selected at the minimum deviation 

from normal values that will indicate the condition, without risking 

spurious trips due to normal fluctuations in the measured parameter. 

The Allowable Values for bypass removal Functions are stated in the 

Applicable MODE or Other Specified Condition column of Table 3.3.1-1. 

The safety analyses applicable to each RPS Function are discussed next. 

1. Nuclear Overpower

 a. Nuclear Overpower - High Setpoint

The Nuclear Overpower - High Setpoint trip provides protection 

for the design thermal overpower condition based on the 

measured out of core fast neutron leakage flux. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-13 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Nuclear Overpower - High Setpoint trip initiates a reactor trip 

when the neutron power reaches a predefined setpoint at the 

design overpower limit. Because THERMAL POWER lags the 

neutron power, tripping when the neutron power reaches the 

design overpower will limit THERMAL POWER to a maximum 

value of the design overpower. Thus, the Nuclear Overpower - 

High Setpoint trip protects against violation of the DNBR and fuel 

centerline melt SLs. However, the RCS Variable Low Pressure, 

and Nuclear Overpower RCS Flow and Measured AXIAL 

POWER IMBALANCE, provide more direct protection. The role 

of the Nuclear Overpower - High Setpoint trip is to limit reactor 

THERMAL POWER below the highest power at which the other 

two trips are known to provide protection. 

The Nuclear Overpower - High Setpoint trip also provides 

transient protection for rapid positive reactivity excursions during 

power operations. These events include the rod withdrawal 

accident, the rod ejection accident, and the steam line break 

accident. By providing a trip during these events, the Nuclear 

Overpower - High Setpoint trip protects the unit from excessive 

power levels and also serves to reduce reactor power to prevent 

violation of the RCS pressure SL. 

Rod withdrawal accident analyses cover a large spectrum of 

reactivity insertion rates (rod worths), which exhibit slow and 

rapid rates of power increases. At high reactivity insertion rates, 

the Nuclear Overpower - High Setpoint trip provides the primary 

protection. At low reactivity insertion rates, the high pressure trip 

provides primary protection. 

The specified Allowable Value is selected to ensure that a trip 

occurs before reactor power exceeds the highest point at which 

the RCS Variable Low Pressure and the Nuclear Overpower 

RCS Flow and Measured AXIAL POWER IMBALANCE trips are 

analyzed to provide protection against DNB and fuel centerline 

melt. The Allowable Value does not account for harsh 

environment induced errors, because the trip will actuate prior to 

degraded environmental conditions being reached. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-14 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

 b. Nuclear Overpower - Low Setpoint

While in shutdown bypass, with the Shutdown Bypass RCS High 

Pressure trip OPERABLE, the Nuclear Overpower - Low 

Setpoint trip must be reduced to ≤ 5% RTP. The low power 

setpoint, in conjunction with the lower Shutdown Bypass RCS 

High Pressure setpoint, ensure that the unit is protected from 

excessive power conditions when other RPS trips are bypassed. 

The setpoint Allowable Value was chosen to be as low as 

practical and still lie within the range of the out of core 

instrumentation. 

2. RCS High Outlet Temperature

The RCS High Outlet Temperature trip, in conjunction with the RCS 

Low Pressure and RCS Variable Low Pressure trips, provides 

protection for the DNBR SL. A trip is initiated whenever the reactor 

vessel outlet temperature approaches the conditions necessary for 

DNB. Portions of each RCS High Outlet Temperature trip channel 

are common with the RCS Variable Low Pressure trip. The RCS 

High Outlet Temperature trip provides steady state protection for the 

DNBR SL. 

The RCS High Outlet Temperature trip limits the maximum RCS 

temperature to below the highest value for which DNB protection by 

the Variable Low Pressure trip is ensured. The trip setpoint 

Allowable Value is selected to ensure that a trip occurs before hot leg 

temperatures reach the point beyond which the RCS Low Pressure 

and Variable Low Pressure trips are analyzed. Above the high 

temperature trip, the variable low pressure trip need not provide 

protection, because the unit would have tripped already. The 

setpoint Allowable Value does not reflect errors induced by harsh 

environmental conditions that the equipment is expected to 

experience because the trip is not required to mitigate accidents that 

create harsh conditions in the RB. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-15 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3. RCS High Pressure

The RCS High Pressure trip works in conjunction with the pressurizer 

and main steam safety valves to prevent RCS overpressurization, 

thereby protecting the RCS High Pressure SL. 

The RCS High Pressure trip has been credited in the accident 

analysis calculations for slow positive reactivity insertion transients 

(rod withdrawal accidents and moderator dilution) and loss of 

feedwater accidents. The rod withdrawal accidents cover a large 

spectrum of reactivity insertion rates and rod worths that exhibit slow 

and rapid rates of power increases. At high reactivity insertion rates, 

the Nuclear Overpower - High Setpoint trip provides the primary 

protection. At low reactivity insertion rates, the RCS High Pressure 

trip provides the primary protection. 

The setpoint Allowable Value is selected to ensure that the RCS High 

Pressure SL is not challenged during steady state operation or slow 

power increasing transients. The setpoint Allowable Value does not 

reflect errors induced by harsh environmental conditions because the 

equipment is not required to mitigate accidents that create harsh 

conditions in the RB. 

4. RCS Low Pressure

The RCS Low Pressure trip, in conjunction with the RCS High Outlet 

Temperature and Variable Low Pressure trips, provides protection for 

the DNBR SL. A trip is initiated whenever the system pressure 

approaches the conditions necessary for DNB. The RCS Low 

Pressure trip provides DNB low pressure limit for the RCS Variable 

Low Pressure trip. 

The RCS Low Pressure setpoint Allowable Value is selected to 

ensure that a reactor trip occurs before RCS pressure is reduced 

below the lowest point at which the RCS Variable Low Pressure trip 

is analyzed. The RCS Low Pressure trip provides protection for 

primary system depressurization events and has been credited in the 

accident analysis calculations for small break loss of coolant 

accidents (LOCAs). Consequently, harsh RB conditions created by 

small break LOCAs can affect performance of the RCS pressure 

sensors and transmitters. Therefore, degraded environmental 

conditions are considered in the Allowable Value determination. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-16 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

5. RCS Variable Low Pressure

The RCS Variable Low Pressure trip, in conjunction with the RCS 

High Outlet Temperature and RCS Low Pressure trips, provides 

protection for the DNBR SL. A trip is initiated whenever the system 

parameters of pressure and temperature approach the conditions 

necessary for DNB. The RCS Variable Low Pressure trip provides a 

floating low pressure trip based on the RCS High Outlet Temperature 

within the range specified by the RCS High Outlet Temperature and 

RCS Low Pressure trips. 

The RCS Variable Low Pressure setpoint Allowable Value is selected 

to ensure that a trip occurs when temperature and pressure approach 

the conditions necessary for DNB while operating in a temperature 

pressure region constrained by the low pressure and high 

temperature trips. The RCS Variable Low Pressure trip is not 

assumed for transient protection in the unit safety analysis; therefore, 

determination of the setpoint Allowable Value does not account for 

errors induced by a harsh RB environment. 

6. Reactor Building High Pressure

The Reactor Building High Pressure trip provides an early indication 

of a high energy line break (HELB) inside the RB. By detecting 

changes in the RB pressure, the RPS can provide a reactor trip 

before the other system parameters have varied significantly. Thus, 

this trip acts to minimize accident consequences. It also provides a 

backup for RPS trip instruments exposed to an RB HELB 

environment. 

The Allowable Value for RB High Pressure trip is set at the lowest 

value consistent with avoiding spurious trips during normal operation. 

The electronic components of the RB High Pressure trip are located 

in an area that is not exposed to high temperature steam 

environments during HELB transients. The components are exposed 

to high radiation conditions. Therefore, the determination of the 

setpoint Allowable Value accounts for errors induced by the high 

radiation. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-17 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

7. Reactor Coolant Pump to Power

The Reactor Coolant Pump to Power trip provides protection for 

changes in the reactor coolant flow due to the loss of multiple RCPs. 

Because the flow reduction lags loss of power indications due to the 

inertia of the RCPs, the trip initiates protective action earlier than a 

trip based on a measured flow signal. 

The trip also prevents operation with both pumps in either coolant 

loop tripped. Under these conditions, core flow and core fluid mixing 

are insufficient for adequate heat transfer. Thus, the Reactor Coolant 

Pump to Power trip functions to protect the DNBR and fuel centerline 

melt SLs. 

The Reactor Coolant Pump to Power trip has been credited in the 

accident analysis calculations for the loss of four RCPs. The trip also 

provides the primary protection for the loss of a pump or pumps, 

which would result in both pumps in a single steam generator loop 

being tripped. 

The Allowable Value for the Reactor Coolant Pump to Power trip 

setpoint is selected to prevent normal power operation unless at least 

three RCPs are operating. RCP status is monitored by power 

transducers on each pump. These relays indicate a loss of an RCP 

on overpower with an Allowable Value of ≥ 14,400 kW and on 

underpower with an Allowable Value of ≤ 1752 kW. The overpower 

Allowable Value is selected low enough to detect locked rotor 

conditions (although credit is not allowed for this capability) but high 

enough to avoid a spurious trip on the in rush current when the 

pumps start. The underpower Allowable Value is selected to reliably 

trip on loss of voltage to the RCPs. Neither the reactor power nor the 

pump power Allowable Value account for instrumentation errors 

caused by harsh environments because the trip Function is not 

required to respond to events that could create harsh environments 

around the equipment. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-18 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

8. Nuclear Overpower RCS Flow and Measured AXIAL POWER

IMBALANCE

The Nuclear Overpower RCS Flow and Measured AXIAL POWER 

IMBALANCE trip provides steady state protection for the power 

imbalance SLs. A reactor trip is initiated when the core power, 

AXIAL POWER IMBALANCE, and reactor coolant flow conditions 

indicate an approach to DNB or fuel centerline melt limits. 

This trip supplements the protection provided by the Reactor Coolant 

Pump to Power trip, through the power to flow ratio, for loss of 

reactor coolant flow events. The power to flow ratio provides direct 

protection for the DNBR SL for the loss of a single RCP and for 

locked RCP rotor accidents. The imbalance portion of the trip is 

credited for steady state protection only. 

The power to flow ratio of the Nuclear Overpower RCS Flow and 

Measured AXIAL POWER IMBALANCE trip also provides steady 

state protection to prevent reactor power from exceeding the 

allowable power when the primary system flow rate is less than full 

four pump flow. Thus, the power to flow ratio prevents overpower 

conditions similar to the Nuclear Overpower trip. This protection 

ensures that during reduced flow conditions the core power is 

maintained below that required to begin DNB. 

The Allowable Value is selected to ensure that a trip occurs when the 

core power, axial power peaking, and reactor coolant flow conditions 

indicate an approach to DNB or fuel centerline melt limits. By 

measuring reactor coolant flow and by tripping only when conditions 

approach an SL, the unit can operate with the loss of one pump from 

a four pump initial condition. The Allowable Value for this Function is 

given in the unit COLR because the cycle specific core peaking 

changes affect the Allowable Value. 

9. Main Turbine Trip (Control Oil Pressure)

The Main Turbine Trip Function trips the reactor when the main 

turbine is lost at high power levels. The Main Turbine Trip Function 

provides an early reactor trip in anticipation of the loss of heat sink 

associated with a turbine trip. The Main Turbine Trip Function was 

added to the B&W designed units in accordance with NUREG-0737 

(Ref. 7) following the Three Mile Island Unit 2 accident. The trip 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-19 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

lowers the probability of an RCS power operated relief valve (PORV) 

actuation for turbine trip cases. This trip is activated at higher power 

levels, thereby limiting the range through which the Integrated 

Control System must provide an automatic runback on a turbine trip. 

Each of the four turbine oil pressure switches feeds all four protection 

channels through buffers that continuously monitor the status of the 

contacts. Therefore, failure of any pressure switch affects all 

protection channels. 

For the Main Turbine Trip (Control Oil Pressure) bistable, the 

Allowable Value of 45 psig is selected to provide a trip whenever 

feedwater pump control oil pressure drops below the normal 

operating range. To ensure that the trip is enabled as required by the 

LCO, the reactor power bypass is set with an Allowable Value of 

45% RTP. The turbine trip is not required to protect against events 

that can create a harsh environment in the turbine building. 

Therefore, errors induced by harsh environments are not included in 

the determination of the setpoint Allowable Value. 

10. Loss of Main Feedwater Pumps (Control Oil Pressure)

The Loss of Main Feedwater Pumps (Control Oil Pressure) trip 

provides a reactor trip at high power levels when both MFW pumps 

are lost. The trip provides an early reactor trip in anticipation of the 

loss of heat sink associated with the LOMFW. This trip was added in 

accordance with NUREG-0737 (Ref. 7) following the Three Mile 

Island Unit 2 accident. This trip provides a reactor trip at high power 

levels for a LOMFW to minimize challenges to the PORV. 

For the feedwater pump control oil pressure bistable, the Allowable 

Value of 55 psig is selected to provide a trip whenever feedwater 

pump control oil pressure drops below the normal operating range. 

To ensure that the trip is enabled as required by the LCO, the reactor 

power bypass is set with an Allowable Value of 15% RTP. The Loss 

of Main Feedwater Pumps (Control Oil Pressure) trip is not required 

to protect against events that can create a harsh environment in the 

turbine building. Therefore, errors caused by harsh environments are 

not included in the determination of the setpoint Allowable Value. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-20 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

11. Shutdown Bypass RCS High Pressure

The RPS Shutdown Bypass RCS High Pressure is provided to allow 

for withdrawing the CONTROL RODS prior to reaching the normal 

RCS Low Pressure trip setpoint. The shutdown bypass provides trip 

protection during deboration and RCS heatup by allowing the 

operator to withdraw the safety groups of CONTROL RODS. This 

makes their negative reactivity available to terminate inadvertent 

reactivity excursions. Use of the shutdown bypass trip requires that 

the neutron power trip setpoint be reduced to 5% of full power or 

less. The Shutdown Bypass RCS High Pressure trip forces a reactor 

trip to occur whenever the unit switches from power operation to 

shutdown bypass or vice versa. This ensures that the CONTROL 

RODS are all inserted and the flux distribution is known before power 

operation can begin. The operator is required to remove the 

shutdown bypass, reset the Nuclear Overpower - High Power trip 

setpoint, and again withdraw the safety rod groups before proceeding 

with startup. 

Accidents analyzed in the FSAR, Chapter [14] (Ref. 3), do not 

describe events that occur during shutdown bypass operation, 

because the consequences of these events are enveloped by the 

events presented in the FSAR. 

During shutdown bypass operation with the Shutdown Bypass RCS 

High Pressure trip active with a setpoint of ≤ [1720] psig and the 

Nuclear Overpower - Low Setpoint set at or below 5% RTP, the 

(numbered) trip Functions listed below can be bypassed. Under 

these conditions, the Shutdown Bypass RCS High Pressure trip and 

the Nuclear Overpower - Low Setpoint trip act to prevent unit 

conditions from reaching a point where actuation of these trip 

Functions is necessary. 

1.a Nuclear Overpower - High Setpoint, 

4. RCS Low Pressure, 

5. RCS Variable Low Pressure, 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-21 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

7. Reactor Coolant Pump to Power, and 

8. Nuclear Overpower RCS Flow and Measured AXIAL POWER 

IMBALANCE. 

The Shutdown Bypass RCS High Pressure Function's Allowable Value is 

selected to ensure a trip occurs before producing THERMAL POWER. 

The RPS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

In MODES 1 and 2, the following (numbered) trip Functions shall be 

OPERABLE because the reactor is critical in these MODES. These trips 

are designed to take the reactor subcritical to maintain the SLs during 

AOOs and to assist the ESFAS in providing acceptable consequences 

during accidents. 

1.a Nuclear Overpower - High Setpoint, 

2. RCS High Outlet Temperature, 

3. RCS High Pressure, 

4. RCS Low Pressure, 

5. RCS Variable Low Pressure, 

6. Reactor Building High Pressure, 

7. Reactor Coolant Pump to Power, and 

8. Nuclear Overpower RCS Flow and Measured AXIAL POWER 

IMBALANCE. 

Functions 1, 3, 4, 5, 7, and 8 just listed may be bypassed in MODE 2 

when RCS pressure is below [1720] psig, provided the Shutdown Bypass 

RCS High Pressure and the Nuclear Overpower - Low setpoint trip are 

placed in operation. Under these conditions, the Shutdown Bypass RCS 

High Pressure trip and the Nuclear Overpower - Low setpoint trip act to 

prevent unit conditions from reaching a point where actuation of these 

Functions is necessary. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-22 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

In MODE 3 when not operating in shutdown bypass but with any CRD trip 

breaker in the closed position and the CRD System capable of rod 

withdrawal, the Nuclear Overpower-High Setpoint trip and the RCS High 

Pressure trip are required to be OPERABLE. 

Two other Functions are required to be OPERABLE during portions of 

MODE 1. These are the Main Turbine Trip (Control Oil Pressure) and the 

Loss of Main Feedwater Pumps (Control Oil Pressure) trip. These 

Functions are required to be OPERABLE above [45]% RTP and 

[15]% RTP, respectively. Analyses presented in BAW-1893 (Ref. 8) have 

shown that for operation below these power levels, these trips are not 

necessary to minimize challenges to the PORVs as required by 

NUREG-0737 (Ref. 7). 

Because the only safety function of the RPS is to trip the CONTROL 

RODS, the RPS is not required to be OPERABLE in MODE 3, 4, or 5 if 

the reactor trip breakers are open, or the CRD System is incapable of rod 

withdrawal. Similarly, the RPS is not required to be OPERABLE in 

MODE 6 when the CONTROL RODS are decoupled from the CRDs. 

However, in MODE 2, 3, 4, or 5, the Shutdown Bypass RCS High 

Pressure and Nuclear Overpower - Low setpoint trips are required to be 

OPERABLE if the CRD trip breakers are closed and the CRD System is 

capable of rod withdrawal. Under these conditions, the Shutdown Bypass 

RCS High Pressure and Nuclear Overpower - Low setpoint trips are 

sufficient to prevent an approach to conditions that could challenge SLs. 

ACTIONS Conditions A, B, and C are applicable to all RPS protection Functions. If 

a channel's trip setpoint is found nonconservative with respect to the 

required Allowable Value in Table 3.3.1-1, or the transmitter, instrument 

loop, signal processing electronics or bistable is found inoperable, the 

channel must be declared inoperable and Condition A or Conditions A 

and B entered immediately. 

When the number of inoperable channels in a trip Function exceed those 

specified in the related Conditions associated with a trip Function, then 

the unit is outside the safety analysis. Therefore, LCO 3.0.3 must be 

immediately entered if applicable in the current MODE of operation. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-23 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

If a unit is to take credit for topical reports as the basis for justifying 

Completion Times, the reports must be supported by an NRC Staff Safety 

Evaluation Report (SER) that establishes the acceptability of each topical 

report for that unit. 

-------------------------------------------------------------------------------------------------- 

A.1

If one or more Functions in one protection channel become inoperable, 

the affected protection channel must be placed in bypass or trip. If the 

channel is bypassed, all RPS Functions are placed in a two-out-of-three 

logic configuration and the bypass of any other channel is prevented. In 

this configuration, the RPS can still perform its safety function in the 

presence of a random failure of any single channel. Alternatively, the 

inoperable channel can be placed in trip. Tripping the affected protection 

channel places all RPS Functions in a one-out-of-three configuration. 

Operation in the two-out-of-three configuration or in the one-out-of-three 

configuration may continue indefinitely based on the NRC SER for 

BAW-10167, Supplement 2 (Ref. 9). In this configuration, the RPS is 

capable of performing its trip Function in the presence of any single 

random failure. The 1 hour Completion Time is sufficient to perform 

Required Action A.1. 

B.1 and B.2

For Required Action B.1 and Required Action B.2, if one or more 

Functions in two protection channels become inoperable, one of two 

inoperable protection channels must be placed in trip and the other in 

bypass. These Required Actions place all RPS Functions in a one-out-oftwo logic configuration and prevent bypass of a second channel. In this 

configuration, the RPS can still perform its safety functions in the 

presence of a random failure of any single channel. The 1 hour 

Completion Time is sufficient time to perform Required Action B.1 and 

Required Action B.2. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-24 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

Required Action C.1 directs entry into the appropriate Condition 

referenced in Table 3.3.1-1. The applicable Condition referenced in the 

table is Function dependent. If the Required Action and the associated 

Completion Time of Condition A or B are not met or if more than two 

channels are inoperable, Condition C is entered to provide for transfer to 

the appropriate subsequent Condition. 

D.1 and D.2

If the Required Action and associated Completion Time of Condition A 

or B are not met and Table 3.3.1-1 directs entry into Condition D, the unit 

must be brought to a MODE in which the specified RPS trip Functions are 

not required to be OPERABLE. The allowed Completion Time of 6 hours 

is reasonable, based on operating experience, to reach MODE 3 from full 

power conditions in an orderly manner and to open all CRD trip breakers 

without challenging plant systems. 

E.1

If the Required Action and associated Completion Time of Condition A 

or B are not met and Table 3.3.1-1 directs entry into Condition E, the unit 

must be brought to a MODE in which the specified RPS trip Functions are 

not required to be OPERABLE. To achieve this status, all CRD trip 

breakers must be opened. The allowed Completion Time of 6 hours is 

reasonable, based on operating experience, to open CRD trip breakers 

without challenging plant systems. 

F.1

If the Required Action and associated Completion Time of Condition A 

or B are not met and Table 3.3.1-1 directs entry into Condition F, the unit 

must be brought to a MODE in which the specified RPS trip Function is 

not required to be OPERABLE. To achieve this status, THERMAL 

POWER must be reduced < [45]% RTP. The allowed Completion Time of 

6 hours is reasonable, based on operating experience, to reach 

[45]% RTP from full power conditions in an orderly manner without 

challenging plant systems. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-25 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

G.1

If the Required Action and associated Completion Time of Condition A 

or B are not met and Table 3.3.1-1 directs entry into Condition G, the unit 

must be brought to a MODE in which the specified RPS trip Function is 

not required to be OPERABLE. To achieve this status, THERMAL 

POWER must be reduced < [15]% RTP. The allowed Completion Time of 

6 hours is reasonable, based on operating experience, to reach 

[15]% RTP from full power conditions in an orderly manner without 

challenging plant systems. 

SURVEILLANCE The SRs for each RPS Function are identified by the SRs column of 

REQUIREMENTS Table 3.3.1-1 for that Function. Most Functions are subject to CHANNEL 

CHECK, CHANNEL FUNCTIONAL TEST, CHANNEL CALIBRATION, 

and RPS RESPONSE TIME testing. 

The SRs are modified by a Note. The [first] Note directs the reader to 

Table 3.3.1-1 to determine the correct SRs to perform for each RPS 

Function. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The CHANNEL FUNCTIONAL TEST Frequencies are based on approved 

topical reports. For a licensee to use these times, the licensee must 

justify the Frequencies as required by the NRC Staff SER for the topical 

report. 

-------------------------------------------------------------------------------------------------- 

SR 3.3.1.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. CHANNEL 

CHECK will detect gross channel failure; therefore, it is key in verifying 

that the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-26 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Agreement criteria are determined by the unit staff based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the transmitter or the signal processing equipment has 

drifted outside its limit. If the channels are within the criteria, it is an 

indication that the channels are OPERABLE. If the channels are normally 

off scale during times when surveillance is required, the CHANNEL 

CHECK will only verify that they are off scale in the same direction. Off 

scale low current loop channels are verified to be reading at the bottom of 

the range and not failed downscale. 

The agreement criteria includes an expectation of one decade of overlap 

when transitioning between neutron flux instrumentation. For example, 

during a power increase near the top of the scale of the intermediate 

range monitors, a power range monitor reading is expected with at least 

one decade overlap. Without such an overlap, the power range monitors 

are considered inoperable unless it is clear that an intermediate range 

monitor inoperability is responsible for the lack of the expected overlap. 

The Frequency, about once every shift, is based on operating experience 

that demonstrates channel failure is rare. Since the probability of two 

random failures in redundant channels in any 12 hour period is extremely 

low, the CHANNEL CHECK minimizes the chance of loss of protective 

function due to failure of redundant channels. The CHANNEL CHECK 

supplements less formal but more frequent checks of channel 

OPERABILITY during normal operational use of the displays associated 

with the LCO's required channels. 

For Functions that trip on a combination of several measurements, such 

as the Nuclear Overpower RCS Flow and Measured AXIAL POWER 

IMBALANCE Function, the CHANNEL CHECK must be performed on 

each input. 

SR 3.3.1.2

This SR is the performance of a heat balance calibration for the power 

range channels every 24 hours when reactor power is > 15% RTP. The 

heat balance calibration consists of a comparison of the results of the 

calorimetric with the power range channel output. The outputs of the 

power range channels are normalized to the calorimetric. Note 1 to the 

SR states if the absolute difference between the calorimetric and the 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-27 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Nuclear Instrumentation System (NIS) channel output is > [2]% RTP, the 

NIS is not declared inoperable but must be adjusted. If the NIS channel 

cannot be properly adjusted, the channel is declared inoperable. Note 2 

clarifies that this Surveillance is required only if reactor power is 

≥ 15% RTP and that 24 hours is allowed for performing the first 

Surveillance after reaching 15% RTP. At lower power levels, calorimetric 

data are inaccurate. 

The power range channel's output shall be adjusted consistent with the 

calorimetric results if the absolute difference between the calorimetric and 

the power range channel's output is > [2]% RTP. The value of [2]% is 

adequate because this value is assumed in the safety analyses of FSAR, 

Chapter [14] (Ref. 3). These checks and, if necessary, the adjustment of 

the power range channels ensure that channel accuracy is maintained 

within the analyzed error margins. The 24 hour Frequency is adequate, 

based on unit operating experience, which demonstrates the change in 

the difference between the power range indication and the calorimetric 

results rarely exceeds a small fraction of [2]% in any 24 hour period. 

Furthermore, the control room operators monitor redundant indications 

and alarms to detect deviations in channel outputs. 

SR 3.3.1.3

A comparison of power range nuclear instrumentation channels against 

incore detectors shall be performed at a 31 day Frequency when reactor 

power is > 15% RTP. The SR is modified by two Notes. Note 2 clarifies 

that 24 hours is allowed for performing the first Surveillance after reaching 

15% RTP. Note 1 states if the absolute difference between the power 

range and incore measurements is ≥ [2]% RTP, the power range channel 

is not inoperable, but an adjustment of the measured imbalance to agree 

with the incore measurements is necessary. If the power range channel 

cannot be properly recalibrated, the channel is declared inoperable. The 

calculation of the Allowable Value envelope assumes a difference in out 

of core to incore measurements of 2.5%. Additional inaccuracies beyond 

those that are measured are also included in the setpoint envelope 

calculation. The 31 day Frequency is adequate, considering that long 

term drift of the excore linear amplifiers is small and burnup of the 

detectors is slow. Also, the excore readings are a strong function of the 

power produced in the peripheral fuel bundles, and do not represent an 

integrated reading across the core. The slow changes in neutron flux 

during the fuel cycle can also be detected at this interval. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-28 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.1.4

A CHANNEL FUNCTIONAL TEST is performed on each required RPS 

channel to ensure that the entire channel will perform the intended 

function. A successful test of the required contact(s) of a channel relay 

may be performed by the verification of the change of state of a single 

contact of the relay. This clarifies what is an acceptable CHANNEL 

FUNCTIONAL TEST of a relay. This is acceptable because all of the 

other required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per 

refueling interval with applicable extensions. Setpoints must be found 

within the Allowable Values specified in Table 3.3.1-1. Any setpoint 

adjustment shall be consistent with the assumptions of the current unit 

specific setpoint analysis. 

The as found and as left values must also be recorded and reviewed for 

consistency with the assumptions of the surveillance interval extension 

analysis. The requirements for this review are outlined in BAW-10167 

(Ref. 10). 

The Frequency of [45] days on a STAGGERED TEST BASIS is 

consistent with the calculations of Reference 9 that indicate the RPS 

retains a high level of reliability for this test interval. 

SR 3.3.1.5

A Note to the Surveillance indicates that neutron detectors are excluded 

from CHANNEL CALIBRATION. This Note is necessary because of the 

difficulty in generating an appropriate detector input signal. Excluding the 

detectors is acceptable because the principles of detector operation 

ensure a virtually instantaneous response. 

A CHANNEL CALIBRATION is a complete check of the instrument 

channel, including the sensor. The test verifies that the channel responds 

to the measured parameter within the necessary range and accuracy. 

CHANNEL CALIBRATION leaves the channel adjusted to account for 

instrument drift to ensure that the instrument channel remains operational 

between successive tests. CHANNEL CALIBRATION shall find that 

measurement errors and bistable setpoint errors are within the 

assumptions of the unit specific setpoint analysis. CHANNEL 

CALIBRATIONS must be performed consistent with the assumptions of 

the unit specific setpoint analysis. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-29 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Whenever a sensing element is replaced, the next required CHANNEL 

CALIBRATION of the resistance temperature detectors (RTD) sensors is 

accomplished by an inplace cross calibration that compares the other 

sensing elements with the recently installed sensing element. 

The Frequency is justified by the assumption of an [18] month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.1.6

This SR verifies individual channel actuation response times are less than 

or equal to the maximum values assumed in the accident analysis. 

Individual component response times are not modeled in the analyses. 

The analyses model the overall, or total, elapsed time from the point at 

which the parameter exceeds the analytical limit at the sensor to the point 

of rod insertion. Response time testing acceptance criteria for this unit 

are included in Reference 2. 

A Note to the Surveillance indicates that neutron detectors are excluded 

from RPS RESPONSE TIME testing. This Note is necessary because of 

the difficulty in generating an appropriate detector input signal. Excluding 

the detectors is acceptable because the principles of detector operation 

ensure a virtually instantaneous response. 

Response time tests are conducted on an [18] month STAGGERED 

TEST BASIS. Testing of the final actuation devices, which make up the 

bulk of the response time, is included in the testing of each channel. 

Therefore, staggered testing results in response time verification of these 

devices every [18] months. The [18] month Frequency is based on unit 

operating experience, which shows that random failures of 

instrumentation components causing serious response time degradation, 

but not channel failure, are infrequent occurrences. 
RPS Instrumentation 

B 3.3.1 

BWOG STS B 3.3.1-30 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. Regulatory Guide 1.105, Revision 3, “Setpoints for Safety Related 

Instrumentation.” 

 2. FSAR, Chapter [7]. 

 3. FSAR, Chapter [14]. 

 4. 10 CFR 50.49. 

 5. [Unit Specific Setpoint Methodology]. 

 6. [Unit Specific Accident Analysis]. 

 7. NUREG-0737, November 1979. 

 8. BAW-1893. 

 9. NRC SER for BAW-10167, Supplement 2, July 8, 1992. 

 10. BAW-10167, May 1986. 
RPS Manual Reactor Trip 

B 3.3.2 

BWOG STS B 3.3.2-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.2 Reactor Protection System (RPS) Manual Reactor Trip 

BASES 

BACKGROUND The RPS Manual Reactor Trip provides the operator with the capability to 

trip the reactor from the control room in the absence of any other trip 

condition. Manual trip is provided by a trip push button on the main 

control board. This push button operates four electrically independent 

switches, one for each train. This trip is independent of the automatic trip 

system. As shown in Figure [ ] , FSAR, Chapter [7] (Ref. 1), power for 

the CONTROL ROD drive (CRD) breaker undervoltage coils and 

contactor coils comes from the reactor trip modules (RTMs). The manual 

trip switches are located between the RTM output and the breaker 

undervoltage coils. Opening of the switches opens the lines to the 

breakers, tripping them. The switches also energize the breaker shunt 

trip mechanisms. There is a separate switch in series, with the output of 

each of the four RTMs. All switches are actuated through a mechanical 

linkage from a single push button. 

APPLICABLE The Manual Reactor Trip ensures that the control room operator can 

SAFETY initiate a reactor trip at any time. The Manual Reactor Trip Function is 

ANALYSES required as a backup to the automatic trip functions and allows operators 

to shut down the reactor whenever any parameter is rapidly trending 

toward its trip setpoint. 

The Manual Reactor Trip Function satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The LCO on the RPS Manual Reactor Trip requires that the trip shall be 

OPERABLE whenever the reactor is critical or any time any control rod 

breaker is closed and rods are capable of being withdrawn, including 

shutdown bypass. This enables the operator to terminate any reactivity 

excursion that in the operator's judgment requires protective action, even 

if no automatic trip condition exists. 

The Manual Reactor Trip Function is composed of four electrically 

independent trip switches sharing a common mechanical push button. 
RPS Manual Reactor Trip 

B 3.3.2 

BWOG STS B 3.3.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The Manual Reactor Trip Function is required to be OPERABLE in 

MODES 1 and 2. It is also required to be OPERABLE in MODES 3, 4, 

and 5 if any CRD trip breaker is in the closed position and if the CRD 

System is capable of rod withdrawal. The only safety function of the RPS 

is to trip the CONTROL RODS; therefore, the Manual Reactor Trip 

Function is not needed in MODE 3, 4, or 5 if the reactor trip breakers are 

open or if the CRD System is incapable of rod withdrawal. Similarly, the 

RPS Manual Reactor Trip is not needed in MODE 6 when the CONTROL 

RODS are decoupled from the CRDs. 

ACTIONS A.1

Condition A applies when the Manual Reactor Trip Function is found 

inoperable. One hour is allowed to restore Function to OPERABLE 

status. The automatic functions and various alternative manual trip 

methods, such as removing power to the RTMs, are still available. The 

1 hour Completion Time is sufficient time to correct minor problems. 

B.1 and B.2

With the Manual Reactor Trip Function inoperable and unable to be 

returned to OPERABLE status within 1 hour in MODE 1, 2, or 3, the unit 

must be placed in a MODE in which manual trip is not required. Required 

Action B.1 and Required Action B.2 place the unit in at least MODE 3 with 

all CRD trip breakers open within 6 hours. The allowed Completion Time 

of 6 hours is reasonable, based on operating experience, to reach 

MODE 3 from full power conditions in an orderly manner and without 

challenging unit systems. 

C.1

With the Manual Reactor Trip Function inoperable and unable to be 

returned to OPERABLE status within 1 hour in MODE 4 or 5, the unit 

must be placed in a MODE in which manual trip is not required. To 

achieve this status, all CRD trip breakers must be opened. The allowed 

Completion Time of 6 hours is reasonable, based on operating 

experience, to open all CRD trip breakers without challenging unit 

systems. 
RPS Manual Reactor Trip 

B 3.3.2 

BWOG STS B 3.3.2-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.3.2.1

REQUIREMENTS 

This SR requires the performance of a CHANNEL FUNCTIONAL TEST of 

the Manual Reactor Trip Function. This test verifies the OPERABILITY of 

the Manual Reactor Trip by actuation of the CRD trip breakers. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. The Frequency shall be once prior to each reactor 

startup if not performed within the preceding 7 days to ensure the 

OPERABILITY of the Manual Reactor Trip Function prior to achieving 

criticality. The Frequency was developed in consideration that these 

Surveillances are only performed during a unit outage. 

REFERENCES 1. FSAR, Chapter [7]. 
RPS - RTM 

B 3.3.3 

BWOG STS B 3.3.3-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.3 Reactor Protection System (RPS) - Reactor Trip Module (RTM) 

BASES 

BACKGROUND The RPS consists of four independent protection channels, each 

containing an RTM. Figure [ ] , FSAR, Chapter [7] (Ref. 1), shows a 

typical RPS protection channel and the relationship of the RTM to the 

RPS instrumentation, manual trip, and CONTROL ROD drive (CRD) trip 

devices. The RTM receives bistable trip signals from the functions in its 

own channel and channel trip signals from the other three RPS - RTMs. 

The RTM provides these signals to its own two-out-of-four trip logic and 

transmits its own channel trip signal to the two-out-of-four logic of the 

RTMs in the other three RPS channels. Whenever any two RPS 

channels transmit channel trip signals, the RTM logic in each channel 

actuates to remove 120 VAC power from its associated CRD trip device. 

The RPS trip scheme consists of series contacts that are operated by 

bistables. During normal unit operations, all contacts are closed and the 

RTM channel trip relay remains energized. However, if any trip 

parameter exceeds its setpoint, its associated contact opens, which deenergizes the channel trip relay. 

When an RTM channel trip relay de-energizes, several things occur: 

a. Each of the four (4) output logic relays "informs" its associated RPS 

channel that a reactor trip signal has occurred in the tripped RPS 

channel, 

b. The contacts in the trip device circuitry, powered by the tripped 

channel, open, but the trip device remains energized through the 

closed contacts from the other RTMs. (This condition exists in each 

RPS - RTM. Each RPS - RTM controls power to a trip device.), and 

c. The contact in parallel with the channel reset switch opens and the 

trip is sealed in. To re-energize the channel trip relay, the channel 

reset switch must be depressed after the trip condition has cleared. 

When the second RPS channel senses a reactor trip condition, the output 

logic relays for the second channel de-energize and open contacts that 

supply power to the trip devices. With contacts opened by two separate 

RPS channels, power to the trip devices is interrupted and the CONTROL 

RODS fall into the core. 
RPS - RTM 

B 3.3.3 

BWOG STS B 3.3.3-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

A minimum of two out of four RTMs must sense a trip condition to cause 

a reactor trip. Also, because the bistable relay contacts for each function 

are in series with the channel trip relays, two channel trips caused by 

different trip functions can result in a reactor trip. 

APPLICABLE Accident analyses rely on a reactor trip for protection of reactor core 

SAFETY integrity, reactor coolant pressure boundary integrity, and reactor building 

ANALYSES OPERABILITY. A reactor trip must occur when needed to prevent 

accident conditions from exceeding those calculated in the accident 

analyses. More detailed descriptions of the applicable accident analyses 

are found in the bases for each of the RPS trip Functions in LCO 3.3.1, 

"Reactor Protection System (RPS) Instrumentation." 

RTM response time is included in the overall required response time for 

each RPS trip and is not specified separately. 

The RTMs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The RTM LCO requires all four RTMs to be OPERABLE. Failure of any 

RTM renders a portion of the RPS inoperable and reduces the reliability 

of the affected Functions. 

Four RTMs must be OPERABLE to ensure that a reactor trip would occur 

if needed any time the reactor is critical. OPERABILITY is defined as the 

RTM being able to receive and interpret trip signals from its own and 

other RPS channels and to open its associated trip device. 

The requirement of four channels to be OPERABLE ensures that a 

minimum of two RPS channels will remain OPERABLE if a single failure 

has occurred in one channel and if a second channel has been bypassed 

for surveillance or maintenance. This two-out-of-four trip logic also 

ensures that a single RPS channel failure will not cause an unwanted 

reactor trip. Violation of this LCO could result in a trip signal not causing 

a reactor trip when needed. 
RPS - RTM 

B 3.3.3 

BWOG STS B 3.3.3-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The RTMs are required to be OPERABLE in MODES 1 and 2. They are 

also required to be OPERABLE in MODES 3, 4, and 5 if any CRD trip 

breakers are in the closed position and the CRD System is capable of rod 

withdrawal. The RTMs are designed to ensure a reactor trip would occur, 

if needed, any time the reactor is critical. This condition can exist in all of 

these MODES; therefore, the RTMs must be OPERABLE. 

ACTIONS A.1.1, A.1.2, and A.2

When an RTM is inoperable, the associated CRD trip breaker must then 

be placed in a condition that is equivalent to a tripped condition for the 

RTM. Required Action A.1.1 or Required Action A.1.2 requires this either 

by tripping the CRD trip breaker or by removing power to the CRD trip 

device. Tripping one RTM or removing power opens one set of CRD trip 

devices. Power to hold up CONTROL RODS is still provided via the 

parallel CRD trip device(s). Therefore, a reactor trip will not occur until a 

second protection channel trips. 

To ensure the trip signal is registered in the other channels, Required 

Action A.2 requires that the inoperable RTM be removed from the 

cabinet. This action causes the electrical interlocks to indicate a tripped 

channel in the remaining three RTMs. Operation in this condition is 

allowed indefinitely because the actions put the RPS into a one-out-ofthree configuration. The 1 hour Completion Time is sufficient time to 

perform the Required Actions. 

B.1, B.2.1, and B.2.2

Condition B applies if two or more RTMs are inoperable or if the Required 

Actions of Condition A are not met within the required Completion Time in 

MODE 1, 2, or 3. In this case, the unit must be placed in a MODE in 

which the LCO does not apply. This is done by placing the unit in at least 

MODE 3 with all CRD trip breakers open or with power from all CRD trip 

breakers removed within 6 hours. The allowed Completion Time of 

6 hours is reasonable, based on operating experience, to reach MODE 3 

from full power conditions in an orderly manner and without challenging 

unit systems. 
RPS - RTM 

B 3.3.3 

BWOG STS B 3.3.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

Condition C applies if two or more RTMs are inoperable or if the Required 

Actions of Condition A are not met within the required Completion Time in 

MODE 4 or 5. In this case, the unit must be placed in a MODE in which 

the LCO does not apply. This is done by opening all CRD trip breakers or 

removing power from all CRD trip breakers. The allowed Completion 

Time of 6 hours is reasonable, based on operating experience, to open all 

CRD trip breakers or remove power from all CRD trip breakers without 

challenging unit systems. 

SURVEILLANCE SR 3.3.3.1

REQUIREMENTS 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The CHANNEL FUNCTIONAL TEST Frequency is approved for all B&W 

power plants except for TMI based on an approved topical report. No 

further evaluations or justifications are required for the evaluated plants to 

incorporate the 23 day STAGGERED TEST BASIS Frequency. 

-------------------------------------------------------------------------------------------------- 

The SRs include performance of a CHANNEL FUNCTIONAL TEST every 

[23] days on a STAGGERED TEST BASIS. This test shall verify the 

OPERABILITY of the RTM and its ability to receive and properly respond 

to channel trip and reactor trip signals. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. Calculations have 

shown that the Frequency (23 days) maintains a high level of reliability of 

the Reactor Trip System in BAW-10167A, Supplement 3 (Ref. 2). 

REFERENCES 1. FSAR, Chapter [7]. 

 2. BAW-10167A, Supplement 3, February 1998. 
CRD Trip Devices 

B 3.3.4 

BWOG STS B 3.3.4-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.4 CONTROL ROD Drive (CRD) Trip Devices 

BASES 

BACKGROUND The Reactor Protection System (RPS) contains multiple CRD trip devices: 

two AC trip breakers, two DC trip breaker pairs, and eight electronic trip 

assembly (ETA) relays. The system has two separate paths (or 

channels), with each path having one AC breaker in series with either a 

pair of DC breakers or four ETA relays in parallel. Each path provides 

independent power to the CRDs. Either path can provide sufficient power 

to operate the entire CRD System. 

Figure [ ] , FSAR, Chapter [7] (Ref. 1), illustrates the configuration of 

CRD trip devices. To trip the reactor, power to the CRDs must be 

removed. Loss of power causes the CRD's mechanisms to release the 

CONTROL RODS, which then fall by gravity into the core. 

Power to CRDs is supplied from two separate unit sources through the 

AC trip circuit breakers. These breakers are designated A and B, and 

their undervoltage and shunt trip coils are powered by RPS channels A 

and B, respectively. From the circuit breakers, the CRD power travels 

through voltage regulators and stepdown transformers. These devices in 

turn supply redundant buses that feed the DC power supplies and the 

regulating rod power supplies. 

The DC power supplies rectify the AC input and supply power to hold the 

safety rods in their fully withdrawn position. One of the redundant power 

sources supplies phase A; the other, phase C. Either phase being 

energized is sufficient to hold the rod. Two breakers are located on the 

output of each power supply. Each breaker controls power to one of the 

four safety rod groups. The undervoltage and shunt trip coils on the two 

circuit breakers on the output of one of the power supplies is controlled by 

RPS channel C. The other two breakers are controlled by RPS 

channel D. 

In addition to the DC power supplies, the redundant buses also supply 

power to the regulating and auxiliary power supplies. These power 

supplies consist of ETAs that are gated on by programming lamps. 

Programming lamp power is controlled by contactors (E and F), which are 

controlled by RPS power. One of the redundant programming lamp 

supplies is controlled by RPS channel C; the other, by RPS channel D. 
CRD Trip Devices 

B 3.3.4 

BWOG STS B 3.3.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The AC breaker and DC breakers are in series in one of the power 

supplies; whereas, the redundant AC breaker and DC breakers are in 

series in the other power supply to the CONTROL RODS. The logic 

required to cause a reactor trip is the opening of a circuit breaker in each 

of the redundant power supplies. (The pair of DC circuit breakers on the 

output of the power supply are treated as one breaker.) This is known as 

a one-out-of-two taken twice logic. The following examples illustrate the 

operation of the reactor trip circuit breakers. 

a. If the A AC circuit breaker opens: 

 1. The input power to associated DC power supply is lost and 

 2. The SCR supply from the associated power source is lost. 

b. If the D DC circuit breaker(s) and F contactors open: 

 1. The output of the redundant DC power supply is lost and the 

safety rods de-energize and 

 2. When the F contactor opens, programming lamp power is lost 

and the regulating rods will be de-energized. 

c. The combination of (a) and (b) causes a reactor trip. 

Any other combination of at least one circuit breaker opening in each 

power supply will cause a reactor trip. 

In summary, two tripped RPS channels will cause a reactor trip. For 

example, a reactor trip occurs if RPS channel B senses a low Reactor 

Coolant System (RCS) pressure condition and if RPS channel C senses a 

variable low RCS pressure condition. When the channel B bistable relay 

de-energizes, the channel trip relay de-energizes and opens its 

associated contacts. The same thing occurs in channel C, except the 

variable lower pressure bistable relay de-energizes the channel C trip 

relay. When the output logic relays de-energize, the B and C contacts in 

the undervoltage and E and F contacts de-energize, all circuit breakers 

open, and programming lamp power is removed. All rods fall into the 

core, resulting in a reactor trip. 
CRD Trip Devices 

B 3.3.4 

BWOG STS B 3.3.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE Accident analyses rely on a reactor trip for protection of reactor core 

SAFETY integrity, reactor coolant pressure boundary integrity, and reactor building 

ANALYSES OPERABILITY. A reactor trip must occur when needed to prevent 

accident consequences from exceeding those calculated in the accident 

analyses. The control rod insertion limits ensure that adequate rod worth 

is available upon reactor trip to shut down the reactor to the required 

SDM. Further, OPERABILITY of the CRD trip devices ensures that all 

CONTROL RODS (except Group 8) will trip when required. More detailed 

descriptions of the applicable accident analyses are found in the Bases 

for each of the individual RPS trip Functions in LCO 3.3.1, "Reactor 

Protection System (RPS) Instrumentation." 

The CRD trip devices satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The LCO requires all of the CRD trip devices to be OPERABLE. Failure 

of any CRD trip device renders a portion of the RPS inoperable and 

reduces the reliability of the affected Functions. Without reliable CRD 

reactor trip circuit breakers and associated support circuitry, a reactor trip 

cannot occur when initiated either automatically or manually. 

All CRD trip devices shall be OPERABLE to ensure that the reactor 

remains capable of being tripped any time it is critical. OPERABILITY is 

defined as the CRD trip device being able to receive a reactor trip signal 

and to respond to this trip signal by interrupting AC power to the CRDs. 

Both of the AC breaker's trip devices and the breaker itself must be 

functioning properly for the AC breaker to be OPERABLE. 

Requiring all breakers and ETA relays to be OPERABLE ensures that at 

least one device in each of the two power paths to the CRDs will remain 

OPERABLE even with a single failure. Requiring all devices OPERABLE 

also ensures that a single failure will not cause an unwanted reactor trip. 

APPLICABILITY The CRD trip devices shall be OPERABLE in MODES 1 and 2, and in 

MODES 3, 4, and 5 when any CRD trip breaker is in the closed position 

and the CRD System is capable of rod withdrawal. 

The CRD trip devices are designed to ensure that a reactor trip would 

occur if needed any time the reactor is critical. Since this condition can 

exist in all of these MODES, the CRD trip devices shall be OPERABLE. 
CRD Trip Devices 

B 3.3.4 

BWOG STS B 3.3.4-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A Note has been added to the ACTIONS indicating separate Condition 

entry is allowed for each CRD trip device. 

Condition A

Condition A represents reduced redundancy in the CRD trip Function. 

Condition A applies when: 

• One diverse trip Function (undervoltage or shunt trip device) is 

inoperable in one or more CRD trip breaker(s) [or breaker pair] or 

• One diverse trip Function is inoperable in both DC trip breakers 

associated with one protection channel. In this case, the inoperable 

trip Function does not need to be the same for both breakers. 

A.1 and A.2

If one of the diverse trip Functions on a CRD trip breaker [or breaker pair] 

becomes inoperable, actions must be taken to preclude the inoperable 

CRD trip device from preventing a reactor trip when needed. This is done 

by manually tripping the inoperable CRD trip breaker or by removing 

power from the channel containing the inoperable CRD trip breaker. 

Either of these actions places the affected CRDs in a one-out-of-two trip 

configuration, which precludes a single failure, which in turn could prevent 

tripping of the reactor. The 48 hour Completion Time has been shown to 

be acceptable through operating experience. 

Condition B

Condition B represents a loss of redundancy for the CRD trip Function. 

Condition B applies when: 

• One or more CRD trip breaker(s) [or breaker pair] will not function on 

either undervoltage or shunt trip Functions or 

• Both diverse trip Functions are inoperable in one or both DC trip 

breakers associated with one protection channel. 
CRD Trip Devices 

B 3.3.4 

BWOG STS B 3.3.4-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

Required Action B.1 and Required Action B.2 are the same as Required 

Action A.1 and Required Action A.2, but the Completion Time is 

shortened. The 1 hour Completion Time allowed to trip or remove power 

from the CRD trip breaker allows the operator to take all the appropriate 

actions for the inoperable breaker and still ensures that the risk involved 

is acceptable. 

C.1 and C.2

Condition C represents a loss of redundancy for the CRD trip Function. 

Condition C applies when one or more ETA relays are inoperable. The 

preferred action is to restore the ETA relay to OPERABLE status. If this 

cannot be done, the operator can perform one of two actions to eliminate 

reliance on the failed ETA relay. This first option is to switch the affected 

control rod group to an alternate power supply. This removes the failed 

ETA relay from the trip sequence, and the unit can operate indefinitely. 

The second option is to trip the corresponding AC CRD trip breaker. This 

results in the safety function being performed, thereby eliminating the 

failed ETA relay from the trip sequence. The 1 hour Completion Time is 

sufficient to perform the Required Action. 

D.1, D.2.1, and D.2.2

If the Required Actions of Condition A, B, or C are not met within the 

required Completion Time in MODE 1, 2, or 3, the unit must be brought to 

a MODE in which the LCO does not apply. To achieve this status, the 

unit must be brought to at least MODE 3, with all CRD trip breakers open 

or with power from all CRD trip breakers removed within 6 hours. The 

allowed Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power conditions in an orderly 

manner and without challenging unit systems. 
CRD Trip Devices 

B 3.3.4 

BWOG STS B 3.3.4-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1 and E.2

If the Required Actions of Condition A, B, or C are not met within the 

required Completion Time in MODE 4 or 5, the unit must be brought to a 

MODE in which the LCO does not apply. To achieve this status, all CRD 

trip breakers must be opened or power from all CRD trip breakers 

removed within 6 hours. The allowed Completion Time of 6 hours is 

reasonable, based on operating experience, to open all CRD trip breakers 

or remove power from all CRD trip breakers without challenging unit 

systems. 

SURVEILLANCE SR 3.3.4.1

REQUIREMENTS 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The CHANNEL FUNCTIONAL TEST Frequency is approved for all B&W 

plants except for TMI based on an approved topical report. No further 

evaluations or justifications are required for the evaluated plants to 

incorporate the 23 day STAGGERED TEST BASIS Frequency. 

-------------------------------------------------------------------------------------------------- 

SR 3.3.4.1 is to perform a CHANNEL FUNCTIONAL TEST every 23 days 

on a STAGGERED TEST BASIS. This test verifies the OPERABILITY of 

the trip devices by actuation of the end devices. Also, this test 

independently verifies the undervoltage and shunt trip mechanisms of the 

AC breakers. A successful test of the required contact(s) of a channel 

relay may be performed by the verification of the change of state of a 

single contact of the relay. This clarifies what is an acceptable CHANNEL 

FUNCTIONAL TEST of a relay. This is acceptable because all of the 

other required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per 

refueling interval with applicable extensions. Calculations have shown 

that the Frequency (23 days) maintains a high level of reliability of the 

Reactor Trip System in BAW-10167A, Supplement 3 (Ref. 2). 

REFERENCES 1. FSAR, Chapter [7]. 

 2. BAW-10167A, Supplement 3, February 1998. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.5 Engineered Safety Feature Actuation System (ESFAS) Instrumentation 

BASES 

BACKGROUND The ESFAS initiates necessary safety systems, based on the values of 

selected unit Parameters, to protect against violating core design limits 

and reactor coolant pressure boundary and to mitigate accidents. 

ESFAS actuates the following systems: 

• High pressure injection (HPI) Actuation, 

• Low pressure injection (LPI) Actuation, 

• Reactor building (RB) Cooling, 

• RB Spray, 

• RB Isolation, and 

• Emergency diesel generator (EDG) Start. 

ESFAS also provides a signal to the Emergency Feedwater Isolation and 

Control (EFIC) System. This signal initiates emergency feedwater (EFW) 

when HPI is initiated. 

The ESFAS operates in a distributed manner to initiate the appropriate 

systems. The ESFAS does this by determining the need for actuation in 

each of three channels monitoring each actuation Parameter. Once the 

need for actuation is determined, the condition is transmitted to automatic 

actuation logics, which perform the two-out-of-three logic to determine the 

actuation of each end device. Each end device has its own automatic 

actuation logic, although all automatic actuation logics take their signals 

from the same point in each channel for each Parameter. 

Four Parameters are used for actuation: 

• Low Reactor Coolant System (RCS) Pressure, 

• Low Low RCS Pressure, 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

• High RB Pressure, and 

• High High RB Pressure. 

LCO 3.3.5 covers only the instrumentation channels that measure these 

Parameters. These channels include all intervening equipment 

necessary to produce actuation before the measured process Parameter 

exceeds the limits assumed by the accident analysis. This includes 

sensors, bistable devices, operational bypass circuitry, block timers, and 

output relays. LCO 3.3.6, "Engineered Safety Feature Actuation System 

(ESFAS) Manual Initiation," and LCO 3.3.7, "Engineered Safety Feature 

Actuation System (ESFAS) Automatic Actuation Logic," provide 

requirements on the manual initiation and automatic actuation logic 

Functions. 

The ESFAS consists of three protection channels. Each channel 

provides input to logics that initiate equipment with a two-out-of-three 

logic on each component. Each protection channel includes bistable 

inputs from one instrumentation channel of Low RB Pressure, Low Low 

RCS Pressure, High RB Pressure, and High High RB Pressure. 

Automatic actuation logics combine the three protection channel trips in 

each train to actuate the individual Engineered Safety Feature (ESF) 

components needed to initiate each ESF System. Figure [ ] , FSAR, 

Chapter [7] (Ref. 1), illustrates how instrumentation channel trips combine 

to cause protection channel trips. 

The RCS pressure sensors are common to both trains. Isolation is 

provided via separate bistables for each train. Separate RB pressure 

sensors are used for the high and high high pressure Functions in each 

train, and separate sensors are used for each train. 

The following matrix identifies the measurement channels and the 

Function actuated by each. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

PARAMETER LOW RCS 

PRESSURE 

LOW LOW 

RCS 

PRESSURE 

HIGH RB 

PRESSURE 

HIGH 

HIGH RB 

PRESSURE

HPI X X X 

LPI 

 

X 

 

X 

RB Cooling X X X (b) 

RB Spray (b) 

 

RB Isolation(a) X X X 

EDG Start X X X 

Control Room 

Isolation 

 

X 

(a) Only isolates systems not required for RB or RCS heat removal. 

(b) Actuates on High High RB Pressure coincident with HPI actuation. 

Engineered safeguards bus undervoltage will also sequence on the HPI 

loads started by the HPI block timers. However, HPI will not occur unless 

the ESFAS HPI signal is also present. LCO 3.3.8, "Emergency Diesel 

Generator (EDG) Loss of Power Start (LOPS)," contains the requirements 

for the undervoltage channels. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-4 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The ESF equipment is divided between the two redundant actuation 

trains A and B. The division of the equipment between the two actuation 

trains is based on the equipment redundancy and function and is 

accomplished in such a manner that the failure of one of the actuation 

channels and the related safeguards equipment will not inhibit the overall 

ESF Functions. Where a motor operated or a solenoid operated valve is 

driven by either of two matrices, one is from actuation channel A and one 

from actuation channel B. Redundant ESF pumps are controlled from 

separate and independent actuation channels. 

The actuation of ESF equipment is also available by manual actuation 

switches located on the control room console. 

The ESFAS, in conjunction with the actuated equipment, provides 

protective functions necessary to mitigate Design Basis Accidents 

(DBAs), specifically the loss of coolant accident (LOCA) and steam line 

break (SLB) events. The ESFAS relies on the OPERABILITY of the 

automatic actuation logic for each component to perform the actuation of 

the selected systems of LCO 3.3.7. 

Engineered Safety Feature Actuation System Bypasses

No provisions are made for maintenance bypass of ESFAS 

instrumentation channels. Operational bypass of certain channels is 

necessary to allow accident recovery actions to continue and, for some 

channels, to allow reactor shutdown without spurious ESFAS actuation. 

The ESFAS RCS pressure instrumentation channels include permissive 

bistables that allow manual bypass when reactor pressure is below the 

point at which the low and low low pressure trips are required to be 

OPERABLE. Once permissive conditions are sensed, the RCS pressure 

trips may be manually bypassed. Bypasses are automatically removed 

when bypass permissive conditions are exceeded. 

Each High RB Pressure channel may be manually bypassed after the 

other two channels in the Parameter have tripped. The manual bypass 

allows operators to take manual control of ESF Functions after initiation to 

allow recovery actions. The bypass may be manually removed and is 

automatically removed when RB pressure returns to below the trip 

setpoint. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-5 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Reactor Coolant System Pressure

The RCS pressure is monitored by three independent pressure 

transmitters located in the RB. These transmitters are separate from the 

transmitters that feed the Reactor Protection System (RPS). Each of the 

pressure signals generated by these transmitters is monitored by four 

bistables to provide two trip signals, at 1500 psig and 500 psig, and two 

bypass permissive signals, at 1700 psig and 900 psig. 

The outputs of the three bistables, associated with the low RCS pressure, 

1500 psig, trip drive relays in two sets (actuation channels A and B) of 

identical and independent channels. These two sets of HPI channels 

each use three logic channels used in two-out-of-three coincidence 

networks for HPI Actuation. The outputs of the three bistables associated 

with the Low Low RCS Pressure [500 psig] trip drive relays in two sets 

(actuation channels A and B) of identical and independent channels. 

These two sets of LPI channels each use three logic channels used in 

two-out-of-three coincidence networks for LPI Actuation. The outputs of 

the three Low Low RCS Pressure bistables also trip the drive relays in the 

corresponding HPI Actuation channel as previously described. 

Reactor Building Pressure

RB pressure inputs to the ESFAS are provided by 12 pressure switches. 

Six pressure switches are used for the High RB Pressure Parameter, and 

six pressure switches are used for the High High Pressure Parameter. 

The output contacts of six High RB Pressure switches are used in two 

sets of identical and independent actuation trains. These two trains each 

use three logic channels. The outputs of these channels are used in twoout-of-three coincidence networks. The output contacts of the six RB 

pressure switches also trip the drive relays in the corresponding HPI and 

LPI Actuation channels as previously described. 

The output contacts of six High High RB Pressure switches are used in 

two sets of identical and independent actuation trains. These two trains 

each use three logic channels (RB4, RB5, and RB6). The outputs of 

these channels are used in two-out-of-three coincident networks for RB 

Spray Actuation. Each high high pressure train actuates one RB Spray 

train when the High High RB signal and the HPI signal are coincident in 

that train. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-6 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Trip Setpoints and Allowable Values

Trip setpoints are the nominal value at which the bistables are set. Any 

bistable is considered to be properly adjusted when the "as left" value is 

within the band for CHANNEL CALIBRATION accuracy (i.e., ± [rack 

calibration + comparator setting accuracy]). 

The trip setpoints used in the bistables are based on the analytical limits 

stated in Figure [ ] , FSAR, Chapter [7] (Ref. 1). The selection of these 

trip setpoints is such that adequate protection is provided when all sensor 

and processing time delays are taken into account. To allow for 

calibration tolerances, instrumentation uncertainties, instrument drift, and 

severe environment induced errors for those ESFAS channels that must 

function in harsh environments as defined by 10 CFR 50.49 (Ref. 2), the 

Allowable Values specified in Table 3.3.5-1 in the accompanying LCO are 

conservatively adjusted with respect to the analytical limits. A detailed 

description of the methodology used to calculate the trip setpoints, 

including their explicit uncertainties, is provided in the "Unit Specific 

Setpoint Methodology" (Ref. 3). The actual nominal trip setpoint entered 

into the bistable is more conservative than that specified by the Allowable 

Value to account for changes in random measurement errors detectable 

by a CHANNEL FUNCTIONAL TEST. One example of such a change in 

measurement error is drift during the surveillance interval. A channel is 

inoperable if its actual trip setpoint is not within its required Allowable 

Value. 

Setpoints, in accordance with the Allowable Values, ensure that the 

consequences of DBAs will be acceptable, providing the unit is operated 

from within the LCOs at the onset of the DBA and the equipment 

functions as designed. 

Each channel can be tested online to verify that the setpoint accuracy is 

within the specified allowance requirements of Reference 3. Once a 

designated channel is taken out of service for testing, a simulated signal 

is injected in place of the field instrument signal. The process equipment 

for the channel in test is then tested, verified, and calibrated. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-7 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The Allowable Values listed in Table 3.3.5-1 are based on the 

methodology described in FSAR, Chapter [14] (Ref. 4), which 

incorporates all of the known uncertainties applicable for each channel. 

The magnitudes of these uncertainties are factored into the determination 

of each trip setpoint. All field sensors and signal processing equipment 

for these channels are assumed to operate within the allowances of these 

uncertainty magnitudes. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The ESFAS LCOs in the BWOG Standard Technical Specifications are 

based on a system representative of the Crystal River Unit 3 design. 

-------------------------------------------------------------------------------------------------- 

As discussed earlier, this arrangement involves measurement channels 

shared among all actuation functions, with separate actuation logic 

channels for each actuated component. In this arrangement, multiple 

components are affected by each instrumentation channel failure, but a 

single automatic actuation logic failure affects only one component. The 

organization of BWOG STS ESFAS LCOs reflects the described logic 

arrangement by identifying instrumentation requirements on an 

instrumentation channel rather than on a protective function basis. This 

greatly simplifies delineation of ESFAS LCOs. Furthermore, the LCO 

requirements on instrumentation channels, automatic actuation logics, 

and manual initiation are specified separately to reflect the different 

impact each has on ESFAS OPERABILITY. 

APPLICABLE The following ESFAS Functions have been assumed within the accident 

SAFETY analyses. 

ANALYSES 

High Pressure Injection

The ESFAS actuation of HPI has been assumed for core cooling in the 

LOCA analysis and is credited with boron addition in the SLB analysis. 

Low Pressure Injection

The ESFAS actuation of LPI has been assumed for large break LOCAs. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-8 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

Reactor Building Spray, Reactor Building Cooling, and Reactor Building 

Isolation

The ESFAS actuation of the RB coolers and RB Spray have been 

credited in RB analysis for LOCAs, both for RB performance and 

equipment environmental qualification pressure and temperature 

envelope definition. Accident dose calculations have credited RB 

Isolation and RB Spray. 

Emergency Diesel Generator Start

The ESFAS initiated EDG Start has been assumed in the LOCA analysis 

to ensure that emergency power is available throughout the limiting LOCA 

scenarios. 

The small and large break LOCA analyses assume a conservative 

35 second delay time for the actuation of HPI and LPI in FSAR, 

Chapter [14] (Ref. 4). This delay time includes allowances for EDG 

starting, EDG loading, Emergency Core Cooling Systems (ECCS) pump 

starts, and valve openings. Similarly, the RB Cooling, RB Isolation, and 

RB Spray have been analyzed with delays appropriate for the entire 

system analyzed. Typical values used in the analysis are 35 seconds for 

RB Cooling, 60 seconds for RB Isolation, and 56 seconds for RB Spray. 

Accident analyses rely on automatic ESFAS actuation for protection of 

the core temperature and containment pressure limits and for limiting off 

site dose levels following an accident. These include LOCA, SLB, and 

feedwater line break events that result in RCS inventory reduction or 

severe loss of RCS cooling. 

The ESFAS channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The LCO requires three channels of ESFAS instrumentation for each 

Parameter in Table 3.3.5-1 to be OPERABLE in each ESFAS train. 

Failure of any instrument renders the affected channel(s) inoperable and 

reduces the reliability of the affected Functions. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-9 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Only the Allowable Value is specified for each ESFAS Function in the 

LCO. Nominal trip setpoints are specified in the unit specific setpoint 

calculations. The nominal trip setpoints are selected to ensure the 

setpoints measured by CHANNEL FUNCTIONAL TESTS do not exceed 

the Allowable Value if the bistable is performing as required. Operation 

with a trip setpoint less conservative than the nominal trip setpoint, but 

within its Allowable Value, is acceptable provided that operation and 

testing are consistent with the assumptions of the unit specific setpoint 

calculations. Each Allowable Value specified is more conservative than 

the analytical limit assumed in the safety analysis to account for 

instrument uncertainties appropriate to the trip Parameter. These 

uncertainties are defined in the "Unit Specific Setpoint Methodology" 

(Ref. 3). 

The Allowable Values for bypass removal functions are stated in the 

Applicable MODES or Other Specified Condition column of Table 3.3.5-1. 

Three ESFAS instrumentation channels shall be OPERABLE in each 

ESFAS train to ensure that a single failure in one channel will not result in 

loss of the ability to automatically actuate the required safety systems. 

The bases for the LCO on ESFAS Parameters include the following. 

Reactor Coolant System Pressure

Three channels each of RCS Pressure - Low and RCS Pressure - Low 

Low are required OPERABLE in each train. Each channel includes a 

sensor, trip bistable, bypass bistable, bypass relays, output relays, and 

block timers. The analog portion of each pressure channel is common to 

both trains of both RCS Pressure Parameters. Therefore, failure of one 

analog channel renders one channel of the low pressure and low low 

pressure Functions in each train inoperable. The bistable portions of the 

channels are Function and train specific. Therefore, a bistable failure 

renders only one Function in one train inoperable. Failure of a bypass 

bistable or bypass circuitry, such that a trip channel cannot be bypassed, 

does not render the channel inoperable. Output relays and block timer 

relays are train specific but may be shared among Parameters. 

Therefore, output or block timer relay failure renders all affected 

Functions in one train inoperable. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-10 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

1. Reactor Coolant System Pressure - Low Setpoint

The RCS Pressure - Low Setpoint is based on HPI actuation for 

small break LOCAs. The setpoint ensures that the HPI will be 

actuated at a pressure greater than or equal to the value assumed in 

accident analyses plus the instrument uncertainties. The maximum 

value assumed for the setpoint of the RCS Pressure - Low trip of HPI 

in safety analyses is 1480 psig. The setpoint for the low RCS and 

Allowable Value of ≥ [1600] psig for the low pressure Parameter is 

selected to ensure actuation occurs when actual RCS pressure is 

above 1480 psig. The RCS Pressure instrumentation must function 

while subject to the severe environment created by a LOCA. 

Therefore, the trip setpoint Allowable Value accounts for severe 

environment induced errors. 

To ensure the RCS Pressure - Low trip is not bypassed when 

required to be OPERABLE by the safety analysis, each channel's 

bypass removal bistable must be set with an Allowable Value of 

≤ [1800] psig. The bypass removal does not need to function for 

accidents initiated from RCS Pressures below the bypass removal 

setpoint. Therefore, the bypass removal setpoint Allowable Value 

need not account for severe environment induced errors. 

2. Reactor Coolant System Pressure - Low Low Setpoint

The RCS Pressure - Low Low Setpoint LPI actuation occurs in 

sufficient time to ensure LPI flow prior to the emptying of the core 

flood tanks during a large break LOCA. The Allowable Value of 

≥ [400] psig ensures sufficient overlap of the core flood tank flow and 

the LPI flow to keep the reactor vessel downcomer full during a large 

break LOCA. The RCS Pressure instrumentation must function while 

subject to the severe environment created by a LOCA. Therefore, 

the trip setpoint Allowable Value accounts for severe environment 

induced errors. 

To ensure the RCS Pressure - Low Low trip is not bypassed when 

assumed OPERABLE by the safety analysis, each channel's bypass 

removal bistable must be set with an Allowable Value of ≤ [900] psig. 

The bypass removal does not need to function for accidents initiated 

by RCS Pressure below the bypass removal setpoint. Therefore, the 

bypass removal setpoint Allowable Value need not account for 

severe environment induced errors. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-11 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Reactor Building Pressure

Three channels each of RCS Pressure - Low and RB Pressure - High are 

required to be OPERABLE in each train. Each channel includes a 

pressure switch, bypass relays, and output relays. The high pressure 

channels also include block timers. Each pressure switch is Function and 

train specific, so there are 12 pressure switches total. Therefore, a 

pressure switch renders only one Function in one train inoperable. 

Output relays and block timer relays are train specific but may be shared 

among Parameters. Therefore, output or block timer relay failure renders 

all affected Functions in one train inoperable. 

The RB Pressure switches may be subjected to high radiation conditions 

during the accidents that they are intended to mitigate. The sensor 

portion of the switches is also exposed to the steam environment present 

in the RB following a LOCA or high energy line break. Therefore, the trip 

setpoint Allowable Value accounts for measurement errors induced by 

these environments. 

1. Reactor Building Pressure - High Setpoint

The RB Pressure - High Setpoint Allowable Value ≤ [5] psig was 

selected to be low enough to detect a rise in RB Pressure that would 

occur due to a small break LOCA, thus ensuring that the RB high 

pressure actuation of the safety systems will occur for a wide 

spectrum of break sizes. The trip setpoint also causes the RB 

coolers to shift to emergency mode to prevent damage to the cooler 

fans due to the increase in the density of the air steam mixture 

present in the containment following a LOCA. 

2. Reactor Building Pressure - High High Setpoint

The RB Pressure - High High Setpoint Allowable Value ≤ [30] psig 

was chosen to be high enough to avoid actuation during an SLB, but 

also low enough to ensure a timely actuation during a large break 

LOCA. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-12 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY Three channels of ESFAS instrumentation for each Parameter listed next 

shall be OPERABLE in each ESFAS train. 

1. Reactor Coolant System Pressure - Low Setpoint

The RCS Pressure - Low Setpoint actuation Parameter shall be 

OPERABLE during operation above 1800 psig. This requirement 

ensures the capability to automatically actuate safety systems and 

components during conditions indicative of a LOCA or secondary unit 

overcooling. Below 1800 psig, the low RCS Pressure actuation 

Parameter can be bypassed to avoid actuation during normal unit 

cooldowns when safety systems actuations are not required. 

The allowance for the bypass is consistent with the transition of the 

unit to a lower energy state, providing greater margins to safety 

limits. The unit response to any event, given that the reactor is 

already tripped, will be less severe and allows sufficient time for 

operator action to provide manual safety system actuations. This is 

even more appropriate during unit heatups when the primary system 

and core energy content is low, prior to power operation. 

In MODES 5 and 6, there is adequate time for the operator to 

evaluate unit conditions and respond by manually starting individual 

systems, pumps, and other equipment to mitigate the consequences 

of an abnormal condition or accident. Plant pressure and 

temperature are very low, and many ESF components are 

administratively locked out or otherwise prevented from actuating to 

prevent inadvertent overpressurization of unit systems. 

2. Reactor Coolant System Pressure - Low Low Setpoint

The RCS Pressure - Low Low Setpoint actuation Parameter shall be 

OPERABLE during operation above [900] psig. This requirement 

ensures the capability to automatically actuate safety systems and 

components during conditions indicative of a LOCA or secondary unit 

overcooling. Below [900] psig, the low low RCS Pressure actuation 

Parameter can be bypassed to avoid actuation during normal unit 

cooldowns when safety system actuations are not required. 

The allowance for the bypass is consistent with the transition of the 

unit to a lower energy state, providing greater margins to safety 

limits. The unit response to any event, given that the reactor is 

already tripped, will be less severe and allows sufficient time for 

operator action to provide manual safety system actuations. This is 

even more appropriate during unit heatups when the primary system 

and core energy content is low, prior to power operation. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-13 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

In MODES 5 and 6, there is adequate time for the operator to 

evaluate unit conditions and respond by manually starting individual 

systems, pumps, and other equipment to mitigate the consequences 

of an abnormal condition or accident. Plant pressure and 

temperature are very low, and many ESF components are 

administratively locked out or otherwise prevented from actuating to 

prevent inadvertent overpressurization of unit systems. 

3. 4. Reactor Building Pressure - High and Reactor Building Pressure – 

 High High Setpoints

The RB Pressure - High and RB Pressure - High High actuation 

Functions of ESFAS shall be OPERABLE in MODES 1, 2, 3, and 4 

when the potential for a HELB exists. In MODES 5 and 6, the unit 

conditions are such that there is insufficient energy in the primary and 

secondary systems to raise the containment pressure to either the 

RB Pressure - High or RB Pressure - High High Setpoints. 

Furthermore, in MODES 5 and 6, there is adequate time for the 

operator to evaluate unit conditions and respond by manually starting 

individual systems, pumps, and other equipment to mitigate the 

consequences of an abnormal condition or accident. Plant pressure 

and temperature are very low and many ESF components are 

administratively locked out or otherwise prevented from actuating to 

prevent inadvertent overpressurization of unit systems. 

ACTIONS Required Actions A and B apply to all ESFAS instrumentation Parameters 

listed in Table 3.3.5-1. 

A Note has been added to the ACTIONS indicating separate Condition 

entry is allowed for each Parameter. 

If a channel's trip setpoint is found nonconservative with respect to the 

Allowable Value, or the transmitter, instrument loop, signal processing 

electronics, or ESFAS bistable is found inoperable, then all affected 

functions provided by that channel should be declared inoperable and the 

unit must enter the Conditions for the particular protection Parameter 

affected. 

When the number of inoperable channels in a trip Parameter exceeds 

those specified, then the unit is outside the safety analysis. Therefore, 

LCO 3.0.3 shall be immediately entered if applicable in the current MODE 

of operation. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-14 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

Condition A applies when one channel becomes inoperable in one or 

more Parameters. If one ESFAS channel is inoperable, placing it in a 

tripped condition leaves the system in a one-out-of-two condition for 

actuation. Thus, if another channel were to fail, the ESFAS 

instrumentation could still perform its actuation functions. This action is 

completed when all of the affected output relays and block timers are 

tripped. This can normally be accomplished by tripping the affected 

bistables or tripping the individual output relays and block timers. [At this 

unit, the specific output relays associated with each ESFAS 

instrumentation channel are listed in the following document:] 

The 1 hour Completion Time is sufficient time to perform the Required 

Action. 

B.1, B.2.1, B.2.2, and B.2.3

Condition B applies when Required Action A.1 is not met within the 

required Completion Time or when one or more parameters have more 

than one inoperable channel. If Condition B applies, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and, 

for the RCS Pressure - Low Setpoint, to < [1800] psig, for the RCS 

Pressure - Low Low Setpoint, to < [900] psig, and for the RB Pressure 

High Setpoint and High High Setpoint, to MODE 5 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

SURVEILLANCE All ESFAS Parameters listed in Table 3.3.5-1 are subject to CHANNEL 

REQUIREMENTS CHECK, CHANNEL FUNCTIONAL TEST, CHANNEL CALIBRATION, 

and response time testing. The operational bypasses associated with 

each ESFAS instrumentation channel are also subject to these SRs to 

ensure OPERABILITY of the ESFAS instrumentation channel. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-15 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.5.1

Performance of the CHANNEL CHECK every 12 hours ensures that a 

gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. CHANNEL 

CHECK will detect gross channel failure; therefore, it is key in verifying 

that the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the transmitter or the signal processing equipment has 

drifted outside its limit. If the channels are normally off scale during times 

when surveillance is required, the CHANNEL CHECK will only verify that 

they are off scale in the same direction. Off scale low current loop 

channels are verified to be reading at the bottom of the range and not 

failed downscale. 

The Frequency, about once every shift, is based on operating experience 

that demonstrates channel failure is rare. Since the probability of two 

random failures in redundant channels in any 12 hour period is extremely 

low, the CHANNEL CHECK minimizes the chance of loss of protective 

function due to failure of redundant channels. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channel operability 

during normal operational use of the displays associated with the LCO's 

required channels. 

SR 3.3.5.2

A Note defines a channel as being OPERABLE for up to 8 hours while 

bypassed for Surveillance testing provided the remaining two ESFAS 

channels are OPERABLE or tripped. The Note allows channel bypass for 

testing without defining it as inoperable, although during this time period it 

cannot initiate ESFAS. This allowance is based on the inability to perform 

the Surveillance in the time permitted by the Required Actions. Eight 

hours is the average time required to perform the Surveillance. It is not 

acceptable to routinely remove channels from service for more than 

8 hours to perform required Surveillance testing. 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-16 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

A CHANNEL FUNCTIONAL TEST is performed on each required ESFAS 

channel to ensure the entire channel will perform the intended functions. 

A successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. Any setpoint adjustment shall be consistent with 

the assumptions of the current unit specific setpoint analysis. 

The Frequency of 31 days is based on unit operating experience, with 

regard to channel OPERABILITY and drift, which demonstrates that 

failure of more than one channel of a given function in any 31 day interval 

is a rare event. 

SR 3.3.5.3

CHANNEL CALIBRATION is a complete check of the instrument channel, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy. 

CHANNEL CALIBRATION leaves the channel adjusted to account for 

instrument drift to ensure that the instrument channel remains operational 

between successive tests. CHANNEL CALIBRATION shall find that 

measurement errors and bistable setpoint errors are within the 

assumptions of the unit specific setpoint analysis. CHANNEL 

CALIBRATIONS must be performed consistent with the assumptions of 

the unit specific setpoint analysis. 

This Frequency is justified by the assumption of an [18] month calibration 

interval to determine the magnitude of equipment drift in the setpoint 

analysis. 

SR 3.3.5.4

SR 3.3.5.4 ensures that the ESFAS actuation channel response times are 

less than or equal to the maximum times assumed in the accident 

analysis. The response time values are the maximum values assumed in 

the safety analyses. Individual component response times are not 

modeled in the analyses. Response time testing acceptance criteria for 

this unit are included in Reference 1. The analyses model the overall or 

total elapsed time from the point at which the parameter exceeds the 
ESFAS Instrumentation 

B 3.3.5 

BWOG STS B 3.3.5-17 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

actuation setpoint value at the sensor to the point at which the end device 

is actuated. Thus, this SR encompasses the automatic actuation logic 

components covered by LCO 3.3.7 and the operation of the mechanical 

ESF components. 

Response time tests are conducted on an [18] month STAGGERED 

TEST BASIS. Testing of the final actuation devices, which make up the 

bulk of the response time, is included in the testing of each channel. 

Therefore, staggered testing results in response time verification of these 

devices every [18] months. The 18 month test Frequency is based on 

unit operating experience, which shows that random failures of 

instrumentation components causing serious response time degradation 

but not channel failure are infrequent occurrences. 

REFERENCES 1. FSAR, Chapter [7]. 

 2. 10 CFR 50.49. 

 3. [Unit Specific Setpoint Methodology.] 

 4. FSAR, Chapter [14]. 
ESFAS Manual Initiation 

B 3.3.6 

BWOG STS B 3.3.6-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.6 Engineered Safety Feature Actuation System (ESFAS) Manual Initiation 

BASES 

BACKGROUND The ESFAS manual initiation capability allows the operator to actuate 

ESFAS Functions from the main control room in the absence of any other 

initiation condition. Manually actuated Functions include High Pressure 

Injection, Low Pressure Injection, Reactor Building (RB) Cooling, RB 

Spray, RB Isolation, and Control Room Isolation. This ESFAS manual 

initiation capability is provided in the event the operator determines that 

an ESFAS Function is needed and has not been automatically actuated. 

Furthermore, the ESFAS manual initiation capability allows operators to 

rapidly initiate Engineered Safety Feature (ESF) Functions if the trend of 

unit parameters indicates that ESF actuation will be needed. 

LCO 3.3.6 covers only the system level manual initiation of these 

Functions. LCO 3.3.5, "Engineered Safety Feature Actuation System 

(ESFAS) Instrumentation," and LCO 3.3.7, "Engineered Safety Feature 

Actuation System (ESFAS) Automatic Actuation Logic," provide 

requirements on the portions of the ESFAS that automatically initiate the 

Functions described earlier. 

The ESFAS manual initiation Function relies on the OPERABILITY of the 

automatic actuation logic (LCO 3.3.7) for each component to perform the 

actuation of the systems. A manual trip push button is provided on the 

ESF panel of the control room console for each of the levels of protection 

for each actuation. Operation of the push button energizes relays whose 

contacts perform a logical "OR" function with the matrices of the 

automatic actuation, except for the matrices which are part of the ESF 

buses loading sequence. Manual actuation of the ESF buses loading 

sequence is made by de-energizing the timed output relays. The power 

supply for the manual trip relays is taken from the station batteries. 

Different batteries are used for the two actuations. 

The ESFAS manual initiation channel is defined as the instrumentation 

between the console switch and the automatic actuation logic, which 

actuates the end devices. Other means of manual initiation, such as 

controls for individual ESF devices, may be available in the control room 

and other unit locations. These alternative means are not required by this 

LCO, nor may they be credited to fulfill the requirements of this LCO. 
ESFAS Manual Initiation 

B 3.3.6 

BWOG STS B 3.3.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The ESFAS, in conjunction with the actuated equipment, provides 

SAFETY protective functions necessary to mitigate Design Basis Accidents, 

ANALYSES specifically, the loss of coolant accident and steam line break events. 

The ESFAS manual initiation ensures that the control room operator can 

rapidly initiate ESF Functions at any time. The manual initiation trip 

Function is required as a backup to automatic trip functions and allows 

operators to initiate ESFAS whenever any parameter is rapidly trending 

toward its trip setpoint. Furthermore, the ESFAS manual initiation may be 

specified in operating procedures for verification that ESF systems are 

running. 

The ESFAS manual initiation functions satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Two ESFAS manual initiation channels of each ESFAS Function shall be 

OPERABLE whenever conditions exist that could require ESF protection 

of the reactor or RB. Two OPERABLE channels ensure that no single 

random failure will prevent system level manual initiation of any ESFAS 

Function. The ESFAS manual initiation Function allows the operator to 

initiate protective action prior to automatic initiation or in the event the 

automatic initiation does not occur. 

APPLICABILITY The ESFAS manual initiation Functions shall be OPERABLE in 

MODES 1, 2, and 3, and in MODE 4 when the associated engineered 

safeguard equipment is required to be OPERABLE. The manual initiation 

channels are required because ESF Functions are designed to provide 

protection in these MODES. In MODES 5 and 6, ESFAS initiates 

systems that are either reconfigured or disabled for shutdown cooling 

operation. Accidents in these MODES are slow to develop and would be 

mitigated by manual operation of individual components. Adequate time 

is available to evaluate unit conditions and to respond by manually 

operating the ESF components, if required. 

ACTIONS A Note has been added to the ACTIONS indicating separate Condition 

entry is allowed for each ESFAS manual initiation Function. 
ESFAS Manual Initiation 

B 3.3.6 

BWOG STS B 3.3.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

Condition A applies when one manual initiation channel of one or more 

ESFAS Functions becomes inoperable. Required Action A.1 must be 

taken to restore the channel to OPERABLE status within the next 

72 hours. The Completion Time of 72 hours is based on unit operating 

experience and administrative controls, which provide alternative means 

of ESFAS Function initiation via individual component controls. The 

72 hour Completion Time is consistent with the allowed outage time for 

the safety systems actuated by ESFAS. 

B.1 and B.2

Required Action B.1 and Required Action B.2 apply if Required Action A.1 

cannot be met within the required Completion Time. If Required 

Action A.1 cannot be met within the required Completion Time, the unit 

must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the unit must be brought to at least MODE 3 within 

6 hours and to MODE 5 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required 

MODES from full power conditions in an orderly manner and without 

challenging unit systems. 

SURVEILLANCE SR 3.3.6.1

REQUIREMENTS 

This SR requires the performance of a CHANNEL FUNCTIONAL TEST of 

the ESFAS manual initiation. This test verifies that the initiating circuitry 

is OPERABLE and will actuate the end device (i.e., pump, valves, etc.). 

A successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. The [18] month Frequency is based on the need 

to perform this Surveillance under the conditions that apply during a unit 

outage and the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. This Frequency is 

demonstrated to be sufficient, based on operating experience, which 

shows these components usually pass the Surveillance when performed 

on the [18] month Frequency. 

REFERENCES None. 
ESFAS Automatic Actuation Logic 

B 3.3.7 

BWOG STS B 3.3.7-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.7 Engineered Safety Feature Actuation System (ESFAS) Automatic Actuation Logic 

BASES 

BACKGROUND The automatic actuation logic channels of ESFAS are defined as the logic 

between the buffers of the sensing channels and the controllers that 

actuate ESFAS equipment. Each of the components actuated by the 

ESFAS Functions has an associated automatic actuation logic matrix. If 

two-out-of-three ESFAS instrumentation channels indicate a trip, or 

system level manual initiation occurs, the automatic actuation logic is 

activated and the associated component is actuated. The purpose of 

requiring OPERABILITY of the ESFAS automatic actuation logic is to 

ensure that the Functions of the ESFAS can be automatically initiated in 

the event of an accident. Automatic actuation of some Functions is 

necessary to prevent the unit from exceeding the Emergency Core 

Cooling Systems (ECCS) limits in 10 CFR 50.46 (Ref. 1). It should be 

noted that OPERABLE automatic actuation logic channels alone will not 

ensure that each Function can be activated; the instrumentation channels 

and actuated equipment associated with each Function must also be 

OPERABLE to ensure that the Functions can be automatically initiated 

during an accident. 

LCO 3.3.7 covers only the automatic actuation logic that initiates these 

Functions. LCO 3.3.5, "Engineered Safety Feature Actuation System 

(ESFAS) Instrumentation," and LCO 3.3.6, "Engineered Safety Feature 

Actuation System (ESFAS) Manual Initiation," provide requirements on 

the instrumentation and manual initiation channels that input to the 

automatic actuation logic. 

The ESFAS, in conjunction with the actuated equipment, provides 

protective functions necessary to mitigate Design Basis Accidents 

(DBAs), specifically, the loss of coolant accident (LOCA) and steam line 

break (SLB) events. The ESFAS relies on the OPERABILITY of the 

automatic actuation logic for each component to perform the actuation of 

the selected systems. 

The small and large break LOCA analyses assume a conservative 

35 second delay time for the actuation of high pressure injection (HPI) 

and low pressure injection (LPI) in BAW-10103A, Rev. 3 (Ref. 2). This 

delay time includes allowances for emergency diesel generator (EDG) 

starts, EDG loading, ECCS pump starts, and valve openings. Similarly, 

the reactor building (RB) Cooling, RB Isolation, and RB Spray have been 

analyzed with delays appropriate for the entire system. 
ESFAS Automatic Actuation Logic 

B 3.3.7 

BWOG STS B 3.3.7-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Typical values used in the analyses are 35 seconds for RB Cooling, 

60 seconds for RB Isolation, and 58 seconds for RB Spray. 

The ESFAS automatic initiation of Engineered Safety Feature (ESF) 

Functions to mitigate accident conditions is assumed in the DBA analysis 

and is required to ensure that consequences of analyzed events do not 

exceed the accident analysis predictions. Automatically actuated features 

include HPI, LPI, RB Cooling, RB Spray, and RB Isolation. 

The ESFAS LCOs in the BWOG Standard Technical Specifications (STS) 

are based on a system representative of the Crystal River Unit 3 design. 

As discussed earlier, this arrangement involves measurement channels 

shared among all actuation functions, with separate actuation logic 

channels for each actuated component. In this arrangement, multiple 

ESF components are affected by a measurement channel failure, but a 

single automatic actuation logic failure affects only one component. The 

organization of BWOG STS ESFAS LCOs reflect the described logic 

arrangement by linking actions for automatic actuation logic failures 

directly to the actions for the affected ESF component. The overall 

philosophy is that if an automatic actuation logic fails, the affected 

component is put into its engineered safeguard configuration. This action 

eliminates the need for the automatic actuation logic. If the affected 

component cannot be placed in its engineered safeguard configuration, 

actions are taken to address the inoperability of the supported system 

component. This greatly simplifies delineation of ESFAS LCOs. 

Furthermore, the LCO requirements on instrumentation channels, 

automatic actuation logics, and manual initiation are specified separately 

to reflect the different impact each has on ESFAS OPERABILITY. 

APPLICABLE Accident analyses rely on automatic ESFAS actuation for protection of 

SAFETY of the core and RB and for limiting off site dose levels following an 

ANALYSES accident. These include LOCA, SLB, and feedwater line break events 

that result in Reactor Coolant System (RCS) inventory reduction or 

severe loss of RCS cooling. The automatic actuation logic is an integral 

part of the ESFAS. 

The ESFAS automatic actuation logics satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
ESFAS Automatic Actuation Logic 

B 3.3.7 

BWOG STS B 3.3.7-3 Rev. 3.0, 03/31/04 

BASES 

LCO The automatic actuation logic matrix for each component actuated by the 

ESFAS is required to be OPERABLE whenever conditions exist that 

could require ESF protection of the reactor or the RB. This ensures 

automatic initiation of the ESF required to mitigate the consequences of 

accidents. 

APPLICABILITY The automatic actuation logic Function shall be OPERABLE in MODES 1, 

2, and 3, and in MODE 4 when the associated engineered safeguard 

equipment is required to be OPERABLE, because ESF Functions are 

designed to provide protection in these MODES. Automatic actuation in 

MODE 5 or 6 is not required because the systems initiated by the ESFAS 

are either reconfigured or disabled for shutdown cooling operation. 

Accidents in these MODES are slow to develop and would be mitigated 

by manual operation of individual components. Adequate time is 

available to evaluate unit conditions and respond by manually operating 

the ESF components, if required. 

ACTIONS A Note has been added to the ACTIONS indicating separate Condition 

entry is allowed for each ESFAS automatic actuation logic matrix. 

A.1 and A.2

When one or more automatic actuation logic matrices are inoperable, the 

associated component(s) can be placed in its engineered safeguard 

configuration. Required Action A.1 is equivalent to the automatic 

actuation logic performing its safety function ahead of time. In some 

cases, placing the component in its engineered safeguard configuration 

would violate unit safety or operational considerations. In these cases, 

the component status should not be changed, but the supported system 

component must be declared inoperable. Conditions which would 

preclude the placing of a component in its engineered safeguard 

configuration include, but are not limited to, violation of system 

separation, activation of fluid systems that could lead to thermal shock, or 

isolation of fluid systems that are normally functioning. The Completion 

Time of 1 hour is based on operating experience and reflects the urgency 

associated with the inoperability of a safety system component. 

Required Action A.2 requires entry into the Required Actions of the 

affected supported systems, since the true effect of automatic actuation 

logic failure is inoperability of the supported system. The Completion 

Time of 1 hour is based on operating experience and reflects the urgency 

associated with the inoperability of a safety system component. 
ESFAS Automatic Actuation Logic 

B 3.3.7 

BWOG STS B 3.3.7-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.3.7.1

REQUIREMENTS 

SR 3.3.7.1 is the performance of a CHANNEL FUNCTIONAL TEST on a 

31 day STAGGERED TEST BASIS. The test demonstrates that every 

automatic actuation logic associated with one of the two safety system 

trains successfully performs the two-out-of-three logic combinations every 

31 days. All automatic actuation logics are thus retested every 62 days. 

The test simulates the required one-out-of-three inputs to the logic circuit 

and verifies the successful operation of the automatic actuation logic. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. The Frequency is based on operating experience 

that demonstrates the rarity of more than one channel failing within the 

same 31 day interval. 

Automatic actuation logic response time testing is incorporated into the 

response time testing required by LCO 3.3.5. 

REFERENCES 1. 10 CFR 50.46. 

 2. BAW-10103A, Rev. 3, July 1977. 
EDG LOPS 

B 3.3.8 

BWOG STS B 3.3.8-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.8 Emergency Diesel Generator (EDG) Loss of Power Start (LOPS) 

BASES 

BACKGROUND The EDGs provide a source of emergency power when offsite power is 

either unavailable or is insufficiently stable to allow safe unit operation. 

Undervoltage protection will generate a LOPS in the event a loss of 

voltage or degraded voltage condition occurs in the switchyard. There 

are two LOPS Functions for each 4.16 kV vital bus. 

Three undervoltage relays with [inverse voltage time] characteristics are 

provided on each 4.16 kV Class 1E instrument bus for the purpose of 

detecting a sustained undervoltage condition or a loss of bus voltage. 

The relays are combined in a two-out-of-three logic to generate a LOPS if 

the voltage is below 75% for a short time or below 90% for a long time. 

The LOPS initiated ACTIONS are described in FSAR, Section [8.3] 

(Ref. 1). 

Trip Setpoints and Allowable Value

The trip setpoints used in the bistables are based on the analytical limits 

presented in accident analysis in FSAR, Chapter [14] (Ref. 2). The 

selection of these trip setpoints is such that adequate protection is 

provided when all sensor and processing time delays are taken into 

account. The actual nominal trip setpoint entered into the bistable is 

more conservative than that required by the unit specific setpoint 

calculations. A channel is inoperable if its actuation trip setpoint is not 

within its required Allowable Value. 

Setpoints in accordance with the Allowable Value will assure that limits of 

Chapter 2.0, "Safety Limits," in the Technical Specifications are not 

violated during anticipated operational occurrences (AOOs); that the 

consequences of accidents will be acceptable, providing the unit is 

operated from within the LCOs at the onset of the AOO or accident; and 

that the equipment functions as designed. 

The undervoltage protection scheme has been designed to protect the 

unit from spurious trips caused by the offsite power source. This is made 

possible by the inverse voltage time characteristics of the relays used. A 

complete loss of offsite power will result in approximately a [1] second 

delay in LOPS actuation. The EDG starts and is available to accept loads 

within a 10 second time interval on the Engineered Safety Feature 

Actuation System (ESFAS) or LOPS. Emergency power is established 

within the maximum time delay assumed for each event analyzed in the 

accident analysis (Ref. 2). 
EDG LOPS 

B 3.3.8 

BWOG STS B 3.3.8-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

With three protection channels in a two-out-of-three trip logic for each 

division of the 4.16 kV power supply, no single failure will cause or 

prevent protective system actuation. This arrangement meets 

IEEE-279-1971 criteria (Ref. 3). 

APPLICABLE The EDG LOPS is required for the Engineered Safety Features (ESF) 

SAFETY to function in any accident with a loss of offsite power. Its design basis 

ANALYSES is that of the ESFAS. 

Accident analyses credit the loading of the EDG, based on the loss of 

offsite power, during a loss of coolant accident (LOCA). The actual EDG 

Start has historically been associated with the ESFAS actuation. The 

diesel loading has been included in the delay time associated with each 

safety system component requiring EDG supplied power following a loss 

of offsite power. The analysis assumes a nonmechanistic EDG loading, 

which does not explicitly account for each individual component of the 

loss of power detection and subsequent actions. The total actuation time 

for the limiting systems, high pressure injection, and low pressure 

injection is 35 seconds. This delay time includes contributions from the 

EDG Start, EDG loading, and safety injection system component 

actuation. The response of the EDG to a loss of power must be 

demonstrated to fall within this analysis response time when including the 

contributions of all portions of the delay. 

The required channels of LOPS, in conjunction with the ESF systems 

powered from the EDGs, provide unit protection in the event of any of the 

analyzed accidents discussed in the accident analysis (Ref. 2), in which a 

loss of offsite power is assumed. 

The delay times assumed in the safety analysis for the ESF equipment 

include the 10 second EDG Start delay and, if applicable, the appropriate 

sequencing delay. The response times for ESFAS actuated equipment in 

LCO 3.3.5, "Engineered Safety Feature Actuation System (ESFAS) 

Instrumentation," include the appropriate EDG loading and sequencing 

delay. 

The EDG LOPS channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
EDG LOPS 

B 3.3.8 

BWOG STS B 3.3.8-3 Rev. 3.0, 03/31/04 

BASES 

LCO The LCO for the LOPS requires that three channels per bus of each 

LOPS instrumentation Function shall be OPERABLE in MODES 1, 2, 3, 

and 4 when the LOPS supports safety systems associated with the 

ESFAS. In MODES 5 and 6, the three channels must be OPERABLE 

whenever the associated EDG is required to be OPERABLE to ensure 

that the automatic start of the EDG is available when needed. 

Loss of LOPS function could result in the delay of safety systems initiation 

when required. This could lead to unacceptable consequences during 

accidents. During the loss of offsite power, which is an AOO, the EDG 

powers the motor driven emergency feedwater pumps. Failure of these 

pumps to start would leave only the one turbine driven pump and an 

increased potential for a loss of decay heat removal through the 

secondary system. 

Only Allowable Values are specified for each Function in the LCO. 

Nominal trip setpoints are specified in the unit specific setpoint 

calculations. The nominal setpoints are selected to ensure that the 

setpoint measured by CHANNEL FUNCTIONAL TESTS does not exceed 

the Allowable Value if the bistable is performing as required. Operation 

with a trip setpoint less conservative than the nominal trip setpoint, but 

within the Allowable Value, is acceptable provided that operation and 

testing is consistent with the assumptions of the unit specific setpoint 

calculation. Each Allowable Value specified is more conservative than 

the analytical limit assumed in the transient and accident analysis to 

account for instrument uncertainties appropriate to the trip function. 

These uncertainties are defined in the "[Unit Specific Setpoint 

Methodology]" (Ref. 4). 

Degraded Voltage LOPS

Voltage: The minimum Allowable Value includes an allowance for relay 

coil calibration error and is based on maintaining at least [90%] of rated 

voltage on the 480 V motor control centers, with a [4.1%] V drop across 

the [4160/480] V stepdown transformers. The [4.1%] V drop associated 

with these transformers is the maximum expected due to ESF bus 

loading, while the MCC contactors are considered to require at least 

[90%] V for proper operation. 

The maximum Allowable Value is not based on equipment operability 

concerns, but rather avoidance of unnecessary EDG starts due to 

spurious channel trip. 
EDG LOPS 

B 3.3.8 

BWOG STS B 3.3.8-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Time Delay: The response time includes [5 seconds] for undervoltage 

relay actuation following detection of degraded ES bus voltage, 

[13 seconds] for the bus trip delay timer, and [3 seconds] for the dead bus 

timer. Note that the acceptance criteria of [21 seconds] does not account 

for the setpoint tolerance of [10%] or [± 2.1 seconds]. 

Loss of Voltage LOPS

Voltage and Response Time: The Allowable Value for the loss of voltage 

channels is ≥ 0 V. This Allowable Value and the associated channel 

response time are based on the physical characteristics of the loss of 

voltage sensing relays. The loss of voltage channels respond to a 

complete loss of ES bus voltage, providing automatic starting and loading 

of the associated EDG. However, their response time is not critical to the 

overall ES equipment response time following an actuation, since the 

degraded voltage LOPS instrumentation will also respond to the complete 

loss of voltage, and will do so earlier than the loss of voltage 

instrumentation. The loss of voltage channel response includes only the 

time response associated with the undervoltage relays, including the 

nominal setpoint of [7.8 seconds] and a tolerance of [7%] or 

[0.55 seconds]. 

APPLICABILITY The EDG LOPS actuation Function shall be OPERABLE in MODES 1, 2, 

3, and 4 because ESF Functions are designed to provide protection in 

these MODES. Actuation is also required whenever the EDG is required 

to be OPERABLE by LCO 3.8.2, "AC Sources - Shutdown," so that the 

EDG can perform its function on a loss of power or degraded power to the 

vital bus. 

ACTIONS If a channel's trip setpoint is found nonconservative with respect to the 

Allowable Value, or the channel is found inoperable, then the function that 

the channel provides must be declared inoperable and the LCO Condition 

entered for the particular protection function affected. Since the required 

channels are specified on a per EDG basis, the Condition may be entered 

separately for each EDG. 

A Note has been added to the ACTIONS indicating that separate 

Condition entry is allowed for each Function. 
EDG LOPS 

B 3.3.8 

BWOG STS B 3.3.8-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

If one channel per EDG in one or more Functions is inoperable, it must be 

tripped within 1 hour. With a channel in trip, the LOPS channels are 

configured to provide a one-out-of-two logic to initiate a trip of the 

incoming offsite power. In trip, one additional valid actuation will cause a 

LOPS signal on the bus. The 1 hour Completion Time is reasonable to 

evaluate and to take action by correcting a degraded condition in an 

orderly manner and takes into account the low probability of an event 

requiring LOPS occurring during this interval. 

B.1

Condition B applies when two or more undervoltage or two or more 

degraded voltage channels on a single bus are inoperable. 

Required Action B.1 requires all but one inoperable channel to be 

restored to OPERABLE status within 1 hour. With two or more channels 

inoperable, the logic is not capable of providing an automatic EDG LOPS 

signal for valid loss of voltage or degraded voltage conditions. The 1 hour 

Completion Time is reasonable to evaluate and to take action by 

correcting the degraded condition in an orderly manner and takes into 

account the low probability of an event requiring LOPS occurring during 

this interval. 

C.1

Condition C applies if the Required Action of Condition A or Condition B 

and the associated Completion Time is not met. 

Required Action C.1 ensures that Required Actions for affected diesel 

generator inoperabilities are initiated. Depending on unit MODE, the 

Actions specified in LCO 3.8.1, "AC Sources - Operating," or LCO 3.8.2, 

are required immediately. 

SURVEILLANCE SR 3.3.8.1

REQUIREMENTS 

SR 3.3.8.1 is the performance of the CHANNEL CHECK once every 

12 hours to ensure that a gross failure of instrumentation has not 

occurred. A CHANNEL CHECK is normally a comparison of the 
EDG LOPS 

B 3.3.8 

BWOG STS B 3.3.8-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

parameter indicated on one channel to a similar parameter on other 

channels. It is based on the assumption that instrument channels 

monitoring the same parameter should read approximately the same 

value. Significant deviations between the two instrument channels could 

be an indication of excessive instrument drift in one of the channels or of 

something even more serious. CHANNEL CHECK will detect gross 

channel failure; therefore, it is key in verifying that the instrumentation 

continues to operate properly between each CHANNEL CALIBRATION. 

Agreement criteria are determined by the unit staff based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the transmitter or the signal processing equipment has 

drifted outside its limit. If the channels are within the criteria, it is an 

indication that the channels are OPERABLE. 

The Frequency, about once every shift, is based on operating experience 

that demonstrates channel failure is rare. Since the probability of two 

random failures in redundant channels in any 12 hour period is low, the 

CHANNEL CHECK minimizes the chance of loss of protective function 

due to failure of redundant channels. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channel 

OPERABILITY during normal operational use of the displays associated 

with this LCO's required channels. 

SR 3.3.8.2

The Note allows channel bypass for testing without defining it as 

inoperable although during this time period it cannot actuate a diesel 

start. This allowance is based on the assumption that 4 hours is the 

average time required to perform channel Surveillance. The 4 hour testing 

allowance does not significantly reduce the probability that the EDG will 

start when necessary. It is not acceptable to routinely remove channels 

from service for more than 4 hours to perform required Surveillance 

testing. 

A CHANNEL FUNCTIONAL TEST is performed on each required EDG 

LOPS channel to ensure the entire channel will perform the intended 

function. A successful test of the required contact(s) of a channel relay 

may be performed by the verification of the change of state of a single 

contact of the relay. This clarifies what is an acceptable CHANNEL 
EDG LOPS 

B 3.3.8 

BWOG STS B 3.3.8-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

FUNCTIONAL TEST of a relay. This is acceptable because all of the 

other required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per 

refueling interval with applicable extensions. Any setpoint adjustments 

shall be consistent with the assumptions of the current unit specific 

setpoint analysis. The Frequency of 31 days is considered reasonable 

based on the reliability of the components and on operating experience 

that demonstrates channel failure is rare. 

SR 3.3.8.3

A CHANNEL CALIBRATION is a complete check of the instrument 

channel, including the sensor. The setpoints and the response to a loss 

of voltage and a degraded voltage test shall include a single point 

verification that the trip occurs within the required delay time, as shown in 

Reference 1. CHANNEL CALIBRATION shall find that measurement 

setpoint errors are within the assumptions of the unit specific setpoint 

analysis. CHANNEL CALIBRATIONS must be performed consistent with 

the assumptions of the unit specific setpoint analysis in Reference 4. 

The Frequency is based on operating experience and consistency with 

the typical industry refueling cycle and is justified by the assumption of an 

18 month calibration interval in the determination of equipment drift in the 

setpoint calculation. 

REFERENCES 1. FSAR, Section [8.3]. 

 2. FSAR, Chapter [14]. 

 3. IEEE-279-1971, April 1972. 

 4. [Unit Name], [Unit Specific Setpoint Methodology]. 
Source Range Neutron Flux 

B 3.3.9 

BWOG STS B 3.3.9-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.9 Source Range Neutron Flux 

BASES 

BACKGROUND The source range neutron flux channels provide the operator with an 

indication of the approach to criticality at lower power levels than can be 

seen on the intermediate range neutron flux instrumentation. These 

channels also provide the operator with a flux indication that reveals 

changes in reactivity and helps to verify that SDM is being maintained. 

The source range instrumentation has two redundant count rate channels 

originating in two high sensitivity proportional counters. Two source 

range detectors are externally located on opposite sides of the core 180°. 

These channels are used over a counting range of 0.1 cps to 1E6 cps 

and are displayed on the operator's control console in terms of log count 

rate. The channels also measure the rate of change of the neutron flux 

level, which is displayed for the operator in terms of startup rate from -0.5 

decades to +5 decades per minute. An interlock provides a control rod 

withdraw "inhibit" on a high startup rate of +2 decades per minute in either 

channel. 

The proportional counters of the source range channels are BF3

chambers. The detector high voltage is automatically turned off when the 

flux level is approximately one decade above the useful operating range. 

Conversely, the high voltage is turned on automatically when the flux 

level returns to within approximately one decade of the detectors' 

maximum useful range. High voltage will be turned off automatically 

when the flux level is above 1E-10 amp in both intermediate range 

channels, or 10% power in power range channels. 

APPLICABLE The source range neutron flux channels are necessary to monitor 

SAFETY core reactivity changes. It is the primary means for detecting and 

ANALYSES triggering operator actions to respond to reactivity transients initiated from 

conditions in which the Reactor Protection System (RPS) is not required 

to be OPERABLE. It also triggers operator actions to anticipate RPS 

actuation in the event of reactivity transients starting from shutdown or 

low power conditions. 

The source range neutron flux channels satisfy Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 
Source Range Neutron Flux 

B 3.3.9 

BWOG STS B 3.3.9-2 Rev. 3.0, 03/31/04 

BASES 

LCO Two source range neutron flux channels shall be OPERABLE whenever 

the control rods are capable of being withdrawn to provide the operator 

with redundant source range neutron instrumentation. The source range 

instrumentation is the primary power indication at low power levels 

≤ 1E-10 amp on intermediate range instrumentation and must remain 

OPERABLE for the operator to continue increasing power. 

A Note has been added allowing detector high voltage to be de-energized 

with neutron flux > 1E-10 amp on the intermediate range channels. 

Above this point, the source range instrumentation is no longer the 

primary power indicator. As such, the high voltage to the source range 

detectors may be de-energized. 

APPLICABILITY Two source range neutron flux channels shall be OPERABLE in MODE 2 

to provide redundant indication during an approach to criticality. Neutron 

flux level is sufficient for monitoring on the intermediate range and on the 

power range instrumentation prior to entering MODE 1; therefore, source 

range instrumentation is not required in MODE 1. 

In MODES 3, 4, and 5, source range neutron flux instrumentation shall be 

OPERABLE to provide the operator with a means of monitoring changes 

in SDM and to provide an early indication of reactivity changes. 

The requirements for source range neutron flux instrumentation during 

MODE 6 refueling operations are addressed in LCO 3.9.2., "Nuclear 

Instrumentation." 

ACTIONS A.1

The Required Action for one channel of the source range neutron flux 

indication inoperable with neutron flux ≤ 1E-10 amp on the intermediate 

range neutron flux instrumentation is to delay increasing reactor power 

until the channel is repaired and restored to OPERABLE status. This 

limits power increases in the range where the operators rely solely on the 

source range instrumentation for power indication. The Completion Time 

ensures the source range is available prior to further power increases. 

Furthermore, it ensures that power remains below the point where the 

intermediate range channels provide primary protection until both source 

range channels are available to support the overlap verification required 

by SR 3.3.9.4. 
Source Range Neutron Flux 

B 3.3.9 

BWOG STS B 3.3.9-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1, B.2, B.3, and B.4

With both source range neutron flux channels inoperable with neutron flux 

≤ 1E-10 amp on the intermediate range neutron flux instrumentation, the 

operators must take actions to limit the possibilities for adding positive 

reactivity. This is done by immediately suspending positive reactivity 

additions, initiating action to insert all CONTROL RODS, and opening the 

CONTROL ROD drive trip breakers within 1 hour. Periodic SDM 

verification is then required to provide a means for detecting the slow 

reactivity changes that could be caused by mechanisms other than 

control rod withdrawal or operations involving positive reactivity changes. 

Since the source range instrumentation provides the only reliable direct 

indication of power in this condition, the operators must continue to verify 

the SDM every 12 hours until at least one channel of the source range 

instrumentation is returned to OPERABLE status. Required Action B.1, 

Required Action B.2, and Required Action B.3 preclude rapid positive 

reactivity additions. The 1 hour Completion Time for Required Action B.3 

and Required Action B.4 provides sufficient time for operators to 

accomplish the actions. The 12 hour Frequency for performing the SDM 

verification ensures that the reactivity changes possible with CONTROL 

RODS inserted are detected before SDM limits are challenged. 

Required Action B.1 is modified by a Note which permits plant 

temperature changes provided the temperature change is accounted for 

in the calculated SDM. Introduction of temperature changes, including 

temperature increases when a positive MTC exists, must be evaluated to 

ensure they do not result in a loss of required SDM. 

C.1

With neutron flux > 1E-10 amp in MODE 2, 3, 4, or 5 on the intermediate 

range neutron flux instrumentation, continued operation is allowed with 

one or more source range neutron flux channels inoperable. The ability 

to continue operation is justified because the instrumentation does not 

provide a safety function during high power operation. However, actions 

are initiated within 1 hour to restore the channel(s) to OPERABLE status 

for future availability. The Completion Time of 1 hour is sufficient to 

initiate the action. The action must continue until channels are restored to 

OPERABLE status. 
Source Range Neutron Flux 

B 3.3.9 

BWOG STS B 3.3.9-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.3.9.1

REQUIREMENTS 

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. CHANNEL 

CHECK will detect gross channel failure; therefore, it is key in verifying 

that the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the transmitter or the signal processing equipment has 

drifted outside its limit. If the channels are within the criteria, it is an 

indication that the channels are OPERABLE. If the channels are normally 

off scale during times when surveillance is required, the CHANNEL 

CHECK will only verify that they are off scale in the same direction. Off 

scale low current loop channels are verified to be reading at the bottom of 

the range and not failed downscale. 

The agreement criteria includes an expectation of one decade of overlap 

when transitioning between neutron flux instrumentation. For example, 

during a power reduction near the bottom of the scale for the intermediate 

range monitors, a source range monitor reading is expected with at least 

one decade overlap. Without such an overlap, the source range monitors 

are considered inoperable unless it is clear that an intermediate range 

monitor inoperability is responsible for the lack of the expected overlap. 

The Frequency, about once every shift, is based on operating experience 

that demonstrates channel failure is rare. Since the probability of two 

random failures in redundant channels in any 12 hour period is extremely 

low, the CHANNEL CHECK minimizes the chance of loss of protective 

function due to failure of redundant channels. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channel 

OPERABILITY during normal operational use of the displays associated 

with the LCO's required channels. When operating in Required 

Action A.1, CHANNEL CHECK is still required. However, in this 
Source Range Neutron Flux 

B 3.3.9 

BWOG STS B 3.3.9-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

condition, a redundant source range is not available for comparison. 

CHANNEL CHECK may still be performed via comparison with 

intermediate range detectors, if available, and verification that the 

OPERABLE source range channel is energized and indicating a value 

consistent with current unit status. 

SR 3.3.9.2

For source range neutron flux channels, CHANNEL CALIBRATION is a 

complete check and readjustment of the channels from the preamplifier 

input to the indicators. This test verifies the channel responds to 

measured parameters within the necessary range and accuracy. 

CHANNEL CALIBRATION leaves the channel adjusted to account for 

instrument drift to ensure that the instrument channel remains operational 

between successive tests. 

The SR is modified by a Note excluding neutron detectors from 

CHANNEL CALIBRATION. It is not necessary to test the detectors 

because generating a meaningful test signal is difficult. The detectors are 

of simple construction, and any failures in the detectors will be apparent 

as change in channel output. 

The Frequency of [18] months is based on demonstrated instrument 

CHANNEL CALIBRATION reliability over an [18] month interval, such that 

the instrument is not adversely affected by drift. 

REFERENCES None. 
Intermediate Range Neutron Flux 

B 3.3.10 

BWOG STS B 3.3.10-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.10 Intermediate Range Neutron Flux 

BASES 

BACKGROUND The intermediate range neutron flux channels provide the operator with 

an indication of reactor power at higher power levels than the source 

range instrumentation and lower power levels than the power range 

instrumentation. 

The intermediate range instrumentation has two log N channels 

originating in two electrically identical gamma compensated ion 

chambers. Each channel provides eight decades of flux level information 

in terms of the log of ion chamber current from 1E-10 amp to 1E-2 amp. 

The channels also measure the rate of change of the neutron flux level, 

which is displayed for the operator in terms of startup rate from -0.5 

decades to +5 decades per minute. A high startup rate of +3 decades per 

minute in either channel will initiate a control rod withdrawal inhibit. 

The intermediate range compensated ion chambers are of the electrically 

adjustable gamma compensating type. Each detector has a separate 

adjustable high voltage power supply and an adjustable compensating 

voltage supply. 

APPLICABLE Intermediate range neutron flux channels are necessary to monitor 

SAFETY core reactivity changes and are the primary indication to trigger 

ANALYSES operator actions to anticipate Reactor Protection System actuation in the 

event of reactivity transients starting from low power conditions. 

The intermediate range neutron flux channels satisfy Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO Two intermediate range neutron flux instrumentation channels shall be 

OPERABLE to provide the operator with redundant neutron flux 

indication. These enable operators to control the increase in power and 

to detect neutron flux transients. This indication is used until the power 

range instrumentation is on scale. Violation of this requirement could 

prevent the operator from detecting and controlling neutron flux transients 

that could result in reactor trip during power escalation. 
Intermediate Range Neutron Flux 

B 3.3.10 

BWOG STS B 3.3.10-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The intermediate range neutron flux channels shall be OPERABLE in 

MODE 2 and in MODES 3, 4 and 5 with any CONTROL ROD drive (CRD) 

trip breaker in the closed position and the CRD System capable of rod 

withdrawal. 

The intermediate range instrumentation is designed to detect power 

changes during initial criticality and power escalation when the power 

range and source range instrumentation cannot provide reliable 

indications. Since those conditions can exist in all of these MODES, the 

intermediate range instrumentation must be OPERABLE. 

ACTIONS A.1

If one intermediate range channel becomes inoperable when the 

channels indicate > 1E-10 amp, the unit is exposed to the possibility that 

a single failure will disable all neutron monitoring instrumentation. To 

avoid this, the inoperable channel must be repaired or power must be 

reduced to the point where source range channels can provide neutron 

flux indication. Completion of Required Action A.1 places the unit in this 

state, and LCO 3.3.9, "Source Range Neutron Flux," requires 

OPERABILITY of two source range detectors once this state is reached. 

If the one channel failure occurs when indicated power is ≤ 1E-10 amp, 

the Required Action prohibits increases in power above the source range 

capability. 

The 2 hour Completion Time allows controlled reduction of power into the 

source range and is based on unit operating experience that 

demonstrates the improbability of the second intermediate range channel 

failing during the allowed interval. 

B.1 and B.2

With two intermediate range neutron flux channels inoperable when 

THERMAL POWER is ≤ 5% RTP, the operators must place the reactor in 

the next lowest condition for which the intermediate range instrumentation 

is not required. This involves providing power level indication on the 

source range instrumentation by immediately suspending operations 

involving positive reactivity changes and, within 1 hour, placing the 

reactor in the tripped condition with the CRD trip breakers open. The 

Completion Times are based on unit operating experience and allow the 

operators sufficient time to manually insert the CONTROL RODS prior to 

opening the CRD breakers. 
Intermediate Range Neutron Flux 

B 3.3.10 

BWOG STS B 3.3.10-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Action B.1 is modified by a Note which permits plant 

temperature changes provided the temperature change is accounted for 

in the calculated SDM. Introduction of temperature changes, including 

temperature increases when a positive MTC exists, must be evaluated to 

ensure they do not result in a loss of required SDM. 

SURVEILLANCE SR 3.3.10.1

REQUIREMENTS 

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. CHANNEL 

CHECK will detect gross channel failure; therefore, it is key in verifying 

that the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 

Agreement criteria are determined by the unit staff based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the transmitter or the signal processing equipment has 

drifted outside its limit. If the channels are within the criteria, it is an 

indication that the channels are OPERABLE. 

The agreement criteria includes an expectation of one decade of overlap 

when transitioning between neutron flux instrumentation. For example, 

during a power increase near the top of the scale for the source range 

monitors, an intermediate range monitor reading is expected with at least 

one decade overlap. Without such an overlap, the intermediate range 

monitors are considered inoperable unless it is clear that a source range 

monitor inoperability is responsible for the lack of the expected overlap. 

Further, during a power reduction near the bottom of the scale for the 

power range monitors, an intermediate range monitor reading is expected 

with at least one decade overlap. Without such an overlap, the 

intermediate range monitors are considered inoperable unless it is clear 

that a power range monitor inoperability is responsible for the lack of the 

expected overlap. 
Intermediate Range Neutron Flux 

B 3.3.10 

BWOG STS B 3.3.10-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Frequency, about once every shift, is based on operating experience 

that demonstrates channel failure is rare. Since the probability of two 

random failures in redundant channels in any 12 hour period is extremely 

low, the CHANNEL CHECK minimizes the chance of loss of protective 

function due to failure of redundant channels. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channel 

OPERABILITY during normal operational use of the displays associated 

with the LCO's required channels. 

When operating in Required Action A.1, CHANNEL CHECK is still 

required. However, in this condition, a redundant intermediate range is 

not available for comparison. CHANNEL CHECK may still be performed 

via comparison with power or source range detectors, if available, and 

verification that the OPERABLE intermediate range channel is energized 

and indicates a value consistent with current unit status. 

SR 3.3.10.2

For intermediate range neutron flux channels, CHANNEL CALIBRATION 

is a complete check and readjustment of the channels, from the 

preamplifier input to the indicators. This test verifies the channel 

responds to a measured parameter within the necessary range and 

accuracy. CHANNEL CALIBRATION leaves the channel adjusted to 

account for instrument drift to ensure that the instrument channel remains 

operational between successive tests. 

The SR is modified by a Note excluding neutron detectors from 

CHANNEL CALIBRATION. It is not necessary to test the detectors 

because generating a meaningful test signal is difficult. In addition, the 

detectors are of simple construction, and any failures in the detectors will 

be apparent as a change in channel output. The Frequency is based on 

operating experience and consistency with the typical industry refueling 

cycle and is justified by demonstrated instrument reliability over an 

[18] month interval such that the instrument is not adversely affected by 

drift. 

REFERENCES None. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.11 Emergency Feedwater Initiation and Control (EFIC) Instrumentation 

BASES 

BACKGROUND The EFIC System instrumentation is designed to provide safety grade 

means of controlling the secondary system as a heat sink for core decay 

heat removal. To ensure the secondary system remains a heat sink, the 

EFIC System takes action to initiate emergency feedwater (EFW) when 

the primary source of feedwater is lost and to isolate functional 

components from hydraulic faults within the secondary system. These 

actions ensure that a source of cooling water is available to be fed to a 

once through steam generator (OTSG) that has a controlled steam 

pressure, thereby fixing the heat sink temperature at the saturation 

temperature of the secondary system. The EFIC Functions that are 

supported and the parameters that are needed for each of these 

Functions are described next. 

The EFIC instrumentation contains devices and circuitry that generate the 

following signals when monitored variables reach levels that are indicative 

of conditions requiring protective actions. 

a. EFW Initiation, 

b. EFW Vector Valve Control, 

c. Main Steam Line Isolation, and 

d. Main Feedwater (MFW) Isolation. 

EFW is initiated to restore a source of cooling water to the secondary 

system when conditions indicate that the normal source of feedwater is 

insufficient to continue heat removal. The two indications used for this 

are the loss of both MFW pumps and a low level in the steam generator 

(SG). Also, EFW is initiated when action is being taken to isolate the 

MFW from the SG during conditions of uncontrolled depressurizations. 

This is done by initiating EFW when steam pressure reaches the low SG 

pressure setpoint for isolation of main steam and MFW, and EFW vector 

valve control. Finally, EFW is initiated when the primary system 

experiences a total loss of forced circulation. This initiation, on the loss of 

all reactor coolant pumps (RCPs), ensures the EFW is available to raise 

SG levels to promote natural circulation cooling. Additionally, this 

ensures that EFW is available under the worst-case, small break loss of 

coolant accident (LOCA) conditions when secondary system cooling with 

high SG water levels is necessary. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The EFIC System also isolates main steam and MFW to an SG that has 

lost pressure control. With the loss of pressure control, the heat sink 

temperature control is lost and the heat removal rate cannot be 

controlled. The main steam and MFW are isolated to an SG when the 

steam pressure reaches a low setpoint, a condition which is beyond the 

normal operating point of the secondary system. 

The EFIC System also performs an EFW control function to avoid 

delivering EFW to a depressurized SG when the other SG remains 

pressurized. This continues the function of isolating functional 

components from an SG whose pressure cannot be controlled. This 

function precludes the delivery of fluid to a depressurized SG, thereby 

avoiding an uncontrolled cooling condition as long as the other SG 

remains pressurized. When both of the SGs are depressurized, the EFIC 

logic provides EFW flow to both SGs until a significant pressure 

difference between the two SGs is developed, thereby ensuring that core 

cooling is maintained. 

Trip Setpoints and Allowable Values

The trip setpoints are the nominal value at which the bistables are set. 

Any bistable is considered to be properly adjusted when the "as left" 

value is within the band for CHANNEL CALIBRATION accuracy (i.e., 

± [rack calibration + comparator setting accuracy]). 

The trip setpoints used in the bistables are based on the analytical limits 

stated in FSAR, Section [14.1] (Ref. 1). The selection of these trip 

setpoints is such that adequate protection is provided when all sensor 

and processing time delays are taken into account. The Allowable Values 

specified in Table 3.3.11-1 in the accompanying LCO are conservatively 

adjusted with respect to the analytical limits to allow for calibration 

tolerances, instrumentation uncertainties, instrument drift, and severe 

environmental errors for those EFIC channels that must function in harsh 

environments as defined by 10 CFR 50.49 (Ref. 2). A detailed 

description of the methodology used to calculate the trip setpoints, 

including their explicit uncertainties, is provided in "[Unit Specific Setpoint 

Methodology]" (Ref. 3). The actual nominal trip setpoint entered into the 

bistable is more conservative than that specified by the Allowable Value 

to account for changes in random measurement errors detectable by a 

CHANNEL FUNCTIONAL TEST. One example of such a change in 

measurement error is drift during the surveillance interval. A channel is 

inoperable if its actuation trip setpoint is not within its required Allowable 

Value. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Setpoints in accordance with the Allowable Value ensure that the 

consequences of Design Basis Accidents (DBAs) are acceptable, 

providing the unit is operated from within the LCOs at the onset of the 

DBA, and that the equipment functions as designed. 

Each channel can be tested on line to verify that the setpoint accuracy is 

within the specified allowance requirements of Figure [ ] , FSAR, 

Chapter [7] (Ref. 4). Once a designated channel is taken out of service 

for testing, a simulated signal is injected in place of the field instrument 

signal. The process equipment for the channel in test is then tested, 

verified, and calibrated. The SRs for the channels are specified in the 

SRs Section. 

The Allowable Values listed in Table 3.3.11-1 are based on the "[Unit 

Specific Setpoint Methodology]" (Ref. 3), which incorporates all of the 

known uncertainties applicable for each channel. The magnitudes of 

these uncertainties are factored into the determination of each trip 

setpoint. All field sensors and signal processing equipment for these 

channels are assumed to operate within the allowances of these 

uncertainty magnitudes. 

Figure [ ] , FSAR, Chapter [7] (Ref. 4), illustrates EFIC EFW Initiation 

logic operation. 

Each EFIC train actuates on a one-out-of-two taken twice combination of 

trip signals from the instrumentation channels. Each EFIC channel can 

issue an initiate command, but an EFIC actuation will take place only if at 

least two channels issue initiate commands. The one-out-of-two taken 

twice logic combinations are transposed between trains so that failure of 

two channels prevents actuation of, at most, one train. 

More detailed descriptions of the EFIC instrumentation are provided next. 

1. EFW Initiation

Figure [ ] , FSAR, Chapter [7] (Ref. 4), illustrates one channel of the 

EFIC EFW Initiation channel. The individual instrumentation 

channels that serve EFIC EFW Initiation Function are discussed next. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-4 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

a. Loss of MFW Pumps (Control Oil Pressure)

Loss of both MFW Pumps is one of the four parameters within 

the EFIC System that automatically initiates EFW. Loss of MFW 

Pumps is detected by MFW Pump turbine control oil pressure. 

The MFW Pump status instrumentation is a part of the nuclear 

instrument (NI) and Reactor Protection System (RPS). Each 

RPS channel receives MFW Pump status information from 

pressure switches (four per pump). If both switches in a single 

channel trip, the associated RPS channel trips. Each RPS 

channel provides both MFW Pumps tripped signal to the 

associated EFIC channel. The trip Function is bypassed when 

THERMAL POWER ≤ 20% RTP and the RPS is in shutdown 

bypass. The bypass is automatically removed when THERMAL 

POWER is greater than 20% RTP. 

Loss of both MFW Pumps was chosen as an EFW automatic 

initiating parameter because it is a direct and immediate indicator 

of loss of MFW. 

b. SG Level - Low

Four EFIC dedicated low range level transmitters per SG Level - 

Low are used to generate the signals used for detection for low 

level conditions for EFW actuation. There is one transmitter for 

each of the four channels A, B, C, and D. The signals are also 

used after EFW is actuated to control SG level at the low level 

setpoint [30 inches] when one or more RCPs are operational. 

The lower and upper taps for the low range level transmitters are 

located at 6 inches and 277 inches, respectively, above the 

upper face of the SG's lower tube sheet. The calibrated range is 

0-150 inches. 

SG Level - Low was chosen as an EFW automatic initiating 

parameter because it indicates that the primary feedwater source 

is insufficient to meet the heat removal requirements and, 

therefore, additional cooling water is necessary to ensure core 

decay heat removal. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-5 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

c. SG Pressure - Low

Four transmitters per SG provide the EFIC System with 

channels A through D of SG Pressure - Low. These are the 

same transmitters used by the MFW and Main Steam Line 

Isolation Functions. When the SG pressure drops below the 

bistable setpoint of 600 psig on a given channel, an EFW 

Initiation signal is sent to the automatic actuation logic. The low 

pressure Function may be manually bypassed when both SGs 

are less than 750 psig. If either SG input channel exceeds 

750 psig, the EFIC channel bypass is automatically removed. 

The low pressure operational bypass allows for normal cooldown 

without EFIC actuation. 

SG Pressure - Low is a primary indication and actuation signal 

for steam line breaks (SLBs) or feedwater line breaks (FWLBs). 

For small breaks, which do not depressurize the SG or take a 

long time to depressurize, automatic actuation is not required. 

The operator has time to diagnose the problem and take the 

appropriate actions. 

d. RCP Status

A loss of power to all four RCPs is an indication of a pending 

loss of forced flow in the Reactor Coolant System. These 

sensing signals are input into the four channels of EFIC. 

When at least two channels issue initiate commands based on 

loss of all RCPs, the EFIC System will automatically actuate 

EFW and switch the level control setpoint to approximately 50% 

in the SG. This higher setpoint provides a thermal center in the 

SG at a higher elevation than that of the reactor to ensure 

natural circulation of the reactor coolant. 

To allow heatup and cooldown operations without actuation, a 

bypass permissive of 10% RTP is used. The 10% bypass 

permissive was chosen because it was an available, qualified 

Class 1E signal at the time the EFIC System was designed. 

When the first RCP is started, the "loss of four RCPs" initiation 

signal may be manually reset. If the bypass is not manually 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-6 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

reset, it will be automatically reset when the unit reaches 10% 

power. During cooldown, the bypass may be inserted at any 

time the power has been reduced below 10%. However, for 

most operating conditions, it is recommended that this trip 

function remain active until after the Decay Heat Removal 

System has been initiated and the system is ready for the last 

RCP to be tripped. This trip function must be bypassed prior to 

stopping the last RCP. 

2. EFW Vector Valve Control

Figure [ ] , FSAR, Chapter [7] (Ref. 4), illustrates one channel of the 

EFIC EFW Vector Valve Control logic. The function of the EFW 

vector logic is to determine whether EFW should not be fed to one or 

the other SG. This is to preclude the continued addition of EFW to a 

depressurized SG and, thus, to minimize the overcooling effects of a 

steam leak. 

Each set of vector logic receives SG pressure information from 

bistables located in the input logic of the same EFIC channel. The 

pressure information received is: 

 a. SG A pressure less than 600 psig, 

 b. SG B pressure less than 600 psig, 

 c. SG A pressure 125 psid greater than SG B pressure, and 

 d. SG B pressure 125 psid greater than SG A pressure. 

Each vector logic also receives a vector/control enable signal from 

both EFIC channel A and channel B when EFW is initiated. [Each 

logic also receives an SG high level signal. High level in an SG 

prevents opening the associated vector valves and enables closing 

the valves without either EFIC train vector valve enable.] 

The vector logic develops signals to open or to close SG A and B 

EFW valves. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-7 Rev. 3.0, 03/31/04 

 

BASES 

BACKGROUND (continued) 

The vector logic outputs are in a neutral state until enabled by the 

control/vector enable from the channel A or B trip logics. When 

enabled, the vector logic can issue open or close commands to the 

EFW control valves and EFW isolation valves per the selected 

channel assignments. 

Each vector logic may isolate EFW to one SG or the other, never 

both. 

The valve open or close commands are determined by the relative 

values of SG pressures as follows: 

 

SG VALVES 

PRESSURE STATUS "A" "B" 

SG A and SG B > 600 psig Open Open 

| SG A - SG B | < 125 psid Open Open 

SG A or SG B ≤ 600 psig 

 and 

SG A - SG B ≥ 125 psid 

Open Close 

SG A or SG B ≤ 600 psig 

 and 

SG B - SG A ≥ 125 psid 

Close Open 

Bypass

One of the four initiation channels can be put into "maintenance bypass." 

Bypassing one initiation channel isolates that channel's signal to the 

functions fed from initiation channel but does not bypass the trip logic 

within the actuation channel. An interlock feature prevents bypassing 

more than one channel at a time. In addition, since the EFIC System 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-8 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

receives signals from NI and RPS, the maintenance bypass from the NI 

and RPS is interlocked with the EFIC System. If one channel of the NIS 

and RPS is in maintenance bypass, only the corresponding channel of 

the EFIC may be bypassed (e.g., channel A, NI or RPS, and channel A, 

EFIC). This ensures that only the corresponding channels of the EFIC 

and NI and RPS are placed in maintenance bypass at the same time. 

EFIC channel maintenance bypass does not bypass EFW Initiation from 

Engineered Safety Feature Actuation System (ESFAS) high pressure 

injection (HPI). The EFIC HPI Actuation Function is, however, bypassed 

when ESFAS is bypassed. 

The operational bypass provisions were discussed as part of the 

individual Functions described earlier. 

Operational bypass of the OTSG Level - High input to the vector valve 

logic is possible after EFIC initiation. [For this unit, bypassing the overfill 

function is for the following reasons:] 

3, 4. Main Steam Line and MFW Isolation

Figure [ ] , FSAR, Chapter [7] (Ref. 4) illustrates one channel of the 

EFIC Main Steam Line and MFW Isolation logic. Four pressure 

transmitters per SG provide EFIC with channels A through D logic of 

SG pressure. The channels are as described for EFW Initiation 

mentioned earlier. 

Once isolated, manual action is required to defeat the isolation 

command if desired. The EFIC System is designed to perform its 

intended function with one channel in maintenance bypass (in effect, 

inoperable) with a single failure in one of the remaining channels. 

This is in compliance with IEEE-279-1971 (Ref. 5) due to the 

redundancy and independence in the EFIC design. 

APPLICABLE 1. EFW Initiation

SAFETY 

ANALYSES Although loss of both MFW pumps is a direct and immediate indicator 

of loss of MFW, other scenarios such as valve closures could 

potentially cause loss of feedwater. The loss of MFW analysis, 

therefore, conservatively assures the actuation of EFW on low SG 

level. If the loss of feedwater is due to loss of MFW pumps, EFW will 

be actuated much earlier than assumed in the analysis, which will 

increase the SG heat transfer capability and will lessen the severity 

of the transient. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-9 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The DBA which forms the basis for initiation of the EFW systems is a 

loss of MFW transient. In the analysis of this transient, SG Level - 

Low is the parameter assumed to automatically initiate EFW. This 

assumption yields the least SG inventory available for heat removal 

and is, therefore, conservative for evaluation of this DBA. SG Level - 

Low would be an indicator of all accidents involving a loss of primary 

to secondary heat removal. 

SG Pressure - Low is a primary indication and provides the actuation 

signal for SLBs or FWLBs. For small breaks, which do not 

depressurize the SG or take a long time to depressurize, automatic 

actuation is not required. The operator has sufficient time to 

diagnose the problem and take the appropriate actions. 

Loss of four RCPs is a primary indicator of the need for auxiliary 

feedwater (AFW) in the safety analyses for loss of electric power and 

loss of coolant flow. It also serves as a backup indicator for SLBs 

and small break LOCAs. 

2. EFW Vector Valve Control

Most of the FSAR SLB analyses were performed prior to the 

development of the safety grade EFIC System. Therefore, the EFIC 

vector valve control was not credited in the original licensing basis for 

a main SLB analysis. Instead, operator action was credited with 

isolating AFW to the affected SG within the first 60 seconds. 

However, isolating the affected SG is a function automatically 

performed by the EFIC System. Therefore, the FSAR analysis 

remains conservative relative to the inclusion of the vector valve 

control. 

3, 4. Main Steam Line and MFW Isolation

The FSAR analysis assumed integrated control system action for 

MFW and Main Steam Line Isolation. The analysis took credit for 

turbine stop valve closure and feedwater valve isolation on reactor 

trip and considered the isolation functions occurring on SG pressure 

< 600 psig as backup. These isolation functions are currently 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-10 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

provided by the safety grade EFIC System. Use of the EFIC System 

in the original safety analysis would have been consistent with the 

licensing position allowing mitigative functions to be performed by 

safety grade systems in accident analysis. For these reasons, the 

SLB accident analysis remains conservative with the assumed 

integrated control system actions. 

The EFIC System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO All instrumentation performing an EFIC System Function in Table B 

3.3.11-1 shall be OPERABLE. Failure of any instrument renders the 

affected channel(s) inoperable and reduces the reliability of the affected 

Functions. 

Four channels are required OPERABLE for all EFIC instrumentation 

channels to ensure that no single failure prevents actuation of a train. 

Each EFIC instrumentation channel is considered to include the sensors 

and measurement channels for each Function, the operational bypass 

switches, and permissives. Failures that disable the capability to place a 

channel in operational bypass, but which do not disable the trip Function, 

do not render the protection channel inoperable. 

Only the Allowable Values are specified for each EFIC initiation and 

bypass removal function in the LCO. In Table 3.3.11-1, Allowable Values 

for the bypass removal functions are specified in terms of applicability 

limits on the associated trip Function. Nominal trip setpoints are specified 

in the unit specific setpoint calculations. The nominal setpoints are 

selected to ensure the setpoints measured by CHANNEL FUNCTIONAL 

TESTS do not exceed the Allowable Value if the bistable is performing as 

required. Operation with a trip setpoint less conservative than the 

nominal trip setpoint, but within its Allowable Value, is acceptable 

provided that operation and testing are consistent with the assumptions of 

the unit specific setpoint calculations. Each Allowable Value specified is 

more conservative than the analytical limit assumed in the safety analysis 

to account for instrument uncertainties appropriate to the trip Function. 

These uncertainties are defined in the "[Unit Specific Setpoint 

Methodology]" (Ref. 3). 

The Bases for the LCO requirements of each specific EFIC Function are 

discussed next. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-11 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Loss of MFW Pumps

Four EFIC channels shall be OPERABLE with MFW pump turbines A 

and B control oil low pressure actuation setpoints of > [55] psig. The 

55 psig setpoint is about half of the normal operating control oil pressure. 

The 55 psig setpoint Allowable Value was arbitrarily chosen as a good 

indication of Loss of MFW Pumps. Analysis only assumes Loss of MFW 

Pumps and a specific value of MFW pump control oil pressure is not used 

in the analysis. The Loss of MFW Pumps Function includes a bypass 

enable and removal function from the NI/RPS. The bypass removal 

function is based on maintaining consistency with RPS LCO and design 

of system. 

SG Level – Low

Four EFIC dedicated low range level transmitters per SG shall be 

OPERABLE with SG Level - Low actuation setpoints of ≥ [9] inches, to 

generate the signals used for detection for low level conditions for EFW 

Initiation. There is one transmitter for each of the four channels A, B, C, 

and D. The signals are also used after EFW is actuated to control at the 

low level setpoint of 30 inches when one or more RCPs are in operation. 

In the determination of the low level setpoint, it is desired to place the 

setpoint as low as possible, considering instrument errors, to give the 

maximum operability margin between the integrated control system low 

load control setpoint and the EFW Initiation setpoint. This will minimize 

spurious or unwanted initiation of EFW. Credit is only taken for low level 

actuation for those transients which do not involve a degraded 

environment. Therefore, normal environment errors only are used for 

determining the SG Level - Low level setpoint. 

SG Pressure – Low

Four EFIC channels per SG shall be OPERABLE with SG low pressure 

actuation setpoints of ≥ [600] psig. The setpoint is chosen to avoid 

actuation under transient conditions not requiring secondary system 

isolation, preferring to maintain a steaming path to the condenser, if 

possible. Small break LOCA analyses have indicated minimum 

secondary system pressures of approximately 700 psig. The SG 

Pressure - Low Function includes a bypass enable and removal function. 

The bypass removal Allowable Value is chosen to allow sufficient 

operating margin for the operator to bypass when cooling down. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-12 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

SG Differential Pressure – High

Four EFIC channels for SG differential pressure shall be OPERABLE with 

setpoints of ≤ [125] psid. The setpoint ensures that automatic EFW 

isolation to a depressurized SG occurs for the range of sizes of SLBs that 

require rapid actuation early in the event. The setpoint has also been 

chosen to avoid spurious isolation of EFW during conditions due to 

relatively small deviations in SG pressures that can be caused by primary 

system conditions. The SG Differential Pressure - High Function includes 

a bypass enable and removal function. The bypass removal Allowable 

Value is chosen to allow sufficient operating margin for the operator to 

bypass when cooling down. 

RCP Status

Four EFIC channels for RCP status shall be OPERABLE. This ensures 

that upon the loss of four RCPs, EFW will be automatically initiated with 

the EFW control level automatically raised to approximately 50%, 

providing a higher SG level for establishing and maintaining natural 

circulation conditions when the forced reactor coolant flow is lost. No 

setpoint is specified since the status indication as used by EFIC is binary 

in nature. The RCP Status Function includes a bypass enable and 

removal function from the RPS. The Allowable Value for the bypass 

removal is set high enough to avoid spurious actuations during low power 

operation. 

SG Level – High

[ For this unit, the basis for SG Level - High signal is as follows: ] 

APPLICABILITY The EFIC System instrumentation Functions shall be OPERABLE in 

accordance with Table 3.3.11-1. Each Function has its own requirements 

that are based on the specific accidents and conditions that it is designed 

to protect against. 

The initiation of EFW on the Loss of MFW Pumps shall only be required 

in MODE 1 and in MODES 2 and 3 when not in shutdown bypass, when 

core power production and heat removal requirements are the greatest. 

Below these unit conditions, the EFW Initiation on low SG level is rapid 

enough to avoid unnecessary primary system overheating. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-13 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

EFW Initiation on low SG level shall be OPERABLE at all times the SG is 

required for heat removal. These conditions include MODES 1, 2, and 3. 

To avoid automatic actuation of the EFW pumps during normal heatup 

and cooldown transients, the low SG pressure Function can be bypassed 

at or below a secondary pressure of [750] psig. This secondary pressure 

can normally only be reached during MODE 3 operation. 

The EFW System Initiation on loss of all RCPs Function shall be operable 

at ≥ 10% RTP. It is possible to bypass the Function below 10% RTP; 

however, for most cases, the Function is kept in service until the unit is 

placed on the Decay Heat Removal System. To prevent inadvertent 

actuation of the EFW pumps, it must be bypassed prior to stopping the 

last RCP. 

The MFW, Main Steam Line Isolation, and EFW Vector Valve Control 

Functions shall be OPERABLE in MODES 1, 2, and 3 with SG pressure 

≥ 750 psig because the SG inventory can be at a high energy level and 

contribute significantly to the peak pressure with a secondary side break. 

Both the normal feedwater and the EFW must be able to be isolated on 

each SG to limit overcooling of the primary and mass and energy 

releases to the reactor building. Once the SG pressures have decreased 

below 750 psig, the Main Steam Line and MFW Isolation Functions can 

be bypassed to avoid actuation during normal unit cooldowns. The EFW 

Vector Valve Control logic will not perform any function when both SG 

pressures are low; thus, the logic can also be bypassed at the same 

point. In MODES 4, 5, and 6, the energy level is low and the secondary 

side feedwater flow rate is low or nonexistent. In MODES 4, 5, and 6, the 

primary system temperatures are too low to allow the SGs to effectively 

remove energy and EFIC instrumentation is not required to be 

OPERABLE. 

ACTIONS If a channel's trip setpoint is found nonconservative with respect to the 

Allowable Value, or any of the transmitter, signal processing electronics, 

or EFIC channel cabinet modules are found inoperable, then all affected 

Functions provided by that channel must be declared inoperable and the 

unit must enter the Conditions for the particular protection Function 

affected. 

A Note has been added to the ACTIONS indicating that a separate 

Condition entry is allowed for each Function. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-14 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1 and A.2

Condition A applies to failures of a single EFW Initiation, Main Steam Line 

Isolation, or MFW Isolation instrumentation channel. This includes failure 

of a common instrumentation channel in any combination of the 

Functions. 

With one channel inoperable in one or more EFW Initiation, Main Steam 

Line Isolation, or MFW Isolation Functions listed in Table 3.3.11-1, the 

channel(s) must be placed in bypass or trip within 1 hour. This Condition 

applies to failures that occur in a single channel, e.g., channel A, which 

when bypassed will remove initiate Functions within the channel from 

service. Since the RPS and EFIC channels are interlocked, only the 

corresponding channel in each system may be bypassed at any time. 

This feature is ensured by an electrical interlock. If testing of another 

channel in either the EFIC or RPS is required, the EFIC channel must be 

placed in trip to allow the other channel to be bypassed. With the channel 

in trip, the resultant logic is one-out-of-two. The Completion Time of 

1 hour is adequate to perform Required Action A.1. 

Required Action A.2 provides for placing the channel(s) in trip if the 

channel(s) is/are not restored to OPERABLE status within 72 hours. 

A single inoperable EFIC instrumentation channel affects at most one 

train of EFW, Main Steam Line Isolation, and MFW Isolation. Therefore, 

the 72 hour Completion Time was selected to be consistent with the 

allowed out of service time for the EFW, Main Steam Line Isolation, and 

MFW Isolation Functions. 

B.1, B.2, and B.3

Condition B applies to a situation where two instrumentation channels for 

multiple protection functions of EFW Initiation, Main Steam Line Isolation, 

or MFW Isolation instrumentation are inoperable. For example, 

Condition B applies if channel A and B of the EFW Initiation Function are 

inoperable. 

Condition B does not apply if one channel of different Functions is 

inoperable in the same protection channel. That condition is addressed 

by Condition A. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-15 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

With two EFW Initiation, Main Steam Line Isolation, or MFW Isolation 

protection channels inoperable, one channel must be placed in bypass 

(Required Action B.1). Bypassing one of the remaining OPERABLE 

channels is not possible due to system interlocks. Therefore, the second 

channel must be tripped (Required Action B.2) to prevent a single failure 

from causing loss of the EFIC Function. The Completion Times of 1 hour 

are adequate to perform the Required Actions. 

One of the channels must be returned to OPERABLE status (Required 

Action B.3) to minimize the time the system is permitted to operate in a 

configuration that is not capable of withstanding a single failure and still 

initiate EFW, Main Steam Line Isolation, and MFW Isolation. Restoring 

one channel changes system status to that of Condition A. A single 

inoperable EFIC channel affects at most one train of EFW, Main Steam 

Line Isolation, and MFW Isolation. Therefore the 72 hour Completion 

Time was selected to be consistent with the allowed out of service time 

for the EFW, Main Steam Line Isolation, and MFW Isolation Functions. 

C.1

The function of the EFW Vector Valve Control is to meet the single-failure 

criterion while being able to provide EFW on demand and isolate an SG 

when required. These conflicting requirements result in the necessity for 

two valves in series, in parallel with two valves in series, and a four 

channel valve command system. Refer to LCO 3.3.14, "Emergency 

Feedwater Initiation and Control (EFIC) Emergency Feedwater (EFW) - 

Vector Valve Logic." 

With one EFW Vector Valve Control channel inoperable, the system 

cannot meet the single-failure criterion and still meet the dual functional 

criteria described earlier. This condition is analogous to having one EFW 

train inoperable. Therefore, when one vector valve control channel is 

inoperable, the channel must be restored to OPERABLE status (Required 

Action C.1) within 72 hours, which is consistent with the Completion Time 

associated with the loss of one train of EFW. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-16 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1, D.2.1, D.2.2, E.1, and F.1

If the Required Actions cannot be met within the required Completion 

Time or if more than two channels are inoperable in one or more 

Functions, the unit must be placed in a MODE or condition in which the 

requirement does not apply. This is done by placing the unit in a 

nonapplicable MODE for the particular Function. The nonapplicable 

MODE is to open the CRD trip breakers for Function 1.a, MODE 4 for 

Function 1.b, less than 10% RTP for Function 1.d, and SG pressure less 

than 750 psig for all other Functions. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems. 

SURVEILLANCE A Note indicates that the SRs for each EFIC instrumentation Function 

REQUIREMENTS are identified in the SRs column of Table 3.3.11-1. All Functions are 

subject to CHANNEL CHECK, CHANNEL FUNCTIONAL TEST, and 

CHANNEL CALIBRATION. The SG - Low Level Function is the only 

Function that was modeled in transient analysis, and thus is the only EFW 

Initiation Function subjected to response time testing. Response time 

testing is also required for Main Steam Line and MFW Isolation. 

Individual EFIC subgroup relays must also be tested, one at a time, to 

verify the individual EFIC components will actuate when required. Some 

components cannot be tested at power since their actuation might lead to 

unit trip or equipment damage. These are specifically identified and must 

be tested when shut down. The various SRs account for individual 

functional differences and for test frequencies applicable specifically to 

the Functions listed in Table 3.3.11-1. The operational bypasses 

associated with each EFIC instrumentation channel are also subject to 

these SRs to ensure OPERABILITY of the EFIC instrumentation channel. 

SR 3.3.11.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-17 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. CHANNEL 

CHECK will detect gross channel failure; therefore, it is key in verifying 

that the instrumentation continues to operate properly between each 

CHANNEL FUNCTIONAL TEST and CHANNEL CALIBRATION. 

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the transmitter or the signal processing equipment has 

drifted outside its limit. If the channels are within the criteria, it is an 

indication that the channels are OPERABLE. If the channels are normally 

off scale during times when surveillance is required, the CHANNEL 

CHECK will only verify that they are off scale in the same direction. Off 

scale low current loop channels are verified to be reading at the bottom of 

the range and not failed downscale. 

The Frequency, about once every shift, is based on operating experience 

that demonstrates channel failure is rare. Since the probability of two 

random failures in redundant channels in any 12 hour period is extremely 

low, the CHANNEL CHECK minimizes the chance of loss of protective 

function due to failure of redundant channels. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channel operability 

during normal operational use of the displays associated with the LCO 

required channels. 

SR 3.3.11.2

A CHANNEL FUNCTIONAL TEST verifies the function of the required 

trip, interlock, and alarm functions of the channel. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. 

This is acceptable because all of the other required contacts of the relay 

are verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. Setpoints for both trip and bypass removal functions must be 

found within the Allowable Value specified in the LCO. (Note that the 

Allowable Values for the bypass removal functions are specified in the 

Applicable MODES or Other Specified Condition column of 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-18 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Table 3.3.11-1 as limits on applicability for the trip Functions.) Any 

setpoint adjustment shall be consistent with the assumptions of the 

current unit specific setpoint analysis. 

The Frequency of 31 days is based on unit operating experience with 

regard to channel OPERABILITY and drift, which demonstrates that 

failure of more than one channel of a given function in any 31 day interval 

is a rare event. 

SR 3.3.11.3

CHANNEL CALIBRATION is a complete check of the instrument channel 

including the sensor. The test verifies the channel responds to a 

measured parameter within the necessary range and accuracy. 

CHANNEL CALIBRATION leaves the channels adjusted to account for 

instrument drift to ensure that the instrument channel remains operational 

between successive tests. CHANNEL CALIBRATION shall find that 

measurement errors and bistable setpoint errors are within the 

assumptions of the unit specific setpoint analysis. CHANNEL 

CALIBRATIONS must be performed consistent with the assumptions of 

the unit specific setpoint analysis. 

The Frequency is based on the assumption of an [18] month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.11.4

This SR verifies individual channel actuation response times are less than 

or equal to the maximum value assumed in the accident analysis. 

Response time testing acceptance criteria are included in "Unit Specific 

Response Time Acceptance Criteria" (Ref. 6). 

Individual component response times are not modeled in the analysis. 

The analysis models the overall or total elapsed time, from the point at 

which the parameter exceeds the actuation setpoint value at the sensor, 

to the point at which the end device is actuated. 
EFIC Instrumentation 

B 3.3.11 

BWOG STS B 3.3.11-19 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

EFIC RESPONSE TIME tests are conducted on an [18] month 

STAGGERED TEST BASIS. Testing of the final actuation devices, which 

make up the bulk of the EFIC RESPONSE TIME, is included in the testing 

of each channel. Therefore, staggered testing results in response time 

verification of these devices every [18] months. The [18] month test 

Frequency is based on unit operating experience, which shows that 

random failures of instrumentation components causing serious response 

time degradation, but not channel failure, are infrequent occurrences. 

EFIC RESPONSE TIMES cannot be determined at power since 

equipment operation is required. 

REFERENCES 1. FSAR, Section [14.1]. 

 2. 10 CFR 50.49. 

 3. [Unit Name], [Unit Specific Setpoint Methodology]. 

 4. FSAR, Chapter [7]. 

 5. IEEE-279-1971, April 1972. 

 6. [Unit Specific Response Time Acceptance Criteria]. 
EFIC Manual Initiation 

B 3.3.12 

BWOG STS B 3.3.12-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.12 Emergency Feedwater Initiation and Control (EFIC) Manual Initiation 

BASES 

BACKGROUND The EFIC manual initiation capability provides the operator with the 

capability to actuate EFIC Functions from the control room in the absence 

of any other initiation condition. Manually actuated Functions include 

main feedwater (MFW) Isolation for once through steam generator 

(SG) A, MFW Isolation for SG B, Main Steam Line Isolation for SG A, 

Main Steam Line Isolation for SG B, and Emergency Feedwater (EFW) 

Actuation. These Functions are provided in the event the operator 

determines that an EFIC Function is needed and does not automatically 

actuate. These are backup Functions to those performed automatically 

by EFIC. 

The EFIC manual initiation circuitry satisfies the manual initiation and 

single-failure criterion requirements of IEEE-279-1971 (Ref. 1). 

APPLICABLE EFIC Functions credited in the safety analysis are automatic. 

SAFETY However, the manual initiation Functions are required by design 

ANALYSES as backups to the automatic trip Functions and allow operators to actuate 

EFW, Main Steam Line Isolation, or MFW Isolation whenever these 

Functions are needed. Furthermore, the manual initiation of EFW 

Actuation, Main Steam Line Isolation, and MFW Isolation may be 

specified in unit operating procedures. 

The EFIC manual initiation functions satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO All instrumentation performing an EFIC manual initiation Function shall be 

OPERABLE. Failure of any instrument renders the affected channel(s) 

inoperable and reduces the reliability of the affected Functions. 

Two manual initiation switches per actuation channel (A and B) of each 

Function (A and B MFW Isolation, A and B Main Steam Line Isolation, 

and EFW Actuation) are required to be OPERABLE whenever the SGs 

are being relied on to remove heat. Each Function (MFW Isolation, Main 

Steam Line Isolation, and EFW Initiation) has two actuation or "trip" 

channels, channels A and B. Within each channel A actuation logic there 

are two manual trip switches. When one manual switch is depressed, a 

half trip occurs. When both manual switches are depressed, a full trip of 

channel A actuation occurs for that particular Function. Similarly, 
EFIC Manual Initiation 

B 3.3.12 

BWOG STS B 3.3.12-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

channel B actuation logic for each Function has two manual trip switches. 

Both switches per actuation channel must be OPERABLE and must be 

depressed to get a full manual trip of that channel. The use of two 

manual trip switches for each channel of actuation logic allows for testing 

without actuating the end devices and also reduces the possibility of 

accidental manual actuation. 

APPLICABILITY The MFW and Main Steam Line Isolation manual initiation Functions shall 

be OPERABLE in MODES 1, 2, and 3 because SG inventory can be at a 

sufficiently high energy level to contribute significantly to the peak 

containment pressure during a secondary side break. In MODES 4, 5, 

and 6, the SG energy level is low and secondary side feedwater flow rate 

is low or nonexistent. 

The EFW manual initiation Function shall be OPERABLE in MODES 1, 2, 

and 3 because the SGs are relied on for Reactor Coolant System heat 

removal. In MODES 4, 5, and 6, heat removal requirements are reduced 

and can be provided by the Decay Heat Removal System. 

ACTIONS A Note has been added to the ACTIONS indicating that separate 

Condition entry is allowed for each EFIC manual initiation Function. 

A.1

With one or both manual initiation switches of one or more EFIC 

Function(s) inoperable in one channel, the channel for the associated 

EFIC Function(s) must be placed in the tripped condition within 72 hours. 

With the channel in the tripped condition, the single-failure criterion is met 

and the operator can still initiate one actuation channel given a single 

failure in the other channel. Failure to perform Required Action A.1 could 

allow a single failure of another switch to prevent manual actuation of at 

least one of two trip channels. The Completion Time allotted to trip the 

channel allows the operator to take all the appropriate actions for the 

failed channel and still ensure that the risk involved in operating with the 

failed channel is acceptable. 
EFIC Manual Initiation 

B 3.3.12 

BWOG STS B 3.3.12-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

With one or both manual initiation switches of one or more EFIC 

Function(s) inoperable in both actuation channels, one actuation channel 

for each Function must be restored to OPERABLE status within 1 hour. 

With the channel restored, the second channel must be placed in the 

tripped condition within 72 hours (Required Action A.1). With the channel 

in the tripped condition, the single-failure criterion is met and the operator 

can still initiate one actuation channel given a single failure in the other 

channel. The Completion Time allotted to restore the channel allows the 

operator to take all the appropriate actions for the failed channel and still 

ensures that the risk involved in operating with the failed channel is 

acceptable. 

C.1 and C.2

If Required Action A.1 or Required Action B.1 cannot be met within the 

required Completion Time, the unit must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the unit must be brought 

to at least MODE 3 within 6 hours and to MODE 4 within 12 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required MODES from full power conditions in an 

orderly manner and without challenging unit systems. 

SURVEILLANCE SR 3.3.12.1

REQUIREMENTS 

This SR requires the performance of a CHANNEL FUNCTIONAL TEST to 

ensure that the channels can perform their intended functions. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. For MFW and Main Steam Line Isolation, the test 

need not include actuation of the end device. This is due to the risk of a 

unit transient caused by the closure of valves associated with MFW and 

Main Steam Line Isolation or actuating EFW during testing at power. The 

Frequency of 31 days is based on operating experience that 

demonstrates the rarity of more than one channel failing within the same 

31 day interval. 

REFERENCES 1. IEEE-279-1971, April 1972. 
EFIC Logic 

B 3.3.13 

BWOG STS B 3.3.13-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.13 Emergency Feedwater Initiation and Control (EFIC) Logic 

BASES 

BACKGROUND Main Steam Line and Main Feedwater (MFW) Isolation

The four emergency feedwater initiation and control (EFIC) channels 

sensing a steam generator (SG) low outlet pressure condition input their 

initiate commands to the trip logic modules. Figure [ ] , FSAR, 

Chapter [7] (Ref. 1), illustrates the Main Steam Line and MFW Isolation 

Logics. The trip logic modules are physically located in the "A" and 

"B" EFIC channel cabinets. Channel "A" actuation logic initiates when 

instrumentation channel "A" or "B" initiates and channel "C" or "D" 

initiates, which in simplified logic is: 

"A" actuation = (A and C) or (A and D) or (B and C) or (B and D) 

Channel "B" actuation logic initiates when instrumentation channel "A" 

or "C" initiates and channel "B" or "D" initiates, which in simplified logic is: 

"B" actuation = (A and B) or (A and D) or (C and B) or (C and D) 

Each of the four Functions (SG A Main Feedwater Isolation, SG B Main 

Feedwater Isolation, SG A Main Steam Line Isolation, and SG B Main 

Steam Line Isolation) has a channel "A" and a channel "B" of automatic 

actuation logic. 

Both channels "A" and "B" of the SG A Main Feedwater Isolation 

automatic actuation logic send closure signals to the SG A main 

feedwater pump suction valve, the three SG A block valves, and the MFW 

pump discharge cross connect valve. In addition, the instrumentation 

trips MFW pump "A." 

Both channels "A" and "B" of the SG A Main Steam Line Isolation 

automatic actuation logic send closure signals to both of the SG A Main 

Steam Isolation valves. 

SG B MFW and Main Steam Line Isolation automatic actuation logics 

respond similarly for the SG B valves and MFW pump "B." 
EFIC Logic 

B 3.3.13 

BWOG STS B 3.3.13-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Emergency Feedwater (EFW) Actuation

The four EFIC instrumentation channels for each of the parameters being 

sensed input their initiate commands to the trip logic modules. Figure [ ], 

FSAR Chapter [7] (Ref. 1), illustrates the EFW initiation logic. These trip 

logic modules are physically located in the "A" and "B" EFIC channel 

cabinets. 

EFW Actuation functions are the same logic combinations as MFW and 

Main Steam Line Isolation. EFW initiation also occurs on high pressure 

injection (HPI) initiation. Both trains of HPI initiation are input into each 

EFW initiate logic channel. 

EFIC automatically initiates the EFW System when any of the following 

conditions exist: 

a. All four reactor coolant pumps are tripped, 

b. Both MFW pumps are tripped and reactor power is > 20% RTP with 

the nuclear instrumentation Reactor Protection System not in 

shutdown bypass, 

c. Low level in either once through SG, 

d. Low pressure in either SG, or 

e. HPI Actuation on both A and B Engineered Safety Feature Actuation 

System channels. 

Vector Valve Enable Logic

The EFW module logic is responsible for sending open or close signals to 

the EFW control and isolation valves. Figure [ ] , FSAR, Chapter [7] 

(Ref. 1), illustrates the vector valve logic. The vector module logic 

outputs are in a neutral state (neither commanding open nor close) until a 

signal is received from the Vector Valve Enable Logic. The Vector Valve 

Enable Logic monitors the channel A and B EFW Actuation logics. When 

an EFW Actuation occurs, the vector enable logic enables the vector logic 

to generate open or close signals to the EFW valves depending on the 

relative values of SG pressures. 
EFIC Logic 

B 3.3.13 

BWOG STS B 3.3.13-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE Automatic isolation of MFW and main steam line was assumed in 

SAFETY the safety analyses to mitigate the consequences of main steam line 

ANALYSES or MFW line ruptures. The FSAR analyses for steam line breaks (SLBs) 

was generated before the development and installation of the safety 

grade EFIC System, which currently performs these automatic safety 

functions. The FSAR analysis, for example, assumes main steam line 

isolation through turbine stop valve closure based on an integrated 

control system signal. This same function is provided by the EFIC 

System by a safety grade signal that closes the Main Steam Line Isolation 

valves. The analyses are bounding, and the use of the EFIC System is 

consistent with the licensing position to take credit for safety grade 

systems to mitigate the consequences of an accident. 

Similarly, vector valve control was not credited in the FSAR SLB analysis. 

Operator action was credited with isolating EFW to the affected SG within 

the first 60 seconds. This function would be automatically performed by 

EFIC. Therefore, the FSAR analysis remains conservative relative to the 

inclusion of the vector valve logic. 

Automatic initiation of EFW is credited in the loss of main feedwater 

analysis. The automatic actuation was based on the SG low level 

function of EFIC, although EFIC would initiate EFW based on the loss of 

both MFW pumps as well. 

The EFIC logic satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Two channels each of MFW and Main Steam Line Isolation, Vector Valve 

Enable, and EFW Actuation logics shall be OPERABLE. There are only 

two channels of automatic actuation logic per Function. Therefore, 

violation of this LCO could result in a complete loss of the automatic 

Function assuming a single failure of the other channel. 

APPLICABILITY The MFW and Main Steam Line Isolation automatic actuation logics shall 

be OPERABLE in MODES 1, 2, and 3 because SG inventory can be at a 

high energy level and can contribute significantly to the peak containment 

pressure during a secondary side line break. In MODES 4, 5, and 6, the 

energy level is low and the secondary side feedwater flow rate is low or 

nonexistent. 
EFIC Logic 

B 3.3.13 

BWOG STS B 3.3.13-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

The EFW automatic actuation and vector enable logics shall be 

OPERABLE in MODES 1, 2, and 3 because the SGs are being used for 

heat removal from the primary system. During these MODES, the core 

power and heat removal requirements are the greatest, and if the normal 

source of feedwater is lost, EFW must be initiated rapidly to minimize the 

overheating of the primary system. 

For portions of MODE 4 and for all of MODES 5 and 6, the primary 

system temperatures are too low to allow the SGs to effectively remove 

energy. 

ACTIONS If a channel is found inoperable, then all affected logic Functions provided 

by that channel must be declared inoperable and the LCO Condition 

entered for the particular protection function affected. 

For this LCO, a Note has been added to the ACTIONS indicating that 

separate Condition entry is allowed for each EFIC logic Function. 

A.1

Condition A applies when one or more EFIC logic Functions in a single 

channel are inoperable (i.e., channel A could be inoperable for all four 

EFIC logic Functions and Condition A would still be applicable) with all 

Functions in the other channel OPERABLE. This Condition is equivalent 

to failure of one EFW, Main Steam Line Isolation, and MFW Isolation 

train. 

With one automatic actuation logic channel of one or more EFIC 

Functions inoperable, the associated EFIC train must be restored to 

OPERABLE status. Since there are only two automatic actuation logic 

channels per EFIC Function, the condition of one channel inoperable is 

analogous to having one train of a two train Engineered Safety Feature 

(ESF) System inoperable. The system safety function can be 

accomplished; however, a single failure cannot be taken. Therefore, the 

failed channel(s) must be restored to OPERABLE status to re-establish 

the system's single-failure tolerance. 

Condition A can be thought of as equivalent to failure of a single train of a 

two train safety system (e.g., the safety function can be accomplished, 

but a single failure cannot be taken). Thus, the Completion Time of 

72 hours has been chosen to be consistent with Completion Times for 

restoring one inoperable ESF System train. 
EFIC Logic 

B 3.3.13 

BWOG STS B 3.3.13-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The EFIC System has not been analyzed for failure of one train of one 

Function and the opposite train of the same Function. In this condition, 

the potential for system interactions that disable heat removal capability 

on EFW has not been evaluated. Consequently, any combination of 

failures in both channels A and B is not covered by Condition A and must 

be addressed by entry into LCO 3.0.3. 

B.1 and B.2

If Required Action A.1 cannot be met within the required Completion 

Time, the unit must be brought to a MODE in which the LCO does not 

apply. To achieve this status, the unit must be brought to at least 

MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required MODES from full power conditions in an orderly 

manner and without challenging unit systems. 

SURVEILLANCE SR 3.3.13.1

REQUIREMENTS 

This SR requires the performance of a CHANNEL FUNCTIONAL TEST to 

ensure that the channels can perform their intended functions. This test 

verifies MFW and Main Steam Line Isolation and EFW initiation automatic 

actuation logics are functional. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. This test simulates 

the required inputs to the logic circuit and verifies successful operation of 

the automatic actuation logic. The test need not include actuation of the 

end device. This is due to the risk of a unit transient caused by the 

closure of valves associated with MFW and Main Steam Line Isolation or 

actuation of EFW during testing at power. The Frequency of 31 days is 

based on operating experience, which has demonstrated the rarity of 

more than one channel failing within the same 31 day interval. 

REFERENCES 1. FSAR, Chapter [7]. 
EFIC - EFW - Vector Valve Logic 

B 3.3.14 

BWOG STS B 3.3.14-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.14 Emergency Feedwater Initiation and Control (EFIC) - Emergency Feedwater 

 (EFW) - Vector Valve Logic 

BASES 

BACKGROUND The function of the EFW vector valve logic is to determine whether EFW 

should not be fed to one or the other steam generator. This is to preclude 

the continued addition of EFW to a depressurized once through steam 

generator (SG) and, thus, minimize the overcooling effects of a steam 

leak. Each vector logic may isolate EFW to one SG or the other, never 

both. 

There are four sets of vector valve logic; one in each channel of EFIC. 

Each set of vector valve logic receives SG pressure information from 

bistables located in the input logic of the same EFIC channel. The 

pressure information received is: 

a. SG "A" pressure less than 600 psig, 

b. SG "B" pressure less than 600 psig, 

c. SG "A" pressure 125 psid greater than SG "B" pressure, and 

d. SG "B" pressure 125 psid greater than SG "A" pressure. 

Each vector valve logic also receives a vector/control enable signal from 

both EFIC channel A and channel B when EFW is actuated. 

The vector valve logic develops signals for open and close control of 

SG "A" and "B" EFW valves. 

The vector valve logic outputs are in a neutral state with the valves fully 

open until enabled by the control/vector enable from the channel A or B 

trip logics. When enabled, the vector valve logic can issue close 

commands to the EFW control valves and open or close commands to 

the EFW isolation valves per the selected channel assignments. 

The valve open/close commands are determined by the relative values of 

steam generator pressures as follows: 
EFIC - EFW - Vector Valve Logic 

B 3.3.14 

BWOG STS B 3.3.14-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

 

SG VALVES 

PRESSURE STATUS "A" "B" 

If SG "A" & SG "B" > 600 psig Open Open 

If SG "A" > 600 psig & SG "B" 

< 600 psig 

Open Close 

If SG "A" < 600 psig & SG "B" 

> 600 psig 

Close Open 

If SG "A" & SG "B" < 600 psig 

 

 AND

SG "A" & SG "B" within 125 psid 

Open Open 

SG "A" 125 psid > SG "B" Open Close 

SG "A" 125 psid > SG "A" Close Open 

APPLICABLE Automatic isolation of main feedwater (MFW) and main steam line 

SAFETY was assumed in the safety analyses to mitigate the consequences 

ANALYSES of main steam line or MFW line ruptures. The FSAR analysis for steam 

line breaks (SLBs) was generated before the development and 

installation of the safety grade EFIC System, which currently performs 

these automatic safety functions. The FSAR analysis, for example, 

assumes main steam line isolation through turbine stop valve closure 

based on an integrated control system signal. This same function is 

provided by the EFIC System by a safety grade signal that closes the 

main steam line isolation valves. The analyses are bounding, and the 

use of the EFIC System is consistent with the licensing position to take 

credit for safety grade systems to mitigate the consequences of an 

accident. 

Similarly, vector logic valve control was not credited in the FSAR SLB 

analysis. Operator action was credited with isolating EFW to the affected 

SG within the first 60 seconds. This function would be automatically 

performed by EFIC. Therefore, the FSAR analysis remains conservative 

relative to the inclusion of the vector valve logic. 
EFIC - EFW - Vector Valve Logic 

B 3.3.14 

BWOG STS B 3.3.14-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

EFW vector valve logic response time is included in the required 

response time for each EFW actuation initiation function instrumentation 

and is not specified separately. 

The EFIC - EFW - vector valve logic satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Four channels of the EFIC - EFW - vector valve logic module are required 

to be OPERABLE. The necessity for four channels is discussed in the 

BASES for ACTIONS. The 600 psig and 125 psid setpoints were chosen 

as discussed in Specification B 3.3.11, "EFIC System Instrumentation." 

The feed only good generator verification study assumed a differential 

pressure vector value of 150 psid. The 125 psid setpoint conservatively 

assumes a 25 psi margin for instrument error. Failure to meet this LCO 

results in not being able to meet the single-failure criterion. 

APPLICABILITY EFIC - EFW - vector valve logic is required in MODES 1, 2, and 3 

because the SGs are relied on in these MODES for required RCS heat 

removal. In MODES 4, 5, and 6, heat removal requirements are reduced 

and may be provided by the Decay Heat Removal System. Therefore, 

vector valve logic is not required to be OPERABLE in these MODES. 

ACTIONS A.1

The function of the EFIC-EFW control/isolation valves and the vector 

valve logic is to meet the single-failure criterion while maintaining the 

capability to: 

a. Provide EFW on demand and 

b. Isolate an SG when required. 

These conflicting requirements result in the necessity for two valves in 

series, in parallel with two valves in series, and a four channel valve 

command system. 

With one channel inoperable, the system cannot meet the single-failure 

criterion and still meet the dual functional criteria previously described. 

Therefore, when one vector valve logic channel is inoperable, the channel 

must be restored to OPERABLE status within 72 hours. This is 

analogous to having one EFW train inoperable; wherein a 72 hour 

Completion Time is provided by the Required Actions of LCO 3.7.4, "EFW 

System." As such, the Completion Time of 72 hours is based on 

engineering judgement. 
EFIC - EFW - Vector Valve Logic 

B 3.3.14 

BWOG STS B 3.3.14-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

If Required Action A.1 cannot be met within the required Completion 

Time, the unit must be brought to a MODE in which the LCO does not 

apply. To achieve this status, the unit must be brought to at least 

MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 

SURVEILLANCE SR 3.3.14.1

REQUIREMENTS 

SR 3.3.14.1 is the performance of a CHANNEL FUNCTIONAL TEST 

every 31 days. This test demonstrates that the EFIC - EFW - vector valve 

logic performs its function as desired. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The Frequency is 

based on operating experience that demonstrates the rarity of more than 

one channel failing within the same 31 day interval. 

REFERENCES None. 
RB Purge Isolation - High Radiation 

B 3.3.15 

BWOG STS B 3.3.15-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.15 Reactor Building (RB) Purge Isolation - High Radiation 

BASES 

BACKGROUND The RB Purge Isolation - High Radiation Function closes the RB purge 

valves. This action isolates the RB atmosphere from the environment to 

minimize releases of radioactivity in the event an accident occurs. The 

high radiation signal indicates a failure of a barrier to the fuel radioactivity, 

and most likely a loss of coolant accident. The purge valves must begin 

to shut rapidly to ensure they reach a completely closed position prior to 

excessive pressures in the RB, against which the valves may not close. 

The radiation monitoring system measures the activity in a representative 

sample of air drawn in succession through a particulate sampler, an 

iodine sampler, and a gas sampler. The LCO addresses only the gas 

sampler portion of this system. The sensitive volume of the gas sampler 

is shielded with lead and monitored by a Geiger-Mueller detector. The air 

sample is taken from the center of the purge exhaust duct through an 

isokinetic nozzle installed in the duct at a point selected for reduced 

turbulence. 

If a gaseous activity flow rate of approximately 1E-2 μCi/sec (Kr-85) is 

exceeded, the monitor will alarm and initiate closure of the purge valves. 

This activity flow rate is selected on the basis of 50,000 scfm flow rate in 

the purge exhaust and on the basis of a gas monitor setpoint equal to two 

times the expected background at the location of the monitor, which will 

provide fast detection of any release. The alarm setpoints for the 

particulate and iodine channels indicate that an alarm is obtained after the 

monitor samples a maximum permissible concentration level for 8 hours. 

Therefore, a maximum of 1.3 mCi of Cs-137 or 67 μCi of DOSE 

EQUIVALENT I-131 will be released to the atmosphere during this period. 

The closure of the purge valves ensures the RB remains as a barrier to 

fission product release. There is no bypass for this function. The closure 

of the purge valves provides an RB isolation assumed in the accident 

analysis. 

Trip Setpoints and Allowable Values

The trip setpoints are the nominal values at which the bistables are set. 

Any bistable is considered to be properly adjusted when the "as left" 

value is within the band for CHANNEL CALIBRATION accuracy (i.e., 

± [rack calibration + comparator setting accuracy]). 
RB Purge Isolation - High Radiation 

B 3.3.15 

BWOG STS B 3.3.15-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The trip setpoints used in the bistables are based on the analytical limits 

derived from the FSAR, Section [14.1] (Ref. 1). The selection of these 

trip setpoints is such that adequate protection is provided when all sensor 

and processing time delays are taken into account to allow for calibration 

tolerances, instrumentation uncertainties, instrument drift, and severe 

environment errors for those channels that must function in harsh 

environments as defined by 10 CFR 50.49 (Ref. 2). Allowable Values 

specified in LCO 3.3.15 are conservatively adjusted with respect to the 

analytical limits. A detailed description of the methodology used to 

calculate the trip setpoints, including their explicit uncertainties, is 

provided in the "Unit Specific Setpoint Methodology" (Ref. 3). The actual 

nominal trip setpoint entered into the bistable is normally still more 

conservative than that specified by the Allowable Value to account for 

changes in random measurement errors detectable by a CHANNEL 

FUNCTIONAL TEST. One example of such a change in measurement 

error is drift during the surveillance interval. A channel is inoperable if its 

actual trip setpoint is not within its required Allowable Value. 

The Allowable Value in SR 3.3.15.3 is based on the methodology 

described in Reference 3, which incorporates all of the known 

uncertainties applicable for each channel. The magnitudes of these 

uncertainties are factored into the determination of each trip setpoint. All 

field sensors and signal processing equipment for these channels are 

assumed to operate within the allowances of these uncertainty 

magnitudes. 

These Allowable Values are established to prevent violation of the 

accident acceptance criteria during anticipated operational occurrences 

(AOOs). 

Setpoints in accordance with the Allowable Value will ensure that the 

consequences of Design Basis Accidents (DBAs) will be acceptable, 

providing the unit is operated from within the LCOs at the onset of the 

AOO or DBA and the equipment functions as designed. 

APPLICABLE The analysis for the maximum hypothetical accident assumes the 

SAFETY RB remains intact, with penetrations that are unnecessary for core 

ANALYSES cooling isolated early in the event, within approximately [60] seconds. 

The closure of the purge valves ensures the RB integrity assumed in the 

analysis is maintained. The isolation of the RB has not been analyzed 

mechanistically in the dose calculations, although its rapid isolation is 

assumed. 
RB Purge Isolation - High Radiation 

B 3.3.15 

BWOG STS B 3.3.15-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The RB Purge Isolation System satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO For sampling systems, OPERABILITY requires correct valve lineups, 

sample pump operation, filter motor operation, and detector 

OPERABILITY, when these sampling features are necessary to initiate a 

trip as assumed by the safety analysis or setpoint analysis. 

Only the Allowable Values are specified for each RB Purge Isolation trip 

Function in the LCO. Nominal trip setpoints are specified in the unit 

specific setpoint calculations. The nominal setpoints are selected to 

ensure the setpoint measured by CHANNEL FUNCTIONAL TESTS does 

not exceed the Allowable Value if the bistable is performing as required. 

Operation with a trip setpoint less conservative than the nominal trip 

setpoint, but within its Allowable Value, is acceptable provided that 

operation and testing are consistent with the assumptions of the unit 

specific setpoint calculations. Each Allowable Value specified is more 

conservative than the analytical limit assumed in the safety analysis to 

account for instrument uncertainties associated with the trip function. 

These uncertainties are defined in the "Unit Specific Setpoint 

Methodology" (Ref. 3) and the Offsite Dose Calculation Manual. 

[ For this unit, the basis for the setpoint Allowable Value is as follows: ] 

APPLICABILITY The RB purge isolation - high radiation shall be OPERABLE in MODES 1, 

2, 3, and 4. Outside of these MODES, the purge isolation must be 

OPERABLE whenever movement of [recently] irradiated fuel assemblies 

within the RB is taking place. These conditions are those under which the 

potential for fuel damage, and thus radiation release, is the greatest. 

While in MODES 5 and 6, without fuel handling [involving handling of 

recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor 

core within the previous [x] days)] in progress, the Purge Valve Isolation 

System does not need to be OPERABLE because the potential for a 

radioactive release is minimized and operator action is sufficient to 

ensure post accident offsite doses are maintained within the limits of 

10 CFR 100. The need to use the purge valves in MODES 5 and 6 is in 

preparation for entry. This capability is required to minimize doses for 

personnel entering the building and is independent of the automatic 

isolation capability. 
RB Purge Isolation - High Radiation 

B 3.3.15 

BWOG STS B 3.3.15-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With one channel inoperable in MODE 1, 2, 3, or 4, the RB purge valves 

must be placed and maintained in the closed position. This action 

accomplishes the safety function of the RB Purge Isolation - High 

Radiation Function. The 1 hour Completion Time is reasonable 

considering the time required to isolate the penetration and the relative 

importance of maintaining containment OPERABILITY during MODES 1, 

2, 3, and 4. 

B.1 and B.2

If Required Action A.1 cannot be met within the required Completion 

Time, the unit must be brought to a MODE in which the LCO does not 

apply. To achieve this status, the unit must be brought to at least 

MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 

C.1, C.2.1, and C.2.2

Condition C applies to failure of the high radiation purge function during 

movement of [recently] irradiated fuel assemblies within the RB. 

With one channel inoperable during movement of [recently] irradiated fuel 

assemblies within the RB, the RB purge valves must be closed, or 

movement of [recently] irradiated fuel assemblies within the RB must be 

suspended. Required Action C.1 accomplishes the function of the high 

radiation channel. Required Action C.2.1 and Required Action C.2.2 

place the unit in a configuration in which purge isolation on high radiation 

is not required. The Completion Time of "Immediately" is consistent with 

the urgency associated with the loss of RB isolation capability under 

conditions in which the fuel handling accidents [involving handling 

recently irradiated fuel] are possible and the high radiation function 

provides the only automatic actions to mitigate radiation release. 
RB Purge Isolation - High Radiation 

B 3.3.15 

BWOG STS B 3.3.15-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.3.15.1

REQUIREMENTS 

SR 3.3.15.1 is the performance of the CHANNEL CHECK for the RB 

purge isolation - high radiation instrumentation once every 12 hours to 

ensure that a gross failure of instrumentation has not occurred. A 

CHANNEL CHECK is normally a comparison of the parameter indicated 

on one channel to a similar parameter on other channels. It is based on 

the assumption that instrument channels monitoring the same parameter 

should read approximately the same value. Significant deviations 

between two instrument channels could be an indication of excessive 

instrument drift in one of the channels or of something even more serious. 

Performance of the CHANNEL CHECK helps to ensure that the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. The high radiation instrumentation should be compared 

to similar unit instruments located throughout the unit. If the radiation 

monitor uses keep alive sources or check sources OPERABLE from the 

control room, the CHANNEL CHECK should also note the detector's 

response to these sources. 

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the transmitter or the signal processing equipment has 

drifted outside its limit. If the channels are within the criteria, it is an 

indication that the channels are OPERABLE. The Frequency, about once 

every shift, is based on operating experience that demonstrates channel 

failure is rare. [At this unit, the following administrative controls and 

design features (e.g., downscale alarms) immediately alert operators to 

loss of function.] 

SR 3.3.15.2

This SR requires the performance of a CHANNEL FUNCTIONAL TEST 

once every 92 days to ensure that the channels can perform their 

intended functions. This test verifies the capability of the instrumentation 

to provide the RB isolation. A successful test of the required contact(s) of 

a channel relay may be performed by the verification of the change of 

state of a single contact of the relay. This clarifies what is an acceptable 

CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because 

all of the other required contacts of the relay are verified by other 
RB Purge Isolation - High Radiation 

B 3.3.15 

BWOG STS B 3.3.15-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. Any setpoint 

adjustment shall be consistent with the assumptions of the current unit 

specific setpoint analysis. 

In MODES 1, 2, 3, and 4, the test does not include the actuation of the 

purge valves, as these valves are normally closed. 

The justification of a 92 day Frequency, in view of the fact that there is 

only one channel, is Draft NUREG-1366 (Ref. 4). 

SR 3.3.15.3

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. The test verifies that the channel responds to a measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations to ensure that the channel remains 

operational between successive tests. CHANNEL CALIBRATIONS must 

be performed consistent with the unit specific setpoint analysis. 

The CHANNEL CALIBRATION is a complete check of the instrumentation 

and detector. In MODES 1, 2, 3, and 4, the CHANNEL CALIBRATION 

does not include the actuation of the purge valves, since they are 

normally closed. 

The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a unit outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. 

REFERENCES 1. FSAR, Section [14.1]. 

 2. 10 CFR 50.49. 

 3. [Unit Specific Setpoint Methodology]. 

 4. Draft NUREG-1366. 
Control Room Isolation - High Radiation 

B 3.3.16 

BWOG STS B 3.3.16-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.16 Control Room Isolation - High Radiation 

BASES 

BACKGROUND The principal function of the Control Room Isolation - High Radiation is to 

provide an enclosed environment from which the unit can be operated 

following an uncontrolled release of radioactivity. The high radiation 

isolation function provides assurance that under the required conditions, 

an isolation signal will be given. The noble gas monitors located in the 

station vent stack provide isolation and shutdown of the normal Control 

Room Emergency Ventilation System (CREVS). 

The control room isolation signal is provided by a single channel 

containing an iodine monitor with a scintillation detector and a gaseous 

monitor with a Geiger-Mueller detector. The iodine channel includes a 

particulate prefilter with the charcoal cartridge. If a radioactivity 

concentration above normal background level is detected or if sampling 

capability is lost, the monitor will initiate a shutdown of the normal duty 

supply fans and will place the ventilation dampers in their recirculation 

mode. 

Trip Setpoints and Allowable Values

The trip setpoints are the nominal value at which the bistables are set. 

Any bistable is considered to be properly adjusted when the "as left" 

value is within the band for CHANNEL CALIBRATION accuracy (i.e., ± 

[rack calibration + comparator setting accuracy]). 

The trip setpoints used in the bistables are based on the analytical limits 

derived from the FSAR, Section [14.1] (Ref. 1). The selection of these 

trip setpoints indicates that adequate protection is provided when all 

sensor and processing time delays are taken into account. To allow for 

calibration tolerances, instrumentation uncertainties, and instrument drift, 

Allowable Values specified in LCO 3.3.15 are conservatively adjusted 

with respect to the analytical limits. A detailed description of the 

methodology used to calculate the trip setpoints, including their explicit 

uncertainties, is provided in the "Unit Specific Setpoint Methodology" 

(Ref. 2). The actual nominal trip setpoint entered into the bistable is more 

conservative than that specified by the Allowable Value to account for 

changes in random measurement errors that are detectable by a 

CHANNEL FUNCTIONAL TEST. One example of a change in 

measurement error is drift during the surveillance interval. A channel is 

inoperable if its actual trip setpoint is not within its required Allowable 

Value. 
Control Room Isolation - High Radiation 

B 3.3.16 

BWOG STS B 3.3.16-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The CREVS is isolated when a reactor building high pressure Engineered 

SAFETY Safety Feature Actuation System signal or a high radiation signal 

ANALYSES is received. For the first 4 days following a loss of coolant accident, the 

CREVS is operated in the total recirculation mode. Four days after the 

start of the accident, the CREVS is started in the intake and recirculation 

mode and continues to operate in this mode for 30 days. This intake 

slightly pressurizes the control room. In both cases, the air flows through 

charcoal filters that are 95% efficient for elemental, particulate, and 

organic materials. The high radiation function only performs the initial 

isolation function to begin the recirculation mode of operation. 

The Control Room Isolation - High Radiation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Only the Allowable Value is specified for each Control Room Isolation - 

High Radiation trip Function in the LCO. Nominal trip setpoints are 

specified in the unit specific setpoint calculations. The nominal setpoints 

are selected to ensure the setpoint measured by the CHANNEL 

FUNCTIONAL TEST does not exceed the Allowable Value if the bistable 

is performing as required. Operation with a trip setpoint less conservative 

than the nominal trip setpoint, but within its Allowable Value, is acceptable 

provided that operation and testing is consistent with the assumptions of 

the unit specific setpoint calculations. Each Allowable Value specified is 

more conservative than the analytical limit assumed in the safety analysis 

to account for instrument uncertainties appropriate to the trip function. 

These uncertainties are defined in the "Unit Specific Setpoint 

Methodology" (Ref. 2). 

[ At this unit, the basis for the Allowable Value is as follows: ] 

APPLICABILITY The control room isolation capability on high radiation shall be 

OPERABLE whenever there is a chance for a significant accidental 

release of radioactivity. This includes MODES 1, 2, 3, 4, [5, and 6] and all 

MODES and conditions during movement of [recently]irradiated fuel 

[involving handling recently irradiated fuel (i.e., fuel that has occupied part 

of a critical reactor core within the previous [x] days)]. If a radioactive 

release were to occur during any of these conditions, the control room 

would have to remain habitable to ensure reactor shutdown and cooling 

can be controlled from the main control room. 
Control Room Isolation - High Radiation 

B 3.3.16 

BWOG STS B 3.3.16-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

Condition A applies to failure of the Control Room Isolation - High 

Radiation Function in MODE 1, 2, 3, or 4. 

With one channel of Control Room Isolation - High Radiation inoperable, 

the CREVS must be placed in a condition that does not require the 

isolation to occur. To ensure that the ventilation system has been placed 

in a state equivalent to that which occurs after the high radiation isolation 

has occurred, one OPERABLE train of the CREVS is placed in the 

emergency recirculation mode of operation. Reactor operation can 

continue indefinitely in this state. The 1 hour Completion Time is a 

sufficient amount of time in which to take the Required Action. 

The Required Action is modified by a Note, which requires the CREVS be 

placed in the toxic gas protection mode if automatic transfer to the toxic 

gas protection mode is inoperable, since the pressurization mode would 

increase vulnerability to toxic gas releases. 

B.1 and B.2

If the CREVS cannot be placed into recirculation mode while in MODE 1, 

2, 3, or 4, actions must be taken to minimize the chances of an accident 

that could lead to radiation releases. The unit must be placed in at least 

MODE 3 within 6 hours, with a subsequent cooldown to MODE 5 within 

36 hours. This places the reactor in a low energy state that allows 

greater time for operator action if habitation of the control room is 

precluded. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

C.1 and C.2

Required Action C.1 is the same as discussed earlier for Condition A, 

except for Completion Time. If the CREVS cannot be placed into 

recirculation mode during moving [recently] irradiated fuel assemblies, 

then Required Action C.2.1 and Required Action C.2.2 suspend actions 

that could lead to an accident that could release radioactivity resulting 

from a fuel handling accident. 
Control Room Isolation - High Radiation 

B 3.3.16 

BWOG STS B 3.3.16-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Action C.2 places the core in a safe and stable configuration in 

which it is less likely to experience an accident that could result in a 

significant release of radioactivity. The reactor must be maintained in 

these conditions until the automatic isolation capability is returned to 

operation or when manual action places one train of the CREVS into the 

emergency recirculation mode. The Completion Time of "Immediately" for 

Required Action C.2.1 and Required Action C.2.2 is consistent with the 

urgency of the situation and accounts for the high radiation function, 

which provides the only automatic Control Room Isolation Function 

capable of responding to radiation release due to a fuel handling accident 

[involving handling recently irradiated fuel]. The Completion Time does 

not preclude placing any fuel assembly into a safe position before ceasing 

any such movement. 

Note that in certain circumstances, such as fuel handling [involving 

handling recently irradiated fuel] in the fuel building during power 

operation, both Condition A and Condition C may apply in the event of 

channel failure. 

SURVEILLANCE SR 3.3.16.1

REQUIREMENTS 

SR 3.3.16.1 is the performance of a CHANNEL CHECK for the Control 

Room Isolation - High Radiation actuation instrumentation once every 

12 hours to ensure that a gross failure of instrumentation has not 

occurred. A CHANNEL CHECK is normally a comparison of the 

parameter indicated on one channel to a similar parameter on other 

channels. It is based on the assumption that instrument channels 

monitoring the same parameter should read approximately the same 

value. Significant deviations between the two instrument channels could 

be an indication of excessive instrument drift in one of the channels or of 

something even more serious. 

Performance of the CHANNEL CHECK helps ensure that the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. The high radiation instrumentation should be compared 

with similar unit instruments located throughout the unit. If the radiation 

monitor uses keep alive sources or check sources operated from the 

control room, the CHANNEL CHECK should also note the detector's 

response to these sources. 
Control Room Isolation - High Radiation 

B 3.3.16 

BWOG STS B 3.3.16-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the transmitter or the signal processing equipment has 

drifted outside its limit. If the channels are within the criteria, it is an 

indication that the channels are OPERABLE. The Frequency, about once 

every shift, is based on operating experience that demonstrates channel 

failure is rare. [At this unit, the following administrative controls and 

design features (e.g., downscale alarms) immediately alert operators to 

loss of function.] 

SR 3.3.16.2

A Note defines a channel as being OPERABLE for up to 3 hours while 

bypassed for surveillance testing. The Note allows channel bypass for 

testing without defining it as inoperable, although during this time period it 

cannot actuate a control room isolation. This is based on the average 

time required to perform channel surveillance. It is not acceptable to 

routinely remove channels from service for more than 3 hours to perform 

required surveillance testing. 

SR 3.3.16.2 is the performance of a CHANNEL FUNCTIONAL TEST 

once every 92 days to ensure that the channels can perform their 

intended functions. This test verifies the capability of the instrumentation 

to provide the automatic Control Room Isolation. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. 

This is acceptable because all of the other required contacts of the relay 

are verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. Any setpoint adjustment shall be consistent with the 

assumptions of the current unit specific setpoint analysis. 

The justification of a 92 day Frequency, in view of the fact that there is 

only one channel, is Draft NUREG-1366 (Ref. 3). 
Control Room Isolation - High Radiation 

B 3.3.16 

BWOG STS B 3.3.16-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.16.3

This SR requires the performance of a CHANNEL CALIBRATION with a 

setpoint Allowable Value of ≤ [25] mR/hr to ensure that the instrument 

channel remains operational with the correct setpoint. This test is a 

complete check of the instrument loop and the transmitter. 

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. The test verifies that the channel responds to a measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations to ensure that the channel remains 

operational between successive tests. CHANNEL CALIBRATIONS must 

be performed consistent with the unit specific setpoint analysis. 

The Frequency is based on the assumption of an [18] month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis and is consistent with the typical refueling cycle. 

REFERENCES 1. FSAR, Section [14.1]. 

 2. [Unit Specific Setpoint Methodology]. 

 3. Draft NUREG-1366. 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.17 Post Accident Monitoring (PAM) Instrumentation 

BASES 

BACKGROUND The primary purpose of the PAM instrumentation is to display unit 

variables that provide information required by the control room operators 

during accident situations. This information provides the necessary 

support for the operator to take the manual actions for which no automatic 

control is provided and that are required for safety systems to accomplish 

their safety functions for Design Basis Events. 

The OPERABILITY of the accident monitoring instrumentation ensures 

that there is sufficient information available on selected unit parameters to 

monitor and to assess unit status and behavior following an accident. 

The availability of accident monitoring instrumentation is important so that 

responses to corrective actions can be observed, and so that the need for 

and magnitude of further actions can be determined. These essential 

instruments are identified by [Unit Specific Documents] (Ref. 1) 

addressing the recommendations of Regulatory Guide 1.97 (Ref. 2) as 

required by Supplement 1 to NUREG-0737 (Ref. 3). 

The instrument channels required to be OPERABLE by this LCO equate 

to two classes of parameters identified during unit specific implementation 

of Regulatory Guide 1.97 as Type A and Category I variables. 

Type A variables are included in this LCO because they provide the 

primary information that permits the control room operator to take specific 

manually controlled actions that are required when no automatic control is 

provided and that are required for safety systems to accomplish their 

safety functions for Design Basis Accidents (DBAs). Because the list of 

Type A variables widely differs between units, Table 3.3.17-1 in the 

accompanying LCO contains only those examples of Type A variables 

that may also be Category I. 

Category I variables are the key variables deemed risk significant 

because they are needed to: 

• Determine whether systems important to safety are performing their 

intended functions, 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

• Provide information to the operators that will enable them to 

determine the potential for causing a gross breach of the barriers to 

radioactivity release, and 

• Provide information regarding the release of radioactive materials to 

allow for early indication of the need to initiate action necessary to 

protect the public and to estimate the magnitude of any impending 

threat. 

These key variables are identified by unit specific Regulatory Guide 1.97 

analysis (Ref. 1). This analysis identifies the unit specific Type A and 

Category I variables and provides justification for deviating from the NRC 

proposed list of Category I variables. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Table 3.3.17-1 provides a list of variables typical of those identified by a 

unit specific Regulatory Guide 1.97 analysis (Ref. 1). Table 3.3.17-1 in 

unit specific Technical Specifications shall list all Type A and Category I 

variables identified by the unit specific Regulatory Guide 1.97 analysis, as 

amended by the NRC's Safety Evaluation Report (SER). 

The specific instrument Functions listed in Table 3.3.17-1 are discussed 

in the LCO Section 

-------------------------------------------------------------------------------------------------- 

APPLICABLE The PAM instrumentation ensures the availability of information so 

SAFETY that the control room operating staff can: 

ANALYSES 

• Perform the diagnosis specified in the emergency operating 

procedures. These variables are restricted to preplanned actions for 

the primary success path of DBAs (e.g., loss of coolant accident 

(LOCA)), 

• Take the specified, preplanned, manually controlled actions, for 

which no automatic control is provided, which are required for safety 

systems to accomplish their safety functions, 

• Determine whether systems important to safety are performing their 

intended functions, 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

• Determine the potential for causing a gross breach of the barriers to 

radioactivity release, 

• Determine if a gross breach of a barrier has occurred, and 

• Initiate action necessary to protect the public and estimate the 

magnitude of any impending threat. 

The unit specific Regulatory Guide 1.97 analysis documents the process 

that identifies Type A and Category I non-Type A variables. 

PAM instrumentation that meets the definition of Type A in Regulatory 

Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category I, 

non-type A, instrumentation must be retained in Technical Specifications 

because it is intended to assist operators in minimizing the consequences 

of accidents. Therefore, Category I, non-Type A variables are important 

for reducing public risk. 

LCO LCO 3.3.17 requires two OPERABLE channels for all but one Function to 

ensure no single failure prevents the operators from being presented with 

the information necessary to determine the status of the unit and to bring 

the unit to, and maintain it in, a safe condition following that accident. 

Furthermore, provision of two channels allows a CHANNEL CHECK 

during the post accident phase to confirm the validity of displayed 

information. [More than two channels may be required at some units if 

the Regulatory Guide 1.97 analysis determines that failure of one 

accident monitoring channel results in information ambiguity (i.e., the 

redundant displays disagree) that could lead operators to defeat or to fail 

to accomplish a required safety function.] 

The exception to the two channel requirement is containment isolation 

valve position. In this case, the important information is the status of the 

containment penetrations. The LCO requires one position indicator for 

each active containment isolation valve. This is sufficient to redundantly 

verify the isolation status of each isolable penetration either via indicated 

status of the active valve and prior knowledge of the passive valve or via 

system boundary status. If a normally active containment isolation valve 

is known to be closed and deactivated, position indication is not needed 

to determine status. Therefore, the position indication for valves in this 

state is not required to be OPERABLE. 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The following list is a discussion of the specified instrument Functions 

listed in Table 3.3.17-1. These discussions are intended as examples of 

what should be provided for each Function when the unit specific list is 

prepared. 

1. Wide Range Neutron Flux

Wide Range Neutron Flux indication is provided to verify reactor 

shutdown. [For this unit, the Wide Range Neutron Flux channels 

consist of the following:] 

2, 3. Reactor Coolant System (RCS) Hot and Cold Leg Temperature

RCS Hot and Cold Leg Temperature instrumentation are Category I 

variables provided for verification of core cooling and long term 

surveillance. Reactor outlet temperature inputs to the RPS are 

provided by two fast response resistance elements and associated 

transmitters in each loop. The channels provide indication over a 

range of 32°F to 700°F. 

4. RCS Pressure (Wide Range)

RCS Pressure (Wide Range) instrumentation is provided for 

verification of core cooling and RCS integrity long term surveillance. 

Wide range RCS loop pressure is measured by pressure transmitters 

with a span of 0 psig to 3000 psig. The pressure transmitters are 

located outside the RB. Redundant monitoring capability is provided 

by two trains of instrumentation. Control room indications are 

provided through the inadequate core cooling monitor (ICCM) plasma 

display. The inadequate core cooling plasma display is the primary 

indication used by the operator during an accident. Therefore, the 

accident monitoring specification deals specifically with this portion of 

the instrument string. 

In some units, RCS Pressure is a Type A variable because the 

operator uses this indication to monitor the cooldown of the RCS 

following a steam generator (SG) tube rupture or small break LOCA. 

Operator actions to maintain a controlled cooldown, such as 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-5 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

adjusting SG pressure or level, would use this indication. In addition, 

high pressure injection (HPI) flow is throttled based on RCS Pressure 

and subcooled margin. For some small break LOCAs, low pressure 

injection (LPI) may actuate with system pressure stabilizing above 

the shutoff head of the LPI pumps. If this condition exists, the 

operator is instructed to verify HPI flow and then terminate LPI flow 

prior to exceeding 30 minutes of LPI pump operation against a 

deadhead pressure. RCS Pressure, in conjunction with LPI flow, is 

also used to determine if a core flood line break has occurred. 

5. Reactor Vessel Water Level

Reactor Vessel Water Level instrumentation is provided for 

verification and long term surveillance of core cooling. The reactor 

vessel level monitoring system provides a direct measurement of the 

collapsed liquid level above the fuel alignment plate. The collapsed 

level represents the amount of liquid mass that is in the reactor 

vessel above the core. Measurement of the collapsed water level is 

selected because it is a direct indication of the water inventory. 

The collapsed level is obtained over the same temperature and 

pressure range as the saturation measurements, thereby 

encompassing all operating and accident conditions where it must 

function. Also, it functions during the recovery interval. Therefore, it 

is designed to survive the high steam temperature that may occur 

during the preceding core recovery interval. 

The level range extends from the top of the vessel down to the top of 

the fuel alignment plate. The response time is short enough to track 

the level during small break LOCA events. The resolution is 

sufficient to show the initial level drop, the key locations near the hot 

leg elevation, and the lowest levels just above the alignment plate. 

This provides the operator with adequate indication to track the 

progression of the accident and to detect the consequences of its 

mitigating actions or the functionality of automatic equipment. 

[ For this unit, the Reactor Vessel Water Level channels consist of the 

following: ]
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-6 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

6. Containment Sump Water Level (Wide Range)

Containment Sump Water Level (Wide Range) instrumentation is 

provided for verification and long term surveillance of RCS integrity. 

[For this unit, the Containment Sump Water Level instrumentation 

consists of the following:] 

7. Containment Pressure (Wide Range)

Containment Pressure (Wide Range) instrumentation is provided for 

verification of RCS and containment OPERABILITY. [For this unit, 

Containment Pressure instrumentation consists of the following:] 

8. Containment Isolation Valve Position

PCIV position is provided for verification of containment integrity. In 

the case of PCIV position, the important information is the isolation 

status of the containment penetration. The LCO requires one 

channel of valve position indication in the control room to be 

OPERABLE for each active PCIV in a containment penetration flow 

path, i.e., two total channels of PCIV position indication for a 

penetration flow path with two active valves. For containment 

penetrations with only one active PCIV having control room 

indication, Note (b) requires a single channel of valve position 

indication to be OPERABLE. This is sufficient to redundantly verify 

the isolation status of each isolable penetration via indicated status of 

the active valve, as applicable, and prior knowledge of passive valve 

or system boundary status. If a penetration flow path is isolated, 

position indication for the PCIV(s) in the associated penetration flow 

path is not needed to determine status. Therefore, the position 

indication for valves in an isolated penetration flow path is not 

required to be OPERABLE. Each penetration is treated separately 

and each penetration flow path is considered a separate function. 

Therefore, separate Condition entry is allowed for each inoperable 

penetration flow path. 

[ For this plant, the PCIV position PAM instrumentation consists of the 

following: ] 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-7 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

9. Containment Area Radiation (High Range)

Containment Area Radiation (High Range) instrumentation is 

provided to monitor the potential for significant radiation releases and 

to provide release assessment for use by operators in determining 

the need to invoke site emergency plans. [For this unit, the 

Containment Area Radiation instrumentation consists of the 

following:] 

10. Pressurizer Level

Pressurizer Level instrumentation is used to determine whether to 

terminate safety injection (SI), if still in progress, or to reinitiate SI if it 

has been stopped. Knowledge of pressurizer water level is also used 

to verify the unit conditions necessary to establish natural circulation 

in the RCS and to verify that the unit is maintained in a safe 

shutdown condition. [For this unit, the Pressurizer Level 

instrumentation consists of the following:] 

11. Steam Generator Water Level

Steam Generator Water Level instrumentation is provided to monitor 

operation of decay heat removal via the SG. The indication of SG 

level is the extended startup range level instrumentation, covering a 

span of 6 inches to 394 inches above the lower tubesheet. The 

measured differential pressure is displayed in inches of water at 

68°F. Temperature compensation for this indication is performed 

manually by the operator. Redundant monitoring capability is 

provided by two trains of instrumentation. The uncompensated level 

signal is input to the unit computer, a control room indicator, and the 

Emergency Feedwater (EFW) Control System. 

SG level indication is used by the operator to manually raise and 

control SG level to establish boiler condenser heat transfer. Operator 

action is initiated on a loss of subcooled margin. Feedwater flow is 

increased until the indicated extended startup range level reaches 

the boiler condenser setpoint. 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-8 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

12. Condensate Storage Tank (CST) Level

CST Level instrumentation is provided to ensure a water supply for 

EFW. The CST provides the assured, safety grade water supply for 

the EFW System. The CST consists of two identical tanks connected 

by a common outlet header. Inventory is monitored by a 0 inch to 

144 inch level indication for each tank. CST Level is displayed on a 

control room indicator, strip chart recorder, and unit computer. In 

addition, a control room annunciator alarms on low level. 

CST Level is the primary indication used by the operator to identify 

loss of CST volume and replenish the CST or align suction to the 

EFW pumps from the hotwell. 

13. Core Exit Temperature

Core Exit Temperature is provided for verification and long term 

surveillance of core cooling. An evaluation was made of the 

minimum number of valid core exit thermocouples (CETs) necessary 

for inadequate core cooling detection. The evaluation determined the 

reduced complement of CETs necessary to detect initial core 

recovery and to trend the ensuing core heatup. The evaluations 

account for core nonuniformities and cold leg injection. Based on 

these evaluations, adequate or inadequate core cooling detection is 

ensured with two sets of five valid CETs. 

The subcooling margin monitor takes the average of the five highest 

CETs for each of the ICCM trains. Two channels ensure that a single 

failure will not disable the ability to determine the representative core 

exit temperature. 

14. Emergency Feedwater Flow

EFW Flow instrumentation is provided to monitor operation of decay 

heat removal via the SGs. The EFW Flow to each SG is determined 

from a differential pressure measurement calibrated to a span of 

0 gpm to 1200 gpm. Redundant monitoring capability is provided by 

two independent trains of instrumentation for each SG. Each 

differential pressure transmitter provides an input to a control room 

indicator and the unit computer. 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-9 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

EFW Flow is the primary indication used by the operator to determine 

the need to throttle flow during an SLB accident to prevent the EFW 

pumps from operating in runout conditions. EFW Flow is also used 

by the operator to verify that the EFW System is delivering the 

correct flow to each SG. However, the primary indication used by the 

operator to ensure an adequate inventory is SG level. 

RCS pressure is used by the operator to monitor the cooldown of the 

RCS following an SG tube rupture or small break LOCA. In addition, 

HPI flow is throttled based on RCS pressure and subcooled margin. 

The indication is also used to identify an LPI pump operating at 

system pressures above its shutoff head. If this condition exists, the 

operator is instructed to verify this condition exists, to verify HPI flow, 

and to terminate LPI flow prior to exceeding 30 minutes of LPI pump 

operation against a deadhead pressure. RCS pressure, in 

conjunction with LPI flow, is also used to determine if a core flood line 

break has occurred. 

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3. 

These variables are related to the diagnosis and preplanned actions 

required to mitigate DBAs. The applicable DBAs are assumed to occur in 

MODES 1, 2, and 3. In MODES 4, 5, and 6, unit conditions are such that 

the likelihood of an event occurring that would require PAM 

instrumentation is low; therefore, the PAM instrumentation is not required 

to be OPERABLE in these MODES. 

ACTIONS A Note is added to the ACTIONS to clarify the application of Completion 

Time rules. The Conditions of this Specification may be entered 

independently for each Function listed in Table 3.3.17-1. The Completion 

Time(s) of the inoperable channels of a Function will be tracked 

separately for each Function starting from the time the Condition was 

entered for that Function. 

A.1

When one or more Functions have one required channel inoperable, the 

inoperable channel must be restored to OPERABLE status within 

30 days. The 30 day Completion Time is based on operating experience. 

This takes into account the remaining OPERABLE channel (or, in the 

case of a Function that has only one required channel, other nonRegulatory Guide 1.97 instrument channels to monitor the Function), the 

passive nature of the instrument (no critical automatic action is assumed 

to occur from these instruments), and the low probability of an event 

requiring PAM instrumentation during this interval. 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-10 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

Required Action B.1 specifies initiation of action described in 

Specification 5.6.7, that requires a written report to be submitted to the 

NRC. This report discusses the results of the root cause evaluation of the 

inoperability and identifies proposed restorative actions. This action is 

appropriate in lieu of a shutdown requirement since alternative actions 

are identified before loss of functional capability and given the likelihood 

of unit conditions that would require information provided by this 

instrumentation. The Completion Time of "Immediately" for Required 

Action B.1 ensures the requirements of Specification 5.6.7 are initiated. 

C.1

When one or more Functions have two required channels inoperable (i.e., 

two channels inoperable in the same Function), one channel in the 

Function should be restored to OPERABLE status within 7 days. The 

Completion Time of 7 days is based on the relatively low probability of an 

event requiring PAM instrumentation action operation and the availability 

of alternative means to obtain the required information. Continuous 

operation with two required channels inoperable in a Function is not 

acceptable because the alternate indications may not fully meet all 

performance of qualification requirements applied to the PAM 

instrumentation. Therefore, requiring restoration of one inoperable 

channel of the Function limits the risk that the PAM Function will be in a 

degraded condition should an accident occur. 

D.1

Required Action D.1 directs entry into the appropriate Condition 

referenced in Table 3.3.17-1. The applicable Condition referenced in the 

Table is Function dependent. Each time an inoperable channel has not 

met the Required Action of Condition C and the associated Completion 

Time has expired, Condition D is entered for that channel and provides 

for transfer to the appropriate subsequent Condition. 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-11 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1

If the Required Action and associated Completion Time of Condition C is 

not met and Table 3.3.17-1 directs entry into Condition E, the unit must 

be brought to a MODE in which the requirements of this LCO do not 

apply. To achieve this status, the unit must be brought to at least 

MODE 3 within 6 hours and MODE 4 within 12 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 

F.1

At this unit, alternative means of monitoring Containment Area Radiation 

have been developed and tested. These alternative means may be 

temporarily installed if the normal PAM channel cannot be restored to 

OPERABLE status within the allowed time. 

If these alternative means are used, the Required Action is not to shut the 

unit down, but rather to follow the directions of Specification 5.6.7, in the 

Administrative Controls section of the Technical Specifications. The 

report provided to the NRC should discuss the alternative means used, 

describe the degree to which the alternative means are equivalent to the 

installed PAM channels, justify the areas in which they are not equivalent, 

and provide a schedule for restoring the normal PAM channels. 

In the case of reactor vessel level, Reference 4 determined that the 

appropriate Required Action was not to shut the unit down, but rather to 

follow the directions of Specification 5.6.7. 

[ At this unit, the alternative monitoring provisions consist of the following: ] 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-12 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE As noted at the beginning of the SRs, the SRs apply to each PAM 

REQUIREMENTS instrumentation Function in Table 3.3.17-1. 

SR 3.3.17.1 

Performance of the CHANNEL CHECK once every 31 days for each 

required instrumentation channel that is normally energized ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel with 

a similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. CHANNEL 

CHECK will detect gross channel failure; therefore, it is key to verifying 

that the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. The high radiation instrumentation should be 

compared with similar unit instruments located throughout the unit. If the 

radiation monitor uses keep alive sources or check sources OPERABLE 

from the control room, the CHANNEL CHECK should also note the 

detector's response to these sources. 

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit. If the channels are within the criteria, it is an indication that the 

channels are OPERABLE. If the channels are normally off scale during 

times when surveillance is required, the CHANNEL CHECK will only 

verify that they are off scale in the same direction. Offscale low current 

loop channels are verified to be reading at the bottom of the range and 

not failed downscale. 

The Frequency is based on unit operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal 

but more frequent checks of channels during normal operational use of 

the displays associated with this LCO's required channels. 
PAM Instrumentation 

B 3.3.17 

BWOG STS B 3.3.17-13 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.17.2

A CHANNEL CALIBRATION is performed every [18] months or 

approximately at every refueling. CHANNEL CALIBRATION is a 

complete check of the instrument channel, including the sensor. This test 

verifies the channel responds to measured parameters within the 

necessary range and accuracy. 

A Note clarifies that the neutron detectors are not required to be tested as 

part of the CHANNEL CALIBRATION. There is no adjustment that can 

be made to the detectors. Furthermore, adjustment of the detectors is 

unnecessary because they are passive devices, with minimal drift. Slow 

changes in detector sensitivity are compensated for by performing the 

daily calorimetric calibration and the monthly axial channel calibration. 

For the Containment Area Radiation instrumentation, a CHANNEL 

CALIBRATION may consist of an electronic calibration of the channel, not 

including the detector, for range decades above 10 R/hr, and a one point 

calibration check of the detector below 10 R/hr with a gamma source. 

Whenever a sensing element is replaced, the next required CHANNEL 

CALIBRATION of the resistance temperature detectors (RTD) sensors is 

accomplished by an inplace cross calibration that compares the other 

sensing elements with the recently installed sensing element. 

Whenever a sensing element is replaced, the next required CHANNEL 

CALIBRATION of the Core Exit thermocouple sensors is accomplished by 

an inplace cross calibration that compares the other sensing elements 

with the recently installed sensing element. 

The Frequency is based on operating experience and consistency with 

the typical industry refueling cycle and is justified by the assumption of an 

[18] month calibration interval in the determination of the magnitude of 

equipment drift. 

REFERENCES 1. [ Unit Specific Documents (e.g., FSAR, NRC Regulatory Guide 1.97 

SER letter). ]

 2. Regulatory Guide 1.97. 

 3. NUREG-0737, 1979. 

 4. 32-1177256-00, "Technical Basis for Reactor Vessel Level Indication 

System (RVLIS) Action Statement," April 10, 1990. 
Remote Shutdown System 

B 3.3.18 

BWOG STS B 3.3.18-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.18 Remote Shutdown System 

BASES 

BACKGROUND The Remote Shutdown System provides the control room operator with 

sufficient instrumentation and controls to place and maintain the unit in a 

safe shutdown condition from locations other than the control room. This 

capability is necessary to protect against the possibility that the control 

room becomes inaccessible. A safe shutdown condition is defined as 

MODE 3. With the unit in MODE 3, the Emergency Feedwater (EFW) 

System and the steam generator (SG) safety valves or the SG 

atmospheric dump valves can be used to remove core decay heat and 

meet all safety requirements. The long term supply of water for the EFW 

System and the ability to borate the Reactor Coolant System (RCS) from 

outside the control room allows extended operation in MODE 3. 

In the event that the control room becomes inaccessible, the operators 

can establish control at the remote shutdown panel and place and 

maintain the unit in MODE 3. Not all controls and necessary transfer 

switches are located at the remote shutdown panel. Some controls and 

transfer switches will have to be operated locally at the switchgear, motor 

control panels, or other local stations. The unit automatically reaches 

MODE 3 following a unit shutdown and can be maintained safely in 

MODE 3 for an extended period of time. 

The OPERABILITY of the Remote Shutdown System control and 

instrumentation Functions ensures that there is sufficient information 

available on selected unit parameters to place and maintain the unit in 

MODE 3 should the control room become inaccessible. 

APPLICABLE The Remote Shutdown System is required to provide equipment at 

SAFETY appropriate locations outside the control room with a capability to 

ANALYSES promptly shut down and maintain the unit in a safe condition in MODE 3. 

The criteria governing the design and the specific system requirements of 

the Remote Shutdown System are located in 10 CFR 50, Appendix A, 

GDC 19 (Ref. 1). 

The Remote Shutdown System satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii). 
Remote Shutdown System 

B 3.3.18 

BWOG STS B 3.3.18-2 Rev. 3.0, 03/31/04 

BASES 

LCO The Remote Shutdown System LCO provides the requirements for the 

OPERABILITY of the instrumentation and controls necessary to place 

and maintain the unit in MODE 3 from a location other than the control 

room. The instrumentation and controls required are listed in 

Table B 3.3.18-1. 

The controls, instrumentation, and transfer switches are those required 

for: 

• Core Reactivity Control (initial and long term), 

• RCS Pressure Control, 

• Decay Heat Removal via the EFW System and the SG safety valves 

or SG atmospheric dump valves, 

• RCS Inventory Control via charging flow, and 

• Safety support systems for the above Functions, including service 

water, component cooling water, and onsite power, including the 

diesel generators. 

A Function of a Remote Shutdown System is OPERABLE if all instrument 

and control channels needed to support the Function are OPERABLE. In 

some cases, Table B 3.3.18-1 may indicate that the required information 

or control capability is available from several alternate sources. In these 

cases, the Function is OPERABLE as long as [one channel of any of] the 

alternate information or control sources are OPERABLE. 

The Remote Shutdown System instruments and control circuits covered 

by this LCO do not need to be energized to be considered OPERABLE. 

This LCO is intended to ensure the Remote Shutdown System 

instruments and control circuits will be OPERABLE if unit conditions 

require that the Remote Shutdown System be placed in operation. 

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1, 2, and 3. 

This is required so that the unit can be placed and maintained in MODE 3 

for an extended period of time from a location other than the control room. 

This LCO is not applicable in MODE 4, 5, or 6. In these MODES, the unit 

is already subcritical and is in a condition of reduced RCS energy. Under 

these conditions, considerable time is available to restore necessary 

instrument and control Functions if control room instruments become 

unavailable. 
Remote Shutdown System 

B 3.3.18 

BWOG STS B 3.3.18-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A Remote Shutdown System division is inoperable when each Function is 

not accomplished by at least one designated Remote Shutdown System 

channel that satisfies the OPERABILITY criteria for the channel's 

Function. These criteria are outlined in the LCO section of the Bases. 

A Note has been added to the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of the Specification may be 

entered independently for each Function. The Completion Time(s) of the 

inoperable channel(s)/train(s) of a Function will be tracked separately for 

each Function starting from the time the Condition was entered for that 

Function. 

A.1

Condition A addresses the situation where one or more required 

Functions of the Remote Shutdown System are inoperable. This includes 

the control and transfer switches for any required Function. 

The Required Action is to restore the required Function to OPERABLE 

status within 30 days. The Completion Time is based on operating 

experience and takes into account the remaining OPERABLE division 

and the low probability of an event that would require evacuation of the 

control room. 

B.1 and B.2

If Required Action A.1 cannot be met within the required Completion 

Time, the unit must be brought to a MODE in which the LCO does not 

apply. To achieve this status, the unit must be brought to at least 

MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 
Remote Shutdown System 

B 3.3.18 

BWOG STS B 3.3.18-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE [ SR 3.3.18.1

REQUIREMENTS 

Performance of the CHANNEL CHECK once every 31 days for each 

required instrumentation channel that is normally energized ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. 

Significant deviations between the two instrument channels could be an 

indication of excessive instrument drift in one of the channels or of 

something even more serious. CHANNEL CHECK will detect gross 

channel failure; therefore, it is key in verifying that the instrumentation 

continues to operate properly between each CHANNEL CALIBRATION. 

Agreement criteria are determined by the unit staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If the channel is outside the criteria, it may be an 

indication that the sensor or the signal processing equipment has drifted 

outside its limit. If the channels are within the criteria, it is an indication 

that the channels are OPERABLE. As specified in the Surveillance, a 

CHANNEL CHECK is only required for those channels that are normally 

energized. If the channels are normally off scale during times when 

surveillance is required, the CHANNEL CHECK will only verify that they 

are off scale in the same direction. Off scale low current loop channels 

are verified to be reading at the bottom of the range and not failed 

downscale. 

The Frequency is based on unit operating experience, which 

demonstrates that channel failure is rare. ]

SR 3.3.18.2

SR 3.3.18.2 verifies each required Remote Shutdown System transfer 

switch and control circuit performs their intended function. This 

verification is performed from the remote shutdown panel and locally, as 

appropriate. Operation of the equipment from the remote shutdown panel 

is not necessary. The Surveillance can be satisfied by performance of a 

continuity check. This will ensure that if the control room becomes 
Remote Shutdown System 

B 3.3.18 

BWOG STS B 3.3.18-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

inaccessible, the unit can be placed and maintained in MODE 3 from the 

remote shutdown panel and the local control stations. The [18] month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a unit outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power. Operating experience demonstrates that remote shutdown control 

channels seldom fail to pass the Surveillance when performed at the 

[18] month Frequency. 

SR 3.3.18.3

CHANNEL CALIBRATION is a complete check of the instrument loop and 

sensor. The test verifies that the channel responds to measured 

parameters within the necessary range and accuracy. 

A Note clarifies that the neutron detectors are not required to be tested as 

part of the CHANNEL CALIBRATION. There is no adjustment that can 

be made to the detectors. Furthermore, adjustment of the detectors is 

unnecessary because they are passive devices, with minimal drift. Slow 

changes in detector sensitivity are compensated for by performing the 

daily calorimetric calibration and the monthly axial channel calibration. 

Whenever a sensing element is replaced, the next required CHANNEL 

CALIBRATION of the resistance temperature detectors (RTD) sensors is 

accomplished by an inplace cross calibration that compares the other 

sensing elements with the recently installed sensing element. 

The Frequency is based on operating experience and consistency with 

the typical industry refueling cycle and is justified by the assumption of an 

[18] month calibration interval in the determination of the magnitude of 

equipment drift. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19. 
Remote Shutdown System 

B 3.3.18 

BWOG STS B 3.3.18-6 Rev. 3.0, 03/31/04 

Table B 3.3.18-1 (page 1 of 1) 

Remote Shutdown System Instrumentation and Controls 

----------------------------------------------------------------------NOTE--------------------------------------------------------------------- 

This Table is for illustration purposes only. It does not attempt to encompass every Function used at every 

unit, but does contain the types of Functions commonly found. 

---------------------------------------------------------------------------------------------------------------------------------------------------

FUNCTION/INSTRUMENT 

OR CONTROL PARAMETER 

REQUIRED 

NUMBER OF FUNCTIONS 

1. Reactivity Control 

a. Log Power Neutron Flux [1] 

b. Source Range Neutron Flux [1] 

c. Reactor Trip Circuit Breaker Position [1 per trip breaker] 

d. Manual Reactor Trip [1] 

2. Reactor Coolant System (RCS) Pressure Control 

a. Pressurizer Pressure or RCS Wide Range 

Pressure 

[1] 

b. Pressurizer Power Operated Relief Valve 

(PORV) Control and Block Valve Control 

[1] 

3. Decay Heat Removal via Steam Generators (SGs) 

a. Reactor Coolant Hot Leg Temperature [1 per loop] 

b. Reactor Coolant Cold Leg Temperature [1 per loop] 

c. Condensate Storage Tank Level [1] 

d. SG Pressure [1 per SG] 

e. SG Level or Emergency Feedwater (EFW) Flow [1 per SG] 

f. EFW Controls [1] 

4. RCS Inventory Control 

a. Pressurizer Level [1] 

b. Reactor Coolant Injection Pump Controls [1] 

-----------------------------------------------------------------REVIEWER’S NOTE------------------------------------------------------- 

For channels that fulfill GDC 19 requirements, the number of OPERABLE channels required depends on the 

unit licensing basis as described in the NRC unit specific Safety Evaluation Report (SER). Generally, two 

divisions are required OPERABLE. However, only one channel is required if the unit has justified such a 

design and the NRC's SER accepted the justification. 

--------------------------------------------------------------------------------------------------------------------------------------------------- 
RCS Pressure, Temperature, and Flow DNB Limits 

B 3.4.1 

BWOG STS B 3.4.1-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits 

BASES 

BACKGROUND These Bases address requirements for maintaining RCS pressure, 

temperature, and flow rate within limits assumed in the safety analyses. 

The safety analyses (Ref. 1) of normal operating conditions and 

anticipated operational occurrences assume initial conditions within the 

normal steady state envelope. The limits placed on DNB related 

parameters ensure that these parameters will not be less conservative 

than were assumed in the analyses and thereby provide assurance that 

the minimum departure from nucleate boiling ratio (DNBR) will meet the 

required criteria for each of the transients analyzed. 

The LCO for minimum RCS pressure is consistent with operation within 

the nominal operating envelope and is above that used as the initial 

pressure in the analyses. A pressure greater than the minimum specified 

will produce a higher minimum DNBR. A pressure lower than the 

minimum specified will cause the plant to approach the DNB limit. 

The LCO for maximum RCS coolant hot leg temperature is consistent 

with full power operation within the nominal operating envelope and is 

lower than the initial hot leg temperature in the analyses. A hot leg 

temperature lower than that specified will produce a higher minimum 

DNBR. A temperature higher than that specified will cause the plant to 

approach the DNB limit. 

The RCS flow rate is not expected to vary during operation with all pumps 

running. The LCO for the minimum RCS flow rate corresponds to that 

assumed for the DNBR analyses. A higher RCS flow rate will produce a 

higher DNBR. A lower RCS flow will cause the plant to approach the 

DNB limit. 

APPLICABLE The requirements of LCO 3.4.1 represent the initial conditions for DNB 

SAFETY limited transients analyzed in the plant safety analyses (Ref. 1). The 

ANALYSES safety analyses have shown that transients initiated from the limits of this 

LCO will meet the DNBR criterion of ≥ [1.3]. This is the acceptance limit 

for the RCS DNBR parameters. Changes to the facility that could impact 

these parameters must be assessed for their impact on the DNBR 
RCS Pressure, Temperature, and Flow DNB Limits 

B 3.4.1 

BWOG STS B 3.4.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

criterion. The transients analyzed for include loss of coolant flow events 

and dropped or stuck control rod events. A key assumption for the 

analysis of these events is that the core power distribution is within the 

limits of LCO 3.2.1, "Regulating Rod Insertion Limits," LCO 3.2.3, "AXIAL 

POWER IMBALANCE OPERATING LIMITS," and LCO 3.2.4, 

"QUADRANT POWER TILT RATIO (QPTR)." 

The core outlet pressure assumed in the safety analyses is 2135 psia. 

The minimum pressure specified in LCO 3.4.1 is the limit value in the 

reactor coolant loop as measured at the hot leg pressure tap. 

The safety analyses are performed with an assumed RCS coolant 

average temperature of 581°F (579°F plus 2°F allowance for calculational 

uncertainty). The corresponding hot leg temperature of 604.6°F is 

calculated by assuming an RCS core outlet pressure of 2135 psia and an 

RCS flow rate of 374,880 gpm. The maximum temperature specified is 

the limit value at the hot leg resistance temperature detector. 

The safety analyses are performed with an assumed RCS flow rate of 

374,880 gpm. The minimum flow rate specified in LCO 3.4.1 is the 

minimum mass flow rate. 

Analyses have been performed to establish the pressure, temperature, 

and flow rate requirements for three pump and four pump operation. The 

flow limits for three pump operation are substantially lower than for four 

pump operation. To meet the DNBR criterion, a corresponding maximum 

power limit is required (see Bases for LCO 3.4.4, "RCS Loops - MODES 1 

and 2"). 

The RCS DNB limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO This LCO specifies limits on the monitored process variables: RCS loop 

(hot leg) pressure, RCS hot leg temperature, and RCS total flow rate to 

ensure that the core operates within the limits assumed for the plant 

safety analyses. Operating within these limits will result in meeting DNBR 

criteria in the event of a DNB limited transient. 

The pressure and temperature limits are to be applied to the loop with two 

reactor coolant pumps (RCPs) running for the three RCPs operating 

condition. 
RCS Pressure, Temperature, and Flow DNB Limits 

B 3.4.1 

BWOG STS B 3.4.1-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The LCO numerical values for pressure, temperature, and flow rate are 

given for the measurement location but have not been adjusted for 

instrument error. Plant specific limits of instrument error are established 

by the plant staff to meet the operational requirements of this LCO. 

APPLICABILITY In MODE 1, the limits on RCS pressure, RCS hot leg temperature, and 

RCS flow rate must be maintained during steady state with four pump or 

three pump operation in order to ensure that DNBR criteria will be met in 

the event of an unplanned loss of forced coolant flow or other DNB limited 

transient. In all other MODES the power level is low enough so that DNB 

is not a concern. 

The Note indicates the limit on RCS pressure may be exceeded during 

short term operational transients such as a THERMAL POWER ramp 

increase > 5% RTP per minute or a THERMAL POWER step increase 

> 10% RTP. These conditions represent short term perturbations where 

actions to control pressure variations might be counterproductive. Also, 

since they represent transients initiated from power levels < 100% RTP, 

increased DNBR margin exists to offset the temporary pressure 

variations. 

Another set of limits on DNBR related parameters is provided in Safety 

Limit (SL) 2.1.1, "Reactor Core SLs." Those limits are less restrictive than 

the limits of LCO 3.4.1, but violation of an SL merits a stricter, more 

severe Required Action. Should a violation of LCO 3.4.1 occur, the 

operator must check whether an SL may have been exceeded. 

ACTIONS A.1

Loop pressure and hot leg coolant temperature are controllable and 

measurable parameters. With one or both of these parameters not within 

the LCO limits, action must be taken to restore the parameters. RCS flow 

rate is not a controllable parameter and is not expected to vary during 

steady state four pump or three pump operation. However, if the flow rate 

is below the LCO limit, the parameter must be restored to within limits or 

power must be reduced as required in Required Action B.1, to restore 

DNBR margin and eliminate the potential for violation of the accident 

analysis bounds. 

The 2 hour Completion Time for restoration of the parameters provides 

sufficient time to adjust plant parameters, determine the cause for the off 

normal condition, and restore the readings within limits. The Completion 

Time is based on plant operating experience. 
RCS Pressure, Temperature, and Flow DNB Limits 

B 3.4.1 

BWOG STS B 3.4.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

If the Required Action A.1 is not met within the Completion Time, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 2 within 

6 hours. In MODE 2, the reduced power condition eliminates the 

potential for violation of the accident analysis bounds. 

The 6 hour Completion Time is reasonable, based on operating 

experience, to reduce power in an orderly manner in conjunction with 

even control of steam generator heat removal. 

SURVEILLANCE SR 3.4.1.1

REQUIREMENTS 

Since Required Action A.1 allows a Completion Time of 2 hours to restore 

parameters that are not within limits, the 12 hour Surveillance Frequency 

for loop (hot leg) pressure is sufficient to ensure that the pressure can be 

restored to a normal operation, steady state condition following load 

changes and other expected transient operations. The RCS pressure 

value specified is dependent on the number of pumps in operation and 

has been adjusted to account for the pressure loss difference between 

the core exit and the measurement location. The value used in the plant 

safety analysis is 2135 psia. The 12 hour interval has been shown by 

operating practice to be sufficient to regularly assess potential 

degradation and to verify operation is within safety analysis assumptions. 

A Note has been added to indicate the pressure limits are to be applied to 

the loop with two pumps in operation for the three pump operating 

condition. 

SR 3.4.1.2

Since Required Action A.1 allows a Completion Time of 2 hours to restore 

parameters that are not within limits, the 12 hour Surveillance Frequency 

for hot leg temperature is sufficient to ensure that the RCS coolant 

temperature can be restored to a normal operation, steady state condition 

following load changes and other expected transient operations. The 

12 hour interval has been shown by operating practice to be sufficient to 

regularly assess potential degradation and to verify that operation is 

within safety analysis assumptions. 
RCS Pressure, Temperature, and Flow DNB Limits 

B 3.4.1 

BWOG STS B 3.4.1-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

A Note has been added to indicate the temperature limits are to be 

applied to the loop with two pumps in operation for the three pump 

operating condition. 

SR 3.4.1.3

The 12 hour Surveillance Frequency for RCS total flow rate is performed 

using the installed flow instrumentation. The 12 hour interval has been 

shown by operating practice to be sufficient to regularly assess potential 

degradation and to verify that operation is within safety analysis 

assumptions. 

SR 3.4.1.4

Measurement of RCS total flow rate by performance of a precision 

calorimetric heat balance once every [18] months allows the installed 

RCS flow instrumentation to be calibrated and verifies that the actual 

RCS flow is greater than or equal to the minimum required RCS flow rate. 

The Frequency of [18] months reflects the importance of verifying flow 

after a refueling outage when the core has been altered or RCS flow 

characteristics may have been modified, which may have caused change 

of flow. 

The Surveillance is modified by a Note that indicates the SR does not 

need to be performed until stable thermal conditions are established at 

higher power levels. The Note is necessary to allow measurement of the 

flow rate at normal operating conditions at power in MODE 1. The 

Surveillance cannot be performed at low power or in MODE 2 or below 

because at low power the ∆T across the core will be too small to provide 

valid results. 

REFERENCES 1. FSAR, Chapter [15]. 
RCS Minimum Temperature for Criticality 

B 3.4.2 

BWOG STS B 3.4.2-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.2 RCS Minimum Temperature for Criticality 

BASES 

BACKGROUND Establishing the value for the minimum temperature for reactor criticality 

is based upon considerations for: 

a. Operation within the existing instrumentation ranges and accuracies 

and 

b. Operation with reactor vessel above its minimum nil ductility 

reference temperature when the reactor is critical. 

The reactor coolant moderator temperature coefficient used in core 

operating and accident analysis is typically defined for the normal 

operating temperature range (532°F to 579°F). The Reactor Protection 

System (RPS) receives inputs from the narrow range hot leg temperature 

detectors, which have a range of 520°F to 620°F. The integrated control 

system controls average temperature (Tavg) using inputs of the same 

range. Nominal Tavg for making the reactor critical is 532°F. Safety and 

operating analyses for lower temperatures have not been made. 

APPLICABLE There are no accident analyses that dictate the minimum temperature 

SAFETY for criticality, but all low power safety analyses assume initial 

ANALYSES temperatures near the 525°F limit (Ref. 1). 

The RCS minimum temperature for criticality satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO The purpose of the LCO is to prevent criticality outside the normal 

operating regime (532°F to 579°F) and to prevent operation in an 

unanalyzed condition. 

The LCO limit of 525°F has been selected to be within the instrument 

indicating range (520°F to 620°F). The limit is also set slightly below the 

lowest power range operating temperature (532°F). 

APPLICABILITY The reactor has been designed and analyzed to be critical in MODES 1 

and 2 only and in accordance with this Specification. Criticality is not 

permitted in any other MODE. Therefore, this LCO is applicable in 

MODE 1 and MODE 2 when keff ≥ 1.0. 
RCS Minimum Temperature for Criticality 

B 3.4.2 

BWOG STS B 3.4.2-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

 

With Tavg below 525°F, the plant must be brought to a MODE in which the 

LCO does not apply. To achieve this status, the plant must be brought to 

MODE 2 with Keff < 1.0 in 30 minutes. Rapid reactor shutdown can be 

readily and practically achieved in a 30 minute period. The Completion 

Time reflects the ability to perform this Action and maintain the plant 

within the analyzed range. If Tavg can be restored within the 30 minute 

time period, shutdown is not required. 

SURVEILLANCE SR 3.4.2.1

REQUIREMENTS 

RCS loop average temperature is required to be verified at or above 

525°F every 12 hours. The SR to verify RCS loop average temperatures 

every 12 hours takes into account indications and alarms that are 

continuously available to the operator in the control room and is 

consistent with other routine Surveillances which are typically performed 

once per shift. In addition, operators are trained to be sensitive to RCS 

temperature during approach to criticality and will ensure that the 

minimum temperature for criticality is met as criticality is approached. 

REFERENCES 1. FSAR, Chapter [15]. 
RCS P/T Limits 

B 3.4.3 

BWOG STS B 3.4.3-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.3 RCS Pressure and Temperature (P/T) Limits 

BASES 

BACKGROUND All components of the RCS are designed to withstand effects of cyclic 

loads due to system pressure and temperature changes. These loads 

are introduced by startup (heatup) and shutdown (cooldown) operations, 

power transients, and reactor trips. This LCO limits the pressure and 

temperature changes during RCS heatup and cooldown, within the design 

assumptions and the stress limits for cyclic operation. 

The PTLR contains P/T limit curves for heatup, cooldown, and inservice 

leak and hydrostatic (ISLH) testing, and data for the maximum rate of 

change of reactor coolant temperature (Ref. 1). 

Each P/T limit curve defines an acceptable region for normal operation. 

The usual use of the curves is operational guidance during heatup or 

cooldown maneuvering, when pressure and temperature indications are 

monitored and compared to the applicable curve to determine that 

operation is within the allowable region. 

The LCO establishes operating limits that provide a margin to brittle 

failure of the reactor vessel and piping of the reactor coolant pressure 

boundary (RCPB). The vessel is the component most subject to brittle 

failure, and the LCO limits apply mainly to the vessel. The limits do not 

apply to the pressurizer, which has different design characteristics and 

operating functions. 

10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limits 

for material fracture toughness requirements of the RCPB materials. 

Reference 2 requires an adequate margin to brittle failure during normal 

operation, anticipated operational occurrences, and system hydrostatic 

tests. It mandates the use of the American Society of Mechanical 

Engineers (ASME), Boiler and Pressure Vessel Code, Section III, 

Appendix G (Ref. 3). 

Linear elastic fracture mechanics (LEFM) methodology is used to 

determine the stresses and material toughness at locations within the 

RCPB. The LEFM methodology follows the guidance given by 

10 CFR 50, Appendix G; ASME Code, Section III, Appendix G; and 

Regulatory Guide 1.99 (Ref. 4). 
RCS P/T Limits 

B 3.4.3 

BWOG STS B 3.4.3-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Material toughness properties of the ferritic materials of the reactor vessel 

are determined in accordance with the NRC Standard Review Plan 

(Ref. 5), ASTM E 185 (Ref. 6), and additional reactor vessel 

requirements. These properties are then evaluated in accordance with 

Reference 3. 

The actual shift in the nil ductility reference temperature (RTNDT) of the 

vessel material will be established periodically by removing and 

evaluating the irradiated reactor vessel material specimens, in 

accordance with ASTM E 185 (Ref. 6) and Appendix H of 10 CFR 50 

(Ref. 7). The operating P/T limit curves will be adjusted, as necessary, 

based on the evaluation findings and the recommendations of 

Reference 3. 

The P/T limit curves are composite curves established by superimposing 

limits derived from stress analyses of those portions of the reactor vessel 

and head that are the most restrictive. At any specific pressure, 

temperature, and temperature rate of change, one location within the 

reactor vessel will dictate the most restrictive limit. Across the span of the 

P/T limit curves, different locations are more restrictive, and, thus, the 

curves are composites of the most restrictive regions. 

The heatup curve represents a different set of restrictions than the 

cooldown curve because the directions of the thermal gradients through 

the vessel wall are reversed. The thermal gradient reversal alters the 

location of the tensile stress between the outer and inner walls. 

The calculation to generate the ISLH testing curve uses different safety 

factors (per Ref. 3) than the heatup and cooldown curves. The ISLH 

testing curve also extends to the RCS design pressure of 2500 psia. 

The P/T limit curves and associated temperature rate of change limits are 

developed in conjunction with stress analyses for large numbers of 

operating cycles and provide conservative margins to nonductile failure. 

Although created to provide limits for these specific normal operations, 

the curves also can be used to determine if an evaluation is necessary for 

an abnormal transient. 
RCS P/T Limits 

B 3.4.3 

BWOG STS B 3.4.3-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The consequence of violating the LCO limits is that the RCS has been 

operated under conditions that can result in brittle failure of the RCPB, 

possibly leading to a nonisolable leak or loss of coolant accident. In the 

event these limits are exceeded, an evaluation must be performed to 

determine the effect on the structural integrity of the RCPB components. 

The ASME Code, Section XI, Appendix E (Ref. 8) provides a 

recommended methodology for evaluating an operating event that causes 

an excursion outside the limits. 

APPLICABLE The P/T limits are not derived from Design Basis Accident (DBA) 

SAFETY analyses. They are prescribed during normal operation to avoid 

ANALYSES encountering pressure, temperature, and temperature rate of change 

conditions that might cause undetected flaws to propagate and cause 

nonductile failure of the RCPB, an unanalyzed condition. Reference 1 

establishes the methodology for determining the P/T limits. Since the P/T 

limits are not derived from any DBA analysis, there are no acceptance 

limits related to the P/T limits. Rather, the P/T limits are acceptance limits 

themselves since they preclude operation in an unanalyzed condition. 

RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The two elements of this LCO are: 

a. The limit curves for heatup, cooldown, and ISLH testing and 

b. Limits on the rate of change of temperature. 

The LCO limits apply to all components of the RCS, except the 

pressurizer. These limits define allowable operating regions and permit a 

large number of operating cycles while providing a wide margin to 

nonductile failure. 

The limits for the rate of change of temperature control the thermal 

gradient through the vessel wall and are used as inputs for calculating the 

heatup, cooldown, and ISLH P/T limit curves. Thus, the LCO for the rate 

of change of temperature restricts stresses caused by thermal gradients 

and also ensures the validity of the P/T limit curves. 

Violating the LCO limits places the reactor vessel outside of the bounds of 

the stress analyses and can increase stresses in other RCPB 

components. The consequences depend on several factors, as follows: 
RCS P/T Limits 

B 3.4.3 

BWOG STS B 3.4.3-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

a. The severity of the departure from the allowable operating P/T 

regime or the severity of the rate of change of temperature, 

b. The length of time the limits were violated (longer violations allow the 

temperature gradient in the thick vessel walls to become more 

pronounced), and 

c. The existences, sizes, and orientations of flaws in the vessel 

material. 

APPLICABILITY The RCS P/T limits Specification provides a definition of acceptable 

operation for prevention of nonductile failure in accordance with 

10 CFR 50, Appendix G (Ref. 2). Although the P/T limits were developed 

to provide guidance for operation during heatup or cooldown (MODES 3, 

4, and 5) or ISLH testing, their applicability is at all times in keeping with 

the concern for nonductile failure. The limits do not apply to the 

pressurizer. 

During MODES 1 and 2, other Technical Specifications provide limits for 

operation that can be more restrictive than or can supplement these P/T 

limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure 

from Nucleate Boiling (DNB) Limits," LCO 3.4.2, "RCS Minimum 

Temperature for Criticality," and Safety Limit (SL) 2.1, "SLs," also provide 

operational restrictions for pressure and temperature and maximum 

pressure. MODES 1 and 2 are above the temperature range of concern 

for nonductile failure, and stress analyses have been performed for 

normal maneuvering profiles, such as power ascension or descent. 

ACTIONS A.1 and A.2

Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be 

corrected so that the RCPB is returned to a condition that has been 

verified by stress analyses. 

The 30 minute Completion Time reflects the urgency of restoring the 

parameters to within the analyzed range. Most violations will not be 

severe, and the activity can be accomplished in this time in a controlled 

manner. 
RCS P/T Limits 

B 3.4.3 

BWOG STS B 3.4.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Besides restoring operation to within limits, an evaluation is required to 

determine if RCS operation can continue. The evaluation must verify the 

RCPB integrity remains acceptable and must be completed before 

continuing operation. Several methods may be used, including 

comparison with pre-analyzed transients in the stress analyses, new 

analyses, or inspection of the components. The evaluation must be 

completed, documented, and approved in accordance with established 

plant procedures and administrative controls. 

ASME Code, Section XI, Appendix E (Ref. 8) may be used to support the 

evaluation. However, its use is restricted to evaluation of the vessel 

beltline. The evaluation must extend to all components of the RCPB. 

The 72 hour Completion Time is reasonable to accomplish the evaluation. 

The evaluation for a mild violation is possible within this time, but more 

severe violations may require special, event specific stress analyses or 

inspections. A favorable evaluation must be completed before continuing 

to operate. 

Condition A is modified by a Note requiring Required Action A.2 to be 

completed whenever the Condition is entered. The Note emphasizes the 

need to perform the evaluation of the effects of the excursion outside the 

allowable limits. Restoration alone per Required Action A.1 is insufficient 

because higher than analyzed stresses may have occurred and may have 

affected the RCPB integrity. 

B.1 and B.2

If a Required Action and associated Completion Time of Condition A are 

not met, the plant must be brought to a lower MODE because: (a) the 

RCS remained in an unacceptable pressure and temperature region for 

an extended period of increased stress, or (b) a sufficiently severe event 

caused entry into an unacceptable region. Either possibility indicates a 

need for more careful examination of the event, best accomplished with 

the RCS at reduced pressure and temperature. With reduced pressure 

and temperature conditions, the possibility of propagation of undetected 

flaws is decreased. 

If the required restoration activity cannot be accomplished within 

30 minutes, Required Action B.1 and Required Action B.2 must be 

implemented to reduce pressure and temperature. 
RCS P/T Limits 

B 3.4.3 

BWOG STS B 3.4.3-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

If the required evaluation for continued operation cannot be accomplished 

within 72 hours, or the results are indeterminate or unfavorable, action 

must proceed to reduce pressure and temperature as specified in 

Required Actions B.1 and B.2. A favorable evaluation must be completed 

and documented before returning to operating pressure and temperature 

conditions. However, if the favorable evaluation is accomplished while 

reducing pressure and temperature conditions, a return to power 

operation may be considered without completing Required Action B.2. 

Pressure and temperature are reduced by bringing the plant to MODE 3 

within 6 hours and to MODE 5 within 36 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required MODE from full power conditions in an orderly manner and 

without challenging plant systems. 

C.1 and C.2

Actions must be initiated immediately to correct operation outside of the 

P/T limits at times other than MODE 1, 2, 3, or 4, so that the RCPB is 

returned to a condition that has been verified acceptable by stress 

analysis. 

The immediate Completion Time reflects the urgency of initiating action to 

restore the parameters to within the analyzed range. Most violations will 

not be severe, and the activity can be accomplished within this time in a 

controlled manner. 

In addition to restoring operation to within limits, an evaluation is required 

to determine if RCS operation can continue. The evaluation must verify 

that the RCPB integrity remains acceptable and must be completed prior 

to entry into MODE 4. Several methods may be used, including 

comparison with pre-analyzed transients in the stress analysis, or 

inspection of the components. 

ASME Code, Section XI, Appendix E (Ref. 8), may also be used to 

support the evaluation. However, its use is restricted to evaluation of the 

vessel beltline. 
RCS P/T Limits 

B 3.4.3 

BWOG STS B 3.4.3-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition C is modified by a Note requiring Required Action C.2 to be 

completed whenever the Condition is entered. The Note emphasizes the 

need to perform the evaluation of the effects of the excursion outside the 

allowable limits. Restoration alone, per Required Action C.1, is 

insufficient because higher than analyzed stresses may have occurred 

and may have affected RCPB integrity. 

SURVEILLANCE SR 3.4.3.1

REQUIREMENTS 

Verification that operation is within the PTLR limits is required every 

30 minutes when RCS pressure and temperature conditions are 

undergoing planned changes. 

This Frequency is considered reasonable in view of the control room 

indication available to monitor RCS status. Also, since temperature rate 

of change limits are specified in hourly increments, 30 minutes permits 

assessment and correction for minor deviations within a reasonable time. 

Surveillance for heatup, cooldown, or ISLH testing may be discontinued 

when the definition given in the relevant plant procedure for ending the 

activity is satisfied. 

This SR is modified by a Note that requires this SR to be performed only 

during system heatup, cooldown, and ISLH testing. 

REFERENCES 1. BAW-10046A, Rev. 1, July 1977. 

 2. 10 CFR 50, Appendix G. 

 3. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G. 

 4. Regulatory Guide 1.99, Revision 2, May 1988. 

 5. NUREG-0800, Section 5.3.1, Rev. 1, July 1981. 

 6. ASTM E 185-82, July 1982. 

 7. 10 CFR 50, Appendix H. 

 8. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E. 
RCS Loops - MODES 1 and 2 

B 3.4.4 

BWOG STS B 3.4.4-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.4 RCS Loops - MODES 1 and 2 

BASES 

BACKGROUND The primary function of the RCS is removal of the heat generated in the 

fuel due to the fission process, and transfer of this heat, via the steam 

generators (SGs), to the secondary plant. 

The secondary functions of the RCS include: 

a. Moderating the neutron energy level to the thermal state, to increase 

the probability of fission, 

b. Improving the neutron economy by acting as a reflector, 

c. Carrying the soluble neutron poison, boric acid, 

d. Providing a second barrier against fission product release to the 

environment, and 

e. Removing the heat generated in the fuel due to fission product decay 

following a unit shutdown. 

The RCS configuration for heat transport uses two RCS loops. Each 

RCS loop contains an SG and two reactor coolant pumps (RCPs). An 

RCP is located in each of the two SG cold legs. The pump flow rate has 

been sized to provide core heat removal with appropriate margin to 

departure from nucleate boiling (DNB) during power operation and for 

anticipated transients originating from power operation. This 

Specification requires two RCS loops with either three or four pumps to 

be in operation. With three pumps in operation the reactor power level is 

restricted to [79.9]% RTP to preserve the core power to flow relationship, 

thus maintaining the margin to DNB. The intent of the Specification is to 

require core heat removal with forced flow during power operation. 

Specifying the minimum number of pumps is an effective technique for 

designating the proper forced flow rate for heat transport, and specifying 

two loops provides for the needed amount of heat removal capability for 

the allowed power levels. Specifying two RCS loops also provides the 

minimum necessary paths (two SGs) for heat removal. 

The Reactor Protection System (RPS) nuclear overpower trip setpoint is 

automatically reduced when one pump is taken out of service; manual 

resetting is not necessary. 
RCS Loops - MODES 1 and 2 

B 3.4.4 

BWOG STS B 3.4.4-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE Safety analyses contain various assumptions for the Design Bases 

SAFETY Accident (DBA) initial conditions including: RCS pressure, RCS 

ANALYSES temperature, reactor power level, core parameters, and safety system 

setpoints. The important aspect for this LCO is the reactor coolant forced 

flow rate, which is represented by the number of pumps in service. 

Both transient and steady state analyses have been performed to 

establish the effect of flow on DNB. The transient or accident analysis for 

the plant has been performed assuming either three or four pumps are in 

operation. The majority of the plant safety analysis is based on initial 

conditions at high core power or zero power. The accident analyses that 

are of most importance to RCP operation are the four pump coastdown, 

single pump locked rotor, and single pump (broken shaft or coastdown) 

(Ref. 1). 

Steady state DNB analysis has been performed for four, three, and two 

pump combinations. For four pump operation, the steady state DNB 

analysis, which generates the pressure and temperature SL (i.e., the 

departure from nucleate boiling ratio (DNBR) limit), assumes a maximum 

power level of [112]% RTP. This is the design overpower condition for 

four pump operation. The [112]% value is the accident analysis setpoint 

of the nuclear overpower (high flux) trip and is based on an analysis 

assumption that bounds possible instrumentation errors. The DNBR limit 

defines a locus of pressure and temperature points that result in a 

minimum DNBR greater than or equal to the critical heat flux correlation 

limit. 

The three pump pressure temperature limit is tied to the steady state DNB 

analysis, which is evaluated each cycle. The flow used is the minimum 

allowed for three pump operation. The actual RCS flow rate will exceed 

the assumed flow rate. With three pumps operating, overpower 

protection is automatically provided by the power to flow ratio of the RPS 

nuclear overpower based on RCS flow and AXIAL POWER IMBALANCE 

setpoint. The maximum power level for three pump operation is 

[79.9]% RTP and is based on the three pump flow as a fraction of the four 

pump flow at full power. 

Although the Specification limits operation to a minimum of three pumps 

total, existing design analyses show that operation with one pump in each 

loop (two pumps total) is acceptable when core THERMAL POWER is 

restricted to be proportionate to the flow. However, continued power 

operation with two RCPs removed from service is not allowed by this 

Specification. 

RCS Loops - MODES 1 and 2 satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
RCS Loops - MODES 1 and 2 

B 3.4.4 

BWOG STS B 3.4.4-3 Rev. 3.0, 03/31/04 

BASES 

LCO The purpose of this LCO is to require adequate forced flow for core heat 

removal. Flow is represented by the number of RCPs in operation in both 

RCS loops for removal of heat by the two SGs. To meet safety analysis 

acceptance criteria for DNB, four pumps are required at rated power; if 

only three pumps are available, power must be reduced. 

APPLICABILITY In MODES 1 and 2, the reactor is critical and has the potential to produce 

maximum THERMAL POWER. To ensure that the assumptions of the 

accident analyses remain valid, all RCS loops are required to be 

OPERABLE and in operation in these MODES to prevent DNB and core 

damage. 

The decay heat production rate is much lower than the full power heat 

rate. As such, the forced circulation flow and heat sink requirements are 

reduced for lower, noncritical MODES as indicated by the LCOs for 

MODES 3, 4, and 5. 

Operation in other MODES is covered by: 

LCO 3.4.5, "RCS Loops - MODE 3," 

LCO 3.4.6, "RCS Loops - MODE 4," 

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," 

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled," 

LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - 

 High Water Level" (MODE 6); and 

LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - 

 Low Water Level" (MODE 6). 

ACTIONS A.1

If the requirements of the LCO are not met, the Required Action is to 

reduce power and bring the plant to MODE 3. This lowers power level 

and thus reduces the core heat removal needs and minimizes the 

possibility of violating DNB limits. 

The Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power conditions in an orderly 

manner and without challenging safety systems. 
RCS Loops - MODES 1 and 2 

B 3.4.4 

BWOG STS B 3.4.4-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.4.1

REQUIREMENTS 

This SR requires verification every 12 hours of the required number of 

loops in operation. Verification includes flow rate, temperature, or pump 

status monitoring, which help ensure that forced flow is providing heat 

removal while maintaining the margin to DNB. The 12 hour interval has 

been shown by operating practice to be sufficient to regularly assess 

degradation and verify operation within safety analyses assumptions. In 

addition, control room indication and alarms will normally indicate loop 

status. 

REFERENCES 1. FSAR, Chapter [ ] . 
RCS Loops - MODE 3 

B 3.4.5 

BWOG STS B 3.4.5-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.5 RCS Loops - MODE 3 

BASES 

BACKGROUND The primary function of the reactor coolant in MODE 3 is removal of 

decay heat and transfer of this heat, via the steam generators (SGs), to 

the secondary plant fluid. The secondary function of the reactor coolant 

is to act as a carrier for soluble neutron poison, boric acid. 

In MODE 3, reactor coolant pumps (RCPs) are used to provide forced 

circulation for heat removal during heatup and cooldown. The number of 

RCPs in operation will vary depending on operational needs, and the 

intent of this LCO is to provide forced flow from at least one RCP for core 

heat removal and transport. The flow provided by one RCP is adequate 

for heat removal and for boron mixing. However, two RCS loops are 

required to be OPERABLE to provide redundant paths for heat removal. 

Reactor coolant natural circulation is not normally used; however, the 

natural circulation flow rate is sufficient for core cooling. If entry into 

natural circulation is required, the reactor coolant at the highest elevation 

of the hot leg must be maintained subcooled for single phase circulation. 

When in natural circulation, it is preferable to remove heat using both SGs 

to avoid idle loop stagnation that might occur if only one SG were in 

service. One generator will provide adequate heat removal. Boron 

reduction in natural circulation is prohibited because mixing to obtain a 

homogeneous concentration in all portions of the RCS cannot be 

ensured. 

APPLICABLE No safety analyses are performed with initial conditions in MODE 3. 

SAFETY 

ANALYSES Failure to provide heat removal may result in challenges to a fission 

product barrier. The RCS loops are part of the primary success path that 

functions or actuates to prevent or mitigate a Design Basis Accident or 

transient that either assumes the failure of, or presents a challenge to, the 

integrity of a fission product barrier. 

RCS Loops - MODE 3 satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
RCS Loops - MODE 3 

B 3.4.5 

BWOG STS B 3.4.5-2 Rev. 3.0, 03/31/04 

BASES 

LCO The purpose of this LCO is to require two loops to be available for heat 

removal thus providing redundancy. The LCO requires the two loops to 

be OPERABLE with the intent of requiring both SGs to be capable of 

transferring heat from the reactor coolant at a controlled rate. Forced 

reactor coolant flow is the required way to transport heat, although natural 

circulation flow provides adequate removal. A minimum of one running 

RCP meets the LCO requirement for one loop in operation. 

The Note permits a limited period of operation without RCPs. All RCPs 

may be removed from operation for ≤ 8 hours per 24 hour period for the 

transition to or from the Decay Heat Removal (DHR) System, and 

otherwise may be de-energized for ≤ 1 hour per 8 hour period. This 

means that natural circulation has been established. When in natural 

circulation, boron reduction with coolant at boron concentrations less than 

required to assure the SDM of LCO 3.1.1, is prohibited because an even 

concentration distribution throughout the RCS cannot be ensured. Core 

outlet temperature is to be maintained at least [10]°F below the saturation 

temperature so that no vapor bubble may form and possibly cause a 

natural circulation flow obstruction. 

In MODES 3, 4, and 5, it is sometimes necessary to stop all RCP or DHR 

pump forced circulation (e.g., change operation from one DHR train to the 

other, to perform surveillance or startup testing, to perform the transition 

to and from DHR System cooling, or to avoid operation below the RCP 

minimum net positive suction head limit). The time period is acceptable 

because natural circulation is adequate for heat removal, or the reactor 

coolant temperature can be maintained subcooled and boron stratification 

affecting reactivity control is not expected. 

An OPERABLE RCS loop consists of at least one OPERABLE RCP and 

an SG that is OPERABLE in accordance with the Steam Generator Tube 

Surveillance Program. An RCP is OPERABLE if it is capable of being 

powered and is able to provide forced flow if required. 

APPLICABILITY In MODE 3, the heat load is lower than at power; therefore, one RCS loop 

in operation is adequate for transport and heat removal. A second RCS 

loop is required to be OPERABLE but not in operation for redundant heat 

removal capability. 

Operation in other MODES is covered by: 

LCO 3.4.4, "RCS Loops - MODES 1 and 2," 

LCO 3.4.6, "RCS Loops - MODE 4," 

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," 
RCS Loops - MODE 3 

B 3.4.5 

BWOG STS B 3.4.5-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled," 

LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - 

High Water Level" (MODE 6), and 

LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low 

Water Level" (MODE 6). 

ACTIONS A.1

If one RCS loop is inoperable, redundancy for forced flow heat removal is 

lost. The Required Action is restoration of the RCS loop to OPERABLE 

status within a Completion Time of 72 hours. This time allowance is a 

justified period to be without the redundant nonoperating loop because a 

single loop in operation has a heat transfer capability greater than that 

needed to remove the decay heat produced in the reactor core. 

B.1

If restoration of an RCS loop as required in A.1 is not possible within 

72 hours, the unit must be brought to MODE 4. In MODE 4, the plant 

may be placed on the DHR System. The allowed Completion Time of 

12 hours is reasonable, based on operating experience, to achieve 

cooldown and depressurization from the existing plant conditions and 

without challenging plant systems. 

C.1 and C.2

If two RCS loops are inoperable or a required RCS loop is not in 

operation, except as provided in the Note in the LCO section, all 

operations involving introduction of coolant into the RCS with boron 

concentration less than required to meet the minimum SDM of LCO 3.1.1 

must be immediately suspended. Action to restore one RCS loop to 

operation shall be immediately initiated and continued until one RCS loop 

is restored to OPERABLE status and to operation. Suspending the 

introduction of coolant into the RCS of coolant with boron concentration 

less than required to meet the minimum SDM of LCO 3.1.1 is required to 

assure continued safe operation. With coolant added without forced 

circulation, unmixed coolant could be introduced to the core, however 

coolant added with boron concentration meeting the minimum SDM 

maintains acceptable margin to subcritical operations. The immediate 

Completion Time reflects the importance of maintaining operation for 

decay heat removal. 
RCS Loops - MODE 3 

B 3.4.5 

BWOG STS B 3.4.5-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.5.1

REQUIREMENTS 

This SR requires verification every 12 hours that the required number of 

loops and pumps is in operation. Verification includes flow rate, 

temperature, or pump status monitoring, which help ensure that forced 

flow is providing heat removal. The 12 hour interval has been shown by 

operating practice to be sufficient to regularly assess RCS loop status. In 

addition, control room indication and alarms will normally indicate loop 

status. 

SR 3.4.5.2

Verification that each required RCP is OPERABLE ensures that the single 

failure criterion is met and that an additional RCS loop can be placed in 

operation, if needed, to maintain decay heat removal and reactor coolant 

circulation. Verification is performed by verifying proper breaker 

alignment and power availability to each required pump. Alternatively, 

verification that a pump is in operation also verifies proper breaker 

alignment and power availability. The Frequency of 7 days is considered 

reasonable in view of other administrative controls available and has 

been shown to be acceptable by operating experience. 

This SR is modified by a Note that states the SR is not required to be 

performed until 24 hours after a required pump is not in operation. 

REFERENCES None. 
RCS Loops - MODE 4 

B 3.4.6 

BWOG STS B 3.4.6-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.6 RCS Loops - MODE 4 

BASES 

BACKGROUND In MODE 4, the primary function of the reactor coolant is the removal of 

decay heat and transfer of this heat to the steam generators (SGs) or 

decay heat removal (DHR) heat exchangers. The secondary function of 

the reactor coolant is to act as a carrier for soluble neutron poison, boric 

acid. 

In MODE 4, either reactor coolant pumps (RCPs) or DHR pumps can be 

used for coolant circulation. The number of pumps in operation can vary 

to suit the operational needs. The intent of this LCO is to provide forced 

flow from at least one RCP or one DHR pump for decay heat removal and 

transport. The flow provided by one RCP or one DHR pump is adequate 

for heat removal. The other intent of this LCO is to require that two paths 

(loops) be available to provide redundancy for heat removal. 

APPLICABLE No safety analyses are performed with initial condition in MODE 4. 

SAFETY 

ANALYSES RCS Loops - MODE 4 satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). 

LCO The purpose of this LCO is to require that two loops, RCS or DHR, be 

OPERABLE in MODE 4 and one of these loops be in operation. The 

LCO allows the two loops that are required to be OPERABLE to consist of 

any combination of RCS or DHR System loops. Any one loop in 

operation provides enough flow to remove the decay heat from the core 

with forced circulation. The second loop that is required to be 

OPERABLE provides redundant paths for heat removal. 

The Note permits a limited period of operation without RCPs. All RCPs 

may be removed from operation for ≤ 8 hours per 24 hour period for the 

transition to or from the DHR System and otherwise may be de-energized 

for ≤ 1 hour per 8 hour period. This means that natural circulation has 

been established using the SGs. The Note prohibits boron dilution with 

coolant at boron concentrations less than required to assure the SDM of 

LCO 3.1.1 is maintained when forced flow is stopped because an even 

concentration distribution cannot be ensured. Core outlet temperature is 

to be maintained at least 10°F below saturation temperature so that no 

vapor bubble may form and possibly cause a natural circulation flow 

obstruction. 
RCS Loops - MODE 4 

B 3.4.6 

BWOG STS B 3.4.6-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The Note also permits the DHR pumps to be stopped for ≤ 1 hour per 

8 hour period. When the DHR pumps are stopped, no alternate heat 

removal path exists, unless the RCS and SGs have been placed in 

service in forced or natural circulation. The response of the RCS without 

the DHR System depends on the core decay heat load and the length of 

time that the DHR pumps are stopped. As decay heat diminishes, the 

effects on RCS temperature and pressure diminish. Without cooling by 

DHR, higher heat loads will cause the reactor coolant temperature and 

pressure to increase at a rate proportional to the decay heat load. 

Because pressure can increase, the applicable system pressure limits 

(pressure and temperature (P/T) or low temperature overpressure 

protection (LTOP) limits) must be observed and forced DHR flow or heat 

removal via the SGs must be re-established prior to reaching the 

pressure limit. The circumstances for stopping both DHR trains are to be 

limited to situations where: 

a. Pressure and pressure and temperature increases can be maintained 

well within the allowable pressure (P/T and LTOP) and 10°F 

subcooling limits or 

b. An alternate heat removal path through the SG is in operation. 

An OPERABLE RCS loop consists of at least one OPERABLE RCP and 

an SG that is OPERABLE in accordance with the Steam Generator Tube 

Surveillance Program. 

Similarly for the DHR System, an OPERABLE DHR loop is comprised of 

the OPERABLE DHR pump(s) capable of providing forced flow to the 

DHR heat exchanger(s). DHR pumps are OPERABLE if they are capable 

of being powered and are able to provide flow if required. 

APPLICABILITY In MODE 4, this LCO applies because it is possible to remove core decay 

heat and to provide proper boron mixing with either the RCS loops and 

SGs or the DHR System. 

Operation in other MODES is covered by: 

LCO 3.4.4, "RCS Loops - MODES 1 and 2," 

LCO 3.4.5, "RCS Loops - MODE 3," 

LCO 3.4.7, "RCS Loops – MODE 5, Loops Filled," 

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled," 

LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation – 

 High Water Level" (MODE 6), and 

LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation – 

 Low Water Level" (MODE 6). 
RCS Loops - MODE 4 

B 3.4.6 

BWOG STS B 3.4.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

If only one required RCS loop or DHR loop is OPERABLE and in 

operation, redundancy for heat removal is lost. Action must be initiated to 

restore a second loop to OPERABLE status. The immediate Completion 

Time reflects the importance of maintaining the availability of two paths 

for heat removal. 

A.2

If restoration is not accomplished and a DHR loop is OPERABLE, the unit 

must be brought to MODE 5 within the following 24 hours. Bringing the 

unit to MODE 5 is a conservative action with regard to decay heat 

removal. With only one DHR loop OPERABLE, redundancy for decay 

heat removal is lost and, in the event of a loss of the remaining DHR loop, 

it would be safer to initiate that loss from MODE 5 rather than MODE 4. 

The Completion Time of 24 hours is reasonable, based on operating 

experience, to reach MODE 5 in an orderly manner and without 

challenging plant systems. 

This Required Action is modified by a Note which indicates that the unit 

must be placed in MODE 5 only if a DHR loop is OPERABLE. With no 

DHR loop OPERABLE, the unit is in a condition with only limited 

cooldown capabilities. Therefore, the actions are to be concentrated on 

the restoration of a DHR loop, rather than a cooldown of extended 

duration. 

B.1 and B.2

If two required RCS or DHR loops are inoperable or a required loop is not 

in operation, except during conditions permitted by the Note in the LCO 

section, all operations involving introduction of coolant into the RCS with 

boron concentration less than required to meet the minimum SDM of 

LCO 3.1.1 must be suspended and action to restore one RCS or DHR 

loop to OPERABLE status and operation must be initiated. The required 

margin to criticality must not be reduced in this type of operation. 

Suspending the introduction of coolant, into the RCS, with boron 

concentration less than required to meet the minimum SDM of LCO 3.1.1 

is required to ensure continued safe operation. With coolant added 

without forced circulation, unmixed coolant could be introduced to the 

core, however, coolant added with boron concentration meeting the 

minimum SDM maintains acceptable margin to subcritical operations. 

The immediate Completion Times reflect the importance of maintaining 

operation for decay heat removal. The action to restore must continue 

until one loop is restored to operation. 
RCS Loops - MODE 4 

B 3.4.6 

BWOG STS B 3.4.6-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.6.1

REQUIREMENTS 

This Surveillance requires verification every 12 hours of the required DHR 

or RCS loop in operation to ensure forced flow is providing decay heat 

removal. Verification includes flow rate, temperature, or pump status 

monitoring. The 12 hour interval has been shown by operating practice to 

be sufficient to regularly assess RCS loop status. In addition, control 

room indication and alarms will normally indicate loop status. 

SR 3.4.6.2

Verification that each required pump is OPERABLE ensures that an 

additional RCS or DHR loop can be placed in operation if needed to 

maintain decay heat removal and reactor coolant circulation. Verification 

is performed by verifying proper breaker alignment and power available to 

each required pump. Alternatively, verification that a pump is in operation 

also verifies proper breaker alignment and power availability. The 

Frequency of 7 days is considered reasonable in view of other 

administrative controls and has been shown to be acceptable by 

operating experience. 

This SR is modified by a Note that states the SR is not required to be 

performed until 24 hours after a required pump is not in operation. 

REFERENCES None. 
RCS Loops - MODE 5, Loops Filled 

B 3.4.7 

BWOG STS B 3.4.7-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.7 RCS Loops - MODE 5, Loops Filled 

BASES 

BACKGROUND In MODE 5 with RCS loops filled, the primary function of the reactor 

coolant is the removal of decay heat and transfer of this heat either to the 

steam generator (SG) secondary side coolant or the component cooling 

water via the decay heat removal (DHR) heat exchangers. While the 

principal means for decay heat removal is via the DHR System, the SGs 

are specified as a backup means for redundancy. Although the SGs 

cannot remove heat unless steaming occurs (which is not possible in 

MODE 5), they are available as a temporary heat sink and can be used 

by allowing the RCS to heat up into the temperature region of MODE 4 

where steaming can be effective for heat removal. The secondary 

function of the reactor coolant is to act as a carrier for soluble neutron 

poison, boric acid. 

In MODE 5 with RCS loops filled, DHR loops are the principal means for 

heat removal. The number of loops in operation can vary to suit the 

operational needs. The intent of this LCO is to provide forced flow from at 

least one DHR loop for decay heat removal and transport. The flow 

provided by one DHR loop is adequate for decay heat removal. The 

other intent of this LCO is to require that a second path be available to 

provide redundancy for heat removal. 

The LCO provides for either SG heat removal or DHR System heat 

removal. In this MODE, reactor coolant pump (RCP) operation may be 

restricted because of net positive suction head (NPSH) limitations, and 

the SG will not be able to provide steam for the turbine driven feed 

pumps. However, to ensure that the SGs can be used as a heat sink, a 

motor driven feedwater pump is needed, because it is independent of 

steam. Condensate pumps, startup pumps, or the motor driven auxiliary 

feedwater pump can be used. If RCPs are available, the steam generator 

level need not be adjusted. If RCPs are not available, the water level 

must be adjusted for natural circulation. The high entry point in the 

generator should be accessible from the feedwater pumps so that natural 

circulation can be stimulated. The SGs are primarily a backup to the 

DHR pumps, which are used for forced flow. By requiring the SGs to be a 

backup heat removal path, the option to increase RCS pressure and 

temperature for heat removal in MODE 4 is provided. 
RCS Loops - MODE 5, Loops Filled 

B 3.4.7 

BWOG STS B 3.4.7-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE No safety analyses are performed with initial conditions in MODE 5. 

SAFETY 

ANALYSES RCS Loops - MODE 5 (Loops Filled) satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii). 

LCO The purpose of this LCO is to require that at least one of the DHR loops 

be OPERABLE and in operation with an additional DHR loop OPERABLE 

or both SGs with secondary side water level ≥ [50]%. One DHR loop 

provides sufficient forced circulation to perform the safety functions of the 

reactor coolant under these conditions. The second DHR loop is normally 

maintained as a backup to the operating DHR loop to provide redundancy 

for decay heat removal. However, if the standby DHR loop is not 

OPERABLE, a sufficient alternate method of providing redundant heat 

removal paths is to provide both SGs with their secondary side water 

levels ≥ [50]%. Should the operating DHR loop fail, the SGs could be 

used to remove the decay heat. 

Note 1 permits the DHR pumps to be removed from operation for up to 

1 hour per 8 hour period. The circumstances for stopping both DHR 

trains are to be limited to situations where: (a) Pressure and temperature 

increases can be maintained well within the allowable pressure (P/T and 

low temperature overpressure protection) and 10°F subcooling limits or 

(b) Alternate heat paths through the SGs are in operation. 

The Note prohibits boron dilution with coolant at boron concentrations 

less than required to assure the SDM of LCO 3.1.1 is maintained when 

DHR forced flow is stopped because an even concentration distribution 

cannot be ensured. Core outlet temperature is to be maintained at least 

10°F below saturation temperature so that no vapor bubble would form 

and possibly cause a natural circulation flow obstruction. In this MODE, 

the generators are used as a backup for decay heat removal and, to 

ensure their availability, the RCS loop flow path is to be maintained with 

subcooled liquid. 

In MODE 5, it is sometimes necessary to stop all RCP or DHR pump 

forced circulation. This is permitted to change operation from one DHR 

train to the other, perform surveillance or startup testing, perform the 

transition to and from the DHR System, or to avoid operation below the 

RCP minimum NPSH limit. The time period is acceptable because 

natural circulation is acceptable for heat removal, the reactor coolant 

temperature can be maintained subcooled, and boron stratification 

affecting reactivity control is not expected. 
RCS Loops - MODE 5, Loops Filled 

B 3.4.7 

BWOG STS B 3.4.7-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Note 2 allows one DHR loop to be inoperable for a period of up to 2 hours 

provided that the other loop is OPERABLE and in operation. This permits 

periodic surveillance tests to be performed on the inoperable loop during 

the only time when such testing is safe and possible. 

Note 3 provides for an orderly transition from MODE 5 to MODE 4 during 

a planned heatup by permitting DHR loops to not be in operation when at 

least one RCP is in operation. This Note provides for the transition to 

MODE 4 where an RCP is permitted to be in operation and replaces the 

RCS circulation function provided by the DHR loops. 

An OPERABLE DHR loop is composed of an OPERABLE DHR pump 

and an OPERABLE DHR heat exchanger. 

DHR pumps are OPERABLE if they are capable of being powered and 

are able to provide flow if required. An OPERABLE SG can perform as a 

heat sink when it has an adequate water level and is OPERABLE in 

accordance with the Steam Generator Tube Surveillance Program. 

APPLICABILITY In MODE 5 with loops filled, forced circulation is provided by this LCO to 

remove decay heat from the core and to provide proper boron mixing. 

One loop of DHR provides sufficient circulation for these purposes. 

Operation in other MODES is covered by: 

LCO 3.4.4, "RCS Loops - MODES 1 and 2," 

LCO 3.4.5, "RCS Loops - MODE 3," 

LCO 3.4.6, "RCS Loops - MODE 4," 

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled," 

LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High 

 Water Level" (MODE 6), and 

LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low 

 Water Level" (MODE 6). 

ACTIONS A.1, A.2, B.1, and B.2

If one DHR loop is OPERABLE and any required SG has secondary side 

water level < [50]% or one required DHR loop inoperable, redundancy for 

heat removal is lost. Action must be initiated to restore a second DHR 

loop to OPERABLE status or initiate action to restore the secondary side 

water level in the SGs, and action must be taken immediately. Either 

Required Action will restore redundant decay heat removal paths. The 

immediate Completion Time reflects the importance of maintaining the 

availability of two paths for heat removal. 
RCS Loops - MODE 5, Loops Filled 

B 3.4.7 

BWOG STS B 3.4.7-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

If no required DHR loop is in operation, except as provided in Note 1, or 

no required DHR loop is OPERABLE, all operations involving introduction 

of coolant into the RCS with boron concentration less than required to 

meet the minimum SDM of LCO 3.1.1 must be suspended and action to 

restore a DHR loop to OPERABLE status and operation must be initiated. 

The required margin to criticality must not be reduced in this type of 

operation. Suspending the introduction of coolant into the RCS of coolant 

with boron concentration less than required to meet the minimum SDM of 

LCO 3.1.1 is required to assure continued safe operation. With coolant 

added without forced circulation, unmixed coolant could be introduced to 

the core, however coolant added with boron concentration meeting the 

minimum SDM maintains acceptable margin to subcritical operations. 

The immediate Completion Time reflects the importance of maintaining 

operation for decay heat removal. 

SURVEILLANCE SR 3.4.7.1

REQUIREMENTS 

This SR requires verification every 12 hours that the required DHR loop is 

in operation. Verification includes flow rate, temperature, or pump status 

monitoring, which help ensure that forced flow is providing heat removal. 

The 12 hour Frequency has been shown by operating practice to be 

sufficient to regularly assess degradation. In addition, control room 

indication and alarms will normally indicate loop status. 

SR 3.4.7.2

Verifying the SGs are OPERABLE by ensuring their secondary side water 

levels are ≥ [50]% ensures that redundant heat removal paths are 

available if the second DHR loop is not OPERABLE. If both DHR loops 

are OPERABLE, this Surveillance is not needed. The 12 hour Frequency 

has been shown by operating practice to be sufficient to regularly assess 

degradation and verify operation within safety analyses assumptions. 
RCS Loops - MODE 5, Loops Filled 

B 3.4.7 

BWOG STS B 3.4.7-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.4.7.3

Verification that each required DHR pump is OPERABLE ensures that 

redundant paths for heat removal are available. The requirement also 

ensures that the additional loop can be placed in operation if needed to 

maintain decay heat removal and reactor coolant circulation. If the 

secondary side water level is ≥ [50]% in both SGs, this Surveillance is not 

needed. Verification is performed by verifying proper breaker alignment 

and power available to each required pump. Alternatively, verification 

that a pump is in operation also verifies proper breaker alignment and 

power availability. The Frequency of 7 days is considered reasonable in 

view of other administrative controls available and has been shown to be 

acceptable by operating experience. 

This SR is modified by a Note that states the SR is not required to be 

performed until 24 hours after a required pump is not in operation. 

REFERENCES None. 
RCS Loops - MODE 5, Loops Not Filled 

B 3.4.8 

BWOG STS B 3.4.8-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.8 RCS Loops - MODE 5, Loops Not Filled 

BASES 

BACKGROUND In MODE 5 with loops not filled, the primary function of the reactor coolant 

is the removal of decay heat and transfer of this heat to the decay heat 

removal (DHR) heat exchangers. The steam generators (SGs) are not 

available as a heat sink when the loops are not filled. The secondary 

function of the reactor coolant is to act as a carrier for the soluble neutron 

poison, boric acid. 

Loops are not filled when the reactor coolant water level is within the 

horizontal portion of the hot leg as might be the case for refueling or 

maintenance on the reactor coolant pumps or SGs. GL 88-17 (Ref. 1) 

expresses concerns for loss of decay heat removal for this operating 

condition. With water at this low level, the margin above the decay heat 

suction piping connection to the hot leg is small. The possibility of loss of 

level or inlet vortexing exists and if it were to occur, the operating DHR 

pump could become air bound and fail resulting in a loss of forced flow for 

heat removal. As a consequence the water in the core will heat up and 

could boil with the possibility of core uncovering due to boil off. Because 

the containment hatch may be open at this time, a pathway to the outside 

for fission product release exists if core damage were to occur. 

In MODE 5 with loops not filled, only DHR pumps can be used for coolant 

circulation. The number of pumps in operation can vary to suit the 

operational needs. The intent of this LCO is to provide forced flow from at 

least one DHR pump for decay heat removal and transport, to require that 

two paths be available to provide redundancy for heat removal. 

APPLICABLE No safety analyses are performed with initial conditions in MODE 5 with 

SAFETY loops not filled. The flow provided by one DHR pump is adequate for 

ANALYSES heat removal and for boron mixing. 

RCS Loops - MODE 5 (Loops Not Filled) satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii). 

LCO The purpose of this LCO is to require that a minimum of two DHR loops 

be OPERABLE and that one of these loops be in operation. An 

OPERABLE loop is one that has the capability of transferring heat from 

the reactor coolant at a controlled rate. Heat cannot be removed via the 

DHR system unless forced flow is used. A minimum of one running 

decay heat removal pump meets the LCO requirement for one loop in 

operation. An additional DHR loop is required to be OPERABLE to 

provide redundancy for heat removal. 
RCS Loops - MODE 5, Loops Not Filled 

B 3.4.8 

BWOG STS B 3.4.8-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Note 1 permits the DHR pumps to be removed from operation for 

≥ 15 minutes when switching from one train to the other. The 

circumstances for stopping both DHR pumps are to be limited to 

situations where the outage time is short [and temperature is maintained 

≥ [160]°F]. The Note prohibits boron dilution with coolant at boron 

concentrations less than required to assure the SDM of LCO 3.1.1 is 

maintained or draining operations when DHR forced flow is stopped. 

Note 2 allows one DHR loop to be inoperable for a period of 2 hours 

provided that the other loop is OPERABLE and in operation. This permits 

periodic surveillance tests to be performed on the inoperable loop during 

the only time when these tests are safe and possible. 

An OPERABLE DHR loop is composed of an OPERABLE DHR pump 

capable of providing forced flow to an OPERABLE DHR heat exchanger. 

DHR pumps are OPERABLE if they are capable of being powered and 

are able to provide flow if required. 

APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heat removal and 

coolant circulation by the DHR System. 

Operation in other MODES is covered by: 

LCO 3.4.4, "RCS Loops - MODES 1 and 2," 

LCO 3.4.5, "RCS Loops - MODE 3," 

LCO 3.4.6, "RCS Loops - MODE 4," 

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled," 

LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High 

 Water Level" (MODE 6), and 

LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low 

 Water Level" (MODE 6). 

ACTIONS A.1

If one required DHR loop is inoperable, redundancy for heat removal is 

lost. Required Action A.1 is to immediately initiate activities to restore a 

second loop to OPERABLE status. The immediate Completion Time 

reflects the importance of maintaining the availability of two paths for heat 

removal. 
RCS Loops - MODE 5, Loops Not Filled 

B 3.4.8 

BWOG STS B 3.4.8-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

If no required loop is OPERABLE or the required loop is not in operation, 

except as provided by Note 1 in the LCO, the Required Action requires 

immediate suspension of all operations involving introduction of coolant 

into the RCS with boron concentration less than required to meet the 

minimum SDM of LCO 3.1.1 and requires initiation of action to 

immediately restore one DHR loop to OPERABLE status and operation. 

The Required Action for restoration does not apply to the condition of 

both loops not in operation when the exception Note in the LCO is in 

force. Suspending the introduction of coolant into the RCS of coolant with 

boron concentration less than required to meet the minimum SDM of 

LCO 3.1.1 is required to assure continued safe operation. With coolant 

added without forced circulation, unmixed coolant could be introduced to 

the core, however coolant added with boron concentration meeting the 

minimum SDM maintains acceptable margin to subcritical operations. 

The immediate Completion Time reflects the importance of maintaining 

operations for decay heat removal. The action to restore must continue 

until one loop is restored. 

SURVEILLANCE SR 3.4.8.1

REQUIREMENTS 

This Surveillance requires verification every 12 hours that the required 

loop is in operation. Verification includes flow rate, temperature, or pump 

status monitoring, which help ensure that forced flow is providing heat 

removal. The 12 hour interval has been shown by operating practice to 

be sufficient to regularly assess degradation and verify operation within 

safety analyses assumptions. 

SR 3.4.8.2

Verification that each required pump is OPERABLE ensures that 

redundancy for heat removal is provided. The requirement also ensures 

that an additional loop can be placed in operation if needed to maintain 

decay heat removal and reactor coolant circulation. Verification is 

performed by verifying proper breaker alignment and power available to 

each required pump. Alternatively, verification that a pump is in operation 

also verifies proper breaker alignment and power availability. The 

Frequency of 7 days is considered reasonable in view of other 

administrative controls available and has been shown to be acceptable by 

operating experience. 

This SR is modified by a Note that states the SR is not required to be 

performed until 24 hours after a required pump is not in operation. 
RCS Loops - MODE 5, Loops Not Filled 

B 3.4.8 

BWOG STS B 3.4.8-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. Generic Letter 88-17, October 17, 1988. 
Pressurizer 

B 3.4.9 

BWOG STS B 3.4.9-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.9 Pressurizer 

BASES 

BACKGROUND The pressurizer provides a point in the RCS where liquid and vapor are 

maintained in equilibrium under saturated conditions for pressure control 

purposes to prevent bulk boiling in the remainder of the RCS. Key 

functions include maintaining required primary system pressure during 

steady state operation and limiting the pressure changes caused by 

reactor coolant thermal expansion and contraction during normal load 

transients. 

The pressure control components addressed by this LCO include the 

pressurizer water level, the required heaters, and their controls and 

emergency power supplies. Pressurizer safety valves and pressurizer 

power operated relief valves (PORVs) are addressed by LCO 3.4.10, 

"Pressurizer Safety Valves," and LCO 3.4.11, "Pressurizer Power 

Operated Relief Valve (PORV)," respectively. 

The maximum water level limit has been established to ensure that a 

liquid to vapor interface exists to permit RCS pressure control during 

normal operation and proper pressure response for anticipated design 

basis transients. The water level limit thus serves two purposes: 

a. Pressure control during normal operation maintains subcooled 

reactor coolant in the loops and thus is in the preferred state for heat 

transport and 

b. By restricting the level to a maximum, expected transient reactor 

coolant volume increases (pressurizer insurge) will not cause 

excessive level changes that could result in degraded ability for 

pressure control. 

The maximum water level limit permits pressure control equipment to 

function as designed. The limit preserves the steam space during normal 

operation, thus both sprays and heaters can operate to maintain the 

design operating pressure. The level limit also prevents filling the 

pressurizer (water solid) for anticipated design basis transients, thus 

ensuring that pressure relief devices (PORVs or code safety valves) can 

control pressure by steam relief rather than water relief. If the level limits 

were exceeded prior to a transient that creates a large pressurizer 

insurge volume leading to water relief, the maximum RCS pressure might 

exceed the design Safety Limit (SL) of 2750 psig or damage may occur to 

the PORVs or pressurizer code safety valves. 
Pressurizer 

B 3.4.9 

BWOG STS B 3.4.9-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The pressurizer heaters are used to maintain a pressure in the RCS so 

reactor coolant in the loops is subcooled and thus in the preferred state 

for heat transport to the steam generators (SGs). This function must be 

maintained with a loss of offsite power. Consequently, the emphasis of 

this LCO is to ensure that the essential power supplies and the 

associated heaters are adequate to maintain pressure for RCS loop 

subcooling with an extended loss of offsite power. 

A minimum required available capacity of [126] kW ensures that the RCS 

pressure can be maintained. Unless adequate heater capacity is 

available, reactor coolant subcooling cannot be maintained indefinitely. 

Inability to control the system pressure and maintain subcooling under 

conditions of natural circulation flow in the primary system could lead to 

loss of single phase natural circulation and decreased capability to 

remove core decay heat. 

APPLICABLE In MODES 1 and 2, the LCO requirement for a steam bubble is reflected 

SAFETY implicitly in the accident analyses. No safety analyses are performed in 

ANALYSES lower MODES. All analyses performed from a critical reactor condition 

assume the existence of a steam bubble and saturated conditions in the 

pressurizer. In making this assumption, the analyses neglect the small 

fraction of noncondensible gases normally present. 

Safety analyses presented in the FSAR do not take credit for pressurizer 

heater operation; however, an implicit initial condition assumption of the 

safety analyses is that the RCS is operating at normal pressure. 

The maximum level limit is of prime interest for the loss of main feedwater 

(LOMFW) event. Conservative safety analyses assumptions for this 

event indicate that it produces the largest increase of pressurizer level 

caused by a moderate frequency event. Thus this event has been 

selected to establish the pressurizer water level limit. Assuming proper 

response action by emergency systems, the level limit prevents water 

relief through the pressurizer safety valves. Since prevention of water 

relief is a goal for abnormal transient operation, rather than an SL, the 

value for pressurizer level is nominal and is not adjusted for instrument 

error. 
Pressurizer 

B 3.4.9 

BWOG STS B 3.4.9-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

Evaluations performed for the design basis large break loss of coolant 

accident (LOCA), which assumed a higher maximum level than assumed 

for the LOMFW event, have been made. The higher pressurizer level 

assumed for the LOCA is the basis for the volume of reactor coolant 

released to the containment. The containment analysis performed using 

the mass and energy release demonstrated that the maximum resulting 

containment pressure was within design limits. 

The requirement for emergency power supplies is based on 

NUREG-0737 (Ref. 1). The intent is to allow maintaining the reactor 

coolant in a subcooled condition with natural circulation at hot, high 

pressure conditions for an undefined, but extended, time period after a 

loss of offsite power. While loss of offsite power is an initial condition or 

coincident event assumed in many accident analyses, maintaining hot, 

high pressure conditions over an extended time period is not evaluated as 

part of FSAR accident analyses. 

The maximum pressurizer water level limit satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). Although the heaters are not specifically used in 

accident analysis, the need to maintain subcooling in the long term during 

loss of offsite power, as indicated in NUREG-0737 (Ref. 1), is the reason 

for providing an LCO. 

LCO The LCO requirement for the pressurizer to be OPERABLE with a water 

level ≤ [290] inches ensures that a steam bubble exists. Limiting the 

maximum operating water level preserves the steam space for pressure 

control. The LCO has been established to ensure the capability to 

establish and maintain pressure control for steady state operation and to 

minimize the consequences of potential overpressure transients. 

Requiring the presence of a steam bubble is also consistent with 

analytical assumptions. 

The LCO requires a minimum of [126] kW of pressurizer heaters 

OPERABLE [and capable of being powered from an emergency power 

supply]. As such, the LCO addresses both the heaters and the power 

supplies. The minimum heater capacity required is sufficient to maintain 

the system near normal operating pressure when accounting for heat 

losses through the pressurizer insulation. By maintaining the pressure 

near the operating conditions, a wide margin to subcooling can be 

obtained in the loops. The exact design value of [126] kW is derived from 

the use of nine heaters rated at 14 kW each. The amount needed to 

maintain pressure is dependent on the insulation losses, which can vary 

due to tightness of fit and condition. 
Pressurizer 

B 3.4.9 

BWOG STS B 3.4.9-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The need for pressure control is most pertinent when core heat can cause 

the greatest effect on RCS temperature, resulting in the greatest effect on 

pressurizer level and RCS pressure control. Thus Applicability has been 

designated for MODES 1 and 2. The Applicability is also provided for 

MODE 3 and, for pressurizer water level, for MODE 4 with RCS 

temperature ≥ [275]°F. The purpose is to prevent solid water RCS 

operation during heatup and cooldown to avoid rapid pressure rises 

caused by normal operational perturbations, such as reactor coolant 

pump startup. The temperature of [275]°F has been designated as the 

cutoff for applicability because LCO 3.4.12, "Low Temperature 

Overpressure Protection (LTOP) System," provides a requirement for 

pressurizer level below [275]°F. The LCO does not apply to MODE 5 with 

loops filled because LCO 3.4.12 applies. The LCO does not apply to 

MODES 5 and 6 with partial loop operation. 

In MODES 1, 2, and 3, there is the need to maintain the availability of 

pressurizer heaters capable of being powered from an emergency power 

supply. In the event of a loss of offsite power, the initial conditions of 

these MODES give the greatest demand for maintaining the RCS in a hot 

pressurized condition with loop subcooling for an extended period. The 

Applicability is modified by a Note stating that the OPERABILITY 

requirements on pressurizer heaters do not apply in MODE 4. For 

MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to 

ensure loop subcooling for heat transfer when the Decay Heat Removal 

System is in service, and therefore the LCO is not applicable. 

ACTIONS A.1

With pressurizer water level in excess of the maximum limit, action must 

be taken to restore pressurizer operation to within the bounds assumed in 

the analysis. This is done by restoring the pressurizer water level to 

within the limit. The 1 hour Completion Time is considered to be a 

reasonable time for draining excess liquid. 

B.1 and B.2

If the water level cannot be restored, reducing core power constrains heat 

input effects that drive pressurizer insurge that could result from an 

anticipated transient. By shutting down the reactor and reducing reactor 

coolant temperature to at least MODE 3, the potential thermal energy of 

the reactor coolant mass for LOCA mass and energy releases is reduced. 
Pressurizer 

B 3.4.9 

BWOG STS B 3.4.9-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Six hours is a reasonable time based upon operating experience to reach 

MODE 3 from full power without challenging plant systems and operators. 

Further pressure and temperature reduction to MODE 4 with RCS 

temperature ≤ [275]°F places the plant into a MODE where the LCO is not 

applicable. The [24] hour Completion Time to reach the nonapplicable 

MODE is reasonable based upon operating experience. 

C.1

If the [emergency] power supplies to the heaters are not capable of 

providing [126] kW, or the pressurizer heaters are inoperable, restoration 

is required in 72 hours. The Completion Time of 72 hours is reasonable 

considering the anticipation that a demand caused by loss of offsite 

power will not occur in this period. Pressure control may be maintained 

during this time using normal station powered heaters. 

D.1 and D.2

If pressurizer heater capability cannot be restored within the allowed 

Completion Time of Required Action C.1, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to MODE 3 within 6 hours and to MODE 4 within the 

following 6 hours. The Completion Time of 6 hours is reasonable, based 

on operating experience, to reach MODE 3 from full power conditions in 

an orderly manner and without challenging plant systems. Similarly, the 

Completion Time of 12 hours to reach MODE 4 is reasonable based on 

operating experience to achieve power reduction from full power 

conditions in an orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.4.9.1

REQUIREMENTS 

This SR requires that during steady state operation, pressurizer water 

level is maintained below the nominal upper limit to provide a minimum 

space for a steam bubble. The Surveillance is performed by observing 

the indicated level. The 12 hour interval has been shown by operating 

practice to be sufficient to regularly assess the level for any deviation and 

verify that operation is within safety analyses assumptions. Alarms are 

also available for early detection of abnormal level indications. 
Pressurizer 

B 3.4.9 

BWOG STS B 3.4.9-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.4.9.2

The SR requires the power supplies are capable of producing the 

minimum power and the associated pressurizer heaters are verified to be 

at their design rating. (This may be done by testing the power supply 

output and by performing an electrical check on heater element continuity 

and resistance.) The Frequency of [[18] months] is considered adequate 

to detect heater degradation and has been shown by operating 

experience to be acceptable. ]

[ SR 3.4.9.3

This SR is not applicable if the heaters are permanently powered by 

1E power supplies. 

This Surveillance demonstrates that the heaters can be manually 

transferred to, and energized by, emergency power supplies. The 

Frequency of [18] months is based on a typical fuel cycle and is 

consistent with similar verifications of emergency power. ] 

REFERENCES 1. NUREG-0737, November 1980. 
Pressurizer Safety Valves 

B 3.4.10 

BWOG STS B 3.4.10-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.10 Pressurizer Safety Valves 

BASES 

BACKGROUND The purpose of the two spring loaded pressurizer safety valves is to 

provide RCS overpressure protection. Operating in conjunction with the 

Reactor Protection System (RPS), two valves are used to ensure that the 

Safety Limit (SL) of 2750 psig is not exceeded for analyzed transients 

during operation in MODES 1 and 2. Two safety valves are used for 

MODE 3 and portions of MODE 4. For the remainder of MODE 4, 

MODE 5, and MODE 6 with the reactor head on, overpressure protection 

is provided by operating procedures and LCO 3.4.12, "Low Temperature 

Overpressure Protection (LTOP) System." 

The self actuated pressurizer safety valves are designed in accordance 

with the requirements set forth in the ASME Boiler and Pressure Vessel 

Code, Section III (Ref. 1). The required lift pressure is 2500 psig ± 1%. 

The safety valves discharge steam from the pressurizer to a quench tank 

located in the containment. The discharge flow is indicated by an 

increase in temperature downstream of the safety valves and by an 

increase in the quench tank temperature and level. 

The upper and lower pressure limits are based on the ± 1% tolerance 

requirement for lifting pressures above 1000 psig. The lift setting is for 

the ambient conditions associated with MODES 1, 2, and 3. This requires 

either that the valves be set hot or that a correlation between hot and cold 

settings be established. 

The pressurizer safety valves are part of the primary success path and 

mitigate the effects of postulated accidents. OPERABILITY of the safety 

valves ensures that the RCS pressure will be limited to 110% of design 

pressure. The consequences of exceeding the ASME pressure limit 

could include damage to RCS components, increased leakage, or a 

requirement to perform additional stress analyses prior to resumption of 

reactor operation. 

APPLICABLE All accident analyses in the FSAR that require safety valve actuation 

SAFETY assume operation of both pressurizer safety valves to limit increasing 

ANALYSES reactor coolant pressure. The overpressure protection analysis (Ref. 1) is 

also based on operation of both safety valves and assumes that the 

valves open at the high range of the setting (2500 psig system design 

pressure plus 1%). These valves must accommodate pressurizer 
Pressurizer Safety Valves 

B 3.4.10 

BWOG STS B 3.4.10-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

insurges that could occur during a startup, rod withdrawal, ejected rod, 

loss of main feedwater, or main feedwater line break accident. The 

startup accident establishes the minimum safety valve capacity. The 

startup accident is assumed to occur at < 15% power. Single failure of a 

safety valve is neither assumed in the accident analysis nor required to 

be addressed by the ASME Code. Compliance with this Specification is 

required to ensure that the accident analysis and design basis 

calculations remain valid. 

Pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The two pressurizer safety valves are set to open at the RCS design 

pressure (2500 psig) and within the ASME specified tolerance to avoid 

exceeding the maximum RCS design pressure SL, to maintain accident 

analysis assumptions and to comply with ASME Code requirements. The 

upper and lower pressure tolerance limits are based on the ± 1% 

tolerance requirements (Ref. 1) for lifting pressures above 1000 psig. 

The limit protected by this Specification is the reactor coolant pressure 

boundary (RCPB) SL of 110% of design pressure. Inoperability of one or 

both valves could result in exceeding the SL if a transient were to occur. 

The consequences of exceeding the ASME pressure limit could include 

damage to one or more RCS components, increased leakage, or 

additional stress analysis being required prior to resumption of reactor 

operation. 

APPLICABILITY In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP cut in 

temperature, OPERABILITY of two valves is required because the 

combined capacity is required to keep reactor coolant pressure below 

110% of its design value during certain accidents. MODE 3 and portions 

of MODE 4 are conservatively included, although the listed accidents may 

not require both safety valves for protection. 

The LCO is not applicable in MODE 4 when any RCS cold leg 

temperature is ≤ [283]°F and MODE 5 because LTOP protection is 

provided. Overpressure protection is not required in MODE 6 with the 

reactor vessel head detensioned. 

The Note allows entry into MODES 3 and 4 with the lift settings outside 

the LCO limits. This permits testing and examination of the safety valves 

at high pressure and temperature near their normal operating range, but 

only after the valves have had a preliminary cold setting. The cold setting 

gives assurance that the valves are OPERABLE near their design 
Pressurizer Safety Valves 

B 3.4.10 

BWOG STS B 3.4.10-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

condition. Only one valve at a time will be removed from service for 

testing. The [36] hour exception is based on an 18 hour outage time for 

each of the two valves. The 18 hour period is derived from operating 

experience that hot testing can be performed in this timeframe. 

ACTIONS A.1

With one pressurizer safety valve inoperable, restoration must take place 

within 15 minutes. The Completion Time of 15 minutes reflects the 

importance of maintaining the RCS overpressure protection system. An 

inoperable safety valve coincident with an RCS overpressure event could 

challenge the integrity of the RCPB. 

B.1 and B.2

If the Required Action cannot be met within the required Completion Time 

or if both pressurizer safety valves are inoperable, the plant must be 

brought to a MODE in which the requirement does not apply. To achieve 

this status, the plant must be brought to at least MODE 3 within 6 hours 

and to MODE 4 with any RCS cold leg temperature ≤ [283]°F within 

12 hours. The 6 hours allowed is reasonable, based on operating 

experience, to reach MODE 3 from full power conditions in an orderly 

manner and without challenging plant systems. Similarly, the [24] hours 

allowed is reasonable, based on operating experience, to reach MODE 4 

without challenging plant systems. With any RCS cold leg temperature at 

or below [283]°F, overpressure protection is provided by LTOP. The 

change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core 

power and pressure), lowers the potential for large pressurizer insurges, 

and thereby removes the need for overpressure protection by two 

pressurizer safety valves. 

SURVEILLANCE SR 3.4.10.1

REQUIREMENTS 

SRs are specified in the Inservice Testing Program. Pressurizer safety 

valves are to be tested in accordance with the requirements of Section XI 

of the ASME Code (Ref. 1), which provides the activities and the 

Frequency necessary to satisfy the SRs. No additional requirements are 

specified. 

The pressurizer safety valve setpoint is ± [3]% for OPERABILITY; 

however, the valves are reset to ± 1% during the Surveillance to allow for 

drift. 
Pressurizer Safety Valves 

B 3.4.10 

BWOG STS B 3.4.10-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section III, Section XI. 
Pressurizer PORV 

B 3.4.11 

BWOG STS B 3.4.11-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.11 Pressurizer Power Operated Relief Valve (PORV) 

BASES 

BACKGROUND The pressurizer is equipped with three devices for pressure relief 

functions: two American Society of Mechanical Engineers (ASME) 

pressurizer safety valves that are safety grade components and one 

PORV that is not a safety grade device. The PORV is an electromatic 

pilot operated valve that is automatically opened at a specific set pressure 

when the pressurizer pressure increases and is automatically closed on 

decreasing pressure. The PORV may also be manually operated using 

controls installed in the control room. 

An electric motor operated, normally open, block valve is installed 

between the pressurizer and the PORV. The function of the block valve 

is to isolate the PORV. Block valve closure is accomplished manually 

using controls in the control room and may be used to isolate a leaking 

PORV to permit continued power operation. Most importantly, the block 

valve is to be used to isolate a stuck open PORV to isolate the resulting 

small break loss of coolant accident (LOCA). Closure terminates the 

RCS depressurization and coolant inventory loss. 

The PORV, its block valve, and their controls are powered from normal 

power supplies but are also capable of being powered from emergency 

supplies. Power supplies for the PORV are separate from those for the 

block valve. Power supply requirements are defined in NUREG-0737, 

Paragraph III, G.1 (Ref. 1). 

The PORV setpoint is above the high pressure reactor trip setpoint and 

below the opening setpoint for the pressurizer safety valve as required by 

IE Bulletin 79-05B (Ref. 2). The purpose of the relationship of these 

setpoints is to limit the number of transient pressure increase challenges 

that might open the PORV, which, if opened, could fail in the open 

position. A pressure increase transient would cause a reactor trip, 

reducing core energy, and for many expected transients, prevent the 

pressure increase from reaching the PORV setpoint. The PORV setpoint 

thus limits the frequency of challenges from transients and limits the 

possibility of a small break LOCA from a failed open PORV. 

Placing the setpoint below the pressurizer safety valve opening setpoint 

reduces the frequency of challenges to the safety valves, which, unlike 

the PORV, cannot be isolated if they were to fail open. The PORV 

setpoint is therefore important for limiting the possibility of a small break 

LOCA. 
Pressurizer PORV 

B 3.4.11 

BWOG STS B 3.4.11-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The primary purpose of this LCO is to ensure that the PORV and the 

block valve are operating correctly so the potential for a small break 

LOCA through the PORV pathway is minimized, or if a small break LOCA 

were to occur through a failed open PORV, the block valve could be 

manually operated to isolate the path. 

The PORV may be manually operated to depressurize the RCS as 

deemed necessary by the operator in response to normal or abnormal 

transients. The PORV may be used for depressurization when the 

pressurizer spray is not available; a condition that would be encountered 

during loss of offsite power. Steam generator tube rupture (SGTR) is one 

event that may require use of the PORV if the sprays are unavailable. 

The PORV may also be used for feed and bleed core cooling in the case 

of multiple equipment failure events that are not within the design basis, 

such as a total loss of feedwater. 

The PORV functions as an automatic overpressure device and limits 

challenges to the safety valves. Although the PORV acts as an 

overpressure device for operational purposes, safety analyses [do not 

take credit for PORV actuation, but] do take credit for the safety valves. 

The PORV also provides low temperature overpressure protection 

(LTOP) during heatup and cooldown. LCO 3.4.12, "Low Temperature 

Overpressure Protection (LTOP) System," addresses this function. 

APPLICABLE The PORV small break LOCA break size is bounded by the spectrum 

SAFETY of piping breaks analyzed for plant licensing. Because the PORV small 

ANALYSES break LOCA is located at the top of the pressurizer, the RCS response 

characteristics are different from RCS loop piping breaks; analyses have 

been performed to investigate these characteristics. 

The possibility of a small break LOCA through the PORV is reduced when 

the PORV flow path is OPERABLE and the PORV opening setpoint is 

established to be reasonably remote from expected transient challenges. 

The possibility is minimized if the flow path is isolated. 

The PORV opening setpoint has been established in accordance with 

Reference 2. It has been set so expected RCS pressure increases from 

anticipated transients will not challenge the PORV, minimizing the 

possibility of a small break LOCA through the PORV. 
Pressurizer PORV 

B 3.4.11 

BWOG STS B 3.4.11-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

Overpressure protection is provided by safety valves, and analyses do 

not take credit for the PORV opening for accident mitigation. 

Operational analyses that support the emergency operating procedures 

utilize the PORV to depressurize the RCS for mitigation of SGTR when 

the pressurizer spray system is unavailable (loss of offsite power). FSAR 

safety analyses for SGTR have been performed assuming that offsite 

power is available and thus pressurizer sprays (or the PORV) are 

available. 

The PORV and its block valve satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii). 

LCO The LCO requires the PORV and its associated block valve to be 

OPERABLE. The block valve is required to be OPERABLE so it may be 

used to isolate the flow path if the PORV is not OPERABLE. If the block 

valve is not OPERABLE, the PORV may be used for temporary isolation. 

APPLICABILITY In MODES 1, 2, and 3, the PORV and its block valve are required to be 

OPERABLE to limit the potential for a small break LOCA through the flow 

path. A likely cause for PORV LOCA is a result of pressure increase 

transients that cause the PORV to open. Imbalances in the energy output 

of the core and heat removal by the secondary system can cause the 

RCS pressure to increase to the PORV opening setpoint. Pressure 

increase transients can occur any time the steam generators are used for 

heat removal. The most rapid increases will occur at higher operating 

power and pressure conditions of MODES 1 and 2. 

Pressure increases are less prominent in MODE 3 because the core input 

energy is reduced, but the RCS pressure is high. Therefore, the 

applicability is pertinent to MODES 1, 2, and 3. The LCO is not 

applicable in MODE 4 when both pressure and core energy are 

decreased and the pressure surges become much less significant. The 

PORV setpoint is reduced for LTOP in MODES 4, 5, and 6 with the 

reactor vessel head in place. LCO 3.4.12 addresses the PORV 

requirements in these MODES. 

ACTIONS A.1 and A.2

With the PORV inoperable, the PORV must be restored or the flow path 

isolated within 1 hour. The block valve should be closed and power must 

be removed from the block valve to reduce the potential for inadvertent 

PORV opening and depressurization. 
Pressurizer PORV 

B 3.4.11 

BWOG STS B 3.4.11-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

If the block valve is inoperable, it must be restored to OPERABLE status 

within 1 hour. The prime importance for the capability to close the block 

valve is to isolate a stuck open PORV. Therefore, if the block valve 

cannot be restored to OPERABLE status within 1 hour, the Required 

Action is to close the block valve and remove power within 1 hour 

rendering the PORV isolated. The 1 hour Completion Times are 

consistent with an allowance of some time for correcting minor problems, 

restoring the valve to operation, and establishing correct valve positions 

and restricting the time without adequate protection against RCS 

depressurization. 

C.1 and C.2

If the Required Action and associated Completion Time cannot be met, 

the plant must be brought to a MODE in which the requirement does not 

apply. To achieve this status, the plant must be brought to at least 

MODE 3 within 6 hours and to MODE 4 within 12 hours. The 6 hours 

allowed is reasonable, based on operating experience, to reach MODE 3 

from full power conditions in an orderly manner and without challenging 

plant systems. Similarly, the 12 hours allowed is reasonable, based on 

operating experience, to reach MODE 4 from full power conditions in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.4.11.1

REQUIREMENTS 

Block valve cycling verifies that it can be closed if needed. The basis for 

the Frequency of 92 days is ASME Code, Section XI (Ref. 3). Block valve 

cycling, as stated in the Note, is not required to be performed when it is 

closed for isolation; cycling could increase the hazard of an existing 

degraded flow path. 

SR 3.4.11.2

PORV cycling demonstrates its function. The Frequency of 18 months is 

based on a typical refueling cycle and industry accepted practice. 
Pressurizer PORV 

B 3.4.11 

BWOG STS B 3.4.11-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.4.11.3

This Surveillance is not required for plants with permanent 1E power 

supplies to the valves. 

This SR demonstrates that emergency power can be provided and is 

performed by transferring power from the normal supply to the emergency 

supply and cycling the valves. The Frequency of 18 months is based on 

a typical refueling cycle and industry accepted practice. 

REFERENCES 1. NUREG-0737, Paragraph III, G.1, November 1980. 

 2. NRC IE Bulletin 79-05B, April 21, 1979. 

 3. ASME, Boiler and Pressure Vessel Code, Section XI. 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.12 Low Temperature Overpressure Protection (LTOP) System 

BASES 

BACKGROUND -----------------------------------REVIEWER’S NOTE----------------------------------- 

For plants for which the NRC has approved LTOP setpoints based on 

non-10 CFR 50, Appendix G, methodology, as allowed in NRC Generic 

Letter 88-11, the following Bases must be revised accordingly. 

-------------------------------------------------------------------------------------------------- 

The LTOP System controls RCS pressure at low temperatures so the 

integrity of the reactor coolant pressure boundary (RCPB) is not 

compromised by violating the pressure and temperature (P/T) 

requirements of 10 CFR 50, Appendix G (Ref. 1). The reactor vessel is 

the limiting RCPB component for providing such protection. LCO 3.4.3, 

"RCS Pressure and Temperature (P/T) Limits," provides the allowable 

combinations for operational pressure and temperature during cooldown, 

shutdown, and heatup to keep from violating the Reference 1 limits. 

The reactor vessel material is less tough at reduced temperatures than at 

normal operating temperature. Also, as vessel neutron irradiation 

accumulates, the material becomes less resistant to pressure stress at 

low temperatures (Ref. 2). RCS pressure must be maintained low when 

temperature is low and must be increased only as temperature is 

increased. 

Operational maneuvering during cooldown, heatup, or any anticipated 

operational occurrence must be controlled to not violate LCO 3.4.3. 

Exceeding these limits could lead to brittle fracture of the reactor vessel. 

LCO 3.4.3 presents requirements for administrative control of RCS 

pressure and temperature to prevent exceeding the P/T limits. 

This LCO provides RCS overpressure protection in the applicable 

MODES by ensuring an adequate pressure relief capacity and a minimum 

coolant addition capability. The pressure relief capacity requires either 

the power operated relief valve (PORV) lift setpoint to be reduced and 

pressurizer coolant level at or below a maximum limit or the RCS 

depressurized and with an RCS vent of sufficient size to handle the 

limiting transient during LTOP. 

The LTOP approach to protecting the vessel by limiting coolant addition 

capability allows a maximum of [one] makeup pump, and requires 

deactivating HPI, and isolating the core flood tanks (CFTs). 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Should more than [one] HPI pump inject on an HPI actuation, the 

pressurizer level and PORV or another RCS vent cannot prevent 

overpressurizing the RCS. Even with only one HPI pump OPERABLE, 

the vent cannot prevent RCS overpressurization. 

The pressurizer level limit provides a compressible vapor space or 

cushion (either steam or nitrogen) that can accommodate a coolant 

insurge and prevent a rapid pressure increase, allowing the operator time 

to stop the increase. The PORV, with reduced lift setting, or the RCS 

vent is the overpressure protection device that acts as backup to the 

operator in terminating an increasing pressure event. 

With HPI deactivated, the ability to provide RCS coolant addition is 

restricted. To balance the possible need for coolant addition, the LCO 

does not require the Makeup System to be deactivated. Due to the lower 

pressures associated with the LTOP MODES and the expected decay 

heat levels, the Makeup System can provide flow with the OPERABLE 

makeup pump through the makeup control valve. 

PORV Requirements

As designed for the LTOP System, each PORV is signaled to open if the 

RCS pressure approaches a limit set in the LTOP actuation circuit. The 

LTOP actuation circuit monitors RCS pressure and determines when an 

overpressure condition is approached. When the monitored pressure 

meets or exceeds the setting, the PORV is signaled to open. Maintaining 

the setpoint within the limits of the LCO ensures the Reference 1 limits 

will be met in any event analyzed for LTOP. 

When a PORV is opened in an increasing pressure transient, the release 

of coolant causes the pressure increase to slow and reverse. As the 

PORV releases coolant, the RCS pressure decreases until a reset 

pressure is reached and the valve is signaled to close. The pressure 

continues to decrease below the reset pressure as the valve closes. 

RCS Vent Requirements

Once the RCS is depressurized, a vent exposed to the containment 

atmosphere will maintain the RCS at ambient containment pressure in an 

RCS overpressure transient, if the relieving requirements of the maximum 

credible LTOP transient do not exceed the capabilities of the vent. Thus, 

the vent path must be capable of relieving the flow of the limiting LTOP 

transient and maintaining pressure below P/T limits. The required vent 

capacity may be provided by one or more vent paths. 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

For an RCS vent to meet the flow capacity, it requires removing a 

pressurizer safety valve, locking the PORV in the open position and 

disabling its block valve in the open position, or similarly establishing a 

vent by opening an RCS vent valve. The vent path(s) must be above the 

level of reactor coolant, so as not to drain the RCS when open. 

APPLICABLE Safety analyses (Ref. 3) demonstrate that the reactor vessel can be 

SAFETY adequately protected against overpressurization transients during 

ANALYSES shutdown. In MODES 1, 2, and 3, and in MODE 4 with RCS temperature 

exceeding [283]°F, the pressurizer safety valves will prevent RCS 

pressure from exceeding the Reference 1 limits. At nominally [283]°F and 

below, overpressure prevention falls to an OPERABLE PORV and a 

restricted coolant level in the pressurizer or to a depressurized RCS and 

a sufficient size RCS vent. Each of these means has a limited 

overpressure relief capability. 

The actual temperature at which the pressure in the P/T limit curve falls 

below the pressurizer safety valve setpoint increases as vessel material 

toughness decreases due to neutron embrittlement. Each time the P/T 

limit curves are revised, the LTOP System will be re-evaluated to ensure 

that its functional requirements can still be met with the PORV and 

pressurizer level method or the depressurized and vented RCS condition. 

Transients that are capable of overpressurizing the RCS have been 

identified and evaluated. These transients relate to either mass input or 

heat input: actuating the HPI System, discharging the CFTs, energizing 

the pressurizer heaters, failing the makeup control valve open, losing 

decay heat removal, starting a reactor coolant pump (RCP) with a large 

temperature mismatch between the primary and secondary coolant 

systems, and adding nitrogen to the pressurizer. 

HPI actuation and CFT discharge are the transients that result in 

exceeding P/T limits within < 10 minutes, in which time no operator action 

is assumed to take place. In the rest, operator action after that time 

precludes overpressurization. The analyses demonstrate that the time 

allowed for operator action is adequate, or the events are self limiting and 

do not exceed P/T limits. 

The following are required during the LTOP MODES to ensure that 

transients do not occur, which either of the LTOP overpressure protection 

means cannot handle: 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

a. Deactivating all but [one] makeup pump, 

b. Deactivating HPI, and 

c. Immobilizing CFT discharge isolation valves in their closed positions. 

The Reference 3 analyses demonstrate the PORV can maintain RCS 

pressure below limits when only one makeup pump is actuated. 

Consequently, the LCO allows only [one] makeup pump to be 

OPERABLE in the LTOP MODES. 

Since the PORV cannot do this for one HPI pump and the RCS vent 

cannot do this for even one pump, the LCO also requires the HPI 

actuation circuits deactivated and the CFTs isolated. 

The isolated CFTs must have their discharge valves closed and the valve 

power breakers fixed in their open positions. The analyses show the 

effect of CFT discharge is over a narrower RCS temperature range 

(175°F and below) than that of the LCO ([283]°F and below). 

Fracture mechanics analyses established the temperature of LTOP 

Applicability at [283]°F. Above this temperature, the pressurizer safety 

valves provide the reactor vessel pressure protection. The vessel 

materials were assumed to have a neutron irradiation accumulation equal 

to 21 effective full power years (EFPYs) of operation. 

This LCO will deactivate the HPI actuation when the RCS temperature is 

≤ [283]°F. The consequences of a small break LOCA in LTOP MODE 4 

conform to 10 CFR 50.46 and 10 CFR 50, Appendix K (Refs. 4 and 5), 

requirements by having a maximum of [one] makeup pump OPERABLE. 

Reference 3 contains the acceptance limits that satisfy the LTOP 

requirements. Any change to the RCS must be evaluated against these 

analyses to determine the impact of the change on the LTOP acceptance 

limits. 

PORV Performance

The fracture mechanics analyses show that the vessel is protected when 

the PORV is set to open at ≤ [555] psig. The setpoint is derived by 

modeling the performance of the LTOP System, assuming the limiting 

allowed LTOP transient of uncontrolled HPI actuation of one pump. 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

These analyses consider pressure overshoot and undershoot beyond the 

PORV opening and closing, resulting from signal processing and valve 

stroke times. The PORV setpoint at or below the derived limit ensures 

the Reference 1 limits will be met. 

The PORV setpoint will be re-evaluated for compliance when the revised 

P/T limits conflict with the LTOP analysis limits. The P/T limits are 

periodically modified as the reactor vessel material toughness decreases 

due to embrittlement induced by neutron irradiation. Revised P/T limits 

are determined using neutron fluence projections and the results of 

examinations of the reactor vessel material irradiation surveillance 

specimens. The Bases for LCO 3.4.3 discuss these examinations. 

The PORV is considered an active component. Therefore, its failure 

represents the worst case LTOP single active failure. 

Pressurizer Level Performance

Analyses of operator response time show that the pressurizer level must 

be maintained ≤ [220] inches to provide the 10 minute action time for 

correcting transients. 

The pressurizer level limit will also be re-evaluated for compliance each 

time P/T limit curves are revised based on the results of the vessel 

material surveillance. 

RCS Vent Performance

With the RCS depressurized, analyses show a vent of [0.75] square 

inches is capable of mitigating the transient resulting from full opening of 

the makeup control valve while the makeup pump is providing RCS 

makeup. The capacity of a vent this size is greater than the flow resulting 

from this credible transient at 100 psig back pressure, which is less than 

the maximum RCS pressure on the P/T limit curve in LCO 3.4.3. 

The RCS vent size will also be re-evaluated for compliance each time P/T 

limit curves are revised based on the results of the vessel material 

surveillance. 

The vent is passive and is not subject to active failure. 

The LTOP System satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-6 Rev. 3.0, 03/31/04 

BASES 

LCO The LCO requires an LTOP System OPERABLE with a limited coolant 

input capability and a pressure relief capability. To limit coolant input, the 

LCO requires a maximum of [one] makeup pump OPERABLE, the HPI 

deactivated, and the CFT discharge isolation valves closed and 

immobilized. For pressure relief, it requires either the pressurizer coolant 

at or below a maximum level and the PORV OPERABLE with a lift setting 

at the LTOP limit or the RCS depressurized and a vent established. 

The LCO is modified by two Notes. Note 1 allows [two makeup pumps] to 

be made capable of injecting for ≤ 1 hour during pump swap operations. 

One hour provides sufficient time to safely complete the actual transfer 

and to complete the administrative controls and surveillance requirements 

associated with the swap. The intent is to minimize the actual time that 

more than [one] makeup pump is physically capable of injection. Note 2 

states that CFT isolation is only required when the CFT pressure is more 

than or equal to the maximum RCS pressure for the existing RCS 

temperature, as allowed in LCO 3.4.3. This Note permits the CFT 

discharge valve surveillance performed only under these pressure and 

temperature conditions. 

The pressurizer is OPERABLE with a coolant level ≤ [220] inches. 

The PORV is OPERABLE when its block valve is open, its lift setpoint is 

set at ≤ [555] psig and testing has proven its ability to open at that 

setpoint, and motive power is available to the two valves and their control 

circuits. 

For the depressurized RCS, an RCS vent is OPERABLE when open with 

an area of at least [0.75] square inches. 

APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is 

≤ [283]°F, in MODE 5, and in MODE 6 when the reactor vessel head is 

on. The Applicability temperature of [283]°F is established by fracture 

mechanics analyses. The pressurizer safety valves provide overpressure 

protection to meet LCO 3.4.3 P/T limits above [283]°F. With the vessel 

head off, overpressurization is not possible. 

LCO 3.4.3 provides the operational P/T limits for all MODES. 

LCO 3.4.10, "Pressurizer Safety Valves," requires the pressurizer safety 

valves OPERABLE to provide overpressure protection during MODES 1, 

2, and 3, and MODE 4 above [283]°F. 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1 and B.1

With two or more makeup pumps capable of injecting into the RCS or if 

the HPI is activated, immediate actions are required to render the other 

pump(s) inoperable or to deactivate HPI. Emphasis is on immediate 

deactivation because inadvertent injection with [one] or more HPI pump 

OPERABLE is the event of greatest significance, since it causes the 

greatest pressure increase in the shortest time. Also, the vent cannot 

mitigate overpressurization from the injection of even one HPI pump. 

The immediate Completion Times reflect the urgency of quickly 

proceeding with the Required Actions. 

C.1, D.1, and D.2

An unisolated CFT requires isolation within 1 hour only when the CFT 

pressure is at or more than the maximum RCS pressure for the existing 

temperature allowed in LCO 3.4.3. 

If isolation is needed and cannot be accomplished in 1 hour, Required 

Action D.1 and Required Action D.2 provide two options, either of which 

must be performed in 12 hours. By increasing the RCS temperature to 

> 175°F, the CFT pressure of 600 psig cannot exceed the LTOP limits if 

both tanks are fully injected. Depressurizing the CFTs below the LTOP 

limit of [555] psig also prevents exceeding the LTOP limits in the same 

event. 

The Completion Times are based on operating experience that these 

activities can be accomplished in these time periods and on engineering 

evaluations indicating that a limiting LTOP event is not likely in the 

allowed times. 

E.1, F.1, and F.2

With the pressurizer level more than [220] inches, the time for operator 

action in a pressure increasing event is reduced. The postulated event 

most affected in the LTOP MODES is failure of the makeup control valve, 

which fills the pressurizer relatively rapidly. Restoration is required within 

1 hour. 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

If restoration within 1 hour in either case cannot be accomplished, 

Required Actions F.1 and F.2 must be performed within 12 hours to close 

the makeup control valve and its isolation valve. These Required Actions 

limit the makeup capability, which is not required with a high pressurizer 

level, and permit cooldown and depressurization to continue. Heatup 

must be stopped because heat addition decreases the reactor coolant 

density and increases the pressurizer level. 

The Completion Times again are based on operating experience that 

these activities can be accomplished in these time periods and on 

engineering evaluations indicating that a limiting LTOP transient is not 

likely in the allowed times. 

G.1, H.1, and H.2

With the PORV inoperable, overpressure relieving capability is lost, and 

restoration of the PORV within 1 hour is required. If that cannot be 

accomplished, the ability of the Makeup System to add water must be 

limited within the next 12 hours. 

If restoration cannot be completed within 1 hour, Required Action H.1 and 

Required Action H.2 must be performed to limit RCS water addition 

capability. Makeup is not deactivated to maintain the RCS coolant level. 

Required Action H.1 and Required Action H.2 require reducing the 

makeup tank level to 70 inches and deactivating the low low makeup tank 

level interlock to the borated water storage tank. This makes the 

available makeup water volume insufficient to exceed the LTOP limit by a 

makeup control valve full opening. 

These Completion Times also consider these activities can be 

accomplished in these time periods. A limiting LTOP event is not likely in 

those times. 

Some PORV testing or maintenance can only be performed at plant 

shutdown. Such activity is permitted if Required Action H.1 and Required 

Action H.2 are taken to compensate for PORV unavailability. 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-9 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

I.1

With the pressurizer level above [220] inches and the PORV inoperable 

or the LTOP System inoperable for any reason other than cited in 

Condition A through H, Required Action I.1 requires the RCS 

depressurized and vented within 12 hours from the time either Condition 

started. 

One or more vents may be used. A vent size of ≥ [0.75] square inches is 

specified. This vent size assumes 100 psig backpressure. Because 

makeup may be required, the vent size accommodates inadvertent full 

makeup system operation. Such a vent keeps the pressure from full flow 

of [one] makeup pump with a wide open makeup control valve within the 

LCO limit. 

The PORV has a larger area and may be used for venting by opening and 

locking it open. 

This size RCS vent or the PORVs a vent cannot maintain RCS pressure 

below LTOP limits if the HPI and CFT systems are inadvertently actuated. 

Therefore, verification of the deactivation of two HPI pumps, HPI injection, 

and the CFTs must accompany the depressurizing and venting. Since 

these systems are required deactivated by the LCO, SR 3.4.12.1, 

SR 3.4.12.2, and SR 3.4.12.3 require verification of their deactivated 

status every 12 hours. 

The Completion Time is based on operating experience that this activity 

can be accomplished in this time period and on engineering evaluations 

indicating that a limiting LTOP transient is not likely in this time. 

SURVEILLANCE SR 3.4.12.1, SR 3.4.12.2, and SR 3.4.12.3

REQUIREMENTS 

Verifications must be performed that only [one] makeup pump is capable 

of injecting into the RCS, the HPI is deactivated, and the CFT discharge 

isolation valves are closed and immobilized. These Surveillances ensure 

the minimum coolant input capability will not create an RCS overpressure 

condition to challenge the LTOP System. The Surveillances are required 

at 12 hour intervals. 

The 12 hour intervals are shown by operating practice to be sufficient to 

regularly assess conditions for potential degradation and verify operation 

within the safety analysis. 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.4.12.4

Verification of the pressurizer level at ≤ [220] inches by observing control 

room or other indications ensures a cushion of sufficient size is available 

to reduce the rate of pressure increase from potential transients. 

The 30 minute Surveillance Frequency during heatup and cooldown must 

be performed for the LCO Applicability period when temperature changes 

can cause pressurizer level variations. This Frequency may be 

discontinued when the ends of these conditions are satisfied, as defined 

in plant procedures. Thereafter, the Surveillance is required at 12 hour 

intervals. 

These Frequencies are shown by operating practice sufficient to regularly 

assess indications of potential degradation and verify operation within the 

safety analysis. 

SR 3.4.12.5

Verification that the PORV block valve is open ensures a flow path to the 

PORV. This is required at 12 hour intervals. 

The interval has been shown by operating practice sufficient to regularly 

assess conditions for potential degradation and verify operation is within 

the safety analysis. 

SR 3.4.12.6

The RCS vent of at least [0.75] square inches must be verified open for 

relief protection only if the vent is being used to satisfy the requirements 

of this LCO. For a vent valve not locked open, the Frequency is every 

12 hours. Valves that are sealed or secured in the open position are 

considered "locked" in this context. For other vent path(s) (e.g., a vent 

valve that is locked, sealed, or secured in position, a removed pressurizer 

safety valve, or open manway), the required Frequency is every 31 days. 

Again, the Frequency intervals consider operating practice to determine 

adequacy to regularly assess conditions for potential degradation and 

verify operation within the safety analysis. 
Low Temperature Overpressure Protection (LTOP) System 

B 3.4.12 

BWOG STS B 3.4.12-11 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The passive vent path arrangement must only be open to be OPERABLE. 

SR 3.4.12.7

A CHANNEL FUNCTIONAL TEST is required within [12] hours after 

decreasing RCS temperature to ≤ [283]°F and every 31 days thereafter to 

ensure the setpoint is proper for using the PORV for LTOP. A successful 

test of the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. 

This is acceptable because all of the other required contacts of the relay 

are verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. PORV actuation is not needed, as it could depressurize the 

RCS. 

The [12] hour Frequency considers the unlikelihood of a low temperature 

overpressure event during the time. The 31 day Frequency is based on 

industry accepted practice and is acceptable by experience with 

equipment reliability. 

SR 3.4.12.8

The performance of a CHANNEL CALIBRATION is required every 

[18] months. The CHANNEL CALIBRATION for the LTOP setpoint 

ensures that the PORV will be actuated at the appropriate RCS pressure 

by verifying the accuracy of the instrument string. The calibration can 

only be performed in shutdown. 

The Frequency considers a typical refueling cycle and industry accepted 

practice. 

REFERENCES 1. 10 CFR 50, Appendix G. 

 2. Generic Letter 88-11. 

 3. FSAR, Section 15. 

 4. 10 CFR 50.46. 

 5. 10 CFR 50, Appendix K. 
RCS Operational LEAKAGE 

B 3.4.13 

BWOG STS B 3.4.13-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.13 RCS Operational LEAKAGE 

BASES 

BACKGROUND Components that contain or transport the coolant to or from the reactor 

core make up the RCS. Component joints are made by welding, bolting, 

rolling, or pressure loading, and valves isolate connecting systems from 

the RCS. 

During plant life, the joint and valve interfaces can produce varying 

amounts of reactor coolant LEAKAGE, through either normal operational 

wear or mechanical deterioration. The purpose of the RCS Operational 

LEAKAGE LCO is to limit system operation in the presence of LEAKAGE 

from these sources to amounts that do not compromise safety. This LCO 

specifies the types and amounts of LEAKAGE. 

10 CFR 50, Appendix A, GDC 30 (Ref. 1), requires means for detecting 

and, to the extent practical, identifying the source of reactor coolant 

LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable 

methods for selecting Leakage Detection Systems. 

The safety significance of RCS LEAKAGE varies widely depending on its 

source, rate, and duration. Therefore, detecting and monitoring reactor 

coolant LEAKAGE into the containment area are necessary. Quickly 

separating the identified LEAKAGE from the unidentified LEAKAGE is 

necessary to provide quantitative information to the operators, allowing 

them to take corrective action should a leak occur detrimental to the 

safety of the facility and the public. 

A limited amount of leakage inside containment is expected from auxiliary 

systems that cannot be made 100% leaktight. Leakage from these 

systems should be detected, located, and isolated from the containment 

atmosphere, if possible, to not interfere with RCS leakage detection. 

This LCO deals with protection of the reactor coolant pressure boundary 

(RCPB) from degradation and the core from inadequate cooling, in 

addition to preventing the accident analysis radiation release assumptions 

from being exceeded. The consequences of violating this LCO include 

the possibility of a loss of coolant accident (LOCA). However, the ability 

to monitor leakage provides advance warning to permit plant shutdown 

before a LOCA occurs. This advantage has been shown by "leak before 

break" studies. 
RCS Operational LEAKAGE 

B 3.4.13 

BWOG STS B 3.4.13-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses do not 

SAFETY address operational LEAKAGE. However, other operational LEAKAGE 

ANALYSES is related to the safety analyses for LOCA; the amount of leakage can 

affect the probability of such an event. The safety analysis for an event 

resulting in steam discharge to the atmosphere assumes a 1 gpm primary 

to secondary LEAKAGE as the initial condition. 

Primary to secondary LEAKAGE is a factor in the dose releases outside 

containment resulting from a steam line break (SLB) accident. To a 

lesser extent, other accidents or transients involve secondary steam 

release to the atmosphere, such as a steam generator tube rupture 

(SGTR). The leakage contaminates the secondary fluid. 

The FSAR (Ref. 3) analysis for SGTR assumes the contaminated 

secondary fluid is only briefly released via safety valves and the majority 

is steamed to the condenser. The 1 gpm primary to secondary 

LEAKAGE is relatively inconsequential. 

The SLB is more limiting for site radiation releases. The safety analysis 

for the SLB accident assumes 1 gpm primary to secondary LEAKAGE in 

one generator as an initial condition. The dose consequences resulting 

from the SLB accident are well within the limits defined in 10 CFR 100. 

RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO RCS operational LEAKAGE shall be limited to: 

a. Pressure Boundary LEAKAGE

No pressure boundary LEAKAGE is allowed, being indicative of 

material deterioration. LEAKAGE of this type is unacceptable as the 

leak itself could cause further deterioration, resulting in higher 

LEAKAGE. Violation of this LCO could result in continued 

degradation of the RCPB. LEAKAGE past seals and gaskets is not 

pressure boundary LEAKAGE. 

b. Unidentified LEAKAGE

One gallon per minute (gpm) of unidentified LEAKAGE is allowed as 

a reasonable minimum detectable amount that the containment air 

monitoring and containment sump level monitoring equipment can 

detect within a reasonable time period. Violation of this LCO could 

result in continued degradation of the RCPB, if the LEAKAGE is from 

the pressure boundary. 
RCS Operational LEAKAGE 

B 3.4.13 

BWOG STS B 3.4.13-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

c. Identified LEAKAGE

Up to 10 gpm of identified LEAKAGE is considered allowable 

because LEAKAGE is from known sources that do not interfere with 

detection of unidentified LEAKAGE and is well within the capability of 

the RCS makeup system. Identified LEAKAGE includes LEAKAGE 

to the containment from specifically known and located sources, but 

does not include pressure boundary LEAKAGE or controlled reactor 

coolant pump (RCP) seal leakoff (a normal function not considered 

LEAKAGE). Violation of this LCO could result in continued 

degradation of a component or system. 

d. Primary to Secondary LEAKAGE through All Steam Generators 

(SGs)

Total primary to secondary LEAKAGE amounting to 1 gpm through 

all SGs produces acceptable offsite doses in the SLB accident 

analysis. Violation of this LCO could exceed the offsite dose limits 

for this accident. Primary to secondary LEAKAGE must be included 

in the total allowable limit for identified LEAKAGE. 

[ e. Primary to Secondary LEAKAGE through Any One SG

The [720] gallon per day limit on one SG allocates the total 1 gpm 

allowed primary to secondary LEAKAGE equally between the two 

generators. ] 

APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest 

when the RCS is pressurized. 

In MODES 5 and 6, LEAKAGE limits are not required because the reactor 

coolant pressure is far lower, resulting in lower stresses and reduced 

potentials for LEAKAGE. 

LCO 3.4.14, "RCS Pressure Isolation Valve (PIV) Leakage," measures 

leakage through each individual PIV and can impact this LCO. Of the two 

PIVs in series in each isolated line, leakage measured through one PIV 

does not result in RCS LEAKAGE when the other is leaktight. If both 

valves leak and result in a loss of mass from the RCS, the loss must be 

included in the allowable identified LEAKAGE. 
RCS Operational LEAKAGE 

B 3.4.13 

BWOG STS B 3.4.13-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

If unidentified LEAKAGE, identified LEAKAGE, or primary to secondary 

LEAKAGE are in excess of the LCO limits, the LEAKAGE must be 

reduced to within limits within 4 hours. This Completion Time allows time 

to verify leakage rates and either identify unidentified LEAKAGE or 

reduce LEAKAGE to within limits before the reactor must be shut down. 

This action is necessary to prevent further deterioration of the RCPB. 

B.1 and B.2

If any pressure boundary LEAKAGE exists or if unidentified, identified, or 

primary to secondary LEAKAGE cannot be reduced to within limits within 

4 hours, the reactor must be brought to lower pressure conditions to 

reduce the severity of the LEAKAGE and its potential consequences. 

The reactor must be brought to MODE 3 within 6 hours and MODE 5 

within 36 hours. This action reduces the LEAKAGE and also reduces the 

factors that tend to degrade the pressure boundary. 

The Completion Times allowed are reasonable, based on operating 

experience, to reach the required conditions from full power conditions in 

an orderly manner and without challenging plant systems. In MODE 5, 

the pressure stresses acting on the RCPB are much lower and further 

deterioration is much less likely. 

SURVEILLANCE SR 3.4.13.1

REQUIREMENTS 

Verifying RCS LEAKAGE within the LCO limits ensures that the integrity 

of the RCPB is maintained. Pressure boundary LEAKAGE would at first 

appear as unidentified LEAKAGE and can only be positively identified by 

inspection. Unidentified LEAKAGE and identified LEAKAGE are 

determined by performance of an RCS water inventory balance. Primary 

to secondary LEAKAGE is also measured by performance of an RCS 

water inventory balance in conjunction with effluent monitoring within the 

secondary steam and feedwater systems. 

The RCS water inventory balance must be performed with the reactor at 

steady state operating conditions (stable temperature, power level, 

pressurizer and makeup tank levels, makeup and letdown, [and RCP seal 

injection and return flows]). Therefore, a Note is added allowing that this 

SR is not required to be performed until 12 hours after establishing steady 

state operation. The 12 hour allowance provides sufficient time to collect 

and process all necessary data after stable plant conditions are 

established. 
RCS Operational LEAKAGE 

B 3.4.13 

BWOG STS B 3.4.13-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Steady state operation is required to perform a proper water inventory 

balance since calculations during maneuvering are not useful. For RCS 

operational LEAKAGE determination by water inventory balance, steady 

state is defined as stable RCS pressure, temperature, power level, 

pressurizer and makeup tank levels, makeup and letdown, and RCP 

pump seal injection and return flows. 

An early warning of pressure boundary LEAKAGE or unidentified 

LEAKAGE is provided by the automatic systems that monitor the 

containment atmosphere radioactivity and the containment sump level. 

These leakage detection systems are specified in LCO 3.4.15, "RCS 

Leakage Detection Instrumentation." 

The 72 hour Frequency is a reasonable interval to trend LEAKAGE and 

recognizes the importance of early leakage detection in the prevention of 

accidents. 

SR 3.4.13.2

This SR provides the means necessary to determine SG OPERABILITY 

in an operational MODE. The requirement to demonstrate SG tube 

integrity in accordance with the Steam Generator Tube Surveillance 

Program emphasizes the importance of SG tube integrity, even though 

this Surveillance cannot be performed at normal operating conditions. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30. 

 2. Regulatory Guide 1.45, May 1973. 

 3. FSAR, Chapter [15]. 
RCS PIV Leakage 

B 3.4.14 

BWOG STS B 3.4.14-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage 

BASES 

BACKGROUND 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A 

(Refs. 1, 2, and 3), define RCS PIVs as any two normally closed valves in 

series within the RCS pressure boundary that separate the high pressure 

RCS from an attached low pressure system. During their lives, these 

valves can produce varying amounts of reactor coolant leakage through 

either normal operational wear or mechanical deterioration. The RCS PIV 

Leakage LCO allows RCS high pressure operation when leakage through 

these valves exists in amounts that do not compromise safety. 

The PIV leakage limit applies to each individual valve. Leakage through 

both series PIVs in a line must be included as part of the identified 

LEAKAGE, governed by LCO 3.4.13, "RCS Operational LEAKAGE." This 

is true during operation only when the loss of RCS mass through two 

series valves is determined by a water inventory balance (SR 3.4.13.1). 

A known component of the identified LEAKAGE before operation begins 

is the least of the two individual leakage rates determined for leaking 

series PIVs during the required surveillance testing; leakage measured 

through one PIV in a line is not RCS operational LEAKAGE if the other is 

leaktight. 

Although this specification provides a limit on allowable PIV leakage rate, 

its main purpose is to prevent overpressure failure of the low pressure 

portions of connecting systems. The leakage limit is an indication that the 

PIVs between the RCS and the connecting systems are degraded or 

degrading. PIV leakage could lead to overpressure of the low pressure 

piping or components. Failure consequences could be a loss of coolant 

accident (LOCA) outside of containment, an unanalyzed accident that 

could degrade the ability for low pressure injection. 

The basis for this LCO is the 1975 NRC "Reactor Safety Study" (Ref. 4) 

that identified potential intersystem LOCAs as a significant contributor to 

the risk of core melt. 

A subsequent study (Ref. 5) evaluated various PIV configurations to 

determine the probability of intersystem LOCAs. 

PIVs are provided to isolate the RCS from the following typically 

connected systems: 
RCS PIV Leakage 

B 3.4.14 

BWOG STS B 3.4.14-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

a. Decay Heat Removal (DHR) System, 

b. Emergency Core Cooling System (ECCS), and 

c. Makeup and Purification System. 

The PIVs are listed in [FSAR section] Reference 6. 

Violation of this LCO could result in continued degradation of a PIV, which 

could lead to overpressurization of a low pressure system and the loss of 

the integrity of a fission product barrier. 

APPLICABLE Reference 4 identified potential intersystem LOCAs as a significant 

SAFETY contributor to the risk of core melt. The dominant accident sequence in 

ANALYSES the intersystem LOCA category is the failure of the low pressure portion 

of the DHR System outside of containment. The accident is the result of 

a postulated failure of the PIVs, which are part of the reactor coolant 

pressure boundary (RCPB), and the subsequent pressurization of the 

DHR System downstream of the PIVs from the RCS. Because the low 

pressure portion of the DHR System is typically designed for 600 psig, 

overpressurization failure of the DHR low pressure line would result in a 

LOCA outside containment and subsequent risk of core melt. 

Reference 5 evaluated various PIV configurations, leakage testing of the 

valves, and operational changes to determine the effect on the probability 

of intersystem LOCAs. This study concluded that periodic leakage testing 

of the PIVs can substantially reduce the probability of an intersystem 

LOCA. 

RCS PIV leakage satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO RCS PIV leakage is identified LEAKAGE into closed systems connected 

to the RCS. Isolation valve leakage is usually on the order of drops per 

minute. Leakage that increases significantly suggests that something is 

operationally wrong and corrective action must be taken. 

The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with 

a maximum limit of 5 gpm. The previous criterion of 1 gpm for all valve 

sizes imposed an unjustified penalty on the larger valves without 

providing information on potential valve degradation and resulted in 

higher personnel radiation exposures. A study concluded a leakage rate 

limit based on valve size was superior to a single allowable value. 
RCS PIV Leakage 

B 3.4.14 

BWOG STS B 3.4.14-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Reference 7 permits leakage testing at a lower pressure differential than 

between the specified maximum RCS pressure and the normal pressure 

of the connected system during RCS operation (the maximum pressure 

differential) in those types of valves in which the higher service pressure 

will tend to diminish the overall leakage channel opening. In such cases, 

the observed rate may be adjusted to the maximum pressure differential 

by assuming leakage is directly proportional to the pressure differential to 

the one half power. 

APPLICABILITY In MODES 1, 2, 3, and 4, this LCO applies because the PIV leakage 

potential is greatest when the RCS is pressurized. In MODE 4, valves in 

the DHR flow path are not required to meet the requirements of this LCO 

when in, or during the transition to or from, the DHR mode of operation. 

In MODES 5 and 6, leakage limits are not provided because the lower 

reactor coolant pressure results in a reduced potential for leakage and for 

a LOCA outside the containment. 

ACTIONS The ACTIONS are modified by two Notes. Note 1 is added to provide 

clarification that each flow path allows separate entry into a Condition. 

This is allowed based upon the functional independence of the flow path. 

Note 2 requires an evaluation of affected systems if a PIV is inoperable. 

The leakage may have affected system operability, or isolation of a 

leaking flow path with an alternate valve may have degraded the ability of 

the interconnected system to perform its safety function. 

A.1 and A.2

The flow path must be isolated by two valves. Required Actions A.1 

and A.2 are modified by a Note that the valves used for isolation must 

meet the same leakage requirements as the PIVs and must be on the 

RCS pressure boundary [or the high pressure portion of the system]. 

Required Action A.1 requires that the isolation with one valve must be 

performed within 4 hours. Four hours provides time to reduce leakage in 

excess of the allowable limit and to isolate the affected system if leakage 

cannot be reduced. The 4 hours allows the actions and restricts the 

operation with leaking isolation valves. 
RCS PIV Leakage 

B 3.4.14 

BWOG STS B 3.4.14-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ Required Action A.2 specifies that the double isolation barrier of two 

valves be restored by closing some other valve qualified for isolation or 

restoring one leaking PIV. [The 72 hour time after exceeding the limit 

considers the time required to complete the Action and the low probability 

of a second valve failing during this time period. 

or 

The 72 hour time after exceeding the limit allows for the restoration of the 

leaking PIV to OPERABLE status. This timeframe considers the time 

required to complete this Action and the low probability of a second valve 

failing during this period. ]

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Two options are provided for Required Action A.2. The second option 

(72 hour restoration) is appropriate if isolation of a second valve would 

place the unit in an unanalyzed condition. 

-------------------------------------------------------------------------------------------------- 

B.1 and B.2

If leakage cannot be reduced, [the system isolated,] or other Required 

Actions accomplished, the plant must be brought to a MODE in which the 

requirement does not apply. To achieve this status, the plant must be 

brought to MODE 3 within 6 hours and to MODE 5 within 36 hours. This 

Required Action may reduce the leakage and also reduces the potential 

for a LOCA outside the containment. The allowed Completion Times are 

reasonable based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

C.1

The inoperability of the DHR autoclosure interlock renders the DHR 

suction isolation valves incapable of isolating in response to a high 

pressure condition and preventing inadvertent opening of the valves at 

RCS pressures in excess of the DHR systems design pressure. If the 

DHR autoclosure interlock is inoperable, operation may continue as long 

as the DHR suction penetration is closed by at least one closed manual 

or deactivated automatic valve within 4 hours. This action accomplishes 

the purpose of the autoclosure function. 
RCS PIV Leakage 

B 3.4.14 

BWOG STS B 3.4.14-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.14.1

REQUIREMENTS 

Performance of leakage testing on each RCS PIV or isolation valve used 

to satisfy Required Action A.1 or A.2 is required to verify that leakage is 

below the specified limit and to identify each leaking valve. The leakage 

limit of 0.5 gpm per inch of nominal valve diameter up to 5 gpm maximum 

applies to each valve. Leakage testing requires a stable pressure 

condition. 

For the two PIVs in series, the leakage requirement applies to each valve 

individually and not to the combined leakage across both valves. If the 

PIVs are not individually leakage tested, one valve may have failed 

completely and not detected if the other valve in series meets the leakage 

requirement. In this situation, the protection provided by redundant 

valves would be lost. 

Testing is to be performed every [18] months, a typical refueling cycle, if 

the plant does not go into MODE 5 for at least 7 days. The [18 month] 

Frequency is consistent with 10 CFR 50.55a(g) (Ref. 8) as contained in 

the Inservice Testing Program, is within frequency allowed by the 

American Society of Mechanical Engineers (ASME) Code, Section XI 

(Ref. 7), and is based on the need to perform such surveillances under 

conditions that apply during an outage and the potential for an unplanned 

transient if the Surveillance were performed with the plant at power. 

[ In addition, testing must be performed once after the valve has been 

opened by flow or exercised to ensure tight reseating. PIVs disturbed in 

the performance of this Surveillance should also be tested unless 

documentation shows that an infinite testing loop cannot practically be 

avoided. Testing must be performed within 24 hours after the valve has 

been reseated. Within 24 hours is a reasonable and practical time limit 

for performing this test after opening or reseating a valve. ]

The leakage limit is to be met at the RCS pressure associated with 

MODES 1 and 2. This permits leakage testing at high differential 

pressures with stable conditions not possible in the MODES with lower 

pressures. 

Entry into MODES 3 and 4 is allowed to establish the necessary 

differential pressures and stable conditions to allow for performance of 

this Surveillance. The Note that allows this provision is complimentary to 

the Frequency of prior to entry into MODE 2 whenever the unit has been 
RCS PIV Leakage 

B 3.4.14 

BWOG STS B 3.4.14-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

in MODE 5 for 7 days or more, if leakage testing has not been performed 

in the previous 9 months. In addition, this Surveillance is not required to 

be performed on the DHR System when the DHR System is aligned to 

the RCS in the decay heat removal mode of operation. PIVs contained in 

the DHR flow path must be leakage rate tested after DHR is secured and 

stable unit conditions and the necessary differential pressures are 

established. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The "24 hour..." Frequency of performance for Surveillance 

Requirement 3.4.14.1 is not required for B&W Owner's Group plants 

licensed prior to 1980. These plants were licensed prior to the NRC 

establishing formal Technical Specification controls for pressure isolation 

valves. Subsequently, these earlier plants had their licenses modified by 

NRC Order to require certain PIV testing Frequencies (excluding the 

"24 hour..." Frequency) be included in that plant's Technical 

Specifications. Based upon the information available to the Staff at the 

time, the content of those Orders was considered acceptable. Since 

1980, the NRC Staff has determined an additional PIV leakage rate 

determination is required within 24 hours following actuation of the valve 

and flow through the valve. This is necessary in order to ensure the PIV's 

ability to support the integrity of the reactor coolant pressure boundary. 

The Revised Standard Technical Specifications include the "24 hours..." 

Frequency to reflect current NRC Staff position on the need to include this 

test requirement within Technical Specifications. 

-------------------------------------------------------------------------------------------------- 

[ SR 3.4.14.2 and SR 3.4.14.3

Verifying that the DHR autoclosure interlocks are OPERABLE ensures 

that RCS pressure will not pressurize the DHR system beyond 125% of 

its design pressure of [600] psig. The interlock setpoint that prevents the 

valves from being opened is set so the actual RCS pressure must be 

< [425] psig to open the valves. This setpoint ensures the DHR design 

pressure will not be exceeded and the DHR relief valves will not lift. The 

18 month Frequency is based on the need to perform this Surveillance 

under the conditions that apply during a plant outage and the potential for 

an unplanned transient if the Surveillance was performed with the reactor 

at power. The 18 month Frequency is also acceptable based on 

consideration of the design reliability (and confirming operating 

experience) of the equipment. 
RCS PIV Leakage 

B 3.4.14 

BWOG STS B 3.4.14-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

These SRs are modified by Notes allowing the DHR autoclosure function 

to be disabled when using the DHR System suction relief valve for cold 

overpressure protection in accordance with LCO 3.4.12. ] 

REFERENCES 1. 10 CFR 50.2. 

 2. 10 CFR 55a(c). 

 3. 10 CFR 50, Appendix A, Section V, GDC 55. 

 4. NUREG-75/014, Appendix V, October 1975. 

 5. NUREG-0677, NRC, May 1980. 

 6. [Document containing list of PIVs.] 

 7. ASME, Boiler and Pressure Vessel Code, Section XI. 

 8. 10 CFR 50.55a(g). 
RCS Leakage Detection Instrumentation 

B 3.4.15 

BWOG STS B 3.4.15-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.15 RCS Leakage Detection Instrumentation 

BASES 

BACKGROUND GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for 

detecting and, to the extent practical, identifying the location of the source 

of RCS LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable 

methods for selecting leakage detection systems. 

Leakage detection systems must have the capability to detect significant 

reactor coolant pressure boundary (RCPB) degradation as soon after 

occurrence as practical to minimize the potential for propagation to a 

gross failure. Thus, an early indication or warning signal is necessary to 

permit proper evaluation of all unidentified LEAKAGE. 

Industry practice has shown that water flow changes of 0.5 to 1.0 gpm 

can readily be detected in contained volumes by monitoring changes in 

water level, in flow rate, or in the operating frequency of a pump. The 

containment sump used to collect unidentified LEAKAGE is instrumented 

to alarm for increases of 0.5 to 1.0 gpm in the normal flow rates. This 

sensitivity is acceptable for detecting increases in unidentified LEAKAGE. 

The reactor coolant contains radioactivity that, when released to the 

containment, can be detected by radiation monitoring instrumentation. 

Reactor coolant radioactivity levels will be low during initial reactor startup 

and for a few weeks thereafter until activated corrosion products have 

been formed and fission products appear from fuel element cladding 

contamination or cladding defects. Instrument sensitivities of 10-9 μCi/cc 

radioactivity for particulate monitoring and of 10-6 μCi/cc radioactivity for 

gaseous monitoring are practical for these leakage detection systems. 

Radioactivity detection systems are included for monitoring both 

particulate and gaseous activities because of their sensitivities and rapid 

responses to RCS LEAKAGE. 

An increase in humidity of the containment atmosphere would indicate 

release of water vapor to the containment. Dew point temperature 

measurements can thus be used to monitor humidity levels of the 

containment atmosphere as an indicator of potential RCS LEAKAGE. A 

1°F increase in dew point is well within the sensitivity range of available 

instruments. 
RCS Leakage Detection Instrumentation 

B 3.4.15 

BWOG STS B 3.4.15-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Since the humidity level is influenced by several factors, a quantitative 

evaluation of an indicated leakage rate by this means may be 

questionable and should be compared to observed increases in liquid 

flow into or from the containment sump [and condensate flow from air 

coolers]. Humidity level monitoring is considered most useful as an 

indirect alarm or indication to alert the operator to a potential problem. 

Humidity monitors are not required for this LCO. 

Air temperature and pressure monitoring methods may also be used to 

infer unidentified LEAKAGE to the containment. Containment 

temperature and pressure fluctuate slightly during plant operation, but a 

rise above the normally indicated range of values may indicate RCS 

LEAKAGE into the containment. The relevance of temperature and 

pressure measurements are affected by containment free volume and, for 

temperature, detector location. Alarm signals from these instruments can 

be valuable in recognizing rapid and sizable leakage to the containment. 

Temperature and pressure monitors are not required by this LCO. 

APPLICABLE The need to evaluate the severity of an alarm or an indication is important 

SAFETY to the operators, and the ability to compare and verify with indications 

ANALYSES from other systems is necessary. The system response times and 

sensitivities are described in the FSAR (Ref. 3). Multiple instrument 

locations are utilized, if needed, to ensure the transport delay time of the 

leakage from its source to an instrument location yields an acceptable 

overall response time. 

The safety significance of RCS LEAKAGE varies widely depending on its 

source, rate, and duration. Therefore, detecting and monitoring reactor 

coolant LEAKAGE into the containment area are necessary. Quickly 

separating the identified LEAKAGE from the unidentified LEAKAGE 

provides quantitative information to the operators, allowing them to take 

corrective action should a leak occur detrimental to the safety of the unit 

and the public. 

RCS leakage detection instrumentation satisfies Criterion 1 of 

10 CFR 50.36(c)(2)(ii). 
RCS Leakage Detection Instrumentation 

B 3.4.15 

BWOG STS B 3.4.15-3 Rev. 3.0, 03/31/04 

BASES 

LCO One method of protecting against large RCS LEAKAGE derives from the 

ability of instruments to rapidly detect extremely small leaks. This LCO 

requires instruments of diverse monitoring principles to be OPERABLE to 

provide a high degree of confidence that extremely small leaks are 

detected in time to allow actions to place the plant in a safe condition 

when RCS LEAKAGE indicates possible RCPB degradation. 

The LCO requirements are satisfied when monitors of diverse 

measurement means are available. Thus, the containment sump monitor, 

in combination with a particulate or gaseous radioactivity monitor, 

provides an acceptable minimum. 

APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, 

and 4, RCS leakage detection instrumentation is required to be 

OPERABLE. 

In MODE 5 or 6, the temperature is ≤ 200°F and pressure is maintained 

low or at atmospheric pressure. Since the temperatures and pressures 

are far lower than those for MODES 1, 2, 3, and 4, the likelihood of 

leakage and crack propagation is much smaller. Therefore, the 

requirements of this LCO are not applicable in MODES 5 and 6. 

ACTIONS A.1 and A.2

With the required containment sump monitor inoperable, no other form of 

sampling can provide the equivalent information. 

However, the containment atmosphere activity monitor will provide 

indications of changes in leakage. Together with the atmosphere 

monitor, the periodic surveillance for RCS inventory balance, SR 3.4.13.1, 

water inventory balance, must be performed at an increased frequency of 

24 hours to provide information that is adequate to detect leakage. A 

Note is added allowing that SR 3.4.13.1 is not required to be performed 

until 12 hours after establishing steady state operation (stable 

temperature, power level, pressurizer and makeup tank levels, makeup 

and letdown, and [RCP seal injection and return flows]). The 12 hour 

allowance provides sufficient time to collect and process all necessary 

data after stable plant conditions are established. 

Restoration of the required sump monitor to OPERABLE status is 

required to regain the function in a Completion Time of 30 days after the 

monitor's failure. This time is acceptable considering the frequency and 

adequacy of the RCS water inventory balance required by Required 

Action A.1. 
RCS Leakage Detection Instrumentation 

B 3.4.15 

BWOG STS B 3.4.15-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1.1, B.1.2, and B.2

With required gaseous or particulate containment atmosphere 

radioactivity monitoring instrumentation channels inoperable, alternative 

action is required. Either grab samples of the containment atmosphere 

must be taken and analyzed or water inventory balances, in accordance 

with SR 3.4.13.1, must be performed to provide alternate periodic 

information. With a sample obtained and analyzed or a water inventory 

balance performed every 24 hours, the reactor may be operated for up to 

30 days to allow restoration of at least one of the radioactivity monitors. 

The 24 hour interval provides periodic information that is adequate to 

detect leakage. A Note is added allowing that SR 3.4.13.1 is not required 

to be performed until 12 hours after establishing steady state operation 

(stable temperature, power level, pressurizer and makeup tank levels, 

makeup and letdown, and [RCP seal injection and return flows]). The 

12 hour allowance provides sufficient time to collect and process all 

necessary data after stable plant conditions are established. The 30 day 

Completion Time recognizes at least one other form of leak detection is 

available. 

C.1 and C.2

If a Required Action of Condition A or B cannot be met within the required 

Completion Time, the unit must be brought to a MODE in which the LCO 

does not apply. To achieve this status, the unit must be brought to at 

least MODE 3 within 6 hours and to MODE 5 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems. 

D.1

With both required monitors inoperable, no automatic means of 

monitoring leakage are available, and immediate plant shutdown in 

accordance with LCO 3.0.3 is required. 
RCS Leakage Detection Instrumentation 

B 3.4.15 

BWOG STS B 3.4.15-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.15.1

REQUIREMENTS 

SR 3.4.15.1 requires the performance of a CHANNEL CHECK of the 

required containment atmosphere radioactivity monitor. The check gives 

reasonable confidence that each channel is operating properly. The 

Frequency of 12 hours is based on instrument reliability and is reasonable 

for detecting off normal conditions. 

SR 3.4.15.2

SR 3.4.15.2 requires the performance of a CHANNEL FUNCTIONAL 

TEST of the required containment atmosphere radioactivity monitor. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. The test ensures that the monitor can perform its 

function in the desired manner. The test verifies the alarm setpoint and 

relative accuracy of the instrument string. The Frequency of 92 days 

considers instrument reliability, and operating experience has shown it 

proper for detecting degradation. 

SR 3.4.15.3 and SR 3.4.15.4

These SRs require the performance of a CHANNEL CALIBRATION for 

each of the required RCS leakage detection instrumentation channels. 

The calibration verifies the accuracy of the instrument string, including the 

instruments located inside containment. The Frequency of [18] months is 

a typical refueling cycle and considers channel reliability. Again, 

operating experience has proven this Frequency is acceptable. 

REFERENCES 1. 10 CFR 50, Appendix A, Section IV, GDC 30. 

 2. Regulatory Guide 1.45. 

 3. FSAR, Section [ ] . 
RCS Specific Activity 

B 3.4.16 

BWOG STS B 3.4.16-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.16 RCS Specific Activity 

BASES 

BACKGROUND The Code of Federal Regulations, 10 CFR 100 (Ref. 1), specifies the 

maximum dose to the whole body and the thyroid an individual at the site 

boundary can receive for 2 hours during an accident. The limits on 

specific activity ensure that the doses are held to a small fraction of the 

10 CFR 100 limits during analyzed transients and accidents. 

The RCS specific activity LCO limits the allowable concentration level of 

radionuclides in the reactor coolant. The LCO limits are established to 

minimize the offsite radioactivity dose consequences in the event of a 

steam generator tube rupture (SGTR) accident. 

The LCO contains specific activity limits for both DOSE EQUIVALENT 

I-131 and gross specific activity. The allowable levels are intended to 

limit the 2 hour dose at the site boundary to a small fraction of the 

10 CFR 100 dose guideline limits. The limits in the LCO are standardized 

based on parametric evaluations of offsite radioactivity dose 

consequences for typical site locations. 

The parametric evaluations showed the potential offsite dose levels for an 

SGTR accident were an appropriately small fraction of the 10 CFR 100 

dose guideline limits (Ref. 1). Each evaluation assumes a broad range of 

site applicable atmospheric dispersion factors in a parametric evaluation. 

APPLICABLE The LCO limits on the specific activity of the reactor coolant ensure that 

SAFETY the resulting 2 hour doses at the site boundary will not exceed a small 

ANALYSES fraction of the 10 CFR 100 dose guideline limits following an SGTR 

accident. The SGTR safety analysis (Ref. 2) assumes the specific activity 

of the reactor coolant at the LCO limits and an existing reactor coolant 

steam generator (SG) tube leakage rate of 1 gpm. The analysis also 

assumes a reactor trip and a turbine trip at the same time as the SGTR 

event. 

The analysis for the SGTR accident establishes the acceptance limits for 

RCS specific activity. Reference to this analysis is used to assess 

changes to the facility that could affect RCS specific activity as they relate 

to the acceptance limits. 
RCS Specific Activity 

B 3.4.16 

BWOG STS B 3.4.16-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The rise in pressure in the ruptured SG causes radioactively 

contaminated steam to discharge to the atmosphere through the 

atmospheric dump valves or the main steam safety valves. The 

atmospheric discharge stops when the turbine bypass to the condenser 

removes the excess energy to rapidly reduce the RCS pressure and close 

the valves. The unaffected SG removes core decay heat by venting 

steam until the cooldown ends. 

The safety analysis shows the radiological consequences of an SGTR 

accident are within a small fraction of the Reference 1 dose guideline 

limits. Operation with iodine specific activity levels greater than the LCO 

limit is permissible, if the activity levels do not exceed the limits shown in 

Figure 3.4.16-1, in the applicable Specification, for more than 48 hours. 

The remainder of the above limit permissible iodine levels shown in 

Figure 3.4.16-1 are acceptable because of the low probability of an SGTR 

accident occurring during the established 48 hour time limit. The 

occurrence of an SGTR accident at these permissible levels could 

increase the site boundary dose levels, but still be within 10 CFR 100 

dose guideline limits. 

RCS Specific Activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The specific iodine activity is limited to 1.0 μCi/gm DOSE EQUIVALENT 

I-131, and the gross specific activity in the primary coolant is limited to the 

number of μCi/gm equal to 100 divided by Ē (average disintegration 

energy of the sum of the average beta and gamma energies of the 

coolant nuclides). The limit on DOSE EQUIVALENT I-131 ensures the 

2 hour thyroid dose to an individual at the site boundary during the Design 

Basis Accident (DBA) will be a small fraction of the allowed thyroid dose. 

The limit on gross specific activity ensures the 2 hour whole body dose to 

an individual at the site boundary during the DBA will be a small fraction 

of the allowed whole body dose. 

The SGTR accident analysis (Ref. 2) shows that the 2 hour site boundary 

dose levels are within acceptable limits. Violation of the LCO may result 

in reactor coolant radioactivity levels that could, in the event of an SGTR, 

lead to site boundary doses that exceed the 10 CFR 100 dose guideline 

limits. 
RCS Specific Activity 

B 3.4.16 

BWOG STS B 3.4.16-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS average temperature 

≥ 500°F, operation within the LCO limits for DOSE EQUIVALENT I-131 

and gross specific activity are necessary to contain the potential 

consequences of an SGTR to within the acceptable site boundary dose 

values. 

For operation in MODE 3 with RCS average temperature < 500°F, and in 

MODES 4 and 5, the release of radioactivity in the event of an SGTR is 

unlikely since the saturation pressure of the reactor coolant is below the 

lift pressure settings of the atmospheric dump valves and main steam 

safety valves. 

ACTIONS A.1 and A.2

With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples 

at intervals of 4 hours must be taken to demonstrate the limits of 

Figure 3.4.16-1 are not exceeded. The Completion Time of 4 hours is 

required to obtain and analyze a sample. Sampling must continue for 

trending. 

The DOSE EQUIVALENT I-131 must be restored to limits within 

48 hours. The Completion Time of 48 hours is required, if the limit 

violation resulted from normal iodine spiking. 

A Note permits the use of the provisions of LCO 3.0.4.c. This allowance 

permits entry into the applicable MODE(S) while relying on the ACTIONS. 

This allowance is acceptable due to the significant conservatism 

incorporated into the specific activity limit, the low probability of an event 

which is limiting due to exceeding this limit, and the ability to restore 

transient specific activity excursions while the plant remains at, or 

proceeds to power operation. 

B.1

If a Required Action and associated Completion Time of Condition A are 

not met or if the DOSE EQUIVALENT I-131 is in the unacceptable region 

of Figure 3.4.16-1, the reactor must be brought to MODE 3 with RCS 

average temperature < 500°F within 6 hours. The Completion Time of 

6 hours is required to get to MODE 3 below 500°F without challenging 

reactor emergency systems. 
RCS Specific Activity 

B 3.4.16 

BWOG STS B 3.4.16-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

With the gross specific activity in excess of the allowed limit, the unit must 

be placed in a MODE in which the requirement does not apply. 

The allowed Completion Time of 6 hours to reach MODE 3 and RCS 

average temperature < 500°F lowers the saturation pressure of the 

reactor coolant below the setpoints of the main steam safety valves, and 

prevents venting the SG to the environment in an SGTR event. The 

Completion Time of 6 hours is required to reach MODE 3 from full power 

conditions in an orderly manner and without challenging reactor 

emergency systems. 

SURVEILLANCE SR 3.4.16.1

REQUIREMENTS 

SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure 

of the gross specific activity of the reactor coolant at least once per 

7 days. While basically a quantitative measure of radionuclides with half 

lives longer than 15 minutes, excluding iodines, this measurement is the 

sum of the degassed gamma activities and the gaseous gamma activities 

in the sample taken. This Surveillance provides an indication of any 

increase in gross specific activity. 

Trending the results of this Surveillance allows proper remedial action to 

be taken before reaching the LCO limit under normal operating 

conditions. The Surveillance is applicable in MODES 1 and 2, and in 

MODE 3 with RCS average temperature at least 500°F. The 7 day 

Frequency considers the unlikelihood of a gross fuel failure during that 

time period. 

SR 3.4.16.2

This Surveillance is performed in MODE 1 only to ensure the iodine 

remains within limit during normal operation and following fast power 

changes when fuel failure is more apt to occur. The 14 day Frequency is 

adequate to trend changes in the iodine activity level considering gross 

specific activity is monitored every 7 days. The Frequency, between 

2 and 6 hours after a power change of ≥ 15% RTP within a 1 hour period, 

is established because the iodine levels peak during this time following 

fuel failure; samples at other times would provide inaccurate results. 
RCS Specific Activity 

B 3.4.16 

BWOG STS B 3.4.16-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.4.16.3

SR 3.4.16.3 requires radiochemical analysis for Ē determination every 

184 days (6 months) with the plant operating in MODE 1 equilibrium 

conditions. The Ē determination directly relates to the LCO and is 

required to verify plant operation within the specific gross activity LCO 

limit. The analysis for Ē is a measurement of the average energies per 

disintegration for isotopes with half lives longer than 15 minutes, 

excluding iodines. The Frequency of 184 days recognizes Ē does not 

change rapidly. 

This SR has been modified by a Note that requires sampling to be 

performed 31 days after a minimum of 2 EFPD and 20 days of MODE 1 

operation have elapsed since the reactor was last subcritical for at least 

48 hours. This ensures the radioactive materials are at equilibrium so the 

analysis for Ē is representative and not skewed by a crud burst or other 

similar abnormal event. 

REFERENCES 1. 10 CFR 100.11. 

 2. FSAR, Section [15.6.3]. 
CFTs 

B 3.5.1 

BWOG STS B 3.5.1-1 Rev. 3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 

B 3.5.1 Core Flood Tanks (CFTs) 

BASES 

BACKGROUND The function of the ECCS CFTs is to supply water to the reactor vessel 

during the blowdown phase of a loss of coolant accident (LOCA), to 

provide inventory to help accomplish the refill phase that follows 

thereafter, and to provide Reactor Coolant System (RCS) makeup for a 

small break LOCA. Two CFTs are provided for these functions. 

The blowdown phase of a large break LOCA is the initial period of the 

transient during which the RCS departs from equilibrium conditions, and 

heat from fission product decay, hot internals, and the vessel continues to 

be transferred to the reactor coolant. The blowdown phase of the 

transient ends when the RCS pressure falls to a value approaching that of 

the containment atmosphere. 

In the refill phase of a LOCA, which follows immediately, reactor coolant 

inventory has vacated the core through steam flashing and ejection 

through the break. The core is essentially in adiabatic heatup. The 

balance of inventory is then available to help fill voids in the lower plenum 

and reactor vessel downcomer so as to establish a recovery level at the 

bottom of the core and ongoing reflood of the core with the addition of 

safety injection water. 

The CFTs are pressure vessels partially filled with borated water and 

pressurized with nitrogen gas. The CFTs are passive components, since 

no operator or control actions are required for them to perform their 

function. Internal tank pressure is sufficient to discharge the contents of 

the CFTs to the RCS if RCS pressure decreases below the CFT 

pressure. Each CFT is piped separately into the reactor vessel 

downcomer. The CFT injection lines are also utilized by the Low 

Pressure Injection (LPI) System. Each CFT is isolated from the RCS by a 

motor operated isolation valve and two check valves in series. 

The motor operated isolation valves are normally open, with power 

removed from the valve motor to prevent inadvertent closure prior to or 

during an accident. 
CFTs 

B 3.5.1 

BWOG STS B 3.5.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The CFTs thus form a passive system for injection directly into the reactor 

vessel. Except for the core flood line break LOCA, a unique accident that 

also disables a portion of the injection system, both tanks are assumed to 

operate in the safety analyses for Design Basis Events. Because 

injection is directly into the reactor vessel downcomer, and because it is a 

passive system not subject to the single active failure criterion, all fluid 

injection is credited for core cooling. 

The CFT gas/water volumes, gas pressure, and outlet pipe size are 

selected to provide core cooling for a large break LOCA prior to the 

injection of coolant by the LPI System. 

APPLICABLE The CFTs are taken credit for in both the large and small break LOCA 

SAFETY analyses at full power (Ref. 1). These Design Basis Accident (DBA) 

ANALYSES analyses establish the acceptance limits for the CFTs. Reference to the 

analyses for these DBAs is used to assess changes in the CFTs as they 

relate to the acceptance limits. In performing the LOCA calculations, 

conservative assumptions are made concerning the availability of 

emergency injection flow. The assumption of the loss of offsite power is 

required by regulations. In the early stages of a LOCA with the loss of 

offsite power, the CFTs provide the sole source of makeup water to the 

RCS. 

This is because the LPI pumps and high pressure injection (HPI) pumps 

cannot deliver flow until the emergency diesel generators (EDGs) start, 

come to rated speed, and go through their timed loading sequence. 

The limiting large break LOCA is a double ended guillotine cold leg break 

at the discharge of the reactor coolant pump. 

During this event, the CFTs discharge to the RCS as soon as RCS 

pressure decreases below CFT pressure. As a conservative estimate, no 

credit is taken for HPI for large break LOCAs. LPI is not assumed to 

occur until 35 seconds after the RCS pressure decreases to the ESFAS 

actuation pressure. No operator action is assumed during the blowdown 

stage of a large break LOCA. 
CFTs 

B 3.5.1 

BWOG STS B 3.5.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The small break LOCA analysis also assumes a time delay after ESFAS 

actuation before pumped flow reaches the core. For the larger range of 

small breaks, the rate of blowdown is such that the increase in fuel clad 

temperature is terminated by the CFTs, with pumped flow then providing 

continued cooling. As break size decreases, the CFTs and HPI pumps 

both play a part in terminating the rise in clad temperature. As break size 

continues to decrease, the role of the CFTs continues to decrease until 

the tanks are not required and the HPI pumps become responsible for 

terminating the temperature increase. 

This LCO helps to ensure that the following acceptance criteria for the 

ECCS established by 10 CFR 50.46 (Ref. 2) will be met following a 

LOCA: 

a. Maximum fuel element cladding temperature of 2200°F, 

b. Maximum cladding oxidation of ≤ 0.17 times the total cladding 

thickness before oxidation, 

c. Maximum hydrogen generation from a zirconium water reaction of 

≤ 0.01 times the hypothetical amount that would be generated if all of 

the metal in the cladding cylinders surrounding the fuel, excluding the 

cladding surrounding the plenum volume, were to react, and 

d. Core maintained in a coolable geometry. 

Since the CFTs discharge during the blowdown phase of a LOCA, they 

do not contribute to the long term cooling requirements of 10 CFR 50.46. 

The limits for operation with a CFT that is inoperable for any reason other 

than the boron concentration not being within limits minimize the time that 

the plant is exposed to a LOCA event occurring along with failure of a 

CFT, which might result in unacceptable peak cladding temperatures. If a 

closed isolation valve cannot be opened, or the proper water volume or 

nitrogen cover pressure cannot be restored, the full capability of one CFT 

is not available and prompt action is required to place the reactor in a 

MODE in which this capability is not required. 

In addition to LOCA analyses, the CFTs have been assumed to operate 

to provide borated water for reactivity control for severe overcooling 

events such as a large steam line break (SLB). 
CFTs 

B 3.5.1 

BWOG STS B 3.5.1-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The CFTs are part of the primary success path that functions or actuates 

to mitigate a DBA that either assumes the failure of or presents a 

challenge to the integrity of a fission product barrier. 

The minimum volume requirement for the CFTs ensures that both CFTs 

can provide adequate inventory to reflood the core and downcomer 

following a LOCA. The downcomer then remains flooded until the HPI 

and LPI systems start to deliver flow. 

The maximum volume limit is based upon the need to maintain adequate 

gas volume to ensure proper injection, ensure the ability of the CFTs to 

fully discharge, and limit the maximum amount of boron inventory in the 

CFTs. Values of [7555] gallons and [8005] gallons are specified. These 

values allow for instrument inaccuracies. Values of other parameters are 

treated similarly. 

The minimum nitrogen cover pressure requirement of [525] psig ensures 

that the contained gas volume will generate discharge flow rates during 

injection that are consistent with those assumed in the safety analysis. 

The maximum nitrogen cover pressure limit of [625] psig ensures that the 

amount of CFT inventory that is discharged while the RCS depressurizes, 

and is therefore lost through the break, will not be larger than that 

predicted by the safety analysis. The maximum allowable boron 

concentration of [3500] ppm in the CFTs ensures that the sump pH will be 

maintained between 7.0 and 11.0 following a LOCA. 

The minimum boron requirement of [2270] ppm is selected to ensure that 

the reactor will remain subcritical during the reflood stage of a large break 

LOCA. During a large break LOCA, all control rod assemblies are 

assumed not to insert into the core, and the initial reactor shutdown is 

accomplished by void formation during blowdown. Sufficient boron 

concentration must be maintained in the CFTs to prevent a return to 

criticality during reflood. 

The CFT isolation valves are not single failure proof; therefore, whenever 

these valves are open, power shall be removed from them. This 

precaution ensures that both CFTs are available during an accident. With 

power supplied to the valves, a single active failure could result in a valve 

closure, which would render one CFT unavailable for injection. Both 

CFTs are required to function in the event of a large break LOCA. 

The CFTs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
CFTs 

B 3.5.1 

BWOG STS B 3.5.1-5 Rev. 3.0, 03/31/04 

BASES 

LCO The LCO establishes the minimum conditions required to ensure that the 

CFTs are available to accomplish their core cooling safety function 

following a LOCA. Both CFTs are required to function in the event of a 

large break LOCA. If the entire contents of both tanks are not injected 

during the blowdown phase of a large break LOCA, the ECCS 

acceptance criteria of 10 CFR 50.46 (Ref. 2) could be violated. For a 

CFT to be considered OPERABLE, the isolation valve must be fully open, 

power removed above [2000] psig, and the limits established in the SR for 

contained volume, boron concentration, and nitrogen cover pressure must 

be met. 

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure > 750 psig, the 

CFT OPERABILITY requirements are based on full power operation. 

Although cooling requirements may decrease as power decreases, the 

CFTs are still required to provide core cooling as long as elevated RCS 

pressures and temperatures exist. 

This LCO is only applicable at pressures ≥ 750 psig. Below 750 psig, the 

rate of RCS blowdown is such that the safety injection pumps can provide 

adequate injection to ensure that peak clad temperature remains below 

the 10 CFR 50.46 (Ref. 2) limit of 2200°F. 

In MODE 3 with RCS pressure ≤ 750 psig, and in MODES 4, 5, and 6, the 

CFT motor operated isolation valves are closed to isolate the CFTs from 

the RCS. This allows RCS cooldown and depressurization without 

discharging the CFTs into the RCS or requiring depressurization of the 

CFTs. 

ACTIONS A.1

If the boron concentration of one CFT is not within limits, it must be 

returned to within the limits within 72 hours. In this condition, ability to 

maintain subcriticality may be reduced, but the effects of reduced boron 

concentration on core subcriticality during reflood are minor. Boiling of 

the ECCS water in the core during reflood concentrates the boron in the 

saturated liquid that remains in the core. In addition, the volume of the 

CFT is still available for injection. Since the boron requirements are 

based on the average boron concentration of the total volume of two 

CFTs, the consequences are less severe than they would be if the 

contents of a CFT were not available for injection. Thus, 72 hours is 

allowed to return the boron concentration to within limits. 
CFTs 

B 3.5.1 

BWOG STS B 3.5.1-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

If one CFT is inoperable for a reason other than boron concentration, the 

CFT must be returned to OPERABLE status within 1 hour. In this 

condition it cannot be assumed that the CFT will perform its required 

function during a LOCA. Due to the severity of the consequences should 

a LOCA occur in these conditions, the 1 hour Completion Time to open 

the valve, remove power to the valve, or restore the proper water volume 

or nitrogen cover pressure ensures that prompt action will be taken to 

return the inoperable CFT to OPERABLE status. The Completion Time 

minimizes the time the plant is potentially exposed to a LOCA in these 

conditions. 

C.1 and C.2

If the CFT cannot be returned to OPERABLE status within the associated 

Completion Time, the plant must be brought to a MODE in which the LCO 

does not apply. To achieve this status, the plant must be brought to at 

least MODE 3 within 6 hours and RCS pressure reduced to ≤ 750 psig 

within 12 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

D.1

If more than one CFT is inoperable, the unit is in a condition outside the 

accident analysis; therefore, LCO 3.0.3 must be entered immediately. 

SURVEILLANCE SR 3.5.1.1

REQUIREMENTS 

Verification every 12 hours that each CFT isolation valve is fully open, as 

indicated in the control room, ensures that the CFTs are available for 

injection and ensures timely discovery if a valve should be less than fully 

open. If an isolation valve is not fully open, the rate of injection to the 

RCS would be reduced. Although a motor operated valve position should 

not change with power removed, a closed valve could result in accident 

analysis assumptions not being met. A 12 hour Frequency is considered 

reasonable in view of administrative controls that ensure that a 

mispositioned isolation valve is unlikely. 
CFTs 

B 3.5.1 

BWOG STS B 3.5.1-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.5.1.2 and SR 3.5.1.3

Verification every 12 hours of each CFT's nitrogen cover pressure and the 

borated water volume is sufficient to ensure adequate injection during a 

LOCA. Due to the static design of the CFTs, a 12 hour Frequency usually 

allows the operator to identify changes before the limits are reached. 

Operating experience has shown that this Frequency is appropriate for 

early detection and correction of off normal trends. 

SR 3.5.1.4

Surveillance once every 31 days is reasonable to verify that the CFT 

boron concentration is within the required limits, because the static design 

of the CFT limits the ways in which the concentration can be changed. 

The Frequency is adequate to identify changes that could occur from 

mechanisms such as stratification or inleakage. Sampling within 6 hours 

after an 80 gallon volume increase will identify whether inleakage from 

the RCS has caused a reduction in boron concentration to below the 

required limit. It is not necessary to verify boron concentration if the 

added water inventory is from the borated water storage tank (BWST), 

because the water contained in the BWST is within CFT boron 

concentration requirements. This is consistent with the recommendations 

of NUREG-1366 (Ref. 3). 

SR 3.5.1.5

Verification every 31 days that power is removed from each CFT isolation 

valve operator [when the RCS pressure is ≥ [2000] psig ensures that an 

active failure could not result in the undetected closure of a CFT motor 

operated isolation valve coincident with a LOCA. If this closure were to 

occur and the postulated LOCA is a rupture of the redundant CFT inlet 

piping, CFT capability would be rendered inoperable. The rupture would 

render the tank with the open valve inoperable, and a closed valve on the 

other CFT would likewise render it inoperable. This would cause a loss of 

function for the CFTs. Since power is removed under administrative 

control, the 31 day Frequency will provide adequate assurance that the 

power is removed. 
CFTs 

B 3.5.1 

BWOG STS B 3.5.1-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR is modified by a Note that allows power to be supplied to the 

motor operated isolation valves when RCS pressure is < [2000] psig, thus 

allowing operational flexibility by avoiding unnecessary delays to 

manipulate the breakers during plant startups or shutdowns. 

REFERENCES 1. FSAR, Section [6.3]. 

 2. 10 CFR 50.46. 

 3. Draft NUREG-1366, February 1990. 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-1 Rev. 3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 

B 3.5.2 ECCS - Operating 

BASES 

BACKGROUND The function of the ECCS is to provide core cooling to ensure that the 

reactor core is protected after any of the following accidents: 

a. Loss of coolant accident (LOCA), 

b. Rod ejection accident (REA), 

c. Steam generator tube rupture (SGTR), and 

d. Steam line break (SLB). 

There are two phases of ECCS operation: injection and recirculation. In 

the injection phase, all injection is initially added to the Reactor Coolant 

System (RCS) via the cold legs and to the reactor vessel. After the 

borated water storage tank (BWST) has been depleted, the ECCS 

recirculation phase is entered as the ECCS suction is transferred to the 

containment sump. 

Two redundant, 100% capacity trains are provided. In MODES 1, 2, 

and 3, each train consists of high pressure injection (HPI) and low 

pressure injection (LPI) subsystems. In MODES 1, 2, and 3, both trains 

must be OPERABLE. This ensures that 100% of the core cooling 

requirements can be provided even in the event of a single active failure. 

A suction header supplies water from the BWST or the containment sump 

to the ECCS pumps. Separate piping supplies each train. HPI 

discharges into each of the four RCS cold legs between the reactor 

coolant pump and the reactor vessel. LPI discharges into each of the two 

core flood nozzles on the reactor vessel that discharge into the vessel 

downcomer area. Control valves are set to balance the HPI flow to the 

RCS. This flow balance directs sufficient flow to the core to meet the 

analysis assumptions following a small break LOCA in one of the RCS 

cold legs near an HPI nozzle. 

The HPI pumps are capable of discharging to the RCS at an RCS 

pressure above the opening setpoint of the pressurizer safety valves. 

The LPI pumps are capable of discharging to the RCS at an RCS 

pressure of approximately 200 psia. When the BWST has been nearly 

emptied, the suction for the LPI pumps is manually transferred to the 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

containment sump. The HPI pumps cannot take suction directly from the 

sump. If HPI is still needed, a cross connect from the discharge side of 

the LPI pump to the suction of the HPI pumps would be opened. This is 

known as "piggy backing" HPI to LPI and enables continued HPI to the 

RCS, if needed, after the BWST is emptied. 

In the long term cooling period, flow paths in the LPI System are 

established to preclude the possibility of boric acid in the core region 

reaching an unacceptably high concentration. One flow path is from the 

hot leg through the decay heat suction line from the hot leg and then in a 

reverse direction through the containment sump outlet line into the sump. 

The other flow path is through the pressurizer auxiliary spray line from 

one LPI train into the pressurizer and through the hot leg into the top 

region of the core. 

The HPI subsystem also functions to supply borated water to the reactor 

core following increased heat removal events, such as large SLBs. 

During low temperature conditions in the RCS, limitations are placed on 

the maximum number of ECCS pumps that may be OPERABLE. Refer to 

the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection 

(LTOP) System," for the basis of these requirements. 

During a large break LOCA, RCS pressure will decrease to < 200 psia in 

< 20 seconds. The ECCS is actuated upon receipt of an Engineered 

Safety Feature Actuation System (ESFAS) signal. The actuation of 

safeguard loads is accomplished in a programmed time sequence. If 

offsite power is available, the safeguard loads start immediately (in the 

programmed sequence). If offsite power is not available, the Engineered 

Safety Feature (ESF) buses shed normal operating loads and are 

connected to the diesel generators. Safeguard loads are then actuated in 

the programmed time sequence. The time delay associated with diesel 

starting, sequenced loading, and pump starting determines the time 

required before pumped flow is available to the core following a LOCA. 

The active ECCS components, along with the passive core flood tanks 

(CFTs) and the BWST covered in LCO 3.5.1, "Core Flood Tanks (CFTs)," 

and LCO 3.5.4, "Borated Water Storage Tank (BWST)," provide the 

cooling water necessary to meet 10 CFR 50.46 (Ref. 1). 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the 

SAFETY ECCS, established by 10 CFR 50.46 (Ref. 1), will be met following a 

ANALYSES LOCA: 

a. Maximum fuel element cladding temperature is ≤ 2200°F, 

b. Maximum cladding oxidation is ≤ 0.17 times the total cladding 

thickness before oxidation, 

c. Maximum hydrogen generation from a zirconium water reaction is 

≤ 0.01 times the hypothetical amount generated if all of the metal in 

the cladding cylinders surrounding the fuel, excluding the cladding 

surrounding the plenum volume, were to react, 

d. Core is maintained in a coolable geometry, and 

e. Adequate long term core cooling capability is maintained. 

The LCO also helps ensure that containment temperature limits are met. 

Both HPI and LPI subsystems are assumed to be OPERABLE in the 

large break LOCA analysis at full power (Ref. 2). This analysis 

establishes a minimum required flow for the HPI and LPI pumps, as well 

as the minimum required response time for their actuation. The HPI 

pump is credited in the small break LOCA analysis. This analysis 

establishes the flow and discharge head requirements at the design point 

for the HPI pump. The SGTR and SLB analyses also credit the HPI 

pump but are not limiting in their design. 

The large break LOCA event with a loss of offsite power and a single 

failure (disabling one ECCS train) establishes the OPERABILITY 

requirements for the ECCS. During the blowdown stage of a LOCA, the 

RCS depressurizes as primary coolant is ejected through the break into 

the containment. The nuclear reaction is terminated either by moderator 

voiding during large breaks or CONTROL ROD assembly insertion for 

small breaks. Following depressurization, emergency cooling water is 

injected into the reactor vessel core flood nozzles, then flows into the 

downcomer, fills the lower plenum, and refloods the core. 

The LCO ensures that an ECCS train will deliver sufficient water to match 

decay heat boiloff rates soon enough to minimize core uncovery for a 

large break LOCA. It also ensures that the HPI pump will deliver 

sufficient water for a small break LOCA and provide sufficient boron to 

maintain the core subcritical. 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

In the LOCA analyses, HPI and LPI are not credited until 35 seconds after 

actuation of the ESFAS signal. This is based on a loss of offsite power 

and the associated time delays in startup and loading of the emergency 

diesel generator (EDG). Further, LPI flow is not credited until RCS 

pressure drops below the pump's shutoff head. For a large break LOCA, 

HPI is not credited at all. 

The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are 

required to ensure that at least one is available, assuming a single failure 

in the other train. Additionally, individual components within the ECCS 

trains may be called upon to mitigate the consequences of other 

transients and accidents. 

In MODES 1, 2, and 3, an ECCS train consists of an HPI subsystem and 

an LPI subsystem. Each train includes the piping, instruments, and 

controls to ensure an OPERABLE flow path capable of taking suction 

from the BWST upon an ESFAS signal and manually transferring suction 

to the containment sump. 

During an event requiring ECCS actuation, a flow path is provided to 

ensure an abundant supply of water from the BWST to the RCS via the 

HPI and LPI pumps and their respective discharge flow paths to each of 

the four cold leg injection nozzles and the reactor vessel. In the long 

term, this flow path may be manually transferred to take its supply from 

the containment sump and to supply its flow to the RCS via two paths, as 

described in the Background section. 

The flow path for each train must maintain its designed independence to 

ensure that no single failure can disable both ECCS trains. 

As indicated in the Note, operation in MODE 3 with ECCS trains deactivated pursuant to LCO 3.4.12 is necessary for plants with an LTOP 

System arming temperature at or near the MODE 3 boundary 

temperature of [350]°F. LCO 3.4.12 requires that certain components be 

de-activated at and below the LTOP System arming temperature. When 

this temperature is at or near the MODE 3 boundary temperature, time is 

needed to restore the systems to OPERABLE status. 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1, 2, and 3, the ECCS train OPERABILITY requirements for 

the limiting Design Basis Accident, a large break LOCA, are based on full 

power operation. Although reduced power would not require the same 

level of performance, the accident analysis does not provide for reduced 

cooling requirements in the lower MODES. The HPI pump performance 

is based on the small break LOCA, which establishes the pump 

performance curve and is less dependent on power. The HPI pump 

performance requirements are based on a small break LOCA. MODES 2 

and 3 requirements are bounded by the MODE 1 analysis. 

In MODES 5 and 6, plant conditions are such that the probability of an 

event requiring ECCS injection is extremely low. Core cooling 

requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - 

MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops 

Not Filled." MODE 6 core cooling requirements are addressed by 

LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High 

Water Level," and LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant 

Circulation - Low Water Level." 

ACTIONS A.1

With one LPI subsystem inoperable, action must be taken to restore it to 

OPERABLE status within 7 days. In this condition, the remaining 

OPERABLE ECCS train is adequate to perform the heat removal 

function. However, the overall reliability is reduced because a single 

failure to the remaining LPI subsystem could result in loss of ECCS 

function. The [7] day Completion Time is reasonable to perform 

corrective maintenance on the inoperable LPI subystem. The [7] day 

Completion Time is based on the findings of the deterministic and 

probabilistic analysis in Reference 3. Reference 3 concluded that 

extending the Completion Time to [7] days for an inoperable LPI 

subsystem proves plant operational flexibility while simultaneously 

reducing overall plant risk. This is because the risks incurred by having 

the LPI subsystem unavailable for a longer time at power will be 

substantially offset by the benefits associated with avoiding unnecessary 

plant transitions and by reducing risk during plant shutdown operations. 

B.1

With one or more trains operable and at least 100% of the injection flow 

equivalent to a single OPERABLE ECCS train available, components 

inoperable for reasons other than Condition A must be returned to 

OPERABLE status within 72 hours. The 72 hour Completion Time is 

based on NRC recommendations (Ref. 4) that are based on a risk 

evaluation and is a reasonable time for many repairs. 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

An ECCS train is inoperable if it is not capable of delivering the design 

flow to the RCS. 

The LCO requires the OPERABILITY of a number of independent 

subsystems. Due to the redundancy of trains and the diversity of 

subsystems, the inoperability of one component in a train does not render 

the ECCS incapable of performing its function. Neither does the 

inoperability of two different components, each in a different train, 

necessarily result in a loss of function for the ECCS. This allows 

increased flexibility in plant operations under circumstances when 

components in opposite trains are inoperable. 

An event accompanied by a loss of offsite power and the failure of an 

EDG can disable one ECCS train until power is restored. A reliability 

analysis (Ref. 4) has shown the risk of having one full ECCS train 

inoperable to be sufficiently low to justify continued operation for 

72 hours. 

With one or more components inoperable such that 100% of the flow 

equivalent to a single OPERABLE ECCS train is not available, the facility 

is in a condition outside the accident analyses. Therefore, LCO 3.0.3 

must be immediately entered. 

C.1 and C.2

If the inoperable components cannot be returned to OPERABLE status 

within the associated Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 6 hours and at least MODE 4 

within 12 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

D.1

Condition A is applicable with one or more trains inoperable. The allowed 

Completion Time is based on the assumption that at least 100% of the 

ECCS flow equivalent to a single OPERABLE ECCS train is available. 

With less than 100% of the ECCS flow equivalent to a single OPERABLE 

ECCS train available, the facility is in a condition outside of the accident 

analyses. Therefore, LCO 3.0.3 must be entered immediately. 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.5.2.1

REQUIREMENTS 

Verification of proper valve position ensures that the flow path from the 

ECCS pumps to the RCS is maintained. Misalignment of these valves 

could render both ECCS trains inoperable. Securing these valves in 

position by removal of power or by key locking the control in the correct 

position ensures that the valves cannot change position as the result of 

an active failure. These valves are of the type described in Reference 5, 

which can disable the function of both ECCS trains and invalidate the 

accident analyses. The 12 hour Frequency is considered reasonable in 

view of other administrative controls that will ensure the unlikelihood of a 

mispositioned valve. 

SR 3.5.2.2

Verifying the correct alignment for manual, power operated, and 

automatic valves in the ECCS flow paths provides assurance that the 

proper flow paths will exist for ECCS operation. This SR does not apply 

to valves that are locked, sealed, or otherwise secured in position, since 

these valves were verified to be in the correct position prior to locking, 

sealing, or securing. A valve that receives an actuation signal is allowed 

to be in a nonaccident position provided the valve will automatically 

reposition within the proper stroke time. This Surveillance does not 

require any testing or valve manipulation; rather, it involves verification 

that those valves capable of being mispositioned are in the correct 

position. The 31 day Frequency is appropriate because the valves are 

operated under administrative control, and an inoperable valve position 

would only affect a single train. This Frequency has been shown to be 

acceptable through operating experience. 

SR 3.5.2.3

With the exception of systems in operation, the ECCS pumps are 

normally in a standby, nonoperating mode. As such, the flow path piping 

has the potential to develop voids and pockets of entrained gases. 

Maintaining the piping from the ECCS pumps to the RCS full of water 

ensures that the system will perform properly, injecting its full capacity 

into the RCS upon demand. This will also prevent water hammer, pump 

cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or 

hydrogen) into the reactor vessel following an ESFAS signal or during 

shutdown cooling. The 31 day Frequency takes into consideration the 

gradual nature of gas accumulation in the ECCS piping and the existence 

of procedural controls governing system operation. 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.5.2.4

Periodic surveillance testing of ECCS pumps to detect gross degradation 

caused by impeller structural damage or other hydraulic component 

problems is required by Section XI of the ASME Code (Ref. 6). This type 

of testing may be accomplished by measuring the pump's developed 

head at only one point of the pump's characteristic curve. This verifies 

both that the measured performance is within an acceptable tolerance of 

the original pump baseline performance and that the performance at the 

test flow is greater than or equal to the performance assumed in the plant 

accident analysis. SRs are specified in the Inservice Testing Program, 

which encompasses Section XI of the ASME Code. Section XI of the 

ASME Code provides the activities and Frequencies necessary to satisfy 

the requirements. 

SR 3.5.2.5 and SR 3.5.2.6

These SRs demonstrate that each automatic ECCS valve actuates to the 

required position on an actual or simulated ESFAS signal and that each 

ECCS pump starts on receipt of an actual or simulated ESFAS signal. 

This SR is not required for valves that are locked, sealed, or otherwise 

secured in position under administrative controls. The 18 month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power. The 18 month Frequency is also acceptable based on 

consideration of the design reliability (and confirming operating 

experience) of the equipment. The actuation logic is tested as part of the 

ESFAS testing, and equipment performance is monitored as part of the 

Inservice Testing Program. 

SR 3.5.2.7

This Surveillance ensures that these valves are in the proper position to 

prevent the HPI pump from exceeding its runout limit. This 18 month 

Frequency is based on the same reasons as those stated for SR 3.5.2.5 

and SR 3.5.2.6. 
ECCS - Operating 

B 3.5.2 

BWOG STS B 3.5.2-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.5.2.8

This Surveillance ensures that the flow controllers for the LPI throttle 

valves will automatically control the LPI train flow rate in the desired 

range and prevent LPI pump runout as RCS pressure decreases after a 

LOCA. The 18 month Frequency is justified by the same reasons as 

those stated for SR 3.5.2.5 and SR 3.5.2.6. 

SR 3.5.2.9

Periodic inspections of the containment sump suction inlet ensure that it 

is unrestricted and stays in proper operating condition. The 18 month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage, on the need to preserve 

access to the location, and on the potential for an unplanned transient if 

the Surveillance were performed with the reactor at power. This 

Frequency has been found to be sufficient to detect abnormal 

degradation and has been confirmed by operating experience. 

REFERENCES 1. 10 CFR 50.46. 

2. FSAR, Section [6.3]. 

3. BAW-2295-A, Revision 1, Justification for Extension of Allowed 

Outage Time for Low Pressure Injection and Reactor Building Spray 

System. 

4. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended 

Interim Revisions to LCOs for ECCS Components," 

December 1, 1975. 

5. IE Information Notice 87-01, "RHR Valve Misalignment Causes 

Degradation of ECCS in PWRs," January 6, 1987. 

6. ASME, Boiler and Pressure Vessel Code, Section XI, Inservice 

Inspection, Article IWV-3400. 
ECCS - Shutdown 

B 3.5.3 

BWOG STS B 3.5.3-1 Rev. 3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 

B 3.5.3 ECCS - Shutdown 

BASES 

BACKGROUND The Background section for Bases B 3.5.2, "ECCS - Operating," is 

applicable to these Bases, with the following modifications. 

In MODE 4, the required ECCS train consists of two separate 

subsystems: high pressure injection (HPI) and low pressure injection 

(LPI), each consisting of two redundant, 100% capacity trains. 

The ECCS flow paths consist of piping, valves, heat exchangers, and 

pumps, such that water from the borated water storage tank (BWST) can 

be injected into the Reactor Coolant System (RCS) following the 

accidents described in Bases 3.5.2. 

APPLICABLE The Applicable Safety Analyses section of Bases 3.5.2 is applicable to 

SAFETY these Bases. 

ANALYSES 

Due to the stable conditions associated with operation in MODE 4 and the 

reduced probability of occurrence of a Design Basis Accident (DBA), the 

ECCS operational requirements are reduced. Included in these 

reductions is that certain automatic Engineered Safety Feature Actuation 

System (ESFAS) actuation is not available. In this MODE sufficient time 

exists for manual actuation of the required ECCS to mitigate the 

consequences of a DBA. 

Only one ECCS train is required for MODE 4. This requirement dictates 

that single failures are not considered during this MODE. The ECCS train 

- shutdown satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO In MODE 4, one of the two independent (and redundant) ECCS trains is 

required to ensure sufficient ECCS flow is available to the core following a 

DBA. 

In MODE 4, an ECCS train consists of an HPI subsystem and an LPI 

subsystem. Each train includes the piping, instruments, and controls to 

ensure an OPERABLE flow path capable of taking suction from the 

BWST and transferring suction to the containment sump. 

During an event requiring ECCS actuation, a flow path is required to 

provide an abundant supply of water from the BWST to the RCS, via the 

ECCS pumps and their respective supply headers, to each of the four 

cold leg injection nozzles. In the long term, this flow path may be 

switched to take its supply from the containment sump and to supply its 

flow to the RCS hot and cold legs. 
ECCS - Shutdown 

B 3.5.3 

BWOG STS B 3.5.3-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

This LCO is modified by two Notes. The first allows a DHR train to be 

considered OPERABLE during alignment and operation for decay heat 

removal, if capable of being manually realigned (remote or local) to the 

ECCS mode of operation and not otherwise inoperable. This allows 

operation in the DHR mode during MODE 4. The second Note states that 

HPI actuation may be deactivated in accordance with LCO 3.4.12, "Low 

Temperature Overpressure Protection (LTOP) System." Operator action 

is then required to initiate HPI. In the event of a loss of coolant accident 

(LOCA) requiring HPI actuation, the time required for operator action has 

been shown by analysis to be acceptable. 

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for the ECCS are 

covered by LCO 3.5.2. 

In MODE 4 with the RCS temperature below 280°F, one OPERABLE 

ECCS train is acceptable without single failure consideration, on the basis 

of the stable reactivity condition of the reactor and the limited core cooling 

requirements. 

In MODES 5 and 6, plant conditions are such that the probability of an 

event requiring ECCS injection is extremely low. Core cooling 

requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops - 

MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops 

Not Filled." MODE 6 core cooling requirements are addressed by 

LCO 3.9.4, "DHR and Coolant Circulation - High Water Level," and 

LCO 3.9.5, "DHR and Coolant Circulation - Low Water Level." 

ACTIONS A Note prohibits the application of LCO 3.0.4.b to inoperable ECCS DHR 

loops when entering MODE 4 from MODE 5. There is an increased risk 

associated with entering MODE 4 from MODE 5 with DHR inoperable and 

the provisions of LCO 3.0.4.b, which allow entry into a MODE or other 

specified condition in the Applicability with the LCO not met after 

performance of a risk assessment addressing inoperable systems and 

components, should not be applied in this circumstance. 
ECCS - Shutdown 

B 3.5.3 

BWOG STS B 3.5.3-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

 A.1

If no LPI subsystem train is OPERABLE, the unit is not prepared to 

respond to a LOCA or to continue cooldown using the LPI pumps and 

decay heat exchangers. The Completion Time of immediately, which 

would initiate action to restore at least one ECCS LPI subsystem to 

OPERABLE status, ensures that prompt action is taken to restore the 

required cooling capacity. Normally, in MODE 4, reactor decay heat must 

be removed by an LPI train operating with suction from the RCS. If no 

LPI train is OPERABLE for this function, reactor decay heat must be 

removed by some alternate method, such as use of the steam 

generator(s). The alternate means of heat removal must continue until 

the inoperable ECCS LPI subsystem can be restored to operation so that 

continuation of decay heat removal (DHR) is provided. 

With both DHR pumps and heat exchangers inoperable, it would be 

unwise to require the plant to go to MODE 5, where the only available 

heat removal system is the LPI trains operating in the DHR mode. 

Therefore, the appropriate action is to initiate measures to restore one 

ECCS LPI subsystem and to continue the actions until the subsystem is 

restored to OPERABLE status. 

B.1

If no ECCS HPI subsystem is OPERABLE, due to the inoperability of the 

HPI pump or flow path from the BWST, the plant is not prepared to 

provide high pressure response to Design Basis Events requiring ESFAS. 

The 1 hour Completion Time to restore at least one ECCS HPI subsystem 

to OPERABLE status ensures that prompt action is taken to provide the 

required cooling capacity or to initiate actions to place the plant in 

MODE 5, where an ECCS train is not required. 

C.1

When the Required Action of Condition B cannot be completed within the 

required Completion Time, a controlled shutdown should be initiated. The 

allowed Completion Time of 24 hours is reasonable, based on operating 

experience, to reach MODE 5 from full power conditions in an orderly 

manner and without challenging plant systems. 
ECCS - Shutdown 

B 3.5.3 

BWOG STS B 3.5.3-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.5.3.1

REQUIREMENTS 

The applicable Surveillance descriptions from Bases 3.5.2 apply. 

REFERENCES The applicable references from Bases 3.5.2 apply. 
BWST 

B 3.5.4 

BWOG STS B 3.5.4-1 Rev. 3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) 

B 3.5.4 Borated Water Storage Tank (BWST) 

BASES 

BACKGROUND The BWST supports the ECCS and the Containment Spray System by 

providing a source of borated water for ECCS and containment spray 

pump operation. In addition, the BWST supplies borated water to the 

refueling pool for refueling operations. 

The BWST supplies two ECCS trains, each by a separate, redundant 

supply header. Each header also supplies one train of the Containment 

Spray System. A normally open, motor operated isolation valve is 

provided in each header to allow the operator to isolate the BWST from 

the ECCS after the ECCS pump suction has been transferred to the 

containment sump following depletion of the BWST during a loss of 

coolant accident (LOCA). Use of a single BWST to supply both ECCS 

trains is acceptable because the BWST is a passive component, and 

passive failures are not assumed in the analysis of Design Basis Events 

(DBEs) to occur coincidentally with the Design Basis Accident (DBA). 

The ECCS and containment spray pumps are provided with recirculation 

lines that ensure each pump can maintain minimum flow requirements 

when operating at shutoff head conditions. 

This LCO ensures that: 

a. The BWST contains sufficient borated water to support the ECCS 

during the injection phase, 

b. Sufficient water volume exists in the containment sump to support 

continued operation of the ECCS and containment spray pumps at 

the time of transfer to the recirculation mode of cooling, and 

c. The reactor remains subcritical following a LOCA. 

Insufficient water inventory in the BWST could result in insufficient cooling 

capacity of the ECCS when the transfer to the recirculation mode occurs. 

Improper boron concentrations could result in a reduction of SDM or 

excessive boric acid precipitation in the core following a LOCA, as well as 

excessive caustic stress corrosion of mechanical components and 

systems inside containment. 
BWST 

B 3.5.4 

BWOG STS B 3.5.4-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE During accident conditions, the BWST provides a source of borated 

SAFETY water to the high pressure injection (HPI), low pressure injection (LPI), 

ANALYSES and containment spray pumps. As such, it provides containment cooling 

and depressurization, core cooling, and replacement inventory and is a 

source of negative reactivity for reactor shutdown. The design basis 

transients and applicable safety analyses concerning each of these 

systems are discussed in the Applicable Safety Analyses section of 

Specifications B 3.5.2, "ECCS - Operating," and B 3.6.6, "Containment 

Spray and Cooling Systems." These analyses are used to assess 

changes to the BWST in order to evaluate their effects in relation to the 

acceptance limits. 

The limits on volume of [≥ 415,200 gallons and ≤ 449,000 gallons] are 

based on several factors. Sufficient deliverable volume must be available 

to provide at least 20 minutes of full flow of all ECCS pumps prior to the 

transfer to the containment sump for recirculation. Twenty minutes gives 

the operator adequate time to prepare for switchover to containment 

sump recirculation. 

A second factor that affects the minimum required BWST volume is the 

ability to support continued ECCS pump operation after the manual 

transfer to recirculation occurs. When ECCS pump suction is transferred 

to the sump, there must be sufficient water in the sump to ensure 

adequate net positive suction head (NPSH) for the LPI and containment 

spray pumps. This NPSH calculation is described in the FSAR (Ref. 1), 

and the amount of water that enters the sump from the BWST and other 

sources is one of the input assumptions. Since the BWST is the main 

source that contributes to the amount of water in the sump following a 

LOCA, the calculation does not take credit for more than the minimum 

volume of usable water from the BWST. 

The third factor is that the volume of water in the BWST must be within a 

range that will ensure the solution in the sump following a LOCA is within 

a specified pH range that will minimize the evolution of iodine and the 

effect of chloride and caustic stress corrosion cracking on the mechanical 

systems and components. 

The volume range ensures that refueling requirements are met and that 

the capacity of the BWST is not exceeded. Note that the volume limits 

refer to total, rather than usable, volume required to be in the BWST; a 

certain amount of water is unusable because of tank discharge line 

location or other physical characteristics. 
BWST 

B 3.5.4 

BWOG STS B 3.5.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The [2270] ppm limit for minimum boron concentration was established to 

ensure that, following a LOCA, with a minimum BWST level, the reactor 

will remain subcritical in the cold condition following mixing of the BWST 

and Reactor Coolant System (RCS) water volumes. Large break LOCAs 

assume that all control rods remain withdrawn from the core. 

The minimum and maximum concentration limits both ensure that the 

solution in the sump following a LOCA is within a specified pH range that 

will minimize the evolution of iodine and the effect of chloride and caustic 

stress corrosion cracking on the mechanical systems and components. 

The [2450] ppm maximum limit for boron concentration in the BWST is 

also based on the potential for boron precipitation in the core during the 

long term cooling period following a LOCA. For a cold leg break, the core 

dissipates heat by pool nucleate boiling. Because of this boiling 

phenomenon in the core, the boric acid concentration will increase in this 

region. If allowed to proceed in this manner, a point may be reached 

where boron precipitation will occur in the core. Post LOCA emergency 

procedures direct the operator to establish dilution flow paths in the LPI 

System to prevent this condition by establishing a forced flow path 

through the core regardless of break location. These procedures are 

based on the minimum time in which precipitation could occur, assuming 

that maximum boron concentrations exist in the borated water sources 

used for injection following a LOCA. 

Boron concentrations in the BWST in excess of the limit could result in 

precipitation earlier than assumed in the analysis. 

The 40°F lower limit on the temperature of the solution in the BWST was 

established to ensure that the solution will not freeze. This temperature 

also helps prevent boron precipitation and ensures that water injection in 

the reactor vessel will not be colder than the lowest temperature assumed 

in reactor vessel stress analysis. The [100]°F upper limit on the 

temperature of the BWST contents is consistent with the maximum 

injection water temperature assumed in the LOCA analysis. 

The numerical values of the parameters stated in the SR are actual 

values and do not include allowance for instrument errors. 

The BWST satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
BWST 

B 3.5.4 

BWOG STS B 3.5.4-4 Rev. 3.0, 03/31/04 

BASES 

LCO The BWST exists to ensure that an adequate supply of borated water is 

available to cool and depressurize the containment in the event of a DBA; 

to cool and cover the core in the event of a LOCA, thereby ensuring the 

reactor remains subcritical following a DBA; and to ensure an adequate 

level exists in the containment sump to support ECCS and containment 

spray pump operation in the recirculation MODE. To be considered 

OPERABLE, the BWST must meet the limits for water volume, boron 

concentration, and temperature established in the SRs. 

APPLICABILITY In MODES 1, 2, 3, and 4, the BWST OPERABILITY requirements are 

dictated by the ECCS and Containment Spray System OPERABILITY 

requirements. Since both the ECCS and Containment Spray System 

must be OPERABLE in MODES 1, 2, 3, and 4, the BWST must be 

OPERABLE to support their operation. 

Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, 

"RCS Loops - MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - 

MODE 5, Loops Not Filled," respectively. MODE 6 core cooling 

requirements are addressed by LCO 3.9.4, "DHR and Coolant Circulation 

- High Water Level," and LCO 3.9.5, "DHR and Coolant Circulation - Low 

Water Level." 

ACTIONS A.1

With either the BWST boron concentration or borated water temperature 

not within limits, the condition must be corrected within 8 hours. In this 

condition, neither the ECCS nor the Reactor Building Spray System can 

perform its design functions. Therefore, prompt action must be taken to 

restore the tank to OPERABLE status or to place the plant in a MODE in 

which these systems are not required. The 8 hour limit to restore the 

temperature or boron concentration to within limits was developed 

considering the time required to change boron concentration or 

temperature and assuming that the contents of the tank are still available 

for injection. 

B.1

With the BWST inoperable for reasons other than Condition A (e.g., water 

volume), levels must be restored to within required limits within 1 hour. In 

this condition, neither the ECCS nor the Containment Spray System can 

perform its design functions. Therefore, prompt action must be taken to 

restore the tank to OPERABLE status or to place the plant in a MODE in 

which the BWST is not required. The allowed Completion Time of 1 hour 

to restore the BWST to OPERABLE status is based on this condition 

simultaneously affecting multiple redundant trains. 
BWST 

B 3.5.4 

BWOG STS B 3.5.4-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

If the BWST cannot be restored to OPERABLE status within the 

associated Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE SR 3.5.4.1

REQUIREMENTS 

Verification every 24 hours that the BWST water temperature is within the 

specified temperature band ensures that the boron will not precipitate; the 

fluid will not freeze; the fluid temperature entering the reactor vessel will 

not be colder than assumed in the reactor vessel stress analysis; and the 

fluid temperature entering the reactor vessel will not be hotter than 

assumed in the LOCA analysis. The 24 hour Frequency is sufficient to 

identify a temperature change that would approach either temperature 

limit and has been shown to be acceptable through operating experience. 

The SR is modified by a Note that requires the Surveillance to be 

performed only when ambient air temperatures are outside the operating 

temperature limits of the BWST. With ambient temperatures within this 

band, the BWST temperature should not exceed the limits. 

SR 3.5.4.2

Verification every 7 days that the BWST contained volume is within the 

required range ensures that a sufficient initial supply is available for 

injection and to support continued ECCS pump operation on recirculation. 

Since the BWST volume is normally stable and provided with a low level 

alarm, a 7 day Frequency has been shown to be appropriate through 

operating experience. 
BWST 

B 3.5.4 

BWOG STS B 3.5.4-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.5.4.3

Verification every 7 days that the boron concentration of the BWST fluid is 

within the required band ensures that the reactor will remain subcritical 

following a LOCA. Since the BWST volume is normally stable, a 7 day 

sampling Frequency is appropriate and has been shown to be acceptable 

through operating experience. 

REFERENCES 1. FSAR, Section [6.1]. 
Containment 

B 3.6.1 

BWOG STS B 3.6.1-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1 Containment 

BASES 

BACKGROUND The containment consists of the concrete reactor building (RB), its steel 

liner, and the penetrations through this structure. The structure is 

designed to contain radioactive material that may be released from the 

reactor core following a design basis loss of coolant accident (LOCA). 

Additionally, this structure provides shielding from the fission products 

that may be present in the containment atmosphere following accident 

conditions. 

The containment is a reinforced concrete structure with a cylindrical wall, 

a flat foundation mat, and a shallow dome roof. For containments with 

ungrouted tendons, the cylinder wall is prestressed with a post tensioning 

system in the vertical and horizontal directions, and the dome roof is 

prestressed using a three way post tensioning system. The inside 

surface of the containment is lined with a carbon steel liner to ensure a 

high degree of leak tightness during operating and accident conditions. 

The concrete RB is required for structural integrity of the containment 

under Design Basis Accident (DBA) conditions. The steel liner and its 

penetrations establish the leakage limiting boundary of the containment. 

Maintaining the containment OPERABLE limits the leakage of fission 

product radioactivity from the containment to the environment. SR 3.6.1.1 

leakage rate requirements comply with 10 CFR 50, Appendix J, Option 

[A][B] (Ref. 1), as modified by approved exemptions. 

The isolation devices for the penetrations in the containment boundary 

are a part of the containment leak tight barrier. To maintain this leak tight 

barrier: 

a. All penetrations required to be closed during accident conditions are 

either: 

1. Capable of being closed by an OPERABLE automatic 

containment isolation system or 

2. Closed by manual valves, blind flanges, or de-activated 

automatic valves secured in their closed positions, except as 

provided in LCO 3.6.3, "Containment Isolation Valves," 

b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, 

"Containment Air Locks," 
Containment 

B 3.6.1 

BWOG STS B 3.6.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

c. All equipment hatches are closed, and 

[ d. The pressurized sealing mechanism associated with each 

penetration, except as provided in LCO 3.6.[ ] , is OPERABLE. ] 

APPLICABLE The safety design basis for the containment is that the containment must 

SAFETY withstand the pressures and temperatures of the limiting DBA without 

ANALYSES exceeding the design leakage rate. 

The DBAs that result in a challenge to containment OPERABILITY from 

high pressures and temperatures are a LOCA, a steam line break, and a 

rod ejection accident (REA) (Ref. 2). In addition, release of significant 

fission product radioactivity within containment can occur from a LOCA or 

REA. In the DBA analyses, it is assumed that the containment is 

OPERABLE such that, for the DBAs involving release of fission product 

radioactivity, release to the environment is controlled by the rate of 

containment leakage. The containment was designed with an allowable 

leakage rate of [0.25]% of containment air weight per day (Ref. 3). This 

leakage rate, used in the evaluation of offsite doses resulting from 

accidents, is defined in 10 CFR 50, Appendix J, Option [A][B] (Ref. 1), as 

La: the maximum allowable leakage rate at the calculated maximum peak 

containment pressure (Pa) resulting from the limiting design basis LOCA. 

The allowable leakage rate represented by La forms the basis for the 

acceptance criteria imposed on all containment leakage rate testing. La is 

assumed to be [0.25]% per day in the safety analysis at Pa = [53.9] psig 

(Ref. 3). 

Satisfactory leakage rate test results are a requirement for the 

establishment of containment OPERABILITY. 

The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Containment OPERABILITY is maintained by limiting leakage to ≤ 1.0 La, 

except prior to the first startup after performing a required Containment 

Leakage Rate Testing Program leakage test. At this time the applicable 

leakage limits must be met. 

 Compliance with this LCO will ensure a containment configuration, 

including equipment hatches, that is structurally sound and that will limit 

leakage to those leakage rates assumed in the safety analysis. 
Containment 

B 3.6.1 

BWOG STS B 3.6.1-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Individual leakage rates specified for the containment air lock (LCO 3.6.2) 

[and purge valves with resilient seals (LCO 3.6.3)] are not specifically part 

of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage 

rates exceeding these individual limits only result in the containment 

being inoperable when the leakage results in exceeding the overall 

acceptance criteria of 1.0 La. 

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material into containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, containment is not 

required to be OPERABLE in MODE 5 to prevent leakage of radioactive 

material from containment. The requirements for containment during 

MODE 6 are addressed in LCO 3.9.3, "Containment Penetrations." 

ACTIONS A.1

In the event containment is inoperable, containment must be restored to 

OPERABLE status within 1 hour. The 1 hour Completion Time provides a 

period of time to correct the problem commensurate with the importance 

of maintaining containment during MODES 1, 2, 3, and 4. This time 

period also ensures the probability of an accident (requiring containment 

OPERABILITY) occurring during periods when containment is inoperable 

is minimal. 

B.1 and B.2

If containment cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 
Containment 

B 3.6.1 

BWOG STS B 3.6.1-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.6.1.1

REQUIREMENTS 

Maintaining the containment OPERABLE requires compliance with the 

visual examinations and leakage rate test requirements of the 

Containment Leakage Rate Testing Program. Failure to meet air lock 

and purge valve with resilient seal leakage limits specified in LCO 3.6.2 

and LCO 3.6.3 does not invalidate the acceptability of these overall 

leakage determinations unless their contribution to overall Type A, B, 

and C leakage causes that to exceed limits. As left leakage prior to the 

first startup after performing a required Containment Leakage Rate 

Testing Program leakage test is required to be < 0.6 La for combined 

Type B and C leakage, and [< 0.75 La for Option A] [≤ 0.75 La for Option 

B] for overall Type A leakage. At all other times between required 

leakage rate tests, the acceptance criteria is based on an overall Type A 

leakage limit of ≤ 1.0 La. At ≤ 1.0 La the offsite dose consequences are 

bounded by the assumptions of the safety analysis. SR Frequencies are 

as required by the Containment Leakage Rate Testing Program. These 

periodic testing requirements verify that the containment leakage rate 

does not exceed the leakage rate assumed in the safety analysis. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Regulatory Guide 1.163 and NEI 94-01 include acceptance criteria for asleft and as-found Type A leakage rates and combined Type B and C 

leakage rates, which may be reflected in the Bases. 

-------------------------------------------------------------------------------------------------- 

[ SR 3.6.1.2

For ungrouted, post tensioned tendons, this SR ensures that the 

structural integrity of the containment will be maintained in accordance 

with the provisions of the Containment Tendon Surveillance Program. 

Testing and Frequency are consistent with the recommendations of 

Regulatory Guide 1.35 (Ref. 4). ] 

REFERENCES 1. 10 CFR 50, Appendix J, Option [A][B]. 

 2. FSAR, Sections [14.1 and 14.2]. 

 3. FSAR, Section [5.6]. 

 4. Regulatory Guide 1.35, Revision [1]. 
Containment Air Locks 

B 3.6.2 

BWOG STS B 3.6.2-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.2 Containment Air Locks 

BASES 

BACKGROUND Containment air locks form part of the containment pressure boundary 

and provide a means for personnel access during all MODES of 

operation. 

Each air lock is nominally a right circular cylinder, 10 ft in diameter, with a 

door at each end. The doors are interlocked to prevent simultaneous 

opening. During periods when containment is not required to be 

OPERABLE, the door interlock mechanism may be disabled, allowing 

both doors of an air lock to remain open for extended periods when 

frequent containment entry is necessary. Each air lock door has been 

designed and is tested to certify its ability to withstand a pressure in 

excess of the maximum expected pressure following a Design Basis 

Accident (DBA) in containment. As such, closure of a single door 

supports containment OPERABILITY. Each of the doors contains double 

gasketed seals and local leakage rate testing capability to ensure 

pressure integrity. To effect a leak tight seal, the air lock design uses 

pressure seated doors (i.e., an increase in containment internal pressure 

results in increased sealing force on each door). 

Each personnel air lock door is provided with limit switches that provide 

control room indication of door position. Additionally, control room 

indication is provided to alert the operator whenever an air lock door 

interlock mechanism is defeated. 

The containment air locks form part of the containment pressure 

boundary. As such, air lock integrity and leak tightness is essential for 

maintaining the containment leakage rate within limit in the event of a 

DBA. Not maintaining air lock integrity or leak tightness may result in a 

leakage rate in excess of that assumed in the unit safety analysis. 

APPLICABLE The DBAs that result in a release of radioactive material within 

SAFETY containment are a loss of coolant accident (LOCA), a steam line break, 

ANALYSES and a rod ejection accident (Ref. 2). In the analysis of each of these 

accidents, it is assumed that containment is OPERABLE such that 

release of fission products to the environment is controlled by the rate of 

containment leakage. The containment was designed with an allowable 

leakage rate of [0.25]% of containment air weight per day (Ref. 3). This 

leakage rate is defined in 10 CFR 50, Appendix J, Option A (Ref. 1), as 

La: the maximum allowable containment leakage rate at the calculated 

maximum peak containment pressure (Pa) following a design basis 
Containment Air Locks 

B 3.6.2 

BWOG STS B 3.6.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

LOCA. This allowable leakage rate forms the basis for the acceptance 

criteria imposed on the SRs associated with the air lock. La is [0.25]% per 

day and Pa is [53.9] psig, resulting from the limiting design basis LOCA. 

The containment air locks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Each containment air lock forms part of the containment pressure 

boundary. As a part of the containment pressure boundary, the air lock 

safety function is related to control of the containment leakage rate 

resulting from a DBA. Thus, each air lock's structural integrity and leak 

tightness are essential to the successful mitigation of such an event. 

Each air lock is required to be OPERABLE. For the air lock to be 

considered OPERABLE, the air lock interlock mechanism must be 

OPERABLE, the air lock must be in compliance with the Type B air lock 

leakage test, and both air lock doors must be OPERABLE. The interlock 

allows only one air lock door of an air lock to be opened at one time. This 

provision ensures that a gross breach of containment does not exist when 

containment is required to be OPERABLE. Closure of a single door in 

each air lock is sufficient to provide a leak tight barrier following 

postulated events. Nevertheless, both doors are kept closed when the air 

lock is not being used for normal entry into or exit from containment. 

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, the containment air 

locks are not required in MODE 5 to prevent leakage of radioactive 

material from containment. The requirements for the containment air 

locks during MODE 6 are addressed in LCO 3.9.3, "Containment 

Penetrations." 

ACTIONS The ACTIONS are modified by a Note that allows entry and exit to 

perform repairs on the affected air lock component. If the outer door is 

inoperable, then it may be easily accessed for most repairs. It is 

preferred that the air lock be accessed from inside primary containment 

by entering through the other OPERABLE air lock. However, if this not 

practicable, or if repairs on either door must be performed from the barrel 

side of the door then it is permissible to enter the air lock through the 

OPERABLE door, which means there is a short time during which the 

containment boundary is not intact (during access through the 
Containment Air Locks 

B 3.6.2 

BWOG STS B 3.6.2-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

OPERABLE door). The ability to open the OPERABLE door, even if it 

means the containment boundary is temporarily not intact, is acceptable 

due to the low probability of an event that could pressurize the 

containment during the short time in which the OPERABLE door is 

expected to be open. After each entry and exit the OPERABLE door 

must be immediately closed. If ALARA conditions permit, entry and exit 

should be via an OPERABLE air lock. 

A second Note has been added to provide clarification that, for this LCO, 

separate Condition entry is allowed for each air lock. This is acceptable, 

since the Required Actions for each Condition provide appropriate 

compensatory actions for each inoperable air lock. Complying with the 

Required Actions may allow for continued operation, and a subsequent 

inoperable air lock is governed by subsequent Condition entry and 

application of associated Required Actions. 

In the event the air lock leakage results in exceeding the overall 

containment leakage rate, Note 3 directs entry into the applicable 

Conditions and Required Actions of LCO 3.6.1, "Containment." 

A.1, A.2, and A.3 

With one air lock door inoperable in one or more containment air locks, 

the OPERABLE door must be verified closed (Required Action A.1) in 

each affected containment air lock. 

This ensures that a leak tight containment barrier is maintained by the 

use of an OPERABLE air lock door. This action must be completed 

within 1 hour. This specified time period is consistent with the ACTIONS 

of LCO 3.6.1, which requires containment be restored to OPERABLE 

status within 1 hour. 

In addition, the affected air lock penetration must be isolated by locking 

closed the remaining OPERABLE air lock door within the 24 hour 

Completion Time. The 24 hour Completion Time is considered 

reasonable for locking the OPERABLE air lock door, considering the 

OPERABLE door of the affected air lock is being maintained closed. 
Containment Air Locks 

B 3.6.2 

BWOG STS B 3.6.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Action A.3 verifies that an air lock with an inoperable door has 

been isolated by the use of a locked and closed OPERABLE air lock 

door. This ensures that an acceptable containment leakage boundary is 

maintained. The Completion Time of once per 31 days is based on 

engineering judgment and is considered adequate in view of the low 

likelihood of a locked door being mispositioned and other administrative 

controls. Required Action A.3 is modified by a Note that applies to air 

lock doors located in high radiation areas and allows these doors to be 

verified locked closed by use of administrative means. Allowing 

verification by administrative means is considered acceptable, since 

access to these areas is typically restricted. Therefore, the probability of 

misalignment of the door, once it has been verified to be in the proper 

position, is small. 

The Required Actions have been modified by two Notes. Note 1 clarifies 

that only the Required Actions and associated Completion Times of 

Condition C are required if both doors in the same air lock are inoperable. 

With both doors in the same air lock inoperable, an OPERABLE door is 

not available to be closed. Required Actions C.1 and C.2 are the 

appropriate remedial actions. The exception of Note 1 does not affect 

tracking the Completion Time from the initial entry into Condition A; only 

the requirement to comply with the Required Actions. Note 2 allows use 

of the air lock for entry and exit for 7 days under administrative controls if 

both air locks have an inoperable door. This 7 day restriction begins 

when the second air lock is discovered inoperable. Containment entry 

may be required to perform Technical Specifications (TS) Surveillances 

and Required Actions, as well as other activities on equipment inside 

containment that are required by TS or activities on equipment that 

support TS-required equipment. This Note is not intended to preclude 

performing other activities (i.e., non-TS-required activities) if the 

containment was entered, using the inoperable air lock, to perform an 

allowed activity listed above. This allowance is acceptable due to the low 

probability of an event that could pressurize the containment during the 

short time that the OPERABLE door is expected to be open. 

B.1, B.2, and B.3

With an air lock interlock mechanism inoperable in one or more air locks, 

the Required Actions and associated Completion Times are consistent 

with those specified in Condition A. 
Containment Air Locks 

B 3.6.2 

BWOG STS B 3.6.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The Required Actions have been modified by two Notes. Note 1 clarifies 

that only the Required Actions and associated Completion Times of 

Condition C are required if both doors in the same air lock are inoperable. 

With both doors in the same air lock inoperable, an OPERABLE door is 

not available to be closed. Required Actions C.1 and C.2 are the 

appropriate remedial actions. Note 2 allows entry into and exit from the 

containment under the control of a dedicated individual stationed at the 

air lock to ensure that only one door is opened at a time (i.e., the 

individual performs the function of the interlock). 

Required Action B.3 is modified by a Note that applies to air lock doors 

located in high radiation areas and allows these doors to be verified 

locked closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since access to these 

areas is typically restricted. Therefore, the probability of misalignment of 

the door, once it has been verified to be in the proper position, is small. 

C.1, C.2, and C.3

With one or more air locks inoperable for reasons other than those 

described in Condition A or B, Required Action C.1 requires action to be 

immediately initiated to evaluate previous combined leakage rates using 

current air lock test results. An evaluation is acceptable since it is overly 

conservative to immediately declare the containment inoperable if both 

doors in an air lock have failed a seal test or if the overall air lock leakage 

is not within limits. In many instances (e.g., only one seal per door has 

failed), containment remains OPERABLE, yet only 1 hour (per LCO 3.6.1) 

would be provided to restore the air lock door to OPERABLE status prior 

to requiring a plant shutdown. In addition, even with both doors failing the 

seal test, the overall containment leakage rate can still be within limits. 

Required Action C.2 requires that one door in the affected containment air 

lock must be verified to be closed. This action must be completed within 

the 1 hour Completion Time. This specified time period is consistent with 

the ACTIONS of LCO 3.6.1, which requires that containment be restored 

to OPERABLE status within 1 hour. 

Additionally, the affected air lock(s) must be restored to OPERABLE 

status within the 24 hour Completion Time. The specified time period is 

considered reasonable for restoring an inoperable air lock to OPERABLE 

status assuming that at least one door is maintained closed in each 

affected air lock. 
Containment Air Locks 

B 3.6.2 

BWOG STS B 3.6.2-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1 and D.2

If the inoperable containment air lock cannot be restored to OPERABLE 

status within the required Completion Time, the plant must be brought to 

a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 6 hours and to MODE 5 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE SR 3.6.2.1

REQUIREMENTS 

Maintaining containment air locks OPERABLE requires compliance with 

the leakage rate test requirements of the Containment Leakage Rate 

Testing Program. This SR reflects the leakage rate testing requirements 

with regard to air lock leakage (Type B leakage tests). The acceptance 

criteria were established during initial air lock and containment 

OPERABILITY testing. The periodic testing requirements verify that the 

air lock leakage does not exceed the allowed fraction of the overall 

containment leakage rate. The Frequency is required by the Containment 

Leakage Rate Testing Program. 

The SR has been modified by two Notes. Note 1 states that an 

inoperable air lock door does not invalidate the previous successful 

performance of the overall air lock leakage test. This is considered 

reasonable, since either air lock door is capable of providing a fission 

product barrier in the event of a DBA. Note 2 has been added to this SR 

requiring the results to be evaluated against the acceptance criteria which 

is applicable to SR 3.6.1.1. This ensures that air lock leakage is properly 

accounted for in determining the combined Type B and C containment 

leakage rate. 

SR 3.6.2.2

The air lock interlock is designed to prevent simultaneous opening of both 

doors in a single air lock. Since both the inner and outer doors of an air 

lock are designed to withstand the maximum expected post accident 

containment pressure, closure of either door will support containment 

OPERABILITY. Thus, the door interlock feature supports containment 

OPERABILITY while the air lock is being used for personnel transit in and 

out of the containment. Periodic testing of this interlock demonstrates 
Containment Air Locks 

B 3.6.2 

BWOG STS B 3.6.2-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

that the interlock will function as designed and that simultaneous opening 

of the inner and outer doors will not inadvertently occur. Due to the 

purely mechanical nature of this interlock, and given that the interlock 

mechanism is not normally challenged when the containment air lock 

door is used for entry and exit (procedures require strict adherence to 

single door opening), this test is only required to be performed every 

24 months. The 24 month Frequency is based on the need to perform 

this Surveillance under the conditions that apply during a plant outage, 

and the potential for loss of containment OPERABILITY if the 

Surveillance were performed with the reactor at power. Operating 

experience has shown these components usually pass the Surveillance 

when performed at the 24 month Frequency. The 24 month Frequency is 

based on engineering judgment and is considered adequate given that 

the interlock is not challenged during the use of the airlock. 

REFERENCES 1. 10 CFR 50, Appendix J, Option [A][B]. 

 2. FSAR, Sections [14.1 and 14.2]. 

 3. FSAR, Section [5.6]. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.3 Containment Isolation Valves 

BASES 

BACKGROUND The containment isolation valves form part of the containment pressure 

boundary and provide a means for fluid penetrations not serving accident 

consequence limiting systems to be provided with two isolation barriers 

that are closed on an automatic isolation signal. These isolation devices 

consist of either passive devices or active (automatic) devices. Manual 

valves, de-activated automatic valves secured in their closed position 

(including check valves with flow through the valve secured), blind 

flanges, and closed systems are considered passive devices. Check 

valves, or other automatic valves designed to close following an accident 

without operator action, are considered active devices. Two barriers in 

series are provided for each penetration so that no single credible failure 

or malfunction of an active component can result in a loss of isolation or 

leakage that exceeds limits assumed in the safety analyses. One of 

these barriers may be a closed system. These barriers (typically 

containment isolation valves) make up the Containment Isolation System. 

Containment isolation occurs upon receipt of a high containment pressure 

or diverse containment isolation signal. The containment isolation signal 

closes automatic containment isolation valves in fluid penetrations not 

required for operation of engineered safeguard systems to prevent 

leakage of radioactive material. Upon actuation of high pressure 

injection, automatic containment valves also isolate systems not required 

for containment or Reactor Coolant System (RCS) heat removal. Other 

penetrations are isolated by the use of valves in the closed position or 

blind flanges. As a result, the containment isolation valves (and blind 

flanges) help ensure that the containment atmosphere will be isolated in 

the event of a release of radioactive material to containment atmosphere 

from the RCS following a Design Basis Accident (DBA). 

OPERABILITY of the containment isolation valves (and blind flanges) 

supports containment OPERABILITY during accident conditions. 

The OPERABILITY requirements for containment isolation valves help 

ensure that containment is isolated within the time limits assumed in the 

safety analysis. Therefore, the OPERABILITY requirements provide 

assurance that the containment function assumed in the safety analysis 

will be maintained. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The Reactor Building Purge System is part of the Reactor Building 

Ventilation System. The Purge System was designed for intermittent 

operation, providing a means of removing airborne radioactivity caused 

by minor leakage from the RCS prior to personnel entry into containment. 

The Containment Purge System consists of one [48] inch line for exhaust 

and one [48] inch line for supply, with supply and exhaust fans capable of 

purging the containment atmosphere at a rate of approximately [50,000] 

ft3

/min. This flow rate is sufficient to reduce the airborne radioactivity 

level within containment to levels defined in 10 CFR 20 (Ref. 1) for a 

40 hour workweek within 2 hours of purge initiation during reactor 

operation. The containment purge supply and exhaust lines each contain 

two isolation valves that receive an isolation signal on a unit vent high 

radiation condition. 

Failure of the purge valves to close following a design basis event would 

cause a significant increase in the radioactive release because of the 

large containment leakage path introduced by these [48] inch purge lines. 

Failure of the purge valves to close would result in leakage considerably 

in excess of the containment design leakage rate of [0.25]% of 

containment air weight per day (La) (Ref. 2). Because of their large size, 

the [48] inch purge valves in some units are not qualified for automatic 

closure from their open position under DBA conditions. Therefore, the 

[48] inch purge valves are maintained sealed closed (SR 3.6.3.1) in 

MODES 1, 2, 3, and 4 to ensure the containment boundary is maintained. 

The [8 inch] containment minipurge valves operate to: 

a. Reduce the concentration of noble gases within containment prior to 

and during personnel access and 

b. Equalize internal and external pressures. 

Since the minipurge valves are designed to meet the requirements for 

automatic containment isolation valves, these valves may be opened as 

needed in MODES 1, 2, 3, and 4. 

APPLICABLE The containment isolation valve LCO was derived from the assumptions 

SAFETY related to minimizing the loss of reactor coolant inventory and 

ANALYSES establishing containment boundary during major accidents. As part of the 

containment boundary, containment isolation valve OPERABILITY 

supports leak tightness of the containment. Therefore, the safety analysis 

of any event requiring isolation of containment is applicable to this LCO. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The DBAs that result in a release of radioactive material within 

containment are a loss of coolant accident (LOCA), a main steam line 

break, and a rod ejection accident (Ref. 3). In the analysis for each of 

these accidents, it is assumed that containment isolation valves are either 

closed or function to close within the required isolation time following 

event initiation. This ensures that potential paths to the environment 

through containment isolation valves (including containment purge 

valves) are minimized. The safety analysis assumes that the [48] inch 

purge valves are closed at event initiation. 

The DBA analysis assumes that, within 60 seconds after the accident, 

isolation of the containment is complete and leakage terminated except 

for the design leakage rate, La. The containment isolation total response 

time of 60 seconds includes signal delay, diesel generator startup (for 

loss of offsite power), and containment isolation valve stroke times. 

The single-failure criterion required to be imposed in the conduct of unit 

safety analyses was considered in the original design of the containment 

purge valves. Two valves in a series on each purge line provide 

assurance that both the supply and exhaust lines could be isolated even if 

a single failure occurred. The inboard and outboard isolation valves on 

each line are provided with diverse power sources, motor operated and 

pneumatically operated spring closed, respectively. This arrangement 

was designed to preclude common mode failures from disabling both 

valves on a purge line. 

The purge valves may be unable to close in the environment following a 

LOCA. Therefore, each of the purge valves is required to remain sealed 

closed during MODES 1, 2, 3, and 4. In this case, the single-failure 

criterion remains applicable to the containment purge valves because of 

failure in the control circuit associated with each valve. Again, the purge 

system valve design prevents a single failure from compromising the 

containment boundary as long as the system is operated in accordance 

with the subject LCO. 

The containment isolation valves satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-4 Rev. 3.0, 03/31/04 

BASES 

LCO Containment isolation valves form a part of the containment boundary. 

The containment isolation valve safety function is related to minimizing 

the loss of reactor coolant inventory and establishing the containment 

boundary during a DBA. 

The automatic power operated isolation valves are required to have 

isolation times within limits and to actuate on an automatic isolation 

signal. The [48] inch purge valves must be maintained sealed closed [or 

have blocks installed to prevent full opening]. [Blocked purge valves also 

actuate on an automatic signal.] The valves covered by this LCO are 

listed along with their associated stroke times in the FSAR (Ref. 4). 

The normally closed isolation valves are considered OPERABLE when 

manual valves are closed, check valves have flow through the valve 

secured, blind flanges are in place, and closed systems are intact. These 

passive isolation valves/devices are those listed in Reference 5. 

Purge valves with resilient seals must meet additional leakage rate 

requirements. The other containment isolation valve leakage rates are 

addressed by LCO 3.6.1, "Containment," as Type C testing. 

This LCO provides assurance that the containment isolation valves and 

purge valves will perform their designated safety functions to minimize the 

loss of reactor coolant inventory and establish the containment boundary 

during accidents. 

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, the containment 

isolation valves are not required to be OPERABLE in MODE 5. The 

requirements for containment isolation valves during MODE 6 are 

addressed in LCO 3.9.3, "Containment Penetrations." 

ACTIONS The ACTIONS are modified by a Note allowing penetration flow paths, 

except for [48] inch purge valve penetration flow paths, to be unisolated 

intermittently under administrative controls. These administrative controls 

consist of stationing a dedicated operator at the valve controls, who is in 

continuous communication with the control room. In this way, the 

penetration can be rapidly isolated when a need for containment isolation 

is indicated. Due to the size of the containment purge line penetration 

and the fact that those penetrations exhaust directly from the containment 

atmosphere to the environment, the penetration flow paths containing 

these valves may not be opened under administrative controls. A single 

purge valve in a penetration flow path may be opened to effect repairs to 

an inoperable valve, as allowed by SR 3.6.3.1. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A second Note has been added to provide clarification that, for this LCO, 

separate Condition entry is allowed for each penetration flow path. This 

is acceptable , since the Required Actions for each Condition provide 

appropriate compensatory actions for each inoperable containment 

isolation valve. Complying with the Required Actions may allow for 

continued operation, and subsequent inoperable containment isolation 

valves are governed by subsequent Condition entry and application of 

associated Required Actions. 

The ACTIONS are further modified by a third Note, which ensures 

appropriate remedial actions are taken, if necessary, if the affected 

systems are rendered inoperable by an inoperable containment isolation 

valve. 

In the event isolation valve leakage results in exceeding the overall 

containment leakage rate, Note 4 directs entry into the applicable 

Conditions and Required Actions of LCO 3.6.1. 

A.1 and A.2

In the event one containment isolation valve in one or more penetration 

flow paths is inoperable, [except for purge valve leakage not within limit], 

the affected penetration flow path must be isolated. The method of 

isolation must include the use of at least one isolation barrier that cannot 

be adversely affected by a single active failure. Isolation barriers that 

meet this criterion are a closed and de-activated automatic containment 

isolation valve, a closed manual valve, a blind flange, and a check valve 

with flow through the valve secured. For a penetration isolated in 

accordance with Required Action A.1, the device used to isolate the 

penetration should be the closest available one to containment. Required 

Action A.1 must be completed within the 4 hour Completion Time. The 

specified time period is reasonable, considering the time required to 

isolate the penetration and the relative importance of supporting 

containment OPERABILITY during MODES 1, 2, 3, and 4. 

For affected penetration flow paths that cannot be restored to 

OPERABLE status within the 4 hour Completion Time and that have been 

isolated in accordance with Required Action A.1, the affected penetration 

flow paths must be verified to be isolated on a periodic basis. This 

periodic verification is necessary to ensure that containment penetrations 

required to be isolated following an accident and no longer capable of 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

being automatically isolated will be in the isolation position should an 

event occur. This Required Action does not require any testing or device 

manipulation. Rather, it involves verification that those isolation devices 

outside containment and capable of being mispositioned are in the correct 

position. The Completion Time of "once per 31 days for isolation devices 

outside containment" is appropriate considering the fact that the devices 

are operated under administrative controls and the probability of their 

misalignment is low. For the isolation devices inside containment, the 

time period specified as "prior to entering MODE 4 from MODE 5 if not 

performed within the previous 92 days" is based on engineering judgment 

and is considered reasonable in view of the inaccessibility of the isolation 

devices and other administrative controls that will ensure that isolation 

device misalignment is an unlikely possibility. 

Condition A has been modified by a Note indicating this Condition is only 

applicable to those penetration flow paths with two [or more] containment 

isolation valves. For penetration flow paths with only one containment 

isolation valve and a closed system, Condition C provides appropriate 

actions. 

Required Action A.2 is modified by two Notes. Note 1 applies to isolation 

devices located in high radiation areas and allows the devices to be 

verified by use of administrative means. Allowing verification by 

administrative means is considered acceptable since access to these 

areas is typically restricted. Note 2 applies to isolation devices that are 

locked, sealed, or otherwise secured in position and allows these devices 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. Therefore, the probability of 

misalignment of these devices, once they have been verified to be in the 

proper position, is small. 

B.1

With two [or more] containment isolation valves in one or more 

penetration flow paths inoperable, [except for purge valve leakage not 

within limit], the affected penetration flow path must be isolated within 

1 hour. The method of isolation must include the use of at least one 

isolation barrier that cannot be adversely affected by a single active 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

failure. Isolation barriers that meet this criterion are a closed and deactivated automatic valve, a closed manual valve, and a blind flange. The 

1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1. In 

the event the affected penetration is isolated in accordance with Required 

Action B.1, the affected penetration must be verified to be isolated on a 

periodic basis per Required Action A.2, which remains in effect. This 

periodic verification is necessary to assure leak tightness of containment 

and that penetrations requiring isolation following an accident are 

isolated. The Completion Time of once per 31 days for verifying each 

affected penetration flow path is isolated is appropriate considering the 

fact that the valves are operated under administrative controls and the 

probability of their misalignment is low. 

Condition B is modified by a Note indicating this Condition is only 

applicable to penetration flow paths with two [or more] containment 

isolation valves. Condition A of this LCO addresses the condition of one 

containment isolation valve inoperable in this type of penetration flow 

path. 

C.1 and C.2

With one or more penetration flow paths with one containment isolation 

valve inoperable, the inoperable valve must be restored to OPERABLE 

status or the affected penetration flow path must be isolated. The method 

of isolation must include the use of at least one isolation barrier that 

cannot be adversely affected by a single active failure. Isolation barriers 

that meet this criterion are a closed and de-activated automatic valve, a 

closed manual valve, and a blind flange. A check valve may not be used 

to isolate the affected penetration. Required Action C.1 must be 

completed within the 72 hour Completion Time. The specified time period 

is reasonable, considering the relative stability of the closed system 

(hence, reliability) to act as a penetration isolation boundary and the 

relative importance of supporting containment OPERABILITY during 

MODES 1, 2, 3, and 4. In the event the affected penetration is isolated in 

accordance with Required Action C.1, the affected penetration flow path 

must be verified to be isolated on a periodic basis. This periodic 

verification is necessary to assure leak tightness of containment and that 

containment penetrations requiring isolation following an accident are 

isolated. The Completion Time of once per 31 days for verifying that 

each affected penetration flow path is isolated is appropriate considering 

the fact that the valves are operated under administrative controls and the 

probability of their misalignment is low. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition C is modified by a Note indicating that this Condition is only 

applicable to those penetration flow paths with only one containment 

isolation valve and a closed system. The closed system must meet the 

requirements of Reference 6. This Note is necessary since this Condition 

is written to specifically address those penetration flow paths in a closed 

system. 

Required Action C.2 is modified by two Notes. Note 1 applies to valves 

and blind flanges located in high radiation areas and allows these devices 

to be verified by use of administrative means. Allowing verification by 

administrative means is considered acceptable since access to these 

areas is typically restricted. Note 2 applies to isolation devices that are 

locked, sealed, or otherwise secured in position and allows these devices 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. Therefore, the probability of 

misalignment of these devices, once verified to be in the proper position, 

is small. 

[ D.1, D.2, and D.3

In the event one or more containment purge valves in one or more 

penetration flow paths are not within the purge valve leakage limits, purge 

valve leakage must be restored to within limits or the affected penetration 

flow path must be isolated. The method of isolation must be by the use of 

at least one isolation barrier that cannot be adversely affected by a single 

active failure. Isolation barriers that meet this criterion are a [closed and 

de-activated automatic valve, closed manual valve, and blind flange]. A 

purge valve with resilient seals utilized to satisfy Required Action D.1 

must have been demonstrated to meet the leakage requirements of 

SR 3.6.3.6. The specified Completion Time is reasonable, considering 

that one containment purge valve remains closed so that a gross breach 

of containment does not exist. 

In accordance with Required Action D.2, this penetration flow path must 

be verified to be isolated on a periodic basis. The periodic verification is 

necessary to ensure that containment penetrations required to be isolated 

following an accident, which are no longer capable of being automatically 

isolated, will be in the isolation position should an event occur. This 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-9 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Action does not require any testing or valve manipulation. 

Rather, it involves verification that those isolation devices outside 

containment and potentially capable of being mispositioned are in the 

correct position. For the isolation devices inside containment, the time 

period specified as "prior to entering MODE 4 from MODE 5 if not 

performed within the previous 92 days" is based on engineering judgment 

and is considered reasonable in view of the inaccessibility of the isolation 

devices and other administrative controls that will ensure that isolation 

device misalignment is an unlikely possibility. 

For the containment purge valve with resilient seal that is isolated in 

accordance with Required Action D.1, SR 3.6.3.6 must be performed at 

least once every [ ] days. This provides assurance that degradation of 

the resilient seal is detected and confirms that the leakage rate of the 

containment purge valve does not increase during the time the 

penetration is isolated. The normal Frequency for SR 3.6.3.6, 184 days, 

is based on an NRC initiative, Generic Issue B-20 (Ref. 8). Since more 

reliance is placed on a single valve while in this Condition, it is prudent to 

perform the SR more often. Therefore, a Frequency of once per [ ] days 

was chosen and has been shown acceptable based on operating 

experience. 

Required Action D.2 is modified by two Notes. Note 1 applies to isolation 

devices located in high radiation areas and allows these devices to be 

verified closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since access to these 

areas is typically restricted. Note 2 applies to isolation devices that are 

locked, sealed, or otherwise secured in position and allows these devices 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. ] 

E.1 and E.2

If the Required Actions and associated Completion Times are not met, 

the plant must be brought to a MODE in which the LCO does not apply. 

To achieve this status, the plant must be brought to at least MODE 3 

within 6 hours and to MODE 5 within 36 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required plant conditions from full power conditions in an orderly manner 

and without challenging plant systems. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE [ SR 3.6.3.1

REQUIREMENTS 

Each [48] inch containment purge valve is required to be verified sealed 

closed at 31 day intervals. This Surveillance is designed to ensure that a 

gross breach of containment is not caused by an inadvertent or spurious 

opening of a containment purge valve. Detailed analysis of the purge 

valves failed to conclusively demonstrate their ability to close during a 

LOCA in time to limit offsite doses. Therefore, these valves are required 

to be in the sealed closed position during MODES 1, 2, 3, and 4. A 

containment purge valve that is sealed closed must have motive power to 

the valve operator removed. This can be accomplished by de-energizing 

the source of electric power or by removing the air supply to the valve 

operator. In this application, the term "sealed" has no connotation of leak 

tightness. The Frequency is a result of an NRC initiative, Generic 

Issue B-24 (Ref. 7), related to containment purge valve use during unit 

operations. In the event purge valve leakage requires entry into 

Condition D, the Surveillance permits opening one purge valve in a 

penetration flow path to perform repairs. ]

SR 3.6.3.2

This SR ensures that the minipurge valves are closed as required or, if 

open, open for an allowable reason. If a purge valve is open in violation 

of this SR, the valve is considered inoperable. If the inoperable valve is 

not otherwise known to have excessive leakage when closed, it is not 

considered to have leakage outside of limits. The SR is not required to 

be met when the minipurge valves are open for pressure control, ALARA 

or air quality considerations for personnel entry, or for Surveillances that 

require the valves to be open. The minipurge valves are capable of 

closing in the environment following a LOCA. Therefore, these valves are 

allowed to be open for limited periods of time. The 31 day Frequency is 

consistent with other containment isolation valve requirements discussed 

in SR 3.6.3.3. 

SR 3.6.3.3

This SR requires verification that each containment isolation manual 

valve and blind flange located outside containment and not locked, 

sealed, or otherwise secured and required to be closed during accident 

conditions is closed. The SR helps to ensure that post accident leakage 

of radioactive fluids or gases outside the containment boundary is within 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-11 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

design limits. This SR does not require any testing or valve manipulation. 

Rather, it involves verification that those containment isolation valves 

outside containment and capable of being mispositioned are in the correct 

position. Since verification of valve position for containment isolation 

valves outside containment is relatively easy, the 31 day Frequency is 

based on engineering judgment and was chosen to provide added 

assurance of the correct positions. The SR specifies that containment 

isolation valves open under administrative controls are not required to 

meet the SR during the time the valves are open. This SR does not apply 

to valves that are locked, sealed, or otherwise secured in the closed 

position, since these were verified to be in the correct position upon 

locking, sealing, or securing. 

The Note applies to valves and blind flanges located in high radiation 

areas and allows these devices to be verified closed by use of 

administrative means. Allowing verification by administrative means is 

considered acceptable, since access to these areas is typically restricted 

during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the 

probability of misalignment of these containment isolation valves, once 

they have been verified to be in the proper position, is low. 

SR 3.6.3.4

This SR requires verification that each containment isolation manual 

valve and blind flange that is located inside containment and not locked, 

sealed, or otherwise secured and required to be closed during accident 

conditions is closed. The SR helps to ensure that post accident leakage 

of radioactive fluids or gases outside the containment boundary is within 

design limits. For containment isolation valves inside containment, the 

Frequency of "prior to entering MODE 4 from MODE 5 if not performed 

within the previous 92 days" is appropriate, since these containment 

isolation valves are operated under administrative controls and the 

probability of their misalignment is low. The SR specifies that 

containment isolation valves open under administrative controls are not 

required to meet the SR during the time they are open. This SR does not 

apply to valves that are locked, sealed, or otherwise secured in the closed 

position, since these were verified to be in the correct position upon 

locking, sealing, or securing. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-12 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Note allows valves and blind flanges located in high radiation areas 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the access to 

these areas is typically restricted during MODES 1, 2, 3, and 4 for ALARA 

reasons. Therefore, the probability of misalignment of these containment 

isolation valves, once they have been verified to be in their proper 

position, is small. 

SR 3.6.3.5

Verifying that the isolation time of each automatic power operated 

containment isolation valve is within limits is required to demonstrate 

OPERABILITY. The isolation time test ensures the valve will isolate in a 

time period less than or equal to that assumed in the safety analyses. 

[The isolation time and Frequency of this SR are in accordance with the 

Inservice Testing Program or 92 days.] 

SR 3.6.3.6 

For containment purge valves with resilient seals, additional leakage rate 

testing beyond the test requirements of 10 CFR 50, Appendix J, Option 

[A][B] is required to ensure OPERABILITY. Operating experience has 

demonstrated that this type of seal has the potential to degrade in a 

shorter time period than do other seal types. Based on this observation 

and the importance of maintaining this penetration leak tight (due to the 

direct path between containment and the environment), a Frequency of 

once per 184 days was established as part of the NRC resolution of 

Generic Issue B-20, "Containment Leakage Due to Seal Deterioration" 

(Ref. 8). 

Additionally, this SR must be performed within 92 days after opening the 

valve. The 92 day Frequency was chosen recognizing that cycling the 

valve could introduce additional seal degradation (greater than that 

occurring to a valve that has not been opened). Thus, decreasing the 

interval (from 184 days) is a prudent measure after a valve has been 

opened. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-13 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.3.7

Automatic containment isolation valves close on a containment isolation 

signal to prevent leakage of radioactive material from containment 

following a DBA. This SR ensures that each automatic containment 

isolation valve will actuate to its isolation position on a containment 

isolation signal. This SR is not required for valves that are locked, 

sealed, or otherwise secured in position under administrative controls. 

The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass this Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

SR 3.6.3.8

-----------------------------------REVIEWER’S NOTE----------------------------------- 

This SR is only required for those units with resilient seal purge valves 

allowed to be open during [MODE 1, 2, 3, or 4] and having blocking 

devices on the valves that are not permanently installed. 

-------------------------------------------------------------------------------------------------- 

Verifying that each [48] inch containment purge valve is blocked to restrict 

opening to ≤ [50%] is required to ensure that the valves can close under 

DBA conditions within the times assumed in the analyses of References 3 

and 4. If a LOCA occurs, the purge valves must close to maintain 

containment leakage within the values assumed in the accident analysis. 

At other times when purge valves are required to be capable of closing 

(e.g., during movement of [recently] irradiated fuel assemblies), 

pressurization concerns are not present, thus the purge valves can be 

fully open. The [18] month Frequency is appropriate because the 

blocking devices are typically removed only during a refueling outage. 
Containment Isolation Valves 

B 3.6.3 

BWOG STS B 3.6.3-14 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 20. 

 2. FSAR, Section [5.6]. 

 3. FSAR, Sections [14.1 and 14.2]. 

 4. FSAR, Section [5.3]. 

 5. FSAR, Section [5.3]. 

 6. Standard Review Plan 6.2.4. 

 7. Generic Issue B-24. 

 8. Generic Issue B-20. 
Containment Pressure 

B 3.6.4 

BWOG STS B 3.6.4-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.4 Containment Pressure 

BASES 

BACKGROUND The containment pressure is limited during normal operation to preserve 

the initial conditions assumed in the accident analyses for a loss of 

coolant accident (LOCA) or steam line break (SLB). These limits also 

prevent the containment pressure from exceeding the containment design 

negative pressure differential with respect to the outside atmosphere in 

the event of inadvertent actuation of the Containment Spray System. 

Containment pressure is a process variable that is monitored and 

controlled. The containment pressure limits are derived from the input 

conditions used in the containment functional analyses and the 

containment structure external pressure analysis. Should operation occur 

outside these limits coincident with a Design Basis Accident (DBA), post 

accident containment pressures could exceed calculated values. 

APPLICABLE Containment internal pressure is an initial condition used in the DBA 

SAFETY analyses to establish the maximum peak containment internal pressure. 

ANALYSES The limiting DBAs considered, relative to containment pressure, are the 

LOCA and SLB, which are analyzed using computer pressure transients. 

The worst-case LOCA generates larger mass and energy release than 

the worst-case SLB. Thus, the LOCA event bounds the SLB event from 

the containment peak pressure standpoint (Ref. 1). 

The initial pressure condition used in the containment analysis was 

[17.7] psia ([3.0] psig). This resulted in a maximum peak pressure from a 

LOCA of [53.9] psig. The LCO limit of [3.0] psig ensures that, in the event 

of an accident, the design pressure of [55] psig for containment is not 

exceeded. In addition, the building was designed for an internal pressure 

equal to [3] psig above external pressure during a tornado. The 

containment was also designed for an internal pressure equal to [2.5] psig 

below external pressure, to withstand the resultant pressure drop from an 

accidental actuation of the Containment Spray System. The LCO limit of 

[-2.0] psig ensures that operation within the design limit of [-2.5] psig is 

maintained (Ref. 2). 

For certain aspects of transient accident analyses, maximizing the 

calculated containment pressure is not conservative. In particular, the 

cooling effectiveness of the Emergency Core Cooling Systems during the 

core reflood phase of a LOCA analysis increases with increasing 

containment backpressure. Therefore, for the reflood phase, the 
Containment Pressure 

B 3.6.4 

BWOG STS B 3.6.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

containment backpressure is calculated in a manner designed to 

conservatively minimize, rather than maximize, the containment pressure 

response in accordance with 10 CFR 50, Appendix K (Ref. 2). 

Containment pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO Maintaining containment pressure less than or equal to the LCO upper 

pressure limit ensures that, in the event of a DBA, the resultant peak 

containment accident pressure will remain below the containment design 

pressure. Maintaining containment pressure greater than or equal to the 

LCO lower pressure limit ensures that the containment will not exceed the 

design negative differential pressure following the inadvertent actuation of 

the Containment Spray System. 

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. Since maintaining containment pressure within 

design basis limits is essential to ensure initial conditions assumed in the 

accident analysis are maintained, the LCO is applicable in MODES 1, 2, 

3, and 4. 

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Therefore, maintaining containment pressure within the limits of 

the LCO is not required in MODES 5 and 6. 

ACTIONS A.1

When containment pressure is not within the limits of the LCO, 

containment pressure must be restored to within these limits within 

1 hour. The Required Action is necessary to return operation to within the 

bounds of the containment analysis. The 1 hour Completion Time is 

consistent with the ACTIONS of LCO 3.6.1, "Containment," which 

requires that containment be restored to OPERABLE status within 1 hour. 

B.1 and B.2

If containment pressure cannot be restored within limits within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 
Containment Pressure 

B 3.6.4 

BWOG STS B 3.6.4-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.6.4.1

REQUIREMENTS 

Verifying that containment pressure is within limits ensures that operation 

remains within the limits assumed in the containment analysis. The 

12 hour Frequency of this SR was developed after taking into 

consideration operating experience related to trending of containment 

pressure variations during the applicable MODES. Furthermore, the 

12 hour Frequency is considered adequate in view of other indications 

available in the control room, including alarms, to alert the operator to an 

abnormal containment pressure condition. 

REFERENCES 1. FSAR, Section [14.2]. 

 2. 10 CFR 50, Appendix K. 
Containment Air Temperature 

B 3.6.5 

BWOG STS B 3.6.5-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.5 Containment Air Temperature 

BASES 

BACKGROUND The containment structure serves to contain radioactive material, which 

may be released from the reactor core following a Design Basis Accident 

(DBA). The containment average air temperature is limited during normal 

operation to preserve the initial conditions assumed in the accident 

analyses for a loss of coolant accident (LOCA) or steam line break (SLB). 

The containment average air temperature limit is derived from the input 

conditions used in the containment functional analyses and the 

containment structure external pressure analysis. This LCO ensures that 

initial conditions assumed in the analysis of a DBA are not violated during 

unit operations. The total amount of energy to be removed from the 

Containment Cooling System during post accident conditions is 

dependent upon the energy released to the containment due to the event 

as well as the initial containment temperature and pressure. The higher 

the initial temperature, the higher the resultant peak containment 

pressure and temperature. Exceeding containment design pressure may 

result in leakage greater than that assumed in the accident analysis. 

Operation with containment temperature in excess of the LCO limit 

violates an initial condition assumed in the accident analysis. 

APPLICABLE Containment average air temperature is an initial condition used in the 

SAFETY DBA analyses. Average air temperature is also used to establish the 

ANALYSES containment environmental qualification operating envelope. The limit for 

containment average air temperature ensures that operation is 

maintained within the assumptions used in the DBA analysis for 

containment. 

Several accidents (primarily LOCA and SLB) result in a marked increase 

in containment temperature and pressure due to energy release within 

the containment. Of these, the LOCA results in the greatest sustained 

increase in containment temperature. By maintaining containment air 

temperature at less than the initial temperature assumed in the LOCA 

analysis, the reactor building design condition will not be exceeded. 

The LOCA that was identified as presenting the greatest challenge to 

containment OPERABILITY was a cold leg Reactor Coolant System 

break, of specified size, at a reactor coolant pump suction. 

Containment average air temperature satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 
Containment Air Temperature 

B 3.6.5 

BWOG STS B 3.6.5-2 Rev. 3.0, 03/31/04 

BASES 

LCO During a DBA, with an initial containment average air temperature less 

than or equal to the LCO temperature limit, the resultant accident 

temperature profile assures that the containment structural temperature is 

maintained below its design temperature and that required safety related 

equipment will continue to perform its function. 

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, maintaining 

containment average air temperature within the limit is not required in 

MODE 5 or 6. 

ACTIONS A.1

When containment average air temperature is not within the limit of the 

LCO, it must be restored within 8 hours. This Required Action is 

necessary to return operation to within the bounds of the containment 

analysis. The 8 hour Completion Time is acceptable considering the 

sensitivity of the analysis to variations in this parameter and provides 

sufficient time to correct minor problems. 

B.1 and B.2

If the containment average air temperature cannot be restored to within 

its limit within the required Completion Time, the plant must be brought to 

a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 6 hours and to MODE 5 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 
Containment Air Temperature 

B 3.6.5 

BWOG STS B 3.6.5-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.6.5.1

REQUIREMENTS 

Verifying that containment average air temperature is within the LCO limit 

ensures that containment operation remains within the limit assumed for 

the containment analyses. In order to determine the containment 

average air temperature, an arithmetic average is calculated, using 

measurements taken at locations within the containment selected to 

provide a representative sample of the overall containment atmosphere. 

The 24 hour Frequency of this SR is considered acceptable based on 

observed slow rates of temperature increase within containment as a 

result of environmental heat sources (due to the large volume of 

containment). Furthermore, the 24 hour Frequency is considered 

adequate in view of other indications available in the control room, 

including alarms, to alert the operator to an abnormal containment 

temperature condition. 

REFERENCES None. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.6 Containment Spray and Cooling Systems 

BASES 

BACKGROUND The Containment Spray and Containment Cooling systems provide 

containment atmosphere cooling to limit post accident pressure and 

temperature in containment to less than the design values. Reduction of 

containment pressure and the iodine removal capability of the spray 

reduces the release of fission product radioactivity from containment to 

the environment, in the event of a Design Basis Accident (DBA), to within 

limits. The Containment Spray and Containment Cooling systems are 

designed to meet the requirements of 10 CFR 50, Appendix A, GDC 38, 

"Containment Heat Removal," GDC 39, "Inspection of Containment Heat 

Removal Systems," GDC 40, "Testing of Containment Heat Removal 

Systems," GDC 41, "Containment Atmosphere Cleanup," GDC 42, 

"Inspection of Containment Atmosphere Cleanup Systems," and GDC 43, 

"Testing of Containment Atmosphere Cleanup Systems" (Ref. 1), or other 

documents that were appropriate at the time of licensing (identified on a 

unit specific basis). 

The Containment Cooling System and Containment Spray System are 

Engineered Safety Feature (ESF) systems. They are designed to ensure 

that the heat removal capability required during the post accident period 

can be attained. The Containment Spray System and Containment 

Cooling System provide redundant containment heat removal operation. 

The Containment Spray System and Containment Cooling System 

provide redundant methods to limit and maintain post accident conditions 

to less than the containment design values. 

Containment Spray System

The Containment Spray System consists of two separate trains of equal 

capacity, each capable of meeting the design basis. Each train includes 

a containment spray pump, spray headers, nozzles, valves, and piping. 

Each train is powered from a separate ESF bus. The borated water 

storage tank (BWST) supplies borated water to the Containment Spray 

System during the injection phase of operation. In the recirculation mode 

of operation, Containment Spray System pump suction is manually 

transferred from the BWST to the containment sump. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The Containment Spray System provides a spray of relatively cold 

borated water mixed with sodium hydroxide from the spray additive tank 

into the upper regions of containment to reduce the containment pressure 

and temperature and to reduce the concentration of fission products in 

the containment atmosphere during a DBA. In the recirculation mode of 

operation, heat is removed from the containment sump water by the 

decay heat removal coolers. Each train of the Containment Spray 

System provides adequate spray coverage to meet the system design 

requirements for containment heat removal. 

The Containment Spray System is actuated automatically by a 

containment High-High pressure signal coincident with a containment 

high pressure signal and a low pressure injection signal. An automatic 

actuation opens the Containment Spray System pump discharge valves 

and starts the two Containment Spray System pumps. [A manual 

actuation of the Containment Spray System requires the operator to 

actuate two separate switches on the main control board to begin the 

same sequence.] 

Containment Cooling System

The Containment Cooling System consists of three containment cooling 

trains connected to a common duct suction header with four vertical 

return air ducts. Each cooling train is equipped with demisters, cooling 

coils, and an axial flow fan driven by a two speed water cooled electric 

motor. Each unit connection (two per unit) to the common header is 

provided with a backpressure damper for isolation purposes. 

During normal operation, two containment cooling trains are required to 

operate. The third unit is on standby and isolated from the operating units 

by means of the backpressure dampers. The swing unit is equipped with 

a transfer switch. It can be manually placed to either the "A" or "B" power 

train to operate in case one of the operating units fails. Upon receipt of 

an emergency signal, the two operating cooling fans running at high 

speed will automatically stop. The two cooling unit fans connected to the 

ESF buses will automatically restart and run at low speed, provided 

normal or emergency power is available. 

In post accident operation following an actuation signal, the Containment 

Cooling System fans are designed to start automatically in slow speed if 

they are not already running. If they are running at high (normal) speed, 

the fans automatically stop and restart in slow speed. The fans are 

operated at the lower speed during accident conditions to prevent motor 

overload from the higher density atmosphere. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The Containment Spray System and Containment Cooling System limit 

SAFETY the temperature and pressure that could be experienced following a 

ANALYSES DBA. The limiting DBAs considered are the loss of coolant accident 

(LOCA) and the steam line break. The postulated DBAs are analyzed, 

with regard to containment ESF systems, assuming the loss of one ESF 

bus. This is the worst-case single active failure, resulting in one train of 

the Containment Spray System and one train of the Containment Cooling 

System being inoperable. 

The analysis and evaluation show that, under the worst-case scenario, 

the highest peak containment pressure is [53.9] psig (experienced during 

a LOCA). The analysis shows that the peak containment temperature is 

[276]°F (experienced during a LOCA). Both results are less than the 

design values. (See the Bases for LCO 3.6.4, "Containment Pressure," 

and LCO 3.6.5, "Containment Air Temperature," for a detailed 

discussion.) The analyses and evaluations assume a power level of 

[2568] MWt, one containment spray train and one containment cooling 

train operating, and initial (pre-accident) conditions of [130]°F and 

[17.7] psia. The analyses also assume a response time delayed initiation 

to provide conservative peak calculated containment pressure and 

temperature responses. 

The effect of an inadvertent containment spray actuation has been 

analyzed. An inadvertent spray actuation results in a [2.5] psig 

containment pressure drop and is associated with the sudden cooling 

effect in the interior of the leak tight containment. Additional discussion is 

provided in the Bases for LCO 3.6.4. 

The modeled Containment Spray System actuation from the containment 

analyses is based on a response time associated with exceeding the 

containment pressure High-High setpoint coincident with a high pressure 

injection signal to achieve full flow through the containment spray 

nozzles. The Containment Spray System total response time of 

[56] seconds includes diesel generator (DG) startup (for loss of offsite 

power), block loading of equipment, containment spray pump startup, and 

spray line filling (Ref. 2). 

Containment cooling train performance for post accident conditions is 

given in Reference 3. The result of the analysis is that each train can 

provide 33% of the required peak cooling capacity during the post 

accident condition. The train post accident cooling capacity under varying 

containment ambient conditions, required to perform the accident 

analyses, is also shown in Reference 4. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The modeled Containment Cooling System actuation from the 

containment analysis is based on a response time associated with 

exceeding the containment pressure high setpoint to achieve full 

Containment Cooling System air and safety grade cooling water flow. 

The Containment Cooling System total response time of [25] seconds 

includes signal delay, DG startup (for loss of offsite power), and service 

water pump startup times (Ref. 3). 

The Containment Spray System and the Containment Cooling System 

satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO During a DBA, a minimum of one containment cooling train and one 

containment spray train are required to maintain the containment peak 

pressure and temperature below the design limits. Additionally, one 

containment spray train is required to remove iodine from the containment 

atmosphere and maintain concentrations below those assumed in the 

safety analysis. To ensure that these requirements are met, two 

containment spray trains and two containment cooling units must be 

OPERABLE. Therefore, in the event of an accident, the minimum 

requirements are met, assuming the worst-case single active failure 

occurs. 

Each Containment Spray System typically includes a spray pump, spray 

headers, nozzles, valves, piping, instruments, and controls to ensure an 

OPERABLE flow path capable of taking suction from the BWST upon an 

Engineered Safety Features Actuation System signal and manually 

transferring suction to the containment sump. 

Each Containment Cooling System typically includes demisters, cooling 

coils, dampers, an axial flow fan driven by a two speed water cooled 

electrical motor, instruments, and controls to ensure an OPERABLE flow 

path. 

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment and an increase in containment pressure and 

temperature, requiring the operation of the containment spray trains and 

containment cooling trains. 

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Thus, the Containment Spray System and the Containment 

Cooling System are not required to be OPERABLE in MODES 5 and 6. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With one containment spray train inoperable, action must be taken to 

restore it to OPERABLE status within [7] days. In this condition, the 

remaining OPERABLE containment spray train is adequate to perform the 

heat removal function. However, the overall reliability is reduced because 

a single failure to the remaining containment spray train could result in 

loss of spray function. The [7] day Completion Time is reasonable to 

perform corrective maintenance on the inoperable containment spray 

train. The [7] day Completion Time is based on the findings of the 

deterministic and probabilistic analysis in Reference 5. Reference 5 

concluded that extending the Completion Time to [7] days for an 

inoperable containment spray train proves plant operational flexibility 

while simultaneously reducing overall plant risk. This is because the risks 

incurred by having the containment spray train unavailable for a longer 

time at power will be substantially offset by the benefits associated with 

avoiding unnecessary plant transitions and by reducing risk during plant 

shutdown operations. 

The [14] day portion of the Completion Time for Required Action A.1 is 

based upon engineering judgment. It takes into account the low 

probability of coincident entry into two Conditions in this LCO coupled 

with the low probability of an accident occurring during this time. Refer to 

Section 1.3, Completion Times, for a more detailed discussion of the 

purpose of the "from discovery of failure to meet the LCO" portion of the 

Completion Time. 

B.1 and B.2

If the inoperable containment spray train cannot be restored to 

OPERABLE status within the required Completion Time, the plant must 

be brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 6 hours and 

to MODE 5 within 84 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. The extended interval to reach MODE 5 

allows additional time to attempt restoration of the containment spray train 

and is reasonable when considering the driving force for a release of 

radioactive material from the Reactor Coolant System is reduced in 

MODE 3. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

With one of the required containment cooling trains inoperable, the 

inoperable containment cooling train must be restored to OPERABLE 

status within 7 days. The components in this degraded condition provide 

iodine removal capabilities and are capable of providing at least 100% of 

the heat removal needs after an accident. The 7 day Completion Time 

was developed taking into account the redundant heat removal 

capabilities afforded by combinations of the Containment Spray System 

and Containment Cooling System and the low probability of a DBA 

occurring during this period. 

The [14] day portion of the Completion Time for Required Action C.1 is 

based upon engineering judgment. It takes into account the low 

probability of coincident entry into two Conditions in this LCO coupled 

with the low probability of an accident occurring during this time. Refer to 

Section 1.3 for a more detailed discussion of the purpose of the "from 

discovery of failure to meet the LCO" portion of the Completion Time. 

D.1 and D.2

With one containment spray and one [required] containment cooling train 

inoperable, one of the required containment cooling trains must be 

restored to OPERABLE status within 72 hours. The components in this 

degraded condition provide iodine removal capabilities and are capable of 

providing at least 100% of the heat removal needs after an accident. The 

72 hour Completion Time was developed taking into account the 

redundant heat removal capabilities afforded by combinations of the 

Containment Spray System and Containment Cooling System, the iodine 

removal function of the Containment Spray System, and the low 

probability of a DBA occurring during this period. 

E.1

With two of the required containment cooling trains inoperable, one of the 

required containment cooling trains must be restored to OPERABLE 

status within 72 hours. The components in this degraded condition (both 

spray trains are OPERABLE or else Condition G is entered) provide 

iodine removal capabilities and are capable of providing at least 100% of 

the heat removal needs after an accident. The 72 hour Completion Time 

was developed taking into account the redundant heat removal 

capabilities afforded by combinations of the Containment Spray System 

and Containment Cooling System and the low probability of a DBA 

occurring during this period. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

F.1 and F.2

If the Required Actions and associated Completion Times of Condition C, 

D, or E of this LCO are not met, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

G.1

With two containment spray trains or any combination of three or more 

containment spray and containment cooling trains inoperable, the unit is 

in a condition outside the accident analysis. Therefore, LCO 3.0.3 must 

be entered immediately. 

SURVEILLANCE SR 3.6.6.1

REQUIREMENTS 

Verifying the correct alignment for manual, power operated, and 

automatic valves in the containment spray flow path provides assurance 

that the proper flow paths will exist for Containment Spray System 

operation. This SR does not apply to valves that are locked, sealed, or 

otherwise secured in position, since these were verified to be in the 

correct position prior to locking, sealing, or securing. This SR also does 

not apply to valves that cannot be inadvertently misaligned, such as 

check valves. This SR does not require any testing or valve 

manipulation. Rather, it involves verification, through a system walkdown, 

that those valves outside containment and capable of potentially being 

mispositioned are in the correct position. 

SR 3.6.6.2

Operating each [required] containment cooling train fan unit for 

≥ 15 minutes ensures that all trains are OPERABLE and that all 

associated controls are functioning properly. It also ensures that 

blockage, fan or motor failure, or excessive vibration can be detected for 

corrective action. The 31 day Frequency was developed considering the 

known reliability of the fan units and controls, the two train redundancy 

available, and the low probability of a significant degradation of the 

containment cooling trains occurring between surveillances and has been 

shown to be acceptable through operating experience. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.6.3

Verifying that each [required] containment cooling train provides an 

essential raw water cooling flow rate of ≥ [1780] gpm to each cooling unit 

provides assurance that the design flow rate assumed in the safety 

analyses will be achieved (Ref. 1). The Frequency was developed 

considering the known reliability of the Cooling Water System, the two 

train redundancy available, and the low probability of a significant 

degradation of flow occurring between surveillances. 

SR 3.6.6.4

Verifying that each containment spray pump's developed head at the flow 

test point is greater than or equal to the required developed head ensures 

that spray pump performance has not degraded during the cycle. Flow 

and differential pressure are normal tests of centrifugal pump 

performance required by Section XI of the ASME Code (Ref. 6). Since 

the Containment Spray System pumps cannot be tested with flow through 

the spray headers, they are tested on recirculation flow. This test 

confirms one point on the pump design curve and is indicative of overall 

performance. Such inservice tests confirm component OPERABILITY, 

trend performance, and detect incipient failures by indicating abnormal 

performance. The Frequency of this SR is in accordance with the 

Inservice Testing Program. 

SR 3.6.6.5 and SR 3.6.6.6

These SRs require verification that each automatic containment spray 

valve actuates to its correct position and that each containment spray 

pump starts upon receipt of an actual or simulated actuation signal. This 

SR is not required for valves that are locked, sealed, or otherwise 

secured in position under administrative controls. The [18] month 

Frequency is based on the need to perform these Surveillances under the 

conditions that apply during a plant outage and the potential for an 

unplanned transient if the Surveillances were performed with the reactor 

at power. Operating experience has shown that these components 

usually pass the Surveillances when performed at the [18] month 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint. 
Containment Spray and Cooling Systems 

B 3.6.6 

BWOG STS B 3.6.6-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.6.7

This SR requires verification that each [required] containment cooling 

train actuates upon receipt of an actual or simulated actuation signal. 

The [18] month Frequency is based on engineering judgment and has 

been shown to be acceptable through operating experience. See 

SR 3.6.6.5 and SR 3.6.6.6, above, for further discussion of the basis for 

the [18] month Frequency. 

SR 3.6.6.8 

With the containment spray header isolated and drained of any solution, 

low pressure air or smoke can be blown through test connections. 

Performance of this Surveillance demonstrates that each spray nozzle is 

unobstructed and provides assurance that spray coverage of the 

containment during an accident is not degraded. Due to the passive 

nature of the design of the nozzles, a test at [the first refueling and at] 

10 year intervals is considered adequate to detect obstruction of the 

spray nozzles. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 38, GDC 39, GDC 40, GDC 41, 

GDC 42, and GDC 43. 

 2. FSAR, Section [14.1]. 

 3. FSAR, Section [6.3]. 

 4. FSAR, Section [14.2]. 

 5. BAW-2295-A, Revision 1, Justification for Extension of Allowed 

Outage Time for Low Pressure Injection and Reactor Building Spray 

Systems. 

 6. ASME, Boiler and Pressure Vessel Code, Section XI. 
Spray Additive System 

B 3.6.7 

BWOG STS B 3.6.7-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.7 Spray Additive System 

BASES 

BACKGROUND The Spray Additive System is a subsystem of the Containment Spray 

System that assists in reducing the iodine fission product inventory in the 

containment atmosphere resulting from a Design Basis Accident (DBA). 

The Containment Spray System and Spray Additive System perform no 

function during normal operations. In the event of an accident such as a 

loss of coolant accident (LOCA), however, the Spray Additive System will 

be automatically actuated upon a high containment pressure signal by the 

Engineered Safety Features Actuation System. 

Radioiodine in its various forms is the fission product of primary concern 

in the evaluation of a DBA. It is absorbed by the spray from the 

containment atmosphere. To enhance the iodine absorption capacity of 

the spray, the spray solution is adjusted to an alkaline pH that promotes 

iodine hydrolysis, in which iodine is converted to nonvolatile forms. 

Sodium hydroxide (NaOH), because of its stability when exposed to 

radiation and elevated temperature, is the preferred spray additive. 

The spray additive tank is designed and located to permit gravity draining 

into the Containment Spray System. Both Containment Spray System 

pumps initially take suction from the borated water storage tank (BWST) 

via two independent flow paths. The spray additive tank has a common 

header that splits and feeds each of the Containment Spray System 

suction lines. The system is designed to inject at a rate commensurate 

with the draining rate of the BWST so that all borated water injected is 

mixed with NaOH. 

The flow rate is proportioned to provide a spray solution with a pH 

between [7.2 and 11.0] (Ref. 1). This range of alkalinity was established 

not only to aid in removal of airborne iodine, but also to minimize the 

corrosion of mechanical system components that would occur if the acidic 

borated water were not buffered. The pH range also considers the 

environmental qualification of equipment in containment that may be 

subjected to the spray. 

APPLICABLE The containment Spray Additive System is essential to the effective 

SAFETY removal of airborne iodine within containment following a DBA. 

ANALYSES 

 Following the assumed release of radioactive materials into containment, 

the containment is assumed to leak at its design value following the 

accident. The analysis assumes that most of the containment volume is 

covered by the spray. 
Spray Additive System 

B 3.6.7 

BWOG STS B 3.6.7-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The DBA response time assumed for the Spray Additive System is the 

same as for the Containment Spray System and is discussed in the 

Bases for LCO 3.6.6, "Containment Spray and Cooling Systems." 

The DBA analyses assume that one train of the Containment Spray 

System/Spray Additive System is inoperable and that the entire spray 

additive tank volume is added to the remaining Containment Spray 

System flow path. 

In the evaluation of the worst-case LOCA, the safety analysis assumed 

that an alkaline containment spray effectively reduced the airborne iodine. 

Each Containment Spray System suction line is equipped with its own 

gravity feed from the spray additive tank. Therefore, in the event of a 

single failure within the Spray Additive System (i.e., suction valve failure), 

NaOH will still be mixed with the borated water, establishing the alkalinity 

essential to effective iodine removal. 

The Spray Additive System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The Spray Additive System is necessary to reduce the release of 

radioactive material to the environment in the event of a DBA. To be 

considered OPERABLE, the volume and concentration of the spray 

additive solution must be sufficient to provide NaOH injection into the 

spray flow until the Containment Spray System suction path is switched 

from the BWST to the containment sump and to raise the average spray 

solution pH to a level conducive to iodine removal. The average spray 

solution pH is between [7.2 and 11.0]. This pH range maximizes the 

effectiveness of the iodine removal mechanism without introducing 

conditions that may induce caustic stress corrosion cracking of 

mechanical system components. In addition, it is essential that valves in 

the Spray Additive System flow paths are properly positioned and that 

automatic valves are capable of activating to their correct positions. 

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment requiring the operation of the Spray Additive 

System. The Spray Additive System assists in reducing the iodine fission 

product inventory prior to release to the environment. 

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations in these 

MODES. Thus, the Spray Additive System is not required to be 

OPERABLE in MODES 5 and 6. 
Spray Additive System 

B 3.6.7 

BWOG STS B 3.6.7-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With the containment Spray Additive System inoperable, the system must 

be restored to OPERABLE status within 72 hours. The pH adjustment of 

the Containment Spray System for corrosion protection and iodine 

removal enhancement is reduced in this Condition. The Containment 

Spray System would still be available and would remove some iodine 

from the containment atmosphere in the event of a DBA. The 72 hour 

Completion Time takes into account the redundant flow path capabilities 

and the low probability of the worst-case DBA occurring during this 

period. 

B.1 and B.2

If the Spray Additive System cannot be restored to OPERABLE status 

within the required Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 6 hours and to MODE 5 within 

84 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. The extended interval to reach MODE 5 allows additional time 

for restoration of the Spray Additive System and is reasonable when 

considering that the driving force for a release of radioactive material from 

the Reactor Coolant System is reduced in MODE 3. 

SURVEILLANCE SR 3.6.7.1

REQUIREMENTS 

Verifying the correct alignment of spray additive manual, power operated, 

and automatic valves in the spray additive flow path provides assurance 

that the system is able to provide additive to the Containment Spray 

System in the event of a DBA. This SR does not apply to valves that are 

locked, sealed, or otherwise secured in position, since these valves were 

verified to be in the correct position prior to locking, sealing, or securing. 

This SR also does not apply to valves that cannot be inadvertently 

misaligned, such as check valves. This SR does not require any testing 

or valve manipulation. Rather, it involves verification that those valves 

outside containment capable of potentially being mispositioned are in the 

correct position. 
Spray Additive System 

B 3.6.7 

BWOG STS B 3.6.7-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.7.2

To provide effective iodine removal, the containment spray must be an 

alkaline solution. Since the BWST contents are normally acidic, the 

volume of the spray additive tank must provide a sufficient volume of 

spray additive to adjust pH for all water injected. This SR is performed to 

verify the availability of sufficient NaOH solution in the Spray Additive 

System. The 184 day Frequency is based on the low probability of an 

undetected change in tank volume occurring during the SR interval (the 

tank is isolated during normal unit operations). Tank level is also 

indicated and alarmed in the control room, such that there is a high 

confidence that a substantial change in level would be detected. 

SR 3.6.7.3

This SR provides verification of the NaOH concentration in the spray 

additive tank and is sufficient to ensure that the spray solution being 

injected into containment is at the correct pH level. The concentration of 

NaOH in the spray additive tank must be determined by chemical 

analysis. The 184 day Frequency is sufficient to ensure that the 

concentration level of NaOH in the spray additive tank remains within the 

established limits. This is based on the low likelihood of an uncontrolled 

change in concentration (the tank is normally isolated) and the probability 

that any substantial variance in tank volume will be detected. 

SR 3.6.7.4

This SR provides verification that each automatic valve in the Spray 

Additive System flow path actuates to its correct position. The [18] month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power. Operating experience has shown that these components usually 

pass the Surveillance when performed at the [18] month Frequency. 

Therefore, the Frequency was concluded to be acceptable from a 

reliability standpoint. 
Spray Additive System 

B 3.6.7 

BWOG STS B 3.6.7-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.7.5

To ensure that the correct pH level is established in the borated water 

solution provided by the Containment Spray System, the flow [rate] in the 

Spray Additive System is verified once per 5 years. This SR provides 

assurance that the correct amount of NaOH will be metered into the flow 

path upon Containment Spray System initiation. Due to the passive 

nature of the spray additive flow controls, the 5 year Frequency is 

sufficient to identify component degradation that may affect flow [rate]. 

References 1. FSAR, Section [6.2]. 
MSSVs 

B 3.7.1 

BWOG STS B 3.7.1-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.1 Main Steam Safety Valves (MSSVs) 

BASES 

BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection 

for the secondary system. The MSSVs also provide protection against 

overpressurizing the reactor coolant pressure boundary (RCPB) by 

providing a heat sink for removal of energy from the Reactor Coolant 

System (RCS) if the preferred heat sink, provided by the Condenser and 

Circulating Water System, is not available. 

Nine MSSVs are located on each main steam header, outside 

containment, upstream of the main steam isolation valves, as described 

in the FSAR, Section [5.2] (Ref. 1). The MSSV rated capacity passes the 

full steam flow at 112% RTP with the valves full open. This meets the 

requirements of the ASME Code, Section III (Ref. 2). The MSSV design 

includes staggered setpoints, according to Table 3.7.1-1 in the 

accompanying LCO, so that only the needed number of valves will 

actuate. Staggered setpoints reduce the potential for valve chattering 

because of insufficient steam pressure to fully open all valves following a 

turbine reactor trip. 

APPLICABLE The design basis of the MSSVs comes from Reference 2 and its purpose 

SAFETY is to limit secondary system pressure to ≤ 110% of design pressure when 

ANALYSES passing 100% of design steam flow. This design basis is sufficient to 

cope with any anticipated operational occurrence (AOO) or accident 

considered in the Design Basis Accident (DBA) and transient analysis. 

The events that challenge the relieving capacity of the MSSVs, and thus 

RCS pressure, are those characterized as decreased heat removal 

events, and are presented in the FSAR, Section [15.2] (Ref. 3). Of these, 

the full power turbine trip coincident with a loss of condenser heat sink is 

the limiting AOO. For this event, the Condenser Circulating Water 

System is lost and, therefore, the Turbine Bypass Valves are not 

available to relieve Main Steam System pressure. Similarly, MSSV relief 

capacity is utilized in the FSAR for mitigation of the following events: 

a. Loss of main feedwater, 

b. Steam line break, 

c. Steam generator tube rupture, and 

d. Excessive heat removal due to feedwater system malfunction. 

The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
MSSVs 

B 3.7.1 

BWOG STS B 3.7.1-2 Rev. 3.0, 03/31/04 

BASES 

LCO The MSSVs setpoints are established to prevent overpressurization as 

discussed in the Applicable Safety Analysis section of these Bases. The 

LCO requires all MSSVs to be OPERABLE to ensure compliance with the 

ASME Code following DBAs initiated at full power. Operation with less 

than a full complement of MSSVs requires limitations on unit THERMAL 

POWER and adjustment of the Reactor Protection System (RPS) trip 

setpoints. This effectively limits the Main Steam System steam flow while 

the MSSV relieving capacity is reduced due to valve inoperability. To be 

OPERABLE, lift setpoints must remain within limits, according to 

Table 3.7.1-1 in the accompanying LCO. 

The OPERABILITY of the MSSVs is defined as the ability to open within 

the setpoint tolerances, relieve steam generator overpressure, and reseat 

when pressure has been reduced. 

The OPERABILITY of the MSSVs is determined by periodic surveillance 

testing in accordance with the Inservice Testing Program. 

The lift settings, according to Table 3.7.1-1 in the accompanying LCO, 

correspond to ambient conditions of the valve at nominal operating 

temperature and pressure. 

This LCO provides assurance that the MSSVs will perform the design 

safety function to mitigate the consequences of accidents that could result 

in a challenge to the RCPB. 

APPLICABILITY In MODE 1 above [18]% RTP, the number of MSSVs per steam generator 

required to be OPERABLE must be within the acceptable region, 

according to Figure 3.7.1-1 in the accompanying LCO. Below [18]% RTP 

in MODES 1, 2, and 3, only two MSSVs are required OPERABLE per 

steam generator. 

In MODES 4 and 5, there is no credible transient requiring the MSSVs. 

The steam generators are not normally used for heat removal in 

MODES 5 and 6, and thus cannot be overpressurized; there is no 

requirement for the MSSVs to be OPERABLE in these MODES. 

ACTIONS The ACTIONS Table is modified by a Note indicating that separate 

Condition entry is allowed for each MSSV. 
MSSVs 

B 3.7.1 

BWOG STS B 3.7.1-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1 and A.2

An alternative to restoring the inoperable MSSV(s) to OPERABLE status 

is to reduce power so that the available MSSV relieving capacity meets 

ASME Code requirements for the power level. Operation may continue, 

provided the ALLOWABLE THERMAL POWER and RPS nuclear 

overpower trip setpoint are reduced by the application of the following 

formulas: 

 RP = [ Y / Z] x 100% 

and 

 SP = [ Y / Z ] x W 

where: 

W = Nuclear overpower trip setpoint for four pump operation as 

specified in LCO 3.3.1, "Reactor Protection System (RPS)," 

Y = Total OPERABLE MSSV relieving capacity per steam generator 

based on a summation of individual OPERABLE MSSV relief 

capacities per steam generator [lb/hour], 

Z = Required relieving capacity per steam generator of 

[6,585,600] lb/hour, 

RP = Reduced power requirement (not to exceed RTP), and 

SP = Nuclear overpower trip setpoint (not to exceed W). 

These equations are graphically represented in Figure 3.7.1-1, in the 

accompanying LCO. Operation is restricted to the area below and to the 

right of line BCDE. 

The operator should limit the maximum steady state power level to some 

value slightly below this setpoint to avoid an inadvertent overpower trip. 

The 4 hour Completion Time for Required Action A.1 is a reasonable time 

period to reduce power level and is based on the low probability of an 

event occurring during this period that would require activation of the 

MSSVs. An additional 32 hours is allowed in Required Action A.2 to 
MSSVs 

B 3.7.1 

BWOG STS B 3.7.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

reduce the setpoints. The Completion Time of 36 hours for Required 

Action A.2 is based on a reasonable time to correct the MSSV 

inoperability, the time required to perform the power reduction, operating 

experience in resetting all channels of a protective function, and on the 

low probability of the occurrence of a transient that could result in steam 

generator overpressure during this period. 

B.1 and B.2

With one or more MSSVs inoperable, a verification by administrative 

means that at least [two] required MSSVs per steam generator are 

OPERABLE, with each valve from a different lift setting range, is 

performed. 

If the MSSVs cannot be restored to OPERABLE status in the associated 

Completion Time, the unit must be placed in a MODE in which the LCO 

does not apply. To achieve this status, the unit must be placed in at least 

MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.1.1

REQUIREMENTS 

This SR verifies the OPERABILITY of the MSSVs by the verification of 

each MSSV lift setpoint in accordance with the Inservice Testing 

Program. The ASME Code, Section XI (Ref. 4) requires that safety and 

relief valve tests be performed in accordance with ANSI/ASME 

OM-1-1987 (Ref. 5). According to Reference 5, the following tests are 

required for MSSVs: 

a. Visual examination, 

b. Seat tightness determination, 

c. Setpoint pressure determination (lift setting), 

d. Compliance with owner's seat tightness criteria, and 

e. Verification of the balancing device integrity device on balanced 

valves. 
MSSVs 

B 3.7.1 

BWOG STS B 3.7.1-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The ANSI/ASME Standard requires the testing of all valves every 5 years, 

with a minimum of 20% of the valves tested every 24 months. 

Reference 4 provides the activities and frequencies necessary to satisfy 

the requirements. Table 3.7.1-1 allows a ± [3]% setpoint tolerance for 

OPERABILITY; however, the valves are reset to ± 1% during the 

Surveillance to allow for drift. 

This SR is modified by a Note that allows entry into and operation in 

MODE 3 prior to performing the SR. The MSSVs may be either bench 

tested or tested in situ at hot conditions using an assist device to simulate 

lift pressure. If the MSSVs are not tested at hot conditions, the lift setting 

pressure shall be corrected to ambient conditions of the valve at 

operating temperature and pressure. 

REFERENCES 1. FSAR, Section [5.2]. 

 2. ASME, Boiler and Pressure Vessel Code, Section III, 

Article NC-7000, Class 2 Components. 

 3. FSAR, Section [15.2]. 

 4. ASME, Boiler and Pressure Vessel Code, Section XI. 

 5. ANSI/ASME OM-1-1987. 
MSIVs 

B 3.7.2 

BWOG STS B 3.7.2-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.2 Main Steam Isolation Valves (MSIVs) 

BASES 

BACKGROUND The MSIVs isolate steam flow from the secondary side of the steam 

generators following a high energy line break (HELB). MSIV closure 

terminates flow from the unaffected (intact) steam generator. 

One MSIV is located in each main steam line outside of, but close to, 

containment. The MSIVs are downstream from the main steam safety 

valves (MSSVs) and emergency feedwater pump turbine's steam supply 

to prevent their being isolated from the steam generators by MSIV 

closure. Closing the MSIVs isolates each steam generator from the 

other, and isolates the turbine, Turbine Bypass System, and other 

auxiliary steam supplies from the steam generators. 

The MSIVs close on a Steam and Feedwater Rupture Control System 

signal generated by either low steam generator pressure or steam 

generator to feedwater differential pressure. The MSIVs fail closed on 

loss of control or actuation power. The MSIVs may also be actuated 

manually. 

A description of the MSIVs is found in the FSAR, Section [10.3] (Ref. 1). 

APPLICABLE The design basis of the MSIVs is established by the containment analysis 

SAFETY for the large steam line break (SLB) inside containment, as discussed in 

ANALYSES the FSAR, Section [6.2] (Ref. 2). It is also influenced by the accident 

analysis of the SLB events presented in the FSAR, Section [15.4] 

(Ref. 3). The design precludes the blowdown of more than one steam 

generator, assuming a single active component failure (i.e., the failure of 

one MSIV to close on demand). 

The limiting case for the containment analysis is the SLB inside 

containment with a loss of offsite power following turbine trip and failure of 

the MSIV on the affected steam generator to close. At 100% RTP, the 

steam generator inventory and temperature are at their maximum, 

maximizing the mass and energy release to the containment. 

Due to reverse flow, failure of the MSIV to close contributes to the total 

release of the additional mass and energy in the steam headers 

downstream of the other MSIV. Other failures considered are the failure 

of a main feedwater isolation valve to close, and failure of an emergency 

diesel generator (EDG) to start. 
MSIVs 

B 3.7.2 

BWOG STS B 3.7.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The accident analysis compares several different SLB events against 

different acceptance criteria. The large SLB outside containment 

upstream of the MSIV is limiting for offsite dose, although a break in this 

short section of main steam header has a very low probability. The large 

SLB inside containment at full power is the limiting case for a post trip 

return to power. The analysis includes scenarios with offsite power 

available and with a loss of offsite power following turbine trip. With 

offsite power available, the reactor coolant pumps continue to circulate 

coolant through the steam generators, maximizing the Reactor Coolant 

System (RCS) cooldown. With a loss of offsite power, the response of 

mitigating systems, such as the High Pressure Injection (HPI) System 

pumps, is delayed. Significant single failures considered include failure of 

an MSIV to close, failure of an EDG, and failure of an HPI pump. 

The MSIVs serve only a safety function and remain open during power 

operation. These valves operate under the following situations: 

a. An HELB, an SLB, or main feedwater line breaks (FWLBs), inside 

containment. In order to maximize the mass and energy release into 

the containment, the analysis assumes the MSIV in the affected 

steam generator remains open. For this scenario, steam is 

discharged into containment from both steam generators until closure 

of the MSIV in the intact steam generator occurs. After MSIV 

closure, steam is discharged into containment only from the affected 

steam generator and from the residual steam in the main steam 

header downstream of the closed MSIV in the intact loop. 

b. An SLB outside of containment and upstream from the MSIVs is not 

a containment pressurization concern. The uncontrolled blowdown of 

more than one steam generator must be prevented to limit the 

potential for uncontrolled RCS cooldown and positive reactivity 

addition. Closure of the MSIVs isolates the break and limits the 

blowdown to a single steam generator. 

c. A break downstream of the MSIVs will be isolated by the closure of 

the MSIVs. Events such as increased steam flow through the turbine 

or the steam bypass valves will also terminate on closing the MSIVs. 
MSIVs 

B 3.7.2 

BWOG STS B 3.7.2-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

d. Following a steam generator tube rupture, closure of the MSIVs 

isolates the ruptured steam generator from the intact steam 

generator. In addition to minimizing radiological releases, this 

enables the operator to maintain the pressure of the steam generator 

with the ruptured tube below the MSIVs' setpoints, a necessary step 

toward isolating flow through the rupture. 

e. The MSIVs are also utilized during other events such as an FWLB. 

The MSIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO This LCO requires that the MSIV in both steam lines be OPERABLE. The 

MSIVs are considered OPERABLE when the isolation times are within 

limits and they close on an isolation actuation signal. 

This LCO provides assurance that the MSIVs will perform their design 

safety function to mitigate the consequences of accidents that could result 

in offsite exposures comparable to the 10 CFR 100 limits (Ref. 4). 

APPLICABILITY The MSIVs must be OPERABLE in MODE 1 and in MODES 2 and 3 with 

any MSIVs open, when there is significant mass and energy in the RCS 

and steam generator; therefore, the MSIVs must be OPERABLE or 

closed. When the MSIVs are closed, they are already performing the 

safety function. 

In MODE 4, the steam generator energy is low. Therefore, the MSIVs are 

not required to be OPERABLE. 

In MODES 5 and 6, the steam generators do not contain much energy 

because their temperature is below the boiling point of water; therefore, 

the MSIVs are not required for isolation of potential high energy 

secondary system pipe breaks in these MODES. 

ACTIONS A.1

With one MSIV inoperable in MODE 1, action must be taken to restore 

the component to OPERABLE status within [8] hours. Some repairs can 

be made to the MSIV with the unit hot. The [8] hour Completion Time is 

reasonable, considering the probability of an accident that would require 

actuation of the MSIVs occurring during this time interval. The turbine 

stop valves are available to provide the required isolation for the 

postulated accidents. 
MSIVs 

B 3.7.2 

BWOG STS B 3.7.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The [8] hour Completion Time is greater than that normally allowed for 

containment isolation valves because the MSIVs are valves that isolate a 

closed system penetrating containment. These valves differ from other 

containment isolation valves in that the closed system provides an 

additional means for containment isolation. 

B.1

If the MSIV cannot be restored to OPERABLE status within [8] hours, the 

unit must be placed in MODE 2 and the inoperable MSIV closed within 

the next 6 hours. The Completion Times are reasonable, based on 

operating experience, to reach MODE 2. 

C.1 and C.2

Condition C is modified by a Note indicating that separate Condition entry 

is allowed for each MSIV. 

Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the 

inoperable MSIVs may either be restored to OPERABLE status or closed. 

When closed, the MSIVs are already in the position required by the 

assumptions in the safety analysis. 

The [8] hour Completion Time is consistent with that allowed in 

Condition A. 

Inoperable MSIVs that cannot be restored to OPERABLE status within 

the specified Completion Time, but are closed, must be verified on a 

periodic basis to be closed. This is necessary to ensure that the 

assumptions in the safety analysis remain valid. The 7 day Completion 

Time is reasonable, based on engineering judgment, in view of MSIV 

status indications available in the control room, and other administrative 

controls, to ensure these valves are in the closed position. 
MSIVs 

B 3.7.2 

BWOG STS B 3.7.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1 and D.2

If the MSIV cannot be restored to OPERABLE status or closed in the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours and in MODE 4 within 12 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from MODE 2 conditions 

in an orderly manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.2.1

REQUIREMENTS 

This SR verifies that MSIV closure time of each MSIV is ≤ [6] seconds. 

The MSIV isolation time is assumed in the accident and containment 

analyses. This Surveillance is normally performed upon returning the unit 

to operation following a refueling outage, because the MSIVs should not 

be tested at power since even a part stroke exercise increases the risk of 

a valve closure with the unit generating power. As the MSIVs are not to 

be tested at power, they are exempt from the ASME Code, Section XI 

(Ref. 5) requirements during operation in MODES 1 and 2. 

The Frequency for this SR is in accordance with the Inservice Testing 

Program. 

This test is conducted in MODE 3, with the unit at operating temperature 

and pressure. This SR is modified by a Note that allows entry into and 

operation in MODE 3 prior to performing the SR. This allows delaying 

testing until MODE 3 in order to establish conditions consistent with those 

under which the acceptance criterion was generated. 

SR 3.7.2.2

This SR verifies that each MSIV can close on an actual or simulated 

actuation signal. This Surveillance is normally performed upon returning 

the plant to operation following a refueling outage. The Frequency of 

MSIV testing is every [18] months. The [18] month Frequency for testing 

is based on the refueling cycle. Operating experience has shown that 

these components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, this Frequency is acceptable from a 

reliability standpoint. 
MSIVs 

B 3.7.2 

BWOG STS B 3.7.2-6 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [10.3]. 

 2. FSAR, Section [6.2]. 

 3. FSAR, Section [15.4]. 

 4. 10 CFR 100.11. 

 5. ASME, Boiler and Pressure Vessel Code, Section XI. 
 [MFSVs, MFCVs, and Associated SFCVs] 

B 3.7.3 

BWOG STS B 3.7.3-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.3 [ Main Feedwater Stop Valves (MFSVs), Main Feedwater Control Valves (MFCVs), 

 and Associated Startup Feedwater Control Valves (SFCVs) ] 

BASES 

BACKGROUND The main feedwater isolation valves (MFIVs) for each steam generator 

consist of the MFSVs, MFCVs, and the SFCVs. The MFIVs isolate main 

feedwater (MFW) flow to the secondary side of the steam generators 

following a high energy line break (HELB). Closure of the MFIVs 

terminates flow to both steam generators, terminating the event for 

feedwater line breaks (FWLBs) occurring upstream of the MFIVs. The 

consequences of events occurring in the main steam lines or in the 

feedwater lines downstream of the MFIVs will be mitigated by their 

closure. Closing the MFIVs and associated bypass valves effectively 

terminates the addition of feedwater to an affected steam generator, 

limiting the mass and energy release for steam line breaks (SLBs) or 

FWLBs inside containment and reducing the cooldown effects for SLBs. 

The MFIVs close on receipt of a Steam and Feedwater Rupture Control 

System (SFRCS) signal generated by either low steam generator 

pressure or steam generator/feedwater differential pressure. The MFIVs 

can also be closed manually. 

[ The MFIVs and associated bypass valves close on receipt for a safety 

injection - low Tavg coincident with reactor trip or steam generator water 

level - high high signal. They may also be actuated manually. In addition 

to the MFIVs and associated bypass valves, a check valve inside 

containment is available to isolate the feedwater line penetrating 

containment and to ensure that the consequences of events do not 

exceed the capacity of the containment heat removal systems. ]

A description of the MFIVs is found in the FSAR, Section [10.4.7] (Ref. 1). 

APPLICABLE The design basis of the MFIVs is established by the analysis for the large 

SAFETY SLB. It is also influenced by the accident analysis for the large FWLB. 

ANALYSES Closure of the MFIVs may also be relied on to terminate a steam break 

for core response analysis and excess feedwater event upon the receipt 

of a steam generator water level - high signal. 

Failure of an MFIV to close following an SLB, FWLB, or excess feedwater 

event, can result in additional mass and energy being delivered to the 

steam generators, contributing to cooldown. This failure also results in 

additional mass and energy releases following an SLB or FWLB event. 

The MFIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
 [MFSVs, MFCVs, and Associated SFCVs] 

B 3.7.3 

BWOG STS B 3.7.3-2 Rev. 3.0, 03/31/04 

BASES 

LCO This LCO ensures that the MFIVs will isolate MFW flow to the steam 

generators following a FWLB or a main steam line break. These valves 

will also isolate the nonsafety related portions from the safety related 

portions of the system. 

[Two] [MFSVs], [MFCVs], [or associated SFCVs] are required to be 

OPERABLE. The MFIVs are considered OPERABLE when the isolation 

times are within limits and they close on an isolation actuation signal. 

Failure to meet the LCO requirements can result in additional mass and 

energy being released to containment following an SLB or FWLB inside 

containment. If the SFRCS on high steam generator level is relied on to 

terminate an excess feedwater flow event, failure to meet the LCO may 

result in the introduction of water into the main steam lines. 

APPLICABILITY The [MFSVs], [MFCVs], [or associated SFCVs] must be OPERABLE 

whenever there is significant mass and energy in the RCS and steam 

generators. This ensures that in the event of an HELB, a single failure 

cannot result in the blowdown of more than one steam generator. 

In MODES 1, 2, and 3, the [MFSVs], [MFCVs], [or associated SFCVs] are 

required to be OPERABLE in order to limit the amount of available fluid 

that could be added to containment in the case of a secondary system 

pipe break inside containment. When the valves are closed, they are 

already performing their safety function. 

In MODES 4, 5, and 6, steam generator energy is low. Therefore, the 

[MFSVs], [MFCVs], [or associated SFCVs] are not required for isolation of 

potential high energy secondary system pipe breaks in these MODES. 

ACTIONS The ACTIONS Table is modified by a Note indicating that separate 

Condition entry is allowed for each valve. 

A.1 and A.2

With one [MFSV] in one or more flow paths inoperable, action must be 

taken to restore the affected valves to OPERABLE status, or to close or 

isolate inoperable affected valves within [8 or 72] hours. When these 

valves are closed or isolated, they are performing their required safety 

function. 
 [MFSVs, MFCVs, and Associated SFCVs] 

B 3.7.3 

BWOG STS B 3.7.3-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ For units with only one MFIV per feedwater line: The [8] hour Completion 

Time is reasonable to close the MFIV or its associated bypass valve 

which includes performing a controlled unit shutdown to MODE 2. The 

Completion Time is reasonable, based on operating experience, to reach 

MODE 2 from full power conditions with the MFIVs closed, in an orderly 

manner and without challenging unit systems. ]

The [72] hour Completion Time takes into account the redundancy 

afforded by the remaining OPERABLE valves and the low probability of 

an event occurring during this time period that would require isolation of 

the MFW flow paths. The [72] hour Completion Time is reasonable, 

based on operating experience. 

Inoperable [MFSVs] that are closed or isolated, must be verified on a 

periodic basis that they are closed or isolated. This is necessary to 

ensure that the assumptions in the safety analysis remain valid. The 

7 day Completion Time is reasonable, based on engineering judgment, in 

view of valve status indications available in the control room, and other 

administrative controls, to ensure that these valves are closed or isolated. 

B.1 and B.2

With one [MFCV] in one or more flow paths inoperable, action must be 

taken to restore the affected valves to OPERABLE status, or to close or 

isolate inoperable affected valves within [8 or 72] hours. When these 

valves are closed or isolated, they are performing their required safety 

function. 

[ For units with only one MFIV per feedwater line: The [8] hour Completion 

Time is reasonable, based on operating experience, to close the MFIV or 

its associated bypass valve. ]

The [72] hour Completion Time takes into account the redundancy 

afforded by the remaining OPERABLE valves and the low probability of 

an event occurring during this time period that would require isolation of 

the MFW flow paths. 

Inoperable [MFCVs] that are closed or isolated must be verified on a 

periodic basis that they are closed or isolated. This is necessary to 

ensure that the assumptions in the safety analysis remain valid. The 

7 day Completion Time is reasonable, based on engineering judgment, in 

view of valve status indications available in the control room, and other 

administrative controls, to ensure that these valves are closed or isolated. 
 [MFSVs, MFCVs, and Associated SFCVs] 

B 3.7.3 

BWOG STS B 3.7.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

With one [SFCV] in one or more flow paths inoperable, action must be 

taken to restore the affected valves to OPERABLE status, or to close or 

isolate inoperable affected valves within [8 or 72] hours. When these 

valves are closed or isolated, they are performing their required safety 

function. 

[ For units with only one MFIV per feedwater line: The [8] hour Completion 

Time is reasonable, based on operating experience, to close the MFIV or 

its associated bypass valve. ]

The [72] hour Completion Time takes into account the redundancy 

afforded by the remaining OPERABLE valves and the low probability of 

an event occurring during this time period that would require isolation of 

the MFW flow paths. 

Inoperable SFCVs that are closed or isolated must be verified on a 

periodic basis that they are closed or isolated. This is necessary to 

ensure that the assumptions in the safety analysis remain valid. The 

7 day Completion Time is reasonable, based on engineering judgment, in 

view of valve status indications available in the control room, and other 

administrative controls, to ensure that these valves are closed or isolated. 

D.1

With two inoperable valves in the same flow path there may be no 

redundant system to operate automatically and perform the required 

safety function. Although the containment can be isolated with the failure 

to two valves in parallel in the same flow path, the double failure can be 

an indication of a common mode failure in the valves of this flow path and 

as such is treated the same as a loss of the isolation capability of this flow 

path. Under these conditions, affected valves in each flow path must be 

restored to OPERABLE status, or the affected flow path isolated within 

8 hours. The 8 hour Completion Time is reasonable, based on operating 

experience, to close the MFIV or otherwise isolate the affected flow path. 
 [MFSVs, MFCVs, and Associated SFCVs] 

B 3.7.3 

BWOG STS B 3.7.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1 and E.2

If the [MFSVs], [MFCVs], and [associated SFCVs] cannot be restored to 

OPERABLE status, or closed, or isolated within the associated 

Completion Time, the unit must be in a MODE in which the LCO does not 

apply. To achieve this status, the unit must be placed in at least MODE 3 

within 6 hours and in MODE 4 within 12 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required unit conditions from full power conditions in an orderly manner 

and without challenging unit systems. 

SURVEILLANCE SR 3.7.3.1

REQUIREMENTS 

This SR verifies that the closure time of each [MFSV], [MFCV], and 

[associated SFCV] is ≤ 7 seconds. 

The [MFSV], [MFCV], and [associated SFCV] isolation time is assumed in 

the accident and containment analyses. This Surveillance is normally 

performed upon returning the unit to operation following a refueling 

outage. The [MFSV], [MFCV], and [associated SFCV] should not be 

tested at power since even a part stroke exercise increases the risk of a 

valve closure with the unit generating power. This is consistent with the 

ASME Code, Section XI (Ref. 2) requirements during operation in 

MODES 1 and 2. 

This SR is modified by a Note that allows entry into and operation in 

MODE 3 prior to performing the SR. 

The Frequency for this SR is in accordance with the Inservice Testing 

Program. 

SR 3.7.3.2

This SR verifies that each [MFSV, MFCV, and associated SFCV] can 

close on an actual or simulated actuation signal. This Surveillance is 

normally performed upon returning the plant to operation following a 

refueling outage. 

The Frequency for this SR is every [18] months. The [18] month 

Frequency for testing is based on the refueling cycle. Operating 

experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. Therefore, 

this Frequency is acceptable from a reliability standpoint. 
 [MFSVs, MFCVs, and Associated SFCVs] 

B 3.7.3 

BWOG STS B 3.7.3-6 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [10.4.7]. 

 2. ASME, Boiler and Pressure Vessel Code, Section XI. 
AVVs 

B 3.7.4 

BWOG STS B 3.7.4-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.4 Atmospheric Vent Valves (AVVs) 

BASES 

BACKGROUND The AVVs provide a method for cooling the unit to decay heat removal 

(DHR) entry conditions, should the preferred heat sink via the Turbine 

Bypass System to the condenser not be available, as discussed in the 

FSAR, Section [10.3] (Ref. 1). This is done in conjunction with the 

Emergency Feedwater System, providing cooling water from the 

condensate storage tank (CST). The AVVs may also be required to meet 

the design cooldown rate during a normal cooldown when steam pressure 

drops too low for maintenance of a vacuum in the condenser to permit 

use of the Turbine Bypass System. 

[ The AVVs are provided with upstream block valves to permit their being 

tested at power, and to provide an alternate means of isolation. ]

The AVVs are equipped with pneumatic controllers to permit control of the 

cooldown rate. 

[ The AVVs are provided with a pressurized gas supply of bottled nitrogen 

that, on loss of pressure in the normal instrument air supply, automatically 

supplies nitrogen to operate the AVVs. The nitrogen supply is sized to 

provide sufficient pressurized gas to operate the AVVs for the time 

required for Reactor Coolant System (RCS) cooldown to DHR entry 

conditions. ]

A description of the AVVs is found in Reference 1. 

APPLICABLE The design basis of the AVVs is established by the capability to cool the 

SAFETY unit to MODE 3. The design rate of [75]°F per hour is applicable for both 

ANALYSES steam generators, each with one AVV. This rate is adequate to cool the 

unit to DHR entry conditions with only one AVV and one steam generator 

utilizing the cooling water supply available in the CST. 

In the accident analysis presented in Reference 1, the AVVs are assumed 

to be used by the operator to cool down the unit to MODE 3 for accidents 

accompanied by a loss of offsite power. Prior to operator actions to cool 

down the unit, the AVVs and the main steam safety valves (MSSVs) are 

assumed to operate automatically to relieve steam and maintain the 
AVVs 

B 3.7.4 

BWOG STS B 3.7.4-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

steam generator's pressure and temperature below the design value. 

This is about 30 minutes following initiation of an event; however, this 

may be less for a steam generator tube rupture (SGTR) event. Some 

initiating events falling into this category are a main steam line break 

upstream of the main steam isolation valves, a feedwater line break, and 

an SGTR event (although the AVVs on the affected steam generator may 

still be available following an SGTR event). 

For the recovery from an SGTR event, the operator is also required to 

perform a limited cooldown to establish adequate subcooling as a 

necessary step to terminate the primary to secondary break flow into the 

ruptured steam generator. The time required to terminate the primary to 

secondary break flow for an SGTR is more critical than the time required 

to cool down to DHR conditions for this event, and also for other 

accidents. Thus, the SGTR is the limiting event for the AVVs. The 

number of AVVs required to be OPERABLE to satisfy the SGTR accident 

analysis requirements depends upon the consideration of any single 

failure assumptions regarding the failure of one AVV to open on demand. 

[ The design must accommodate the single failure of one AVV to open on 

demand, thus each steam generator must have at least one AVV. The 

AVVs are equipped with manual block valves in the event an AVV 

spuriously fails open, or fails to close during use. ]

The AVVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO [Two] AVVs [lines per steam generator] are required to be OPERABLE. 

Failure to meet the LCO can result in the inability to cool the unit to DHR 

entry conditions following an event in which the condenser is unavailable 

for use with the Steam Bypass System. 

An AVV is considered OPERABLE when it is capable of providing a 

controlled relief of the main steam flow, and is capable of fully opening 

and closing on demand. 

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator is being 

relied upon for heat removal, the AVVs are required to be OPERABLE. 

In MODES 5 and 6, an SGTR is not a credible event. 
AVVs 

B 3.7.4 

BWOG STS B 3.7.4-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With one AVV [line] inoperable, action must be taken to restore the 

inoperable AVV to OPERABLE status. The 7 day Completion Time 

allows for redundant capability afforded by the remaining OPERABLE 

AVV and a nonsafety grade backup in the Steam Bypass System and 

MSSVs. 

[ B.1

With more than one AVV [line] inoperable, action must be taken to restore 

[all but one] AVV [lines] to OPERABLE status. As the block valve can be 

closed to isolate an AVV, some repairs may be possible with the unit at 

power. The 24 hour Completion Time is reasonable to repair inoperable 

AVV [lines], based on the availability of the Steam Bypass System and 

MSSVs, and the low probability of an event occurring during this period 

that would require the AVV [lines]. ]

C.1 and C.2

If the AVV [lines] cannot be restored to OPERABLE status within the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours, and in MODE 4 within [24] hours, 

without reliance upon the steam generator for heat removal. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.4.1

REQUIREMENTS 

To perform a controlled cooldown of the RCS, the AVVs must be able to 

be opened either remotely or locally and throttled through their full range. 

This SR ensures that the AVVs are tested through a full control cycle at 

least once per fuel cycle. Performance of inservice testing or use of an 

AVV during a unit cooldown may satisfy this requirement. Operating 

experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. Therefore, 

the Frequency is acceptable from a reliability standpoint. 
AVVs 

B 3.7.4 

BWOG STS B 3.7.4-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.7.4.2

The function of the block valve is to isolate a failed open AVV. Cycling 

the block valve closed and open demonstrates its ability to perform this 

function. Performance of inservice testing or use of the block valve 

during unit cooldown may satisfy this requirement. Operating experience 

has shown that these components usually pass the Surveillance when 

performed at the [18] month Frequency. Therefore, the Frequency is 

acceptable from a reliability standpoint. ] 

REFERENCES 1. FSAR, Section [10.3]. 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.5 Emergency Feedwater (EFW) System 

BASES 

BACKGROUND The EFW System automatically supplies feedwater to the steam 

generators to remove decay heat from the Reactor Coolant System 

(RCS) upon the loss of normal feedwater supply. The EFW pumps take 

suction through separate and independent suction lines from the 

condensate storage tank (CST) (LCO 3.7.6, "Condensate Storage Tank 

(CST)"), and pump to the steam generator secondary side through the 

EFW nozzles. The steam generators function as a heat sink for core 

decay heat. The heat load is dissipated by releasing steam to the 

atmosphere from the steam generators via the main steam safety valves 

(MSSVs) (LCO 3.7.1, "Main Steam Safety Valves (MSSVs)"), or 

atmospheric vent valves (AVVs) (LCO 3.7.4, "Atmospheric Vent Valves 

(AVVs)"). If the main condenser is available, steam may be released via 

the Turbine Bypass System and recirculated to the CST. 

[The following system description is provided as an example. Actual 

system description should be provided by the specific unit. The EFW 

System consists of two turbine driven EFW pumps, each of which 

provides a nominal 100% capacity, and one nonsafety grade motor driven 

EFW pump. The steam turbine driven EFW pumps receive steam from 

either of the two main steam headers, upstream of the main steam 

isolation valves (MSIVs). The EFW System supplies a common header 

capable of feeding either or both steam generators. The 100% capacity 

is sufficient to remove decay heat and cool the unit to decay heat removal 

(DHR) entry conditions. The EFW System normally receives a supply of 

water from the CST. A safety grade source of water is also supplied by 

the Service Water System (SWS). Automatic valves on the supply piping 

open on low pressure in the supply piping to transfer the water supply 

from the CST to the SWS. A third source of water can be supplied by 

manually aligning the fire protection header to the EFW pump suction.] 

Thus, the requirements for diversity in motive power sources for the EFW 

System are met. 

The EFW System is capable of supplying feedwater to the steam 

generators during normal unit startup, shutdown, and hot standby 

conditions. 

The EFW System is designed to supply sufficient water to cool the unit to 

DHR entry conditions with steam being released through the ADVs or 

condenser. 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The EFW actuates automatically on low steam generator level, low steam 

generator pressure, or loss of four reactor coolant pumps. 

The EFW System is discussed in the FSAR, Sections [9.2.7] and [9.2.8] 

(Refs. 1 and 2, respectively). 

APPLICABLE The EFW System mitigates the consequences of any event with a loss of 

SAFETY normal feedwater. 

ANALYSES 

The design basis of the EFW System is to supply water to the steam 

generator to remove decay heat and other residual heat by delivering at 

least the minimum required flow rate to the steam generators at 

pressures corresponding to the lowest steam generator safety valve set 

pressure plus 3%. 

In addition, the EFW System must supply enough makeup water to 

replace steam generator secondary inventory being lost as steam as the 

unit cools to MODE 4 conditions. Sufficient EFW flow must also be 

available to account for flow losses such as pump recirculation and line 

breaks. 

The limiting Design Basis Accidents (DBAs) and transients for the EFW 

System are as follows: 

a. Feedwater line break (FWLB) and 

b. Loss of main feedwater. 

In addition, the minimum available EFW flow and system characteristics 

are serious considerations in the analysis of a small break loss of coolant 

accident. 

[ The EFW System design is such that it can perform its function following 

a loss of the turbine driven main feedwater pumps or an FWLB, combined 

with a loss of normal or reserve electric power. ]

The EFW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-3 Rev. 3.0, 03/31/04 

BASES 

LCO This LCO provides assurance that the EFW System will perform its 

design safety function to mitigate the consequences of accidents that 

could result in overpressurization of the reactor coolant pressure 

boundary. [Three] independent EFW pumps, in two diverse trains are 

required to be OPERABLE to ensure the availability of residual heat 

removal capability for all events accompanied by a loss of offsite power 

and a single failure. [This is accomplished by powering two pumps by 

steam driven turbines supplied with steam from a source not isolated by 

the closure of the MSIVs, and one pump from a power source that, in the 

event of loss of offsite power, is supplied by the emergency diesel 

generator.] 

The EFW System is considered to be OPERABLE when the components 

and flow paths required to provide EFW flow to the steam generators are 

OPERABLE. This requires that the [two] turbine driven EFW pump(s) be 

OPERABLE with redundant steam supplies from each of the main steam 

lines upstream of the MSIVs and capable of supplying EFW flow to either 

of the two steam generators. The [nonsafety grade] motor driven EFW 

pump(s) and [the] associated flow path(s) to the EFW System [are] also 

required to be OPERABLE. The piping, valves, instrumentation, and 

controls in the required flow paths shall also be OPERABLE. The primary 

and secondary sources of water to the EFW System are required to be 

OPERABLE. The associated flow paths from the EFW System primary 

and secondary sources of water to all EFW pumps also are required to be 

OPERABLE. 

The LCO is modified by a Note indicating that one EFW train, which 

includes a motor driven EFW pump, is required in MODE 4. This is 

because of reduced heat removal requirement, the short duration of 

MODE 4 in which feedwater is required, and the insufficient steam supply 

available in MODE 4 to power the turbine driven EFW pump. 

APPLICABILITY In MODES 1, 2, and 3, the EFW System is required to be OPERABLE 

and to function in the event that the main feedwater is lost. In addition, 

the EFW System is required to supply enough makeup water to replace 

the steam generator secondary inventory lost as the unit cools to 

MODE 4 conditions. 

In MODE 4, with RCS temperature above [212]°F, the EFW System may 

be used for heat removal via the steam generators. In MODE 4, the 

steam generators are used for heat removal until the DHR System is in 

operation. 

In MODES 5 and 6, the steam generators are not used for DHR and the 

EFW System is not required. 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable EFW 

train when entering MODE 1. There is an increased risk associated with 

entering MODE 1 with EFW inoperable and the provisions of LCO 3.0.4.b, 

which allow entry into a MODE or other specified condition in the 

Applicability with the LCO not met after performance of a risk assessment 

addressing inoperable systems and components, should not be applied in 

this circumstance. 

 [ A.1

With one of the two steam supplies to the turbine driven EFW pump 

inoperable, or if a turbine driven pump is inoperable while in MODE 3 

immediately following refueling, action must be taken to restore the 

inoperable equipment to an OPERABLE status within 7 days. The 7 day 

Completion Time is reasonable, based on the following reasons: 

a. For the inoperability of a steam supply to the turbine driven EFW 

pump, the 7 day Completion Time is reasonable since there is a 

redundant steam supply line for the turbine driven pump. 

b. For the inoperability of a turbine driven EFW pump while in MODE 3 

immediately subsequent to a refueling, the 7 day Completion Time is 

reasonable due to the minimal decay heat levels in this situation. 

c. For both the inoperability of a steam supply line to the turbine driven 

pump and an inoperable turbine driven EFW pump while in MODE 3 

immediately following refueling, the 7 day Completion Time is 

reasonable due to the availability of redundant OPERABLE motor 

driven EFW pumps, and due to the low probability of an event 

requiring the use of the turbine driven EFW pump. 

The second Completion Time for Required Action A.1 establishes a limit 

on the maximum time allowed for any combination of Conditions to be 

inoperable during any continuous failure to meet this LCO. 

The 10 day Completion Time provides a limitation time allowed in this 

specified Condition after discovery of failure to meet the LCO. This limit 

is considered reasonable for situations in which Conditions A and B are 

entered concurrently. The AND connector between 72 hours and 10 days 

dictates that both Completion Times apply simultaneously, and the more 

restrictive must be met. 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition A is modified by a Note which limits the applicability of the 

Condition to when the unit has not entered MODE 2 following a refueling. 

Condition A allows one EFW train to be inoperable for 7 days vice the 

72 hour Completion Time in Condition B. This longer Completion Time is 

based on the reduced decay heat following refueling and prior to the 

reactor being critical. ] 

B.1

When one of the required EFW trains (pump or flow path) is inoperable, 

action must be taken to restore the train to OPERABLE status within 

72 hours. This Condition includes the loss of two steam supply lines to 

one of the turbine driven EFW pumps. The 72 hour Completion Time is 

reasonable, based on the redundant capabilities afforded by the EFW 

System, time needed for repairs, and the low probability of a DBA 

occurring during this time period. The second Completion Time for 

Required Action B.1 establishes a limit on the maximum time allowed for 

any combination of Conditions to be inoperable during any continuous 

failure to meet this LCO. 

The 10 day Completion Time provides a limitation time allowed in this 

specified Condition after discovery of failure to meet the LCO. This limit 

is considered reasonable for situations in which Conditions A and B are 

entered concurrently. The AND connector between 72 hours and 10 days 

dictates that both Completion Times apply simultaneously, and the more 

restrictive must be met. 

C.1 and C.2

When either Required Action A.1 or Required Action B.1 cannot be 

completed within the required Completion Time, [or when two EFW trains 

are inoperable in MODE 1, 2, or 3,] the unit must be placed in a MODE in 

which the LCO does not apply. To achieve this status, the unit must be 

placed in at least MODE 3 within 6 hours and in MODE 4 within 

[18] hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

In MODE 4, with two EFW trains inoperable, operation is allowed to 

continue because only one motor driven EFW train is required in 

accordance with the Note that modifies the LCO. Although not required, 

the unit may continue to cool down and initiate DHR. 

D.1

Required Action D.1 is modified by a Note indicating that all required 

MODE changes or power reductions are suspended until at least one 

EFW train is restored to OPERABLE status. 

With [all] EFW trains inoperable in MODE 1, 2, or 3, the unit is in a 

seriously degraded condition with no safety related means for conducting 

a cooldown, and only limited means for conducting a cooldown with 

nonsafety grade equipment. In such a condition, the unit should not be 

perturbed by any action, including a power change, that might result in a 

trip. The seriousness of this condition requires that action be started 

immediately to restore at least one EFW train to OPERABLE status. 

LCO 3.0.3 is not applicable, as it could force the units into a less safe 

condition. 

E.1

In MODE 4, either the steam generator loops or the DHR loops can be 

used to provide heat removal, which is addressed in LCO 3.4.6, "RCS 

Loops - MODE 4." With one EFW train inoperable, action must be taken 

to immediately restore the inoperable train to OPERABLE status. 

SURVEILLANCE SR 3.7.5.1

REQUIREMENTS 

Verifying the correct alignment for manual, power operated, and 

automatic valves in the EFW water and steam supply flow paths provides 

assurance that the proper flow paths exist for EFW operation. This SR 

does not apply to valves that are locked, sealed, or otherwise secured in 

position, since those valves are verified to be in the correct position prior 

to locking, sealing, or securing. This SR also does not apply to valves 

that cannot be inadvertently misaligned, such as check valves. This 

Surveillance does not require any testing or valve manipulation; rather, it 

involves verification that those valves capable of potentially being 

mispositioned are in the correct position. 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions. 

SR 3.7.5.2

Verifying that each EFW pump's developed head at the flow test point is 

greater than or equal to the required developed head ensures that EFW 

pump performance has not degraded during the cycle. Flow and 

differential head are normal tests of pump performance required by 

Section XI of the ASME Code (Ref. 3). Because it is undesirable to 

introduce cold EFW into the steam generators while they are operating, 

this test is performed on recirculation flow. 

This test confirms one point on the pump design curve and is indicative of 

overall performance. Such inservice tests confirm component 

OPERABILITY, trend performance, and detect incipient failures by 

indicating abnormal performance. Performance of inservice testing in the 

ASME Code, Section XI (Ref. 3), at 3 month intervals, satisfies this 

requirement. 

This SR is modified by a Note indicating that the SR should be deferred 

until suitable test conditions are established. This deferral is required 

because there is insufficient steam pressure to perform the test. 

SR 3.7.5.3

This SR verifies that EFW can be delivered to the appropriate steam 

generator in the event of any accident or transient that generates a Steam 

and Feedwater Rupture Control System (SFRCS) signal by 

demonstrating that each automatic valve in the flow path actuates to its 

correct position on an actual or simulated actuation signal. This SR is not 

required for valves that are locked, sealed, or otherwise secured in 

position under administrative controls. The [18] month Frequency is 

based on the need to perform this Surveillance under the conditions that 

apply during a unit outage and the potential for an unplanned transient if 

the Surveillance were performed with the reactor at power. The 

[18] month Frequency is also acceptable based on operating experience 

and design reliability of the equipment. This SR is modified by a Note 

that states the SR is not required to be met in MODE 4. In MODE 4, the 

required AFW train is already aligned and operating. This SR is modified 

by [a] [two] Note[s]. [Note 1 indicates that the SR be deferred until 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

suitable test conditions are established. This deferral is required because 

there is insufficient steam pressure to perform the test.] [The] Note [2] 

states that the SR is not required to be met in MODE 4. [In MODE 4, the 

required pump is already operating and the autostart function is not 

required.] [In MODE 4, the heat removal requirements would be less 

providing more time for operator action to manually start the required 

AFW pump.] 

SR 3.7.5.4

This SR verifies that the turbine driven EFW pumps start in the event of 

any accident or transient that generates an SFRCS signal by 

demonstrating that each turbine driven EFW pump starts automatically on 

an actual or simulated actuation signal. These pumps are not required in 

MODE 4. The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a unit outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. This SR is modified by [a] [two] Note[s]. 

[Note 1 indicates that the SR be deferred until suitable test conditions are 

established. This deferral is required because there is insufficient steam 

pressure to perform the test.] [The] Note [2] states that the SR is not 

required to be met in MODE 4. [In MODE 4, the required pump is already 

operating and the autostart function is not required.] [In MODE 4, the 

heat removal requirements would be less providing more time for 

operator action to manually start the required AFW pump.] 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Some plants may not routinely use the AFW for heat removal in MODE 4. 

The second justification is provided for plants that use a startup feedwater 

pump rather than AFW for startup and shutdown. 

-------------------------------------------------------------------------------------------------- 

SR 3.7.5.5 

This SR ensures that the EFW System is properly aligned by verifying the 

flow paths to each steam generator prior to entering MODE 2 after more 

than 30 days in any combination of MODE 5 or 6, or defueled. 

OPERABILITY of EFW flow paths must be demonstrated before sufficient 

core heat is generated that would require the operation of the EFW 
EFW System 

B 3.7.5 

BWOG STS B 3.7.5-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

System during a subsequent shutdown. The Frequency is reasonable, 

based on engineering judgment, in view of other administrative controls to 

ensure that the flow paths are OPERABLE. To further ensure EFW 

System alignment, flow path OPERABILITY is verified, following 

extended outages to determine no misalignment of valves has occurred. 

This SR ensures that the flow path from the CST to the steam generator 

is properly aligned. (This SR is not required by those units that use EFW 

for normal startup and shutdown.) 

[ SR 3.7.5.6 and SR 3.7.5.7

For this facility, the CHANNEL FUNCTIONAL TEST and CHANNEL 

CALIBRATION for the EFW pump suction pressure interlocks are as 

follows: 

A successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. ] 

REFERENCES 1. FSAR, Section [9.2.7]. 

 2. FSAR, Section [9.2.8]. 

 3. ASME, Boiler and Pressure Vessel Code, Section XI. 
CST 

B 3.7.6 

BWOG STS B 3.7.6-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.6 Condensate Storage Tank (CST) 

BASES 

BACKGROUND The CST provides a safety grade source of water to the steam generators 

for removing decay and sensible heat from the Reactor Coolant System 

(RCS). The CST provides a passive flow of water, by gravity, to the 

Emergency Feedwater (EFW) System (LCO 3.7.5, "Emergency 

Feedwater (EFW) System"). The steam produced is released to the 

atmosphere by the main steam safety valves (MSSVs) or the atmospheric 

vent valves. 

When the main steam isolation valves are open, the preferred means of 

heat removal is to discharge to the condenser by the nonsafety grade 

path of the turbine bypass valves. The condensed steam is returned to 

the CST by the condensate pump. This has the advantage of conserving 

condensate while minimizing releases to the environment. 

Because the CST is a principal component in removing residual heat from 

the RCS, it is designed to withstand earthquakes and other natural 

phenomena, as well as missiles that might be generated by natural 

phenomena. The CST is designed to Seismic Category I to ensure 

availability of the feedwater supply. Feedwater is also available from an 

alternate source(s). 

A description of the CST is found in the FSAR, Section [9.2.60] (Ref. 1). 

APPLICABLE The CST provides cooling water to remove decay heat and cool down 

SAFETY the unit following all events in the accident analysis, as discussed in 

ANALYSES the FSAR, Chapters [6] and [15] (Refs. 2 and 3, respectively). For 

anticipated operational occurrences and accidents that do not affect the 

OPERABILITY of the steam generators, the analysis assumption is 

generally 30 minutes at MODE 3, steaming through the MSSVs, followed 

by a cooldown to decay heat removal (DHR) entry conditions at the 

design cooldown rate. 

The limiting event for the condensate volume is the large feedwater line 

break coincident with a loss of offsite power. Single failures that also 

affect this event include the following: 
CST 

B 3.7.6 

BWOG STS B 3.7.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

a. Failure of the diesel generator powering the motor driven EFW pump 

to the unaffected steam generator (requiring additional steam to drive 

the remaining EFW pump turbine) and 

b. Failure of the steam driven EFW pump (requiring a longer time for 

cooldown using only one motor driven EFW pump). 

These are not usually the limiting failures in terms of consequences for 

these events. 

The CST satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii). 

LCO To satisfy accident analysis assumptions, the [two] CSTs must contain 

sufficient cooling water to remove decay heat for 13 hours following a 

reactor trip from 102% RTP and then to cool down the RCS to DHR 

System entry conditions, assuming a coincident loss of offsite power and 

most adverse single failure. While so doing, the CSTs must retain 

sufficient water to ensure adequate net positive suction head for the EFW 

pump(s) during the cooldown, to account for any losses from the steam 

driven EFW pump turbine, as well as losses incurred before isolating 

EFW to a broken line. 

The level required is equivalent to a usable volume of [250,000] gallons, 

which is based on holding the unit in MODE 3 for 13 hours, followed by a 

cooldown to DHR System entry conditions. 

The OPERABILITY of the CST is determined by maintaining the tank 

level at or above the minimum required level. 

APPLICABILITY In MODES 1, 2, 3, and in MODE 4, when steam generator is being relied 

upon for heat removal, the CST is required to be OPERABLE. 

In MODES 5 and 6, the CST is not required because the EFW System is 

not required. 
CST 

B 3.7.6 

BWOG STS B 3.7.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1 and A.2

As an alternative to unit shutdown, the OPERABILITY of the backup 

water supply should be verified within 4 hours and once every 12 hours 

thereafter. The OPERABILITY of the backup feedwater supply must 

include verification, by administrative means, of the OPERABILITY of flow 

paths from the backup supply to the EFW pumps and availability of the 

required volume of water in the backup supply. The CST must be 

restored to OPERABLE status within 7 days because the backup supply 

may be performing this function in addition to its normal functions. The 

4 hour Completion Time is reasonable, based on operating experience, to 

verify the OPERABILITY of the backup water supply. Additionally, 

verifying the backup water supply every 12 hours is adequate to ensure 

the backup water supply continues to be available. The 7 day Completion 

Time is reasonable, based on an OPERABLE backup water supply being 

available, and the low probability of an event occurring during this time 

period, requiring the use of the water from the CST(s). 

B.1 and B.2

If the CST cannot be restored to OPERABLE status in the associated 

Completion Time, the unit must be placed in a MODE in which the LCO 

does not apply, with the DHR System in operation. To achieve this 

status, the unit must be placed in at least MODE 3 within 6 hours, and in 

MODE 4, without reliance on steam generators for heat removal, within 

[24] hours. This allows an additional 6 hours for the DHR System to be 

placed in service after entering MODE 4. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.6.1

REQUIREMENTS 

This SR verifies that the CST(s) contains the required volume of cooling 

water. The 12 hour Frequency is based on operating experience and the 

need for operator awareness of unit evolutions that may affect the CST 

inventory between checks. The 12 hour Frequency is considered 

adequate in view of other indications in the control room, including 

alarms, to alert the operator to abnormal deviations in CST levels. 
CST 

B 3.7.6 

BWOG STS B 3.7.6-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [9.2.6]. 

 2. FSAR, Chapter [6]. 

 3. FSAR, Chapter [15]. 
CCW System 

B 3.7.7 

BWOG STS B 3.7.7-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.7 Component Cooling Water (CCW) System 

BASES 

BACKGROUND The CCW System provides a heat sink for the removal of process and 

operating heat from safety related components during a Design Basis 

Accident (DBA) or transient. During normal operation, the CCW System 

also provides this function for various nonessential components, as well 

as the spent fuel pool. The CCW System serves as a barrier to the 

release of radioactive byproducts between potentially radioactive systems 

and the Service Water System, and thus to the environment. 

A typical CCW System is arranged as two independent full capacity 

cooling loops, and has isolatable nonsafety related components. Each 

safety related train includes a full capacity pump, surge tank, heat 

exchanger, piping, valves, and instrumentation. Each safety related train 

is powered from a separate bus. A surge tank in the system provides 

sufficient net positive suction head for each pump and isolation of 

nonessential components on a low tank level signal. The pump in each 

train is automatically started on receipt of a safety feature actuation 

signal, and all nonessential components are isolated. 

Additional information on the design and operation of the CCW System, 

along with a list of the components served, is presented in the FSAR, 

Section [9.2.2] (Ref. 1). The principal safety related function of the CCW 

System is the removal of decay heat from the reactor via the [decay heat 

removal (DHR) heat exchanger]. This may utilize the DHR System during 

a normal or post accident cooldown and shutdown, or during the 

recirculation phase following a loss of coolant accident. 

APPLICABLE The design basis of the CCW System is to provide cooling water to the 

SAFETY Emergency Core Cooling System and emergency diesel generators 

ANALYSES (EDGs) during DBA conditions. The CCW System also supplies cooling 

water to EDGs during a loss of offsite power. 

The CCW System is designed to perform its function with a single failure 

of any active component assuming a loss of offsite power. 

The CCW System also functions to cool the unit from [DHR] entry 

conditions (Tcold < [350]°F) to MODE 5 (Tcold < [200]°F) during normal and 

post accident operations. The time required to cool from [350]°F to 

[200]°F is a function of the number of CCW and [DHR] trains operating. 

One CCW train is sufficient to remove decay heat during subsequent 

operations with Tcold < [200]°F. 

The CCW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
CCW System 

B 3.7.7 

BWOG STS B 3.7.7-2 Rev. 3.0, 03/31/04 

BASES 

LCO The CCW trains are independent of each other to the degree that each 

has separate controls and power supplies and the operation of one train 

does not depend on the other. In the event of a DBA, one train of CCW is 

required to provide the minimum heat removal capability assumed in the 

safety analysis for systems to which it supplies cooling water. To ensure 

this is met, two CCW trains must be OPERABLE. At least one CCW train 

will operate assuming the worst case single active failure occurs 

coincident with loss of offsite power. 

A CCW train is considered OPERABLE when: 

a. It has an OPERABLE pump and associated surge tank and 

b. The associated piping, valves, heat exchanger, and instrumentation 

and controls required to perform the safety related function are 

OPERABLE. 

The isolation of CCW from other components or systems not required for 

safety may render these components or systems inoperable, but does not 

affect the OPERABILITY of the CCW System. 

APPLICABILITY In MODES 1, 2, 3, and 4, the CCW System is a normally operating 

system that must be prepared to perform its post accident safety 

functions, primarily Reactor Coolant System heat removal, by cooling the 

DHR heat exchanger. 

In MODES 5 and 6, the OPERABILITY requirements of the CCW System 

are determined by the systems it supports. 

ACTIONS A.1

Required Action A.1 is modified by a Note indicating that the applicable 

Conditions and Required Actions of LCO 3.8.1, "AC Sources - Operating," 

and LCO 3.4.6, "RCS Loops - MODE 4," should be entered if an 

inoperable CCW train results in an inoperable EDG or DHR loop. This is 

an exception to LCO 3.0.6 and ensures the proper actions are taken for 

these components. 

If one CCW train is inoperable, action must be taken to restore 

OPERABLE status within 72 hours. In this Condition, the remaining 

OPERABLE CCW train is adequate to perform the heat removal function. 

The 72 hour Completion Time is reasonable, based on the redundant 

capabilities afforded by the OPERABLE train, and the low probability of a 

DBA occurring during this period. 
CCW System 

B 3.7.7 

BWOG STS B 3.7.7-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

If the CCW train cannot be restored to OPERABLE status in the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours and in MODE 5 within 36 hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.7.1

REQUIREMENTS 

This SR is modified by a Note indicating that the isolation of the CCW 

flow to individual components may render those components inoperable, 

but does not affect the OPERABILITY of the CCW System. 

Verifying the correct alignment for manual, power operated, and 

automatic valves in the CCW flow path provides assurance that the 

proper flow paths exist for CCW operation. This SR does not apply to 

valves that are locked, sealed, or otherwise secured in position, since 

they are verified to be in the correct position prior to locking, sealing, or 

securing. This SR also does not apply to valves which cannot be 

inadvertently misaligned, such as check valves. This Surveillance does 

not require any testing or valve manipulation; rather, it involves 

verification that those valves capable of potentially being mispositioned 

are in their correct position. 

The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions. 

SR 3.7.7.2

This SR verifies proper automatic operation of the CCW valves on an 

actual or simulated actuation signal. The CCW System is a normally 

operating system that cannot be fully actuated as part of routine testing 

during normal operation. This SR is not required for valves that are 

locked, sealed, or otherwise secured in position under administrative 
CCW System 

B 3.7.7 

BWOG STS B 3.7.7-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

controls. The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency is acceptable from a 

reliability standpoint. 

SR 3.7.7.3

This SR verifies proper automatic operation of the CCW pumps on an 

actual or simulated actuation signal. The CCW System is a normally 

operating system that cannot be fully actuated as part of routine testing 

during normal operation. The [18] month Frequency is based on the need 

to perform this Surveillance under the conditions that apply during a plant 

outage and the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. Operating experience has 

shown that these components usually pass the Surveillance when 

performed at the [18] month Frequency. Therefore, the Frequency is 

acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [9.2.2]. 
SWS 

B 3.7.8 

BWOG STS B 3.7.8-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.8 Service Water System (SWS) 

BASES 

BACKGROUND The SWS provides a heat sink for the removal of process and operating 

heat from safety related components during a transient or Design Basis 

Accident (DBA) or transient. During normal operation and normal 

shutdown, the SWS also provides this function for various safety related 

and nonsafety related components. The safety related position is 

covered by this LCO. 

An SWS consists of two separate, 100% capacity safety related cooling 

water trains. Each train consists of a 100% capacity pump, one 

component cooling water (CCW) heat exchanger, piping, valving, and 

instrumentation. The pumps and valves are remote manually aligned, 

except in the unlikely event of a loss of coolant accident (LOCA). The 

pumps are automatically started upon receipt of a safety feature actuation 

signal, and all essential valves are aligned to their post accident positions. 

The SWS also provides cooling directly to the Control Room Emergency 

Ventilation System water cooled condensing unit, the Emergency Core 

Cooling System (ECCS) pump room coolers, containment air cooler, and 

turbine driven cooling water systems. The system provides cooling and is 

also a source of water to the ECCS pump and the emergency feedwater 

pumps, and can provide a source of makeup water to the cooling tower. 

Additional information about the design and operation of the SWS, along 

with a list of the components served, is presented in the FSAR, 

Section [9.2.1] (Ref. 1). The principal safety related function of the SWS 

is the removal of decay heat from the reactor via the [CCW System]. 

APPLICABLE The design basis of the SWS is for one SWS train, in conjunction with the 

SAFETY CCW System and a 100% capacity containment cooling system, 

ANALYSES (containment spray, containment air coolers, or a combination) to remove 

core decay heat following a design basis LOCA, as discussed in the 

FSAR, Section [6.2] (Ref. 2). This provides for a gradual reduction in the 

temperature of this fluid, as it is supplied to the Reactor Coolant System 

(RCS) by the safety injection pumps. 

The SWS is designed to perform its function with a single failure of any 

active component, assuming loss of offsite power. 
SWS 

B 3.7.8 

BWOG STS B 3.7.8-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The SWS, in conjunction with the CCW System, also cools the unit from 

Decay Heat Removal (DHR) System, as discussed in the FSAR, 

Section [6.3], (Ref. 3) entry conditions to MODE 5 during normal and post 

accident operation. The time required for this evolution is a function of 

the number of CCW and DHR System trains that are operating. One 

SWS train is sufficient to remove decay heat during subsequent 

operations in MODES 5 and 6. This assumes a maximum SWS 

temperature of [85]°F occurring simultaneously with maximum heat loads 

on the system. 

The SWS is also required when needed to support CCW in the removal of 

heat from the emergency diesel generators (EDGs) or reactor auxiliaries. 

The SWS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Two SWS trains are required to be OPERABLE to provide the required 

redundancy to ensure that the system functions to remove post accident 

heat loads, assuming the worst case single active failure occurs 

coincident with the loss of offsite power. 

An SWS train is considered OPERABLE when: 

a. It has an OPERABLE pump and 

b. The associated piping, valves, heat exchanger, and instrumentation 

and controls required to perform the safety related function are 

OPERABLE. 

APPLICABILITY In MODES 1, 2, 3, and 4, the SWS is a normally operating system that is 

required to support the OPERABILITY of the equipment serviced by the 

SWS and required to be OPERABLE in these MODES. 

In MODES 5 and 6, the OPERABILITY requirements of the SWS are 

determined by the systems it supports. 

ACTIONS A.1

If one SWS train is inoperable, action must be taken to restore 

OPERABLE status within 72 hours. In this Condition, the remaining 

OPERABLE SWS train is adequate to perform the heat removal function. 

However, the overall reliability is reduced because a single failure in the 
SWS 

B 3.7.8 

BWOG STS B 3.7.8-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

OPERABLE SWS train could result in loss of SWS function. Required 

Action A.1 is modified by two Notes. The first Note indicates that the 

applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources - 

Operating," should be entered if an inoperable SWS train results in an 

inoperable EDG. The second Note indicates that the applicable 

Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," 

should be entered if an inoperable SWS train results in an inoperable 

DHR train. The 72 hour Completion Time is based on the redundant 

capabilities afforded by the OPERABLE train, and the low probability of a 

DBA occurring during this period. 

B.1 and B.2

If the SWS train cannot be restored to OPERABLE status within the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.8.1

REQUIREMENTS 

Verifying the correct alignment for manual, power operated, and 

automatic valves in the SWS flow path provides assurance that the 

proper flow paths exist for SWS operation. This SR does not apply to 

valves that are locked, sealed, or otherwise secured in position, since 

they are verified to be in the correct position prior to locking, sealing, or 

securing. This SR does not require any testing or valve manipulation; 

rather, it involves verification that those valves capable of potentially 

being mispositioned are in the correct position. This SR also does not 

apply to valves that cannot be inadvertently misaligned, such as check 

valves. 

The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions. 

This SR is modified by a Note indicating that the isolation of the SWS 

components or systems may render those components inoperable but 

does not affect the OPERABILITY of the SWS. 
SWS 

B 3.7.8 

BWOG STS B 3.7.8-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.7.8.2

The SR verifies proper automatic operation of the SWS valves. The SWS 

is a normally operating system that cannot be fully actuated as part of the 

normal testing. This SR is not required for valves that are locked, sealed, 

or otherwise secured in position under administrative controls. The 

[18] month Frequency is based on the need to perform this Surveillance 

under the conditions that apply during a unit outage and the potential for 

an unplanned transient if the Surveillance were performed with the 

reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency is acceptable from a 

reliability standpoint. 

SR 3.7.8.3

The SR verifies proper automatic operation of the SWS pumps on an 

actual or simulated actuation signal. The SWS is a normally operating 

system that cannot be fully actuated as part of normal testing during 

normal operation. The [18] month Frequency is based on the need to 

perform this Surveillance under the conditions that apply during a unit 

outage and the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. Operating experience has 

shown that these components usually pass the Surveillance when 

performed at an [18] month Frequency. Therefore, the Frequency is 

acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [9.2.1]. 

 2. FSAR, Section [6.2]. 

 3. FSAR, Section [6.3]. 
UHS 

B 3.7.9 

BWOG STS B 3.7.9-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.9 Ultimate Heat Sink (UHS) 

BASES 

BACKGROUND The UHS provides a heat sink for process and operating heat from safety 

related components during a transient or accident as well as during 

normal operation. This is done utilizing the Service Water System (SWS). 

The UHS has been defined as that complex of water sources, including 

necessary retaining structures (e.g., a pond with its dam, or a river with its 

dam), and the canals or conduits connecting the sources with, but not 

including, the cooling water system intake structures, as discussed in the 

FSAR, Section [9.2.5] (Ref. 1). If cooling towers or portions thereof are 

required to accomplish the UHS safety functions, they should meet the 

same requirements as the sink. The two principal functions of the UHS 

are the dissipation of residual heat after a reactor shutdown, and 

dissipation of residual heat after an accident. 

A variety of complexes is used to meet the requirements for a UHS. A 

lake or an ocean may qualify as a single source. If the complex includes 

a water source contained by a structure, it is likely that a second source 

will be required. 

The basic performance requirements are that a 30 day supply of water be 

available, and that the design basis temperatures of safety related 

equipment not be exceeded. Basins of cooling towers generally include 

less than a 30 day supply of water, typically 7 days or less. A 30 day 

supply would be dependent on another source(s) and a makeup 

system(s) for replenishing the source in the cooling tower basin. For 

smaller basin sources, which may be as small as a 1 day supply, the 

systems for replenishing the basin and the backup source(s) become of 

sufficient importance that the makeup system itself may be required to 

meet the same design criteria as an Engineered Safety Feature (e.g., 

single failure considerations and multiple makeup water sources may be 

required). 

Additional information on the design and operation of the system, along 

with a list of components served, can be found in Reference 1. 
UHS 

B 3.7.9 

BWOG STS B 3.7.9-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The UHS is the sink for heat removal from the reactor core following all 

SAFETY accidents and anticipated operational occurrences in which the unit is 

ANALYSES cooled down and placed on [decay heat removal]. Its maximum post 

accident heat load occurs approximately 20 minutes after a design basis 

loss of coolant accident (LOCA). Near this time, the unit switches from 

injection to recirculation and the containment cooling systems are 

required to remove the core decay heat. 

The operating limits are based on conservative heat transfer analyses for 

the worst case LOCA. Reference 1 provides the details of the 

assumptions used in the analysis. These assumptions include: worst 

expected meteorological conditions, conservative uncertainties when 

calculating decay heat, and the worst case failure (e.g., single failure of a 

manmade structure). The UHS is designed in accordance with 

Regulatory Guide 1.27 (Ref. 2), which requires a 30 day supply of cooling 

water in the UHS. 

The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The UHS is required to be OPERABLE and is considered OPERABLE if 

[it contains a sufficient volume of water at or below the maximum 

temperature] that would allow the SWS to operate for at least 30 days 

following the design basis LOCA without the loss of net positive suction 

head (NPSH), and without exceeding the maximum design temperature 

of the equipment served by the SWS. To meet this condition, the UHS 

temperature should not exceed [90]°F, and the level should not fall below 

[562] ft [mean sea level] during normal unit operation. 

APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is a normally operating system that is 

required to support the OPERABILITY of the equipment serviced by the 

UHS and is required to be OPERABLE in these MODES. 

In MODES 5 and 6, the OPERABILITY requirements of the UHS are 

determined by the systems it supports. 

ACTIONS [ A.1

If one or more cooling towers have one fan inoperable (i.e., up to one fan 

per cooling tower inoperable), action must be taken to restore the 

inoperable cooling tower fan(s) to OPERABLE status within 7 days. 

The 7 day Completion Time is reasonable, based on the low probability of 

an accident occurring during the 7 days that one cooling tower fan is 

inoperable in one or more cooling towers, the number of available 

systems, and the time required to complete the Required Action. ]
UHS 

B 3.7.9 

BWOG STS B 3.7.9-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ B.1

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The [ ]°F is the maximum allowed UHS temperature value and is based 

on temperature limitations of the equipment that is relied upon for 

accident mitigation and safe shutdown of the unit. 

-------------------------------------------------------------------------------------------------- 

With water temperature of the UHS > [90]°F, the design basis assumption 

associated with initial UHS temperature is bounded provided the 

temperature of the UHS averaged over the previous 24 hour period is 

≥ [90]°F. With the water temperature of the UHS > [90]°F, long term 

cooling capability of the ECCS loads and DGs may be affected. 

Therefore, to ensure long term cooling capability is provided to the ECCS 

loads when water temperature of the UHS is > [90]°F, Required Action 

B.1 is provided to more frequently monitor the water temperature of the 

UHS and verify the temperature is ≤ [90]°F when averaged over the 

previous 24 hour period. The once per hour Completion Time takes into 

consideration UHS temperature variations and the increased monitoring 

frequency needed to ensure design basis assumptions and equipment 

limitations are not exceeded in this condition. If the water temperature of 

the UHS exceeds [90]°F when averaged over the previous 24 hour period 

or the water temperature of the UHS exceeds [ ]°F, Condition C must be 

entered immediately.]

[ C.1 and C.2

If the Required Actions and Completion Time of Condition [A or B] are not 

met, or the UHS is inoperable [for reasons other than Condition A or B], 

the unit must be placed in a MODE in which the LCO does not apply. To 

achieve this status, the unit must be placed in at least MODE 3 within 

6 hours and in MODE 5 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems. ] 

SURVEILLANCE [ SR 3.7.9.1

REQUIREMENTS 

This SR verifies that adequate long term (30 days) cooling can be 

maintained. The level specified also ensures NPSH is available for 

operating the SWS pumps. The 24 hour Frequency is based on 

operating experience related to the trending of the parameter variations 

during the applicable MODES. This SR verifies that the UHS water level 

is ≥ [ ] ft [mean sea level]. ]
UHS 

B 3.7.9 

BWOG STS B 3.7.9-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.7.9.2

This SR verifies that the SWS can cool the CCW System to at least its 

maximum design temperature within the maximum [ accident or normal 

heat loads for 30 days following a Design Basis Accident. The 24 hour 

Frequency is based on operating experience related to the trending of the 

parameter variations during the applicable MODES. This SR verifies that 

the UHS average water temperature is ≤ [90]°F. ]

[ SR 3.7.9.3

Operating each cooling tower fan for ≥ [15] minutes ensures that all fans 

are OPERABLE and that all associated controls are functioning properly. 

It also ensures that fan or motor failure, or excessive vibration, can be 

detected for corrective action. The 31 day Frequency is based on 

operating experience, known reliability of the fan units, the redundancy 

available, and the low probability of significant degradation of the UHS 

cooling tower fans occurring between surveillances. ] 

REFERENCES 1. FSAR, Section [9.2.5]. 

 2. Regulatory Guide 1.27. 
CREVS 

B 3.7.10 

BWOG STS B 3.7.10-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.10 Control Room Emergency Ventilation System (CREVS) 

BASES 

BACKGROUND The CREVS provides a protected environment from which operators can 

control the unit following an uncontrolled release of radioactivity[, 

chemicals, or toxic gas]. 

The CREVS consists of two independent, redundant, fan filter 

assemblies. Each filter train consists of a roughing filter, a high efficiency 

particulate air (HEPA) filter, and a charcoal filter. 

The CREVS is an emergency system. Upon receipt of the activating 

signal(s), the normal control room ventilation system is automatically shut 

down and the CREVS can be manually started. The roughing filters and 

water condensing units remove any large particles in the air, and any 

entrained water droplets present, to prevent excessive loading of the 

HEPA and charcoal filters. 

A single train will pressurize the control room with a 1.5 ft2

 LEAKAGE 

area to about 1/8 inch water gauge. The CREVS operation is discussed 

in the FSAR, Section [9.4] (Ref. 1). 

The CREVS is designed to maintain the control room for 30 days of 

continuous occupancy after a Design Basis Accident (DBA), without 

exceeding a 5 rem whole body dose or its equivalent to any part of the 

body. 

APPLICABLE The CREVS components are arranged in redundant safety related 

SAFETY ventilation trains. The location of components and ducting within the 

ANALYSES control room envelope ensures an adequate supply of filtered air to all 

areas requiring access. The CREVS provides airborne radiological 

protection for the control room operators as demonstrated by the control 

room accident dose analyses for the most limiting design basis loss of 

coolant accident fission product release presented in the FSAR, 

Chapter [15] (Ref. 2). 

The worst case single active failure of a CREVS component, assuming a 

loss of offsite power, does not impair the ability of the system to perform 

its design function. 

[ For this unit, there are no sources of toxic gases or chemicals that could 

be released to affect control room habitability. ] 

The CREVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
CREVS 

B 3.7.10 

BWOG STS B 3.7.10-2 Rev. 3.0, 03/31/04 

BASES 

LCO Two independent and redundant CREVS trains are required to be 

OPERABLE to ensure that at least one is available if a single failure 

disables the other train. Total system failure could result in exceeding a 

dose of 5 rem to the control room operators in the event of a large 

radioactive release. 

The CREVS is considered OPERABLE when the individual components 

necessary to control operator exposure are OPERABLE in both trains. A 

CREVS train is considered OPERABLE when the associated: 

a. Fan is OPERABLE, 

b. HEPA filter and charcoal absorber are not excessively restricting 

flow, and are capable of performing their filtration functions, and 

c. Heater, demister, ductwork, valves, and dampers are OPERABLE, 

and air circulation can be maintained. 

In addition, the control room boundary, including the integrity of the walls, 

floors, ceilings, ductwork, and access doors, must be maintained within 

the assumptions of the design analysis. 

The LCO is modified by a Note allowing the control room boundary to be 

opened intermittently under administrative controls. For entry and exit 

through doors, the administrative control of the opening is performed by 

the person(s) entering or exiting the area. For other openings, these 

controls consist of stationing a dedicated individual at the opening who is 

in continuous communication with the control room. This individual will 

have a method to rapidly close the opening when a need for control room 

isolation is indicated. 

APPLICABILITY In MODES 1, 2, 3, and 4, the CREVS must be OPERABLE to ensure that 

the control room will remain habitable during and following a DBA. 

During movement of [recently] irradiated fuel assemblies, the CREVS 

must be OPERABLE to cope with a release due to a fuel handling 

accident [involving handling recently irradiated fuel. Due to radioactive 

decay, CREVS is only required to mitigate fuel handling accidents 

involving handling recently irradiated fuel (i.e., fuel that has occupied part 

of a critical reactor core within the previous [X] days)]. 
CREVS 

B 3.7.10 

BWOG STS B 3.7.10-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With one CREVS train inoperable, action must be taken to restore 

OPERABLE status within 7 days. In this Condition, the remaining 

OPERABLE CREVS train is adequate to perform the control room 

radiation protection function. However, the overall reliability is reduced 

because a failure in the OPERABLE CREVS train could result in loss of 

CREVS function. The 7 day Completion Time is based on the low 

probability of a DBA occurring during this time period, and ability of the 

remaining train to provide the required capability. 

B.1

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Adoption of Condition B is dependent on a commitment from the licensee 

to have written procedures available describing compensatory measures 

to be taken in the event of an intentional or unintentional entry into 

Condition B. 

-------------------------------------------------------------------------------------------------- 

If the control room boundary is inoperable in MODE 1, 2, 3, or 4, the 

CREVS trains cannot perform their intended functions. Actions must be 

taken to restore an OPERABLE control room boundary within 24 hours. 

During the period that the control room boundary is inoperable, 

appropriate compensatory measures (consistent with the intent of GDC 

19) should be utilized to protect control room operators from potential 

hazards such as radioactive contamination, toxic chemicals, smoke, 

temperature and relative humidity, and physical security. Preplanned 

measures should be available to address these concerns for intentional 

and unintentional entry into the condition. The 24 hour Completion Time 

is reasonable based on the low probability of a DBA occurring during this 

time period, and the use of compensatory measures. The 24 hour 

Completion Time is a typically reasonable time to diagnose, plan and 

possibly repair, and test most problems with the control room boundary. 

C.1 and C.2

In MODE 1, 2, 3, or 4, if the inoperable CREVS train or control room 

boundary cannot be restored to OPERABLE status within the required 

Completion Time, the unit must be placed in a MODE in which the LCO 

does not apply. To achieve this status, the unit must be placed in at least 

MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 
CREVS 

B 3.7.10 

BWOG STS B 3.7.10-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ D.1 and D.2

In MODE 5 or 6, or] during movement of [recently] irradiated fuel 

assemblies, if the inoperable CREVS train cannot be restored to 

OPERABLE status within the required Completion Time, the OPERABLE 

CREVS train must immediately be placed in the emergency mode. This 

action ensures that the remaining train is OPERABLE, that no failures 

preventing automatic actuation will occur, and that any active failure will 

be readily detected. Required Action D.1 is modified by a Note indicating 

to place the system in the emergency mode if automatic transfer to 

emergency mode is inoperable. 

An alternative to Required Action D.1 is to immediately suspend activities 

that could release radioactivity that might require isolation of the control 

room. This places the unit in a condition that minimizes the accident risk. 

This does not preclude the movement of fuel to a safe position. ]

[ E.1

In MODE 5 or 6, or] during movement of [recently] irradiated fuel 

assemblies, when two CREVS trains are inoperable, action must be taken 

immediately to suspend activities that could release radioactivity that 

might require isolation of the control room. This places the unit in a 

condition that minimizes the accident risk. This does not preclude the 

movement of fuel to a safe position. ]

F.1

If both CREVS trains are inoperable in MODE 1, 2, 3, or 4 for reasons 

other than an inoperable control room boundary (i.e., Condition B), the 

CREVS may not be capable of performing the intended function and the 

unit is in a condition outside the accident analysis. Therefore, LCO 3.0.3 

must be entered immediately. 
CREVS 

B 3.7.10 

BWOG STS B 3.7.10-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.7.10.1

REQUIREMENTS 

Standby systems should be checked periodically to ensure that they 

function properly. As the environment and normal operating conditions 

on this system are not severe, testing each train once every month 

adequately checks this system. Monthly heater operations dry out any 

moisture that has accumulated in the charcoal because of humidity in the 

ambient air. [Systems with heaters must be operated for ≥ 10 continuous 

hours with the heaters energized. Systems without heaters need only be 

operated for ≥ 15 minutes to demonstrate the function of the system.] 

The 31 day Frequency is based on the known reliability of the equipment 

and the two train redundancy available. 

SR 3.7.10.2

This SR verifies that the required CREVS testing is performed in 

accordance with the [Ventilation Filter Testing Program (VFTP)]. The 

[VFTP] includes testing HEPA filter performance, charcoal absorber 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal. Specific test frequencies and additional information 

are discussed in detail in the [VFTP]. 

SR 3.7.10.3

This SR verifies that [each CREVS train starts] [or the control room 

isolates] and operates on an actual or simulated actuation signal. The 

Frequency of [18] months is consistent with that specified in Reference 3. 

SR 3.7.10.4

This SR verifies the integrity of the control room enclosure and the 

assumed inleakage rates of the potentially contaminated air. The control 

room positive pressure, with respect to potentially contaminated adjacent 

areas, is periodically tested to verify that the CREVS is functioning 

properly. During the emergency mode of operation, the CREVS is 

designed to pressurize the control room ≥ [0.125] inches water gauge 

positive pressure, with respect to adjacent areas, to prevent unfiltered 

inleakage. The CREVS is designed to maintain this positive pressure 

with one train at a flow rate of ≤ [3300] cfm. This value includes [300] cfm 

of outside air. The Frequency of [18] months on a STAGGERED TEST 

BASIS is consistent with industry practice and other filtration SRs. 
CREVS 

B 3.7.10 

BWOG STS B 3.7.10-6 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [9.4]. 

 2. FSAR, Chapter [15]. 

 3. Regulatory Guide 1.52, Rev. [2]. 
CREATCS 

B 3.7.11 

BWOG STS B 3.7.11-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.11 Control Room Emergency Air Temperature Control System (CREATCS) 

BASES 

BACKGROUND The CREATCS provides temperature control for the control room 

following isolation of the control room. 

The CREATCS consists of two independent and redundant trains that 

provide cooling of recirculated control room air. A cooling coil and a 

water cooled condensing unit are provided for each system to provide 

suitable temperature conditions in the control room for operating 

personnel and safety related control equipment. Ductwork, valves or 

dampers, and instrumentation also form part of the system. Two 

redundant air cooled condensing units are provided as a backup to the 

water cooled condensing unit. Both the water cooled and air cooled 

condensing units must be OPERABLE for the CREATCS to be 

OPERABLE. During emergency operation, the CREATCS maintains the 

temperature between 70°F and 85°F. The CREATCS is a subsystem 

providing air temperature control for the control room. 

The CREATCS is an emergency system. On detection of high 

containment building pressure or radiation, low Reactor Coolant System 

pressure, or high noble gas radioactivity in the station vent, the normal 

control room ventilation system is automatically shut down, and the 

Control Room Emergency Ventilation System can be manually started. A 

single train will provide the required temperature control. The CREATCS 

operation to maintain control room temperature is discussed in the FSAR, 

Section [9.4] (Ref. 1). 

APPLICABLE The design basis of the CREATCS is to maintain control room 

SAFETY temperature for 30 days of continuous occupancy. 

ANALYSES 

The CREATCS components are arranged in redundant, safety related 

trains. During emergency operation, the CREATCS maintains the 

temperature between [70]°F and [95]°F. A single active failure of a 

CREATCS component does not impair the ability of the system to perform 

as designed. The CREATCS is designed in accordance with Seismic 

Category I requirements. The CREATCS is capable of removing sensible 

and latent heat loads from the control room, including consideration of 

equipment heat loads and personnel occupancy requirements, to ensure 

equipment OPERABILITY. 

The CREATCS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
CREATCS 

B 3.7.11 

BWOG STS B 3.7.11-2 Rev. 3.0, 03/31/04 

BASES 

LCO Two independent and redundant trains of the CREATCS are required to 

be OPERABLE to ensure that at least one is available, assuming a single 

failure disables the other train. Total system failure could result in the 

equipment operating temperature exceeding limits in the event of an 

accident. 

The CREATCS is considered OPERABLE when the individual 

components that are necessary to maintain control room temperature are 

OPERABLE in both trains. These components include the cooling coils, 

water cooled condensing units, and associated temperature control 

instrumentation. In addition, the CREATCS must be OPERABLE to the 

extent that air circulation can be maintained. 

APPLICABILITY In MODES 1, 2, 3, 4, [5, and 6,] and during movement of [recently] 

irradiated fuel assemblies [i.e., fuel that has occupied part of a critical 

reactor core within the previous [X] days)], the CREATCS must be 

OPERABLE to ensure that the control room temperature will not exceed 

equipment OPERABILITY requirements following isolation of the control 

room. 

ACTIONS A.1

With one CREATCS train inoperable, action must be taken to restore 

OPERABLE status within 30 days. In this Condition, the remaining 

OPERABLE CREATCS train is adequate to maintain the control room 

temperature within limits. However, the overall reliability is reduced 

because a failure in the OPERABLE CREATCS train could result in a loss 

of CREATCS function. The 30 day Completion Time is based on the low 

probability of an event occurring requiring control room isolation, the 

consideration that the remaining train can provide the required 

capabilities, and the alternate safety or nonsafety related cooling means 

that are available. 

Concurrent failure of two CREATCS trains would result in the loss of 

function capability; therefore, LCO 3.0.3 must be entered immediately. 

B.1 and B.2

In MODE 1, 2, 3, or 4, if the inoperable CREATCS train cannot be 

restored to OPERABLE status within the required Completion Time, the 

unit must be placed in a MODE in which the LCO does not apply. To 

achieve this status, the unit must be placed in at least MODE 3 within 

6 hours, and in MODE 5 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner without 

challenging unit systems. 
CREATCS 

B 3.7.11 

BWOG STS B 3.7.11-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ C.1 and C.2

[In MODE 5 or 6, or] during movement of [recently] irradiated fuel, if the 

inoperable CREATCS train cannot be restored to OPERABLE status 

within the required Completion Time, the OPERABLE CREATCS train 

must be placed in operation immediately. This action ensures that the 

remaining train is OPERABLE, that no failures preventing automatic 

actuation will occur, and that any active failure will be readily detected. 

An alternative to Required Action C.1 is to immediately suspend activities 

that could release radioactivity that might require the isolation of the 

control room. This places the unit in a condition that minimizes accident 

risk. This does not preclude the movement of fuel to a safe position. ]

[ D.1

[In MODE 5 or 6, or] during movement of [recently] irradiated fuel 

assemblies, with two CREATCS trains inoperable, action must be taken 

to immediately suspend activities that could release radioactivity that 

might require isolation of the control room. This places the unit in a 

condition that minimizes accident risk. This does not preclude the 

movement of fuel to a safe position. ]

E.1

If both CREATCS trains are inoperable in MODE 1, 2, 3, or 4, the 

CREATCS may not be capable of performing the intended function and 

the unit is in a condition outside the accident analyses. Therefore, 

LCO 3.0.3 must be entered immediately. 

SURVEILLANCE SR 3.7.11.1

REQUIREMENTS 

This SR verifies that the heat removal capability of the system is sufficient 

to remove the heat load assumed in the [safety analyses]. This SR 

consists of a combination of testing and calculations. An [18] month 

Frequency is appropriate, as significant degradation of the CREATCS is 

slow and is not expected over this time period. 

REFERENCES 1. FSAR, Section [9.4]. 
EVS 

B 3.7.12 

BWOG STS B 3.7.12-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.12 Emergency Ventilation System (EVS) 

BASES 

BACKGROUND The EVS filters air from the area of the active Emergency Core Cooling 

System (ECCS) components during the recirculation phase of a loss of 

coolant accident (LOCA). 

The EVS consists of two independent, redundant trains. Each train 

consists of a prefilter, a high efficiency particulate air (HEPA) filter, an 

activated charcoal adsorber section for removal of gaseous activity 

(principally iodines), and a fan. Ductwork, valves or dampers, and 

instrumentation also form part of the system. The system initiates filtered 

ventilation of the Auxiliary Building negative pressure area following 

receipt of a safety features actuation signal (SFAS). 

The EVS is a standby system. During emergency operations, the EVS 

dampers are realigned, and fans are started to begin filtration. Upon 

receipt of the SFAS signal(s), normal air discharges from the negative 

pressure area are isolated, and the stream of ventilation air discharges 

through the system filter trains. The prefilters remove any large particles 

in the air, and any entrained water droplets present, to prevent excessive 

loading of the HEPA filters and charcoal adsorbers. 

The EVS is discussed in the FSAR, Sections [6.2.3], [9.4.2], and 15.4.6] 

(Refs. 1, 2, and 3, respectively). 

APPLICABLE The design basis of the EVS is established by the large break LOCA. 

SAFETY The system evaluation assumes a passive failure of the ECCS outside 

ANALYSES containment, such as an ECCS pump seal failure during the recirculation 

mode. In such a case, the system limits radioactive release to within 

10 CFR 100 (Ref. 4) requirements. The analysis of the effects and 

consequences of a large break LOCA is presented in Reference 3. The 

EVS also actuates following a small break LOCA, in those cases where 

the unit goes into the recirculation mode of long term cooling, and to 

cleanup releases of smaller leaks, such as from valve stem packing. 
EVS 

B 3.7.12 

BWOG STS B 3.7.12-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

Two types of system failures are considered in the accident analysis: 

complete loss of function, and excessive LEAKAGE. Either type of failure 

may result in a lower efficiency of removal of any gaseous and particulate 

activity released to the ECCS pump rooms following a LOCA. 

Following a LOCA, an ESFAS signal starts the EVS fans and opens the 

dampers located in the penetration room outlet ductwork. The ESFAS 

signal closes all containment isolation valves and purge system valves. 

The purge system fans, if running, are shut down automatically. 

The EVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Two independent and redundant trains of the EVS are required to be 

OPERABLE to ensure that at least one is available, assuming that a 

single failure disables the other train coincident with loss of offsite power. 

Total system failure could result in atmospheric release from the negative 

pressure area boundary exceeding Reference 4 limits in the event of a 

Design Basis Accident (DBA). 

The EVS is considered OPERABLE when the individual components 

necessary to maintain the negative pressure area boundary filtration are 

OPERABLE in both trains. 

An EVS train is considered OPERABLE when its associated: 

a. Fan is OPERABLE, 

b. HEPA filter and charcoal adsorber are not excessively restricting 

flow, and are capable of performing their filtration functions, and 

c. [Heater, demister,] ductwork, valves, and dampers are OPERABLE, 

and air circulation can be maintained. 

The LCO is modified by a Note allowing the Auxiliary Building negative 

pressure area boundary to be opened intermittently under administrative 

controls. For entry and exit through doors, the administrative control of 

the opening is performed by the person(s) entering or exiting the area. 

For other openings, these controls consist of stationing a dedicated 

individual at the opening who is in continuous communication with the 

control room. This individual will have a method to rapidly close the 

opening when a need for Auxiliary Building negative pressure area 

isolation is indicated. 
EVS 

B 3.7.12 

BWOG STS B 3.7.12-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1, 2, 3, and 4, the EVS is required to be OPERABLE 

consistent with the OPERABILITY requirements of the ECCS. 

In MODES 5 and 6, the EVS is not required to be OPERABLE since the 

ECCS is not required to be OPERABLE. 

ACTIONS A.1

With one EVS train inoperable, action must be taken to restore 

OPERABLE status within 7 days. During this time, the remaining 

OPERABLE train is adequate to perform the EVS safety function. 

However, the overall reliability is reduced because a single failure in the 

OPERABLE EVS train could result in loss of EVS function. 

The 7 day Completion Time is appropriate because the risk contribution is 

less than that of the ECCS (72 hour Completion Time), and this system is 

not a direct support system for the ECCS. The 7 day Completion Time is 

based on the low probability of a DBA occurring during this time period, 

and ability of the remaining train to provide the required capability. 

B.1

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Adoption of Condition B is dependent on a commitment from the licensee 

to have written procedures available describing compensatory measures 

to be taken in the event of an intentional or unintentional entry into 

Condition B. 

-------------------------------------------------------------------------------------------------- 

If the Auxiliary Building negative pressure area boundary is inoperable, 

the EVS trains cannot perform their intended functions. Actions must be 

taken to restore an OPERABLE Auxiliary Building negative pressure area 

boundary within 24 hours. During the period that the Auxiliary Building 

negative pressure area boundary is inoperable, appropriate 

compensatory measures [consistent with the intent, as applicable, of 

GDC 19, 63, 64 and 10 CFR Part 100] should be utilized to protect plant 

personnel from potential hazards such as radioactive contamination, toxic 

chemicals, smoke, temperature and relative humidity, and physical 

security. Preplanned measures should be available to address these 

concerns for intentional and unintentional entry into the condition. The 

24 hour Completion Time is reasonable based on the low probability of a 

DBA occurring during this time period, and the use of compensatory 

measures. The 24 hour Completion Time is a typically reasonable time to 

diagnose, plan and possibly repair, and test most problems with the 

Auxiliary Building negative pressure area boundary. 
EVS 

B 3.7.12 

BWOG STS B 3.7.12-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

If the EVS train or the Auxiliary Building negative pressure area boundary 

cannot be restored to OPERABLE status within the associated 

Completion Time, the unit must be placed in a MODE in which the LCO 

does not apply. To achieve this status, the unit must be placed in at least 

MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.12.1

REQUIREMENTS 

Standby systems should be checked periodically to ensure that they 

function properly. Since the environment and normal operating conditions 

on this system are not severe, testing each train once a month provides 

an adequate check on this system. Monthly heater operations dry out 

any moisture that may have accumulated in the charcoal from humidity in 

the ambient air. [Systems with heaters must be operated ≥ 10 continuous 

hours with the heaters energized. Systems without heaters need only be 

operated for ≥ 15 minutes to demonstrate the function of the system.] 

The 31 day Frequency is based on known reliability of equipment and the 

two train redundancy available. 

SR 3.7.12.2

This SR verifies that the required EVS testing is performed in accordance 

with the [Ventilation Filter Testing Program (VFTP)]. The [VFTP] includes 

testing HEPA filter performance, charcoal adsorber efficiency, minimum 

system flow rate, and the physical properties of the activated charcoal 

(general use and following specific operations). Specific test frequencies 

and additional information are discussed in detail in the [VFTP]. 

SR 3.7.12.3

This SR verifies that each EVS train starts and operates on an actual or 

simulated actuation signal. The [18] month Frequency is consistent with 

that specified in Reference 5. 
EVS 

B 3.7.12 

BWOG STS B 3.7.12-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.7.12.4

This SR verifies the integrity of the negative pressure boundary area. 

The ability of the EVS to maintain a negative pressure, with respect to 

potentially uncontaminated adjacent areas, is periodically tested to verify 

proper functioning of the EVS. During the [post accident] mode of 

operation, the EVS is designed to maintain a slight negative pressure in 

the negative pressure boundary area with respect to adjacent areas to 

prevent unfiltered LEAKAGE. The EVS is designed to maintain this 

negative pressure at a flow rate of [3000] cfm from the negative pressure 

boundary area. The Frequency of [18] months on a STAGGERED TEST 

BASIS is consistent with industry practice and other filtration SRs. 

[ SR 3.7.12.5

Operating the EVS filter bypass damper is necessary to ensure that the 

system functions properly. The OPERABILITY of the EVS filter bypass 

damper is verified if it can be closed. An [18] month Frequency is 

consistent with that specified in Reference 5. ] 

REFERENCES 1. FSAR, Section [6.2.3]. 

 2. FSAR, Section [9.4.2]. 

 3. FSAR, Section [15.4.6]. 

 4. 10 CFR 100.11. 

 5. Regulatory Guide 1.52, Rev. [2]. 
FSPVS 

B 3.7.13 

BWOG STS B 3.7.13-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.13 Fuel Storage Pool Ventilation System (FSPVS) 

BASES 

BACKGROUND The FSPVS provides negative pressure in the fuel storage area, and 

filters airborne radioactive particulates from the area of the fuel pool 

following a fuel handling accident. 

The FSPVS consists of portions of the normal Fuel Handling Area 

Ventilation System (FHAVS), the station Emergency Ventilation System 

(EVS), ductwork bypasses, and dampers. The portion of the normal 

FHAVS used by the FSPVS consists of ducting between the spent fuel 

pool and the normal FHAVS exhaust fans or dampers, and redundant 

radiation detectors installed close to the suction end of the FHAVS 

exhaust fan ducting. The portion of the EVS used by the FSPVS consists 

of two independent, redundant trains. Each train consists of a heater, 

prefilter, or high efficiency particulate air (HEPA) filter, activated charcoal 

adsorber section for removal of gaseous activity (principally iodines), and 

fan. Ductwork, valves or dampers, and instrumentation also form part of 

the system. Two isolation valves are installed in series in the ductwork 

between the FHAVS and the EVS to provide isolation of the EVS from the 

FHAVS on an Engineered Safety Feature actuation signal. These valves 

are opened prior to fuel handling operations [involving handling recently 

irradiated fuel]. The EVS is the subject of LCO 3.7.12, "Emergency 

Ventilation System (EVS)," and is fully described in the FSAR, 

Section [6.2.3], Reference 12. A ductwork bypass with redundant 

dampers connects the FHAVS to the EVS. 

During normal operation, the exhaust from the fuel handling area is 

passed through the FHAVS exhaust filter and is discharged through the 

station vent stack. In the event of a fuel handling accident, the radiation 

detectors (one per EVS train), located at the suction of the FHAVS 

exhaust fan ducting, send signals to isolate the FHAVS supply and 

exhaust fans and ductwork, open the redundant dampers in the bypass 

ductwork, and start the EVS fans. The EVS fans pull the air from the fuel 

handling area, creating a negative pressure, and discharge the filtered air 

to the station vent. 

The FHAVS is discussed in the FSAR, Sections [6.2.3], [9.4.2], 

and [15.4.7] (Refs. 1, 2, and 3, respectively), because it may be used for 

normal as well as post accident, atmospheric cleanup functions. 
FSPVS 

B 3.7.13 

BWOG STS B 3.7.13-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The FSPVS design basis is established by the consequences of the 

SAFETY limiting Design Basis Accident (DBA), which is a fuel handling accident 

ANALYSES [involving handling recently irradiated fuel]. The analysis of the fuel 

handling accident, given in Reference 3, assumes that a certain number 

of fuel rods in an assembly are damaged. The DBA analysis of the fuel 

handling accident [involving handling recently irradiated fuel] assumes 

that only one train of the FSPVS is functional due to a single failure that 

disables the other train. The accident analysis accounts for the reduction 

in airborne radioactive material provided by the remaining one train of this 

filtration system. These assumptions and the analysis follow the 

guidance provided in Regulatory Guide 1.25 (Ref. 4). 

The FSPVS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO [Two] independent and redundant trains of the FSPVS are required to be 

OPERABLE to ensure that at least one is available, assuming a single 

failure that disables the other train coincident with a loss of offsite power. 

Total system failure could result in the atmospheric release from the fuel 

handling area exceeding 10 CFR 100 (Ref. 5) limits in the event of a fuel 

handling accident [involving handling recently irradiated fuel]. 

The FSPVS is considered OPERABLE when the individual components 

necessary to control operator exposure in the fuel handling building are 

OPERABLE in both trains. An FSPVS train is considered OPERABLE 

when its associated: 

1. Fan is OPERABLE, 

2. HEPA filter and charcoal adsorber are not excessively restricting 

flow, and are capable of performing their filtration functions, and 

3. [Heater, demister,] ductwork, valves, and dampers are OPERABLE, 

and air circulation can be maintained. 

The LCO is modified by a Note allowing the fuel building boundary to be 

opened intermittently under administrative controls. For entry and exit 

through doors, the administrative control of the opening is performed by 

the person(s) entering or exiting the area. For other openings, these 

controls consist of stationing a dedicated individual at the opening who is 

in continuous communication with the control room. This individual will 

have a method to rapidly close the opening when a need for fuel building 

isolation is indicated. 
FSPVS 

B 3.7.13 

BWOG STS B 3.7.13-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY [ In [MODES 1, 2, 3, and 4,] the FSPVS is required to be OPERABLE to 

provide fission product removal associated with ECCS leaks due to a loss 

of coolant accident (refer to LCO 3.7.12) for units that use this system as 

part of their EVSs. 

During movement of [recently] irradiated fuel assemblies in the fuel 

handling area, the FSPVS is always required to be OPERABLE to 

mitigate the consequences of a fuel handling accident. 

In MODES 5 and 6, the FSPVS is not required to be OPERABLE since 

the ECCS is not required to be OPERABLE. ] 

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily. 

A.1

With one FSPVS train inoperable, action must be taken to restore 

OPERABLE status within 7 days. During this time period, the remaining 

OPERABLE train is adequate to perform the FSPVS function. However, 

the overall reliability is reduced because a single failure in the 

OPERABLE FSPVS train could result in a loss of FSPVS functioning. 

The 7 day Completion Time is based on the risk from an event occurring 

requiring the inoperable FSPVS train, and ability of the remaining FSPVS 

train to provide the required protection. 

B.1

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Adoption of Condition B is dependent on a commitment from the licensee 

to have written procedures available describing compensatory measures 

to be taken in the even of an intentional or unintentional entry into 

Condition B. 

-------------------------------------------------------------------------------------------------- 
FSPVS 

B 3.7.13 

BWOG STS B 3.7.13-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

If the fuel building boundary is inoperable in MODE 1, 2, 3, or 4, the 

FSPVS trains cannot perform their intended functions. Actions must be 

taken to restore an OPERABLE fuel building boundary within 24 hours. 

During the period that the fuel building boundary is inoperable, 

appropriate compensatory measures [consistent with the intent, as 

applicable, of GDC 19, 60, 61, 63, 64 and 10 CFR 100] should be utilized 

to protect plant personnel from potential hazards such as radioactive 

contamination, toxic chemicals, smoke, temperature and relative 

humidity, and physical security. Preplanned measures should be 

available to address these concerns for intentional and unintentional entry 

into the condition. The 24 hour Completion Time is reasonable based on 

the low probability of a DBA occurring during this time period, and the use 

of compensatory measures. The 24 hour Completion Time is a typically 

reasonable time to diagnose, plan and possibly repair, and test most 

problems with the fuel building boundary. 

[ C.1 and C.2

In MODE 1, 2, 3, or 4, when Required Action A.1 or B.1 cannot be 

completed within the associated Completion Time, or when both FSPVS 

trains are inoperable for reasons other than an inoperable fuel building 

boundary (i.e., Condition B), the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. ]

D.1 and D.2

If the inoperable FSPVS train cannot be restored to OPERABLE status 

within the required Completion Time, during movement of [recently] 

irradiated fuel assemblies in the fuel building the OPERABLE FSPVS 

train must be started immediately or [recently] irradiated fuel movement 

suspended. This action ensures that the remaining train is OPERABLE, 

that no undetected failures preventing system operation will occur, and 

that any active failures will be readily detected. 

If the system is not placed in operation, this action requires suspension of 

[recently] irradiated fuel movement, which precludes a fuel handling 

accident [involving handling recently irradiated fuel]. This action does not 

preclude the movement of fuel assemblies to a safe position. 
FSPVS 

B 3.7.13 

BWOG STS B 3.7.13-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1

When two trains of the FSPVS are inoperable during movement of 

[recently] irradiated fuel assemblies in the fuel building, the unit must be 

placed in a condition in which the LCO does not apply. This LCO 

involves immediately suspending movement of [recently] irradiated fuel 

assemblies in the fuel building. This does not preclude the movement of 

fuel to a safe position. 

SURVEILLANCE [ SR 3.7.13.1

REQUIREMENTS 

Standby systems should be checked periodically to ensure that they 

function properly. As the environment and normal operating conditions 

on this system are not severe, testing each train once every month 

provides an adequate check on this system. Monthly heater operation 

dries out any moisture accumulated in the charcoal from humidity in the 

ambient air. [Systems with heaters must be operated for ≥ 10 continuous 

hours with the heaters energized. Systems without heaters need only be 

operated for ≥ 15 minutes to demonstrate the function of the system.] 

The 31 day Frequency is based on the known reliability of the equipment 

and the two train redundancy available. ]

[ SR 3.7.13.2

This SR verifies that the required FSPVS testing is performed in 

accordance with the [Ventilation Filter Testing Program (VFTP)]. The 

[VFTP] includes testing HEPA filter performance, charcoal adsorber 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal (general use and following specific operations). 

Specific test frequencies and additional information are discussed in 

detail in the [VFTP]. ]

[ SR 3.7.13.3

This SR verifies that each FSPVS train starts and operates on an actual 

or simulated actuation signal. The 18 month Frequency is consistent with 

that specified in Reference 6. ]
FSPVS 

B 3.7.13 

BWOG STS B 3.7.13-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.7.13.4

This SR verifies the integrity of the fuel handling area. The ability of the 

fuel handling area to maintain a negative pressure, with respect to 

potentially uncontaminated adjacent areas, is periodically tested to verify 

proper function of the FSPVS. During the [post accident] mode of 

operation, the FSPVS is designed to maintain a slight negative pressure 

in the fuel handling area to prevent unfiltered LEAKAGE. The FSPVS is 

designed to maintain this negative pressure at a flow rate of ≤ [3000] cfm 

to the fuel handling area. The Frequency of [18] months on a 

STAGGERED TEST BASIS is consistent with industry practice. 

SR 3.7.13.5

Operating the FSPVS filter bypass damper is necessary to ensure that 

the system functions properly. The OPERABILITY of the FSPVS filter 

bypass damper is verified if it can be opened. A Frequency of 

[18] months is specified in Reference 6. 

REFERENCES 1. FSAR, Section [6.2.3]. 

 2. FSAR, Section [9.4.2]. 

 3. FSAR, Section [15.4.7]. 

 4. Regulatory Guide 1.25. 

 5. 10 CFR 100.11. 

 6. Regulatory Guide 1.52, Rev. [2]. 
Fuel Storage Pool Water Level 

B 3.7.14 

BWOG STS B 3.7.14-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.14 Fuel Storage Pool Water Level 

BASES 

BACKGROUND The minimum water level in the fuel storage pool meets the assumption of 

iodine decontamination factors following a fuel handling accident. The 

specified water level shields and minimizes the general area dose when 

the storage racks are filled to their maximum capacity. The water also 

provides shielding during the movement of spent fuel. 

A general description of the fuel storage pool design is given in the FSAR, 

Section [9.1.2], Reference 1. The Spent Fuel Pool Cooling and Cleanup 

System is given in the FSAR, Section [9.1.3] (Ref. 2). The assumptions 

of the fuel handling accident are given in the FSAR, Section [15.4.7] 

(Ref. 3). 

APPLICABLE The minimum water level in the fuel storage pool meets the assumptions 

SAFETY of the fuel handling accident described in Regulatory Guide 1.25 (Ref. 4). 

ANALYSES The resultant 2 hour thyroid dose to a person at the exclusion area 

boundary is below 10 CFR 100 (Ref. 5) guidelines. 

According to Reference 4, there is 23 ft of water between the top of the 

damaged fuel bundle and the fuel pool surface for a fuel handling 

accident. With 23 ft, the assumptions of Reference 4 can be used 

directly. In practice, the LCO preserves this assumption for the bulk of 

the fuel in the storage racks. In the case of a single bundle dropped and 

lying horizontally on top of the spent fuel rack, however, there may be 

< 23 ft above the top of the fuel bundle and the surface, by the width of 

the bundle. To offset this small nonconservatism, the analysis assumes 

that all fuel rods fail, although the analysis shows that only the first [few] 

rows fail from a hypothetical maximum drop. 

The fuel storage pool water level satisfies Criteria 2 and 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The specified water level preserves the assumptions of the fuel handling 

accident analysis (Ref. 3). As such, it is the minimum required for fuel 

storage and movement within the fuel storage pool. 

APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the 

fuel storage pool since the potential for a release of fission products 

exists. 
Fuel Storage Pool Water Level 

B 3.7.14 

BWOG STS B 3.7.14-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does 

not apply. 

When the initial conditions for an accident cannot be met, immediate 

action must be taken to preclude the occurrence of an accident. With the 

fuel storage pool at less than the required level, the movement of fuel 

assemblies in the fuel storage pool is immediately suspended. This 

effectively precludes the occurrence of a fuel handling accident. In such 

a case, unit procedures control the movement of loads over the spent 

fuel. This does not preclude movement of a fuel assembly to a safe 

position. 

If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 

would not specify any action. If moving irradiated fuel assemblies while in 

MODES 1, 2, 3, and 4, the fuel movement is independent of reactor 

operations. Therefore, in either case, inability to suspend movement of 

irradiated fuel assemblies is not sufficient reason to require a reactor 

shutdown. 

SURVEILLANCE SR 3.7.14.1

REQUIREMENTS 

This SR verifies that sufficient fuel storage pool water is available in the 

event of a fuel handling accident. The water level in the fuel storage pool 

must be checked periodically. The 7 day Frequency is appropriate 

because the volume in the pool is normally stable. Water level changes 

are controlled by unit procedures and are acceptable, based on operating 

experience. 

During refueling operations, the level in the fuel storage pool is at 

equilibrium with that in the refueling canal, and the level in the refueling 

canal is checked daily in accordance with SR 3.9.6.1. 

REFERENCES 1. FSAR, Section [9.1.2]. 

 2. FSAR, Section [9.1.3]. 

 3. FSAR, Section [15.4.7]. 

 4. Regulatory Guide 1.25. 

 5. 10 CFR 100.11. 
 [Spent Fuel Pool Boron Concentration] 

B 3.7.15 

BWOG STS B 3.7.15-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.15 [ Spent Fuel Pool Boron Concentration ] 

BASES 

BACKGROUND As described in the following LCO 3.7.16, "Spent Fuel Assembly 

Storage," fuel assemblies are stored in the spent fuel pool racks [in a 

"checkerboard" pattern] in accordance with criteria based on [initial 

enrichment and discharge burnup]. Although the water in the spent fuel 

pool is normally borated to ≥ [500] ppm, the criteria that limit the storage 

of a fuel assembly to specific rack locations are conservatively developed 

without taking credit for boron. 

APPLICABLE A fuel assembly could be inadvertently loaded into a spent fuel rack 

SAFETY location not allowed by LCO 3.7.16 (e.g., an unirradiated fuel assembly 

ANALYSES or an insufficiently depleted fuel assembly). This accident is analyzed 

assuming the extreme case of completely loading the spent fuel pool 

racks with unirradiated assemblies of maximum enrichment. Another 

type of postulated accident is associated with a fuel assembly that is 

dropped onto the fully loaded spent fuel pool storage rack. Either incident 

could have a positive reactivity effect, decreasing the margin to criticality. 

However, the negative reactivity effect of the soluble boron compensates 

for the increased reactivity caused by either one of the two postulated 

accident scenarios. 

The concentration of dissolved boron in the fuel storage pool satisfies 

Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The specified concentration [≤ [500] ppm] of dissolved boron in the fuel 

storage pool preserves the assumption used in the analyses of the 

potential accident scenarios described above. This concentration of 

dissolved boron is the minimum required concentration for fuel assembly 

storage and movement within the fuel storage pool. 

APPLICABILITY This LCO applies whenever fuel assemblies are stored in the spent fuel 

pool, until a complete spent fuel pool verification has been performed 

following the last movement of fuel assemblies in the spent fuel pool. 

This LCO does not apply following the verification since the verification 

would confirm that there are no misloaded fuel assemblies. With no 

further fuel assembly movement in progress, there is no potential for a 

misloaded fuel assembly or a dropped fuel assembly. 
 [Spent Fuel Pool Boron Concentration] 

B 3.7.15 

BWOG STS B 3.7.15-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1, A.2.1, and A.2.2

The Required Actions are modified by a Note indicating that LCO 3.0.3 

does not apply. 

When the concentration of boron in the fuel storage pool is less than 

required, immediate action must be taken to preclude the occurrence of 

an accident or to mitigate the consequences of an accident in progress. 

This is most efficiently achieved by immediately suspending the 

movement of the fuel assemblies. This does not preclude movement of a 

fuel assembly to a safe position. The concentration of boron is restored 

simultaneously with suspending movement of the fuel assemblies. 

Alternatively, beginning a verification of the spent fuel pool locations, to 

ensure proper locations of the fuel, can be performed. However, prior to 

resuming movement of fuel assemblies, the concentration of boron must 

be restored. 

If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 

would not specify any action. If moving irradiated fuel assemblies while in 

MODE 1, 2, 3, or 4, the fuel movement is independent of reactor 

operation. Therefore, inability to suspend movement of fuel assemblies is 

not a sufficient reason to require a reactor shutdown. 

SURVEILLANCE This SR verifies that the concentration of boron in the fuel storage pool 

REQUIREMENTS is within the required limit. As long as this SR is met, the analyzed 

incidents are fully addressed. The 7 day Frequency is appropriate 

because no major replenishment of pool water is expected to take place 

over a short period of time. 

REFERENCES None. 
 [Spent Fuel Pool Storage] 

B 3.7.16 

BWOG STS B 3.7.16-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.16 [ Spent Fuel Pool Storage ] 

BASES 

BACKGROUND The spent fuel storage facility is designed to store either new 

(nonirradiated) nuclear fuel assemblies, or burned (irradiated) fuel 

assemblies in a vertical configuration underwater. The storage pool is 

sized to store [735] fuel assemblies, which includes storage for [15] failed 

fuel containers. The spent fuel storage cells are installed in parallel rows 

with center to center spacing of [12 31/32] inches in one direction, and 

[13 3/16] inches in the other orthogonal direction. This spacing and "flux 

trap" construction, whereby the fuel assemblies are inserted into neutron 

absorbing stainless steel cans, is sufficient to maintain a keff of ≤ 0.95 for 

spent fuel of original enrichment of up to [3.3]%. However, as higher 

initial enrichment fuel assemblies are stored in the spent fuel pool, they 

must be stored in a checkerboard pattern taking into account fuel burnup 

to maintain a keff of 0.95 or less. 

APPLICABLE The spent fuel storage facility is designed for noncriticality by use of 

SAFETY adequate spacing, and "flux trap" construction whereby the fuel 

ANALYSES assemblies are inserted into neutron absorbing stainless steel cans. 

The spent fuel pool storage satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The restrictions on the placement of fuel assemblies within the fuel pool, 

according to Figure [3.7.16-1] in the accompanying LCO, ensure that the 

keff of the spent fuel pool will always remain < 0.95 assuming the pool to 

be flooded with unborated water. The restrictions are consistent with the 

criticality safety analysis performed for the spent fuel pool, according to 

Figure [3.7.16-1]. Fuel assemblies not meeting the criteria of 

Figure [3.7.16-1] shall be stored in accordance with Specification 4.3.1.1. 

APPLICABILITY This LCO applies whenever any fuel assembly is stored in [Region 2] of 

the spent fuel pool. 
 [Spent Fuel Pool Storage] 

B 3.7.16 

BWOG STS B 3.7.16-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does 

not apply. 

When the configuration of fuel assemblies stored in the spent fuel pool is 

not in accordance with Figure [3.7.16-1], immediate action must be taken 

to make the necessary fuel assembly movement(s) to bring the 

configuration into compliance with Figure [3.7.16-1]. 

If moving fuel assemblies while in MODE 5 or 6, LCO 3.0.3 would not 

specify any action. If moving fuel assemblies while in MODE 1, 2, 3, or 4, 

the fuel movement is independent of reactor operation. Therefore, in 

either case, inability to move fuel assemblies is not sufficient reason to 

require a reactor shutdown. 

SURVEILLANCE SR 3.7.16.1

REQUIREMENTS 

This SR verifies by administrative means that the initial enrichment and 

burnup of the fuel assembly is in accordance with Figure [3.7.16-1] in the 

accompanying LCO. For fuel assemblies in the unacceptable range of 

[Figure 3.7.16-1], performance of the SR will ensure compliance with 

Specification 4.3.1.1. 

REFERENCES None. 
Secondary Specific Activity 

B 3.7.17 

BWOG STS B 3.7.17-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.17 Secondary Specific Activity 

BASES 

BACKGROUND Activity in the secondary coolant results from steam generator tube outLEAKAGE from the Reactor Coolant System (RCS). Under steady state 

conditions, the activity is primarily iodines with relatively short half lives 

and, thus, indicative of current conditions. During transients, I-131 spikes 

have been observed, as well as increased releases of some noble gases. 

Other fission product isotopes, as well as activated corrosion products, in 

lesser amounts, may also be found in the secondary coolant. 

A limit on secondary coolant specific activity during power operation 

minimizes releases to the environment because of normal operation, 

anticipated operational occurrences, and accidents. 

This limit is lower than the activity value that might be expected from a 

1 gpm tube leak (LCO 3.4.13, "RCS Operational Leakage") of primary 

coolant at the limit of 1.0 μCi/gm (LCO 3.4.16, "RCS Specific Activity"). 

The steam line failure is assumed to result in the release of the noble gas 

and iodine activity contained in the steam generator inventory, the 

feedwater, and the reactor coolant leakage. Most of the iodine isotopes 

have short half lives (i.e., < 20 hours). 

With the specified activity limit, the resultant 2 hour thyroid dose to a 

person at the exclusion area boundary (EAB) would be about 0.79 rem if 

the main steam safety valves (MSSVs) are open for the 2 hours following 

a trip from full power. 

Operating a unit at the allowable limits could result in a 2 hour EAB 

exposure of a small fraction of the 10 CFR 100 (Ref. 1) limits, or the limits 

established as the NRC staff approved licensing basis. 

APPLICABLE The accident analysis of the main steam line break, as discussed in the 

SAFETY FSAR, Chapter [15] (Ref. 2) assumes the initial secondary coolant 

ANALYSES specific activity to have a radioactive isotope concentration of 0.1 μCi/gm 

DOSE EQUIVALENT I-131. This assumption is used in the analysis for 

determining the radiological consequences of the postulated accident. 

The accident analysis, based on this and other assumptions, shows that 

the radiological consequences of an MSLB do not exceed established 

limits, (Ref. 1) for whole body and thyroid dose rates. 
Secondary Specific Activity 

B 3.7.17 

BWOG STS B 3.7.17-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

With a loss of offsite power, the remaining steam generator is available 

for core decay heat dissipation by venting steam to the atmosphere 

through the MSSVs and steam generator atmospheric dump valves 

(ADVs). The Emergency Feedwater System supplies the necessary 

makeup to the steam generator. Venting continues until the reactor 

coolant temperature and pressure has decreased sufficiently for the 

Shutdown Cooling System to complete the cooldown. 

In the evaluation of the radiological consequences of this accident, the 

activity released from the steam generator connected to the failed steam 

line is assumed to be released directly to the environment. The 

unaffected steam generator is assumed to discharge steam and any 

entrained activity through the MSSVs and ADVs during the event. Since 

no credit is taken in the analysis for activity plateout or retention, the 

resultant radiological consequences represent a conservative estimate of 

the potential integrated dose due to the postulated steam line failure. 

Secondary specific activity limits satisfy Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO As indicated in the Applicable Safety Analyses, the specific activity limit in 

the secondary coolant system of ≤ [0.10] μ Ci/gm DOSE EQUIVALENT 

I-131 maintains the radiological consequences of a Design Basis 

Accident (DBA) to a small fraction of Reference 1 limits. 

Monitoring the specific activity of the secondary coolant ensures that, 

when secondary specific activity limits are exceeded, appropriate actions 

are taken, in a timely manner, to place the unit in an operational MODE 

that would minimize the radiological consequences of a DBA. 

APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply 

due to the potential for secondary steam releases to the atmosphere. 

In MODES 5 and 6, the steam generators are not being used for heat 

removal. Both the RCS and steam generators are at low pressure and 

primary to secondary LEAKAGE is minimal. Therefore, monitoring of 

secondary specific activity is not required. 
Secondary Specific Activity 

B 3.7.17 

BWOG STS B 3.7.17-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1 and A.2

DOSE EQUIVALENT I-131 exceeding the allowable value in the 

secondary coolant contributes to increased post accident doses. If 

secondary specific activity cannot be restored to within limits within the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours, and in MODE 5 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.17.1

REQUIREMENTS 

This SR verifies that the secondary specific activity is within the limits of 

the accident analysis. A gamma isotopic analysis of the secondary 

coolant, which determines DOSE EQUIVALENT I-131, confirms the 

validity of the safety analysis assumptions as releases. It also serves to 

identify and trend any unusual isotopic concentrations that might indicate 

changes in reactor coolant activity or LEAKAGE. The 31 day Frequency 

is based on the detection of increasing trends of the level of DOSE 

EQUIVALENT I-131, and allows for appropriate action to be taken to 

maintain levels below the LCO limit. 

REFERENCES 1. 10 CFR 100.11. 

 2. FSAR, Chapter [15]. 
Steam Generator Level 

B 3.7.18 

BWOG STS B 3.7.18-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.18 Steam Generator Level 

BASES 

BACKGROUND A principal function of the steam generators is to provide superheated 

steam at a constant pressure (900 psia) over the power range. Steam 

generator water inventory is maintained large enough to provide 

adequate primary to secondary heat transfer. Mass inventory and 

indicated water level in the steam generator increases with load as the 

length of the four heat transfer regions within the steam generator vary. 

Inventory is controlled indirectly as a function of power and maintenance 

of a constant average primary system temperature by the feedwater 

controls in the Integrated Control System. 

The maximum operating steam generator level is based primarily on 

preserving the initial condition assumptions for steam generator inventory 

used in the FSAR steam line break (SLB) analysis (Ref. 1). An inventory 

of 62,600 lb was used in this analysis. The 62,600 lb must not be 

exceeded due to the concerns of a possible return to criticality because of 

primary side cooling following an SLB and the maximum pressure in the 

reactor building. 

For a clean once through steam generator, the mass inventory in a steam 

generator for operating at 100% power is approximately 39,000 lb to 

40,000 lb. 

As a steam generator becomes fouled and the operating level 

approaches the limit of 96%, the mass inventory in the downcomer region 

increases approximately 10,000 lb, and adds to the total mass inventory 

of the steam generator. In matching unit data of startup level versus 

power, the steam generator performance codes have shown that fouling 

of the lower tube support plates does not significantly change the heat 

transfer characteristics of the steam generator. Thus, the steam 

temperature, or superheat, is not degraded due to the fouling of the tube 

support plates, and mass inventory changes are mainly due to the added 

level in the downcomer. 

Analytically, increasing the fouling of the steam generator tube surfaces 

degrades the heat transfer capability of the steam generator, increases 

the mass inventory, and decreases the steam superheat at 100% power 

(2544 MW). The results were presented as the amount of mass inventory 

in each steam generator versus operating range level and steam 

superheat. 
Steam Generator Level 

B 3.7.18 

BWOG STS B 3.7.18-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The limiting curve, which was determined from several steam generator 

performance code runs at a power level of 100%, conservatively bounds 

steam generator mass inventory value, when operating at power levels 

< 100%. 

The points displayed in Figure 3.7.18-1, in the accompanying LCO, are 

the intercept points of the 57,000 lb mass value, and the operating range 

level x and steam superheat values. 

The steam generator performance analysis also indicated that startup and 

full range level instruments are inadequate indicators of steam generator 

mass inventory at high power levels due to the combination of static and 

dynamic pressure losses. If the water level should rise above the 96% 

upper limit, the steam superheat would tend to decrease due to reduced 

feedwater heating through the aspirator ports. Normally, a reduction in 

water level is manually initiated to maintain steam flow through the 

aspirator port by reducing the power level. Thus, the superheat versus 

level limitation also tends to ensure that, in normal operation, water level 

will remain clear of the aspirator ports. 

Feedwater nozzle flooding would impair feedwater heating, and could 

result in excessive tube to shell temperature differentials, excessive 

tubesheet temperature differentials, and large variations in pressurizer 

level. 

APPLICABLE The most limiting Design Basis Accident that would be affected by steam 

SAFETY generator operating level is a steam line failure. This accident is 

ANALYSES evaluated in Reference 1. The parameter of interest is the mass of water, 

or inventory, contained in the steam generator due to its role in lowering 

Reactor Coolant System (RCS) temperature (return to criticality concern), 

and in raising containment pressure during an SLB accident. A higher 

inventory causes the effects of the accident to be more severe. 

Figure 3.7.18-1, in the accompanying LCO, is based upon maintaining 

inventory < 57,000 lb, which is 10% less than the inventory used in the 

FSAR accident analysis, and therefore is conservative. 

The steam generator level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
Steam Generator Level 

B 3.7.18 

BWOG STS B 3.7.18-3 Rev. 3.0, 03/31/04 

BASES 

LCO This LCO is required to preserve the initial condition assumptions of the 

accident analyses. Failure to meet the maximum steam generator level 

LCO requirements can result in additional mass and energy released to 

containment, and excessive cooling (and related core reactivity effects) 

following an SLB. In addition, feedwater nozzle flooding would impair 

feedwater heating, and could result in excessive tube to shell temperature 

differentials and excessive tubesheet temperature gradients. 

APPLICABILITY In MODES 1 and 2, a maximum steam generator water level is required 

to preserve the initial condition assumption for steam generator inventory 

used in the steam line failure accident analysis (Ref. 1). 

In MODE 3, limits on RCS boron concentrations will prevent a return to 

criticality in the event of an SLB. In MODES 4, 5, and 6, the water in the 

steam generator has a low specific enthalpy; therefore, there is no need 

to limit the steam generator inventory when the unit is in this condition. 

ACTIONS A.1

With the steam generator level in excess of the maximum limit, action 

must be taken to restore the level to within the bounds assumed in the 

analysis. To achieve this status, the water level is restored to within the 

limit. The 15 minute Completion Time is considered to be a reasonable 

time to perform this evolution. 

B.1

If the water level in one or more steam generators cannot be restored to 

less than or equal to the maximum level in Figure 3.7.18-1, the unit must 

be placed in a MODE that minimizes the accident risk. To achieve this 

status, the unit must be placed in at least MODE 3 within 6 hours. The 

allowed Completion Time is reasonable, based on operating experience, 

to reach the required unit conditions from full power conditions in an 

orderly manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.18.1

REQUIREMENTS 

This SR verifies the steam generator level to be within acceptable limits. 

The 12 hour Frequency is adequate because the operator will be aware 

of unit evolutions that can affect the steam generator level between 

checks. Furthermore, the 12 hour Frequency is considered adequate in 

view of other indications available in the control room, including alarms, to 

alert the operator to steam generator level status. 

REFERENCES 1. FSAR, Section [15.4.4]. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.1 AC Sources - Operating 

BASES 

BACKGROUND The unit Class 1E AC Electrical Power Distribution System AC sources 

consist of the offsite power sources (preferred power sources, normal and 

alternate(s)) and the onsite standby power sources (Train A and Train B 

diesel generators (DGs)). As required by 10 CFR 50, Appendix A, 

GDC 17 (Ref. 1), the design of the AC electrical power system provides 

independence and redundancy to ensure an available source of power to 

the Engineered Safety Feature (ESF) systems. 

The onsite Class 1E AC Distribution System is divided into redundant 

load groups (trains) so that the loss of any one group does not prevent 

the minimum safety functions from being performed. Each train has 

connections to two preferred offsite power sources and a single DG. 

Offsite power is supplied to the unit switchyard(s) from the transmission 

network by [two] transmission lines. From the switchyard(s), two 

electrically and physically separated circuits provide AC power, through 

[step down station auxiliary transformers], to the 4.16 kV ESF buses. A 

detailed description of the offsite power network and the circuits to the 

Class 1E ESF buses is found in the FSAR, Chapter [8] (Ref. 2). 

An offsite circuit consists of all breakers, transformers, switches, 

interrupting devices, cabling, and controls required to transmit power from 

the offsite transmission network to the onsite Class 1E ESF bus(es). 

Certain required unit loads are returned to service in a predetermined 

sequence in order to prevent overloading the transformer supplying offsite 

power to the onsite Class 1E Distribution System. Within [1 minute] after 

the initiating signal is received, all automatic and permanently connected 

loads needed to recover the unit or maintain it in a safe condition are 

returned to service via the load sequencer. 

The onsite standby power source for each 4.16 kV ESF bus is a 

dedicated DG. DGs [11] and [12] are dedicated to ESF buses [11] 

and [12], respectively. A DG starts automatically on a Reactor Coolant 

System (RCS) pressure signal or on an [ESF bus degraded voltage or 

undervoltage signal] (refer to LCO 3.3.5, "Engineered Safety Feature 

Actuation System (ESFAS) Instrumentation" [and LCO 3.3.8, "Emergency 

Diesel Generator (EDG) Loss of Power Starts (LOPS)"]). After the DG 

has started, it will automatically tie to its respective bus after offsite power 

is tripped as a consequence of ESF bus undervoltage or degraded 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

voltage, independent of or coincident with a safety injection (SI) signal. 

The DGs will also start and operate in the standby mode without tying to 

the ESF bus on an SI signal alone. Following the trip of offsite power, [a 

sequencer/an undervoltage signal] strips nonpermanent loads from the 

ESF bus. When the DG is tied to the ESF bus, loads are then 

sequentially connected to its respective ESF bus by the automatic load 

sequencer. The sequencing logic controls the permissive and starting 

signals to motor breakers to prevent overloading the DG by automatic 

load application. 

In the event of a loss of preferred power, the ESF electrical loads are 

automatically connected to the DGs in sufficient time to provide for safe 

reactor shutdown and to mitigate the consequences of a Design Basis 

Accident (DBA) such as a loss of coolant accident (LOCA). 

Certain required unit loads are returned to service in a predetermined 

sequence in order to prevent overloading the DG in the process. Within 

[1] minute after the initiating signal is received, all loads needed to 

recover the unit or maintain it in a safe condition are returned to service. 

Ratings for Train A and Train B DGs satisfy the requirements of 

Regulatory Guide 1.9 (Ref. 3). The continuous service rating of each DG 

is [7000] kW with [10]% overload permissible for up to 2 hours in any 

24 hour period. The ESF loads that are powered from the 4.16 kV ESF 

buses are listed in Reference 2. 

APPLICABLE The initial conditions of DBA and transient analyses in the FSAR, 

SAFETY Chapter [6] (Ref. 4) and Chapter [15] (Ref. 5), assume ESF systems are 

ANALYSES OPERABLE. The AC electrical power sources are designed to provide 

sufficient capacity, capability, redundancy, and reliability to ensure the 

availability of necessary power to ESF systems so that the fuel, RCS, and 

containment design limits are not exceeded. These limits are discussed 

in more detail in the Bases for Section 3.2, Power Distribution Limits; 

Section 3.4, Reactor Coolant System (RCS); and Section 3.6, 

Containment Systems. 

The OPERABILITY of the AC electrical power sources is consistent with 

the initial assumptions of the accident analyses and is based upon 

meeting the design basis of the unit. This results in maintaining at least 

one train of the onsite or offsite AC sources OPERABLE during accident 

conditions in the event of: 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

a. An assumed loss of all offsite power or all onsite AC power and 

b. A worst-case single failure. 

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Two qualified circuits between the offsite transmission network and the 

onsite Class 1E Electrical Power Distribution System and separate and 

independent DGs for each train ensure availability of the required power 

to shut down the reactor and maintain it in a safe shutdown condition after 

an anticipated operational occurrence (AOO) or a postulated DBA. 

Qualified offsite circuits are those that are described in the FSAR and are 

part of the licensing basis for the unit. 

[ In addition, one required automatic load sequencer per train must be 

OPERABLE. ]

Each offsite circuit must be capable of maintaining rated frequency and 

voltage, and accepting required loads during an accident, while 

connected to the ESF buses. 

[ Offsite circuit #1 consists of Safeguards Transformer B, which is supplied 

from Switchyard Bus B, and is fed through breaker 52-3 powering the 

ESF transformer XNB01, which, in turn, powers the #1 ESF bus through 

its normal feeder breaker. Offsite circuit #2 consists of the Startup 

Transformer, which is normally fed from the Switchyard Bus A, and is fed 

through breaker PA 0201 powering the ESF transformer, which, in turn, 

powers the #2 ESF bus through its normal feeder breaker. ]

Each DG must be capable of starting, accelerating to rated speed and 

voltage, and connecting to its respective ESF bus on detection of bus 

undervoltage. This will be accomplished within [10] seconds. Each DG 

must also be capable of accepting required loads within the assumed 

loading sequence intervals, and continue to operate until offsite power 

can be restored to the ESF buses. These capabilities are required to be 

met from a variety of initial conditions, such as DG in standby with the 

engine hot and DG in standby with the engine at ambient conditions. 

Additional DG capabilities must be demonstrated to meet required 

Surveillances, e.g., capability of the DG to revert to standby status on an 

ECCS signal while operating in parallel test mode. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Proper sequencing of loads, [including tripping of non-essential loads,] is 

a required function for DG OPERABILITY. 

The AC sources in one train must be separate and independent (to the 

extent possible) of the AC sources in the other train. For the DGs, 

separation and independence are complete. 

For the offsite AC sources, separation and independence are to the 

extent practical. [A circuit may be connected to more than one ESF bus, 

with fast-transfer capability to the other circuit OPERABLE, and not 

violate separation criteria. A circuit that is not connected to an ESF bus is 

required to have OPERABLE fast-transfer interlock mechanisms to at 

least two ESF buses to support OPERABILITY of that circuit.] 

APPLICABILITY The AC sources [and sequencers] are required to be OPERABLE in 

MODES 1, 2, 3, and 4 to ensure that: 

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and 

b. Adequate core cooling is provided and containment OPERABILITY 

and other vital functions are maintained in the event of a postulated 

DBA. 

The AC power requirements for MODES 5 and 6 are covered in 

LCO 3.8.2, "AC Sources - Shutdown." 

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG. 

There is an increased risk associated with entering a MODE or other 

specified condition in the Applicability with an inoperable DG and the 

provisions of LCO 3.0.4.b, which allow entry into a MODE or other 

specified condition in the Applicability with the LCO not met after 

performance of a risk assessment addressing inoperable systems and 

components, should not be applied in this circumstance. 

 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

 A.1

To ensure a highly reliable power source remains with one offsite circuit 

inoperable, it is necessary to verify the OPERABILITY of the remaining 

required offsite circuit on a more frequent basis. Since the Required 

Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria 

does not result in a Required Action not met. However, if a second 

required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, 

and Condition C, for two offsite circuits inoperable, is entered. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The turbine driven auxiliary feedwater pump is only required to be 

considered a redundant required feature, and, therefore, required to be 

determined OPERABLE by this Required Action, if the design is such that 

the remaining OPERABLE motor or turbine driven auxiliary feedwater 

pump(s) is not by itself capable (without any reliance on the motor driven 

auxiliary feedwater pump powered by the emergency bus associated with 

the inoperable diesel generator) of providing 100% of the auxiliary 

feedwater flow assumed in the safety analysis. 

-------------------------------------------------------------------------------------------------- 

A.2

Required Action A.2, which only applies if the train cannot be powered 

from an offsite source, is intended to provide assurance that an event 

coincident with a single failure of the associated DG will not result in a 

complete loss of safety function of critical redundant required features. 

These features are powered from the redundant AC electrical power train. 

This includes motor driven emergency feedwater pumps. Single train 

systems, such as turbine driven emergency feedwater pumps, may not be 

included. 

The Completion Time for Required Action A.2 is intended to allow the 

operator time to evaluate and repair any discovered inoperabilities. This 

Completion Time also allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." In this Required Action, 

the Completion Time only begins on discovery that both: 

a. The train has no offsite power supplying it loads and 

b. A required feature on the other train is inoperable. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

If at any time during the existence of Condition A (one offsite circuit 

inoperable) a redundant required feature subsequently becomes 

inoperable, this Completion Time begins to be tracked, 

Discovering no offsite power to one train of the onsite Class 1E Electrical 

Power Distribution System coincident with one or more inoperable 

required support or supported features, or both, that are associated with 

the other train that has offsite power, results in starting the Completion 

Times for the Required Action. Twenty-four hours is acceptable because 

it minimizes risk while allowing time for restoration before subjecting the 

unit to transients associated with shutdown. 

The remaining OPERABLE offsite circuit and DGs are adequate to supply 

electrical power to Train A and Train B of the onsite Class 1E Distribution 

System. The 24 hour Completion Time takes into account the component 

OPERABILITY of the redundant counterpart to the inoperable required 

feature. Additionally, the 24 hour Completion Time takes into account the 

capacity and capability of the remaining AC sources, a reasonable time 

for repairs, and the low probability of a DBA occurring during this period. 

A.3

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition A for a period that should not exceed 72 hours. With one 

offsite circuit inoperable, the reliability of the offsite system is degraded, 

and the potential for a loss of offsite power is increased, with attendant 

potential for a challenge to the unit safety systems. In this Condition, 

however, the remaining OPERABLE offsite circuit and DGs are adequate 

to supply electrical power to the onsite Class 1E Distribution System. 

The 72 hour Completion Time takes into account the capacity and 

capability of the remaining AC sources, a reasonable time for repairs, and 

the low probability of a DBA occurring during this period. 

The second Completion Time for Required Action A.3 establishes a limit 

on the maximum time allowed for any combination of required AC power 

sources to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition A is entered while, for instance, a 

DG is inoperable and that DG is subsequently returned OPERABLE, the 

LCO may already have been not met for up to 72 hours. This could lead 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

to a total of 144 hours, since initial failure to meet the LCO, to restore the 

offsite circuit. At this time, a DG could again become inoperable, the 

circuit restored OPERABLE, and an additional 72 hours (for a total of 

9 days) allowed prior to complete restoration of the LCO. The 6 day 

Completion Time provides a limit on the time allowed in a specified 

condition after discovery of failure to meet the LCO. This limit is 

considered reasonable for situations in which Conditions A and B are 

entered concurrently. The AND connector between the 72 hour and 

6 day Completion Times means that both Completion Times apply 

simultaneously, and the more restrictive Completion Time must be met. 

As in Required Action A.2, the Completion Time allows for an exception 

to the normal "time zero" for beginning the allowed outage time "clock." 

This will result in establishing the "time zero" at the time that the LCO was 

initially not met, instead of at the time Condition A was entered. 

B.1

To ensure a highly reliable power source remains with an inoperable DG, 

it is necessary to verify the availability of the offsite circuits on a more 

frequent basis. Since the Required Action only specifies "perform," a 

failure of SR 3.8.1.1 acceptance criteria does not result in a Required 

Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is 

inoperable. Upon offsite circuit inoperability, additional Conditions and 

Required Actions must then be entered. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The turbine driven auxiliary feedwater pump is only required to be 

considered a redundant required feature, and, therefore, required to be 

determined OPERABLE by this Required Action, if the design is such that 

the remaining OPERABLE motor or turbine driven auxiliary feedwater 

pump(s) is not by itself capable (without any reliance on the motor driven 

auxiliary feedwater pump powered by the emergency bus associated with 

the inoperable diesel generator) of providing 100% of the auxiliary 

feedwater flow assumed in the safety analysis. 

-------------------------------------------------------------------------------------------------- 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.2

Required Action B.2 is intended to provide assurance that a loss of offsite 

power, during the period that a DG is inoperable, does not result in a 

complete loss of safety function of critical systems. These features are 

designed with redundant safety related trains. This includes motor driven 

emergency feedwater pumps. Single train systems, such as turbine 

driven emergency feedwater pumps, are not included. Redundant 

required feature failures consist of inoperable features associated with a 

train, redundant to the train that has an inoperable DG. 

The Completion Time for Required Action B.2 is intended to allow the 

operator time to evaluate and repair any discovered inoperabilities. This 

Completion Time also allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." In this Required Action, 

the Completion Time only begins on discovery that both: 

a. An inoperable DG exists and 

b. A required feature on the other train is inoperable. 

If at any time during the existence of this Condition (one DG inoperable) a 

required feature subsequently becomes inoperable, this Completion Time 

begins to be tracked. 

Discovering one required DG inoperable coincident with one or more 

inoperable required support or supported features, or both, that are 

associated with the OPERABLE DG, results in starting the Completion 

Time for the Required Action. Four hours from the discovery of these 

events existing concurrently is acceptable because it minimizes risk while 

allowing time for restoration before subjecting the unit to transients 

associated with shutdown. 

In this Condition, the remaining OPERABLE DG and offsite circuits are 

adequate to supply electrical power to the onsite Class 1E Distribution 

System. Thus, on a component basis, single-failure protection for the 

required feature's function may have been lost; however, function has not 

been lost. The 4 hour Completion Time takes into account the 

OPERABILITY of the redundant counterpart to the inoperable required 

feature. Additionally, the 4 hour Completion Time takes into account the 

capacity and capability of the remaining AC sources, a reasonable time 

for repairs, and the low probability of a DBA occurring during this period. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-9 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.3.1 and B.3.2

Required Action B.3.1 provides an allowance to avoid unnecessary 

testing of OPERABLE DG(s). If it can be determined that the cause of 

the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 

does not have to be performed. If the cause of inoperability exists on 

other DG(s), the other DG(s) would be declared inoperable upon 

discovery and Condition E of LCO 3.8.1 would be entered. Once the 

failure is repaired, the common cause failure no longer exists and 

Required Action B.3.1 is satisfied. If the cause of the initial inoperable 

DG cannot be confirmed not to exist on the remaining DG(s), 

performance of SR 3.8.1.2 suffices to provide assurance of continued 

OPERABILITY of that DG. 

In the event the inoperable DG is restored to OPERABLE status prior to 

completing either B.3.1 or B.3.2, the [plant corrective action program] will 

continue to evaluate the common cause possibility. This continued 

evaluation, however, is no longer under the 24 hour constraint imposed 

while in Condition B. 

According to Generic Letter 84-15 (Ref. 7), [24] hours is reasonable to 

confirm that the OPERABLE DG(s) is not affected by the same problem 

as the inoperable DG. 

B.4

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition B for a period that should not exceed 72 hours. 

In Condition B, the remaining OPERABLE DG and offsite circuits are 

adequate to supply electrical power to the onsite Class 1E Distribution 

System. The 72 hour Completion Time takes into account the capacity 

and capability of the remaining AC sources, a reasonable time for repairs, 

and the low probability of a DBA occurring during this period. 

The second Completion Time for Required Action B.4 establishes a limit 

on the maximum time allowed for any combination of required AC power 

sources to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition B is entered while, for instance, an 

offsite circuit is inoperable and that circuit is subsequently restored 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-10 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

OPERABLE, the LCO may already have been not met for up to 72 hours. 

This could lead to a total of 144 hours, since initial failure to meet the 

LCO, to restore the DG. At this time, an offsite circuit could again 

become inoperable, the DG restored OPERABLE, and an additional 

72 hours (for a total of 9 days) allowed prior to complete restoration of the 

LCO. The 6 day Completion Time provides a limit on time allowed in a 

specified condition after discovery of failure to meet the LCO. This limit is 

considered reasonable for situations in which Condition A and 

Condition B are entered concurrently. The "AND" connector between the 

72 hour and 6 day Completion Times means that both Completion Times 

apply simultaneously, and the more restrictive Completion Time must be 

met. 

As in Required Action B.2, the Completion Time allows for an exception 

to the normal "time zero" for beginning the allowed time "clock." This will 

result in establishing the "time zero" at the time that the LCO was initially 

not met, instead of at the time Condition B was entered. 

C.1 and C.2

Required Action C.1, which applies when two offsite circuits are 

inoperable, is intended to provide assurance that an event with a 

coincident single failure will not result in a complete loss of redundant 

required safety functions. The Completion Time for this failure of 

redundant required features is reduced to 12 hours from that allowed for 

one train without offsite power (Required Action A.2). The rationale for 

the reduction to 12 hours is that Regulatory Guide 1.93 (Ref. 6) allows a 

Completion Time of 24 hours for two required offsite circuits inoperable, 

based upon the assumption that two complete safety trains are 

OPERABLE. When a concurrent redundant required feature failure 

exists, this assumption is not the case, and a shorter Completion Time of 

12 hours is appropriate. These features are powered from redundant AC 

safety trains. This includes motor driven auxiliary feedwater pumps. 

Single train features, such as turbine driven auxiliary pumps, are not 

included in the list. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-11 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The Completion Time for Required Action C.1 is intended to allow the 

operator time to evaluate and repair any discovered inoperabilities. This 

Completion Time also allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." In this Required Action, 

the Completion Time only begins on discovery that both: 

a. All required offsite circuits are inoperable and 

b. A required feature is inoperable. 

If at any time during the existence of Condition C (two offsite circuits 

inoperable) and a required feature becomes inoperable, this Completion 

Time begins to be tracked. 

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition C for a period that should not exceed 24 hours. This level of 

degradation means that the offsite electrical power system does not have 

the capability to effect a safe shutdown and to mitigate the effects of an 

accident; however, the onsite AC sources have not been degraded. This 

level of degradation generally corresponds to a total loss of the 

immediately accessible offsite power sources. 

Because of the normally high availability of the offsite sources, this level 

of degradation may appear to be more severe than other combinations of 

two AC sources inoperable that involve one or more DGs inoperable. 

However, two factors tend to decrease the severity of this level of 

degradation: 

a. The configuration of the redundant AC electrical power system that 

remains available is not susceptible to a single bus or switching 

failure and 

b. The time required to detect and restore an unavailable offsite power 

source is generally much less than that required to detect and restore 

an unavailable onsite AC source. 

With both of the required offsite circuits inoperable, sufficient onsite AC 

sources are available to maintain the unit in a safe shutdown condition in 

the event of a DBA or transient. In fact, a simultaneous loss of offsite AC 

sources, a LOCA, and a worst-case single failure were postulated as a 

part of the design basis in the safety analysis. Thus, the 24 hour 

Completion Time provides a period of time to effect restoration of one of 

the offsite circuits commensurate with the importance of maintaining an 

AC electrical power system capable of meeting its design criteria. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-12 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

According to Reference 6, with the available offsite AC sources, two less 

than required by the LCO, operation may continue for 24 hours. If two 

offsite sources are restored within 24 hours, unrestricted operation may 

continue. If only one offsite source is restored within 24 hours, power 

operation would continue in accordance with Condition A. 

D.1 and D.2

Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be 

entered even if all AC sources to it were inoperable resulting in deenergization. Therefore, the Required Actions of Condition D are 

modified by a Note to indicate that when Condition D is entered with no 

AC source to any train, the Conditions and Required Actions for 

LCO 3.8.9, "Distribution Systems - Operating," must be immediately 

entered. This allows Condition D to provide requirements for the loss of 

one offsite circuit and one DG without regard to whether a train is deenergized. LCO 3.8.9 provides the appropriate restrictions for a deenergized train. 

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition D for a period that should not exceed 12 hours. 

In Condition D, individual redundancy is lost in both the offsite electrical 

power system and the onsite AC electrical power system. Since power 

system redundancy is provided by two diverse sources of power, 

however, the reliability of the power systems in this Condition may appear 

higher than that in Condition C (loss of both required offsite circuits). This 

difference in reliability is offset by the susceptibility of this power system 

configuration to a single bus or switching failure. The 12 hour Completion 

Time takes into account the capacity and capability of the remaining AC 

sources, reasonable time for repairs, and the low probability of a DBA 

occurring during this period. 

E.1

With Train A and Train B DGs inoperable, there are no remaining standby 

AC sources. Thus, with an assumed loss of offsite electrical power, 

insufficient standby AC sources are available to power the minimum 

required ESF functions. Since the offsite electrical power system is the 

only source of AC power for this level of degradation, the risk associated 

with continued operation for a very short time could be less than that 

associated with an immediate controlled shutdown (the immediate 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-13 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

shutdown could cause grid instability, which could result in a total loss of 

AC power). Since any inadvertent generator trip could also result in a 

total loss of offsite AC power, however, the time allowed for continued 

operation is severely restricted. The intent here is to avoid the risk 

associated with an immediate controlled shutdown and to minimize the 

risk associated with this level of degradation. 

According to Reference 6, with both DGs inoperable, operation may 

continue for a period that should not exceed 2 hours. 

[ F.1

The sequencer(s) is an essential support system to [both the offsite circuit 

and the DG associated with a given ESF bus]. [Furthermore, the 

sequencer is on the primary success path for most major AC electrically 

powered safety systems powered from the associated ESF bus.] 

Therefore, loss of an [ESF bus sequencer] affects every major ESF 

system in the [division]. The [12] hour Completion Time provides a period 

of time to correct the problem commensurate with the importance of 

maintaining sequencer OPERABILITY. This time period also ensures 

that the probability of an accident (requiring sequencer OPERABILITY) 

occurring during periods when the sequencer is inoperable is minimal. 

This Condition is preceded by a Note that allows the Condition to be 

deleted if the unit design is such that any sequencer failure mode will only 

affect the ability of the associated DG to power its respective safety loads 

under any conditions. Implicit in this Note is the concept that the 

Condition must be retained if any sequencer failure mode results in the 

inability to start all or part of the safety loads when required, regardless of 

power availability, or results in overloading the offsite power circuit to a 

safety bus during an event thereby causing its failure. Also implicit in the 

Note is that the Condition is not applicable to any train that does not have 

a sequencer. ]

G.1 and G.2

If the inoperable AC electrical power sources cannot be restored to 

OPERABLE status within the required Completion Time, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and to 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions 

from full power conditions in an orderly manner and without challenging 

plant systems. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-14 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

H.1

Condition H corresponds to a level of degradation in which all redundancy 

in the AC electrical power supplies has been lost. At this severely 

degraded level, any further losses in the AC electrical power system will 

cause a loss of function. Therefore, no additional time is justified for 

continued operation. The unit is required by LCO 3.0.3 to commence a 

controlled shutdown. 

SURVEILLANCE The AC sources are designed to permit inspection and testing of all 

REQUIREMENTS important areas and features, especially those that have a standby 

function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 8). 

Periodic component tests are supplemented by extensive functional tests 

during refueling outages (under simulated accident conditions). The SRs 

for demonstrating the OPERABILITY of the DGs are in accordance with 

the recommendations of Regulatory Guide 1.9 (Ref. 3), Regulatory 

Guide 1.108 (Ref. 9), and Regulatory Guide 1.137 (Ref. 10), as 

addressed in the FSAR. 

Where the SRs discussed herein specify voltage and frequency 

tolerances, the following is applicable. The minimum steady state output 

voltage of [3740] V is 90% of the nominal 4160 V output voltage. This 

value, which is specified in ANSI C84.1 (Ref. 11), allows for voltage drop 

to the terminals of 4000 V motors whose minimum operating voltage is 

specified as 90% or 3600 V. It also allows for voltage drops to motors 

and other equipment down through the 120 V level where minimum 

operating voltage is also usually specified as 90% of name plate rating. 

The specified maximum steady state output voltage of [4756] V is equal 

to the maximum operating voltage specified for 4000 V motors. It ensures 

that for a lightly loaded distribution system, the voltage at the terminals of 

4000 V motors is no more than the maximum rated operating voltages. 

The specified minimum and maximum frequencies of the DG are 58.8 Hz 

and 61.2 Hz, respectively. These values are equal to ± 2% of the 60 Hz 

nominal frequency and are derived from the recommendations given in 

Regulatory Guide 1.9 (Ref. 3). 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-15 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.1

This SR ensures proper circuit continuity for the offsite AC electrical 

power supply to the onsite distribution network and availability of offsite 

AC electrical power. The breaker alignment verifies that each breaker is 

in its correct position to ensure that distribution buses and loads are 

connected to their preferred power source, and that appropriate 

independence of offsite circuits is maintained. The 7 day Frequency is 

adequate since breaker position is not likely to change without the 

operator being aware of it and because its status is displayed in the 

control room. 

SR 3.8.1.2 and SR 3.8.1.7

These SRs help to ensure the availability of the standby electrical power 

supply to mitigate DBAs and transients and to maintain the unit in a safe 

shutdown condition. 

To minimize the wear on moving parts that do not get lubricated when the 

engine is not running, these SRs are modified by a Note (Note 1 for 

SR 3.8.1.2 and Note for SR 3.8.1.7) to indicate that all DG starts for these 

Surveillances may be preceded an engine prelube period and followed by 

a warmup period prior to loading by an engine prelube period. 

For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the DGs are 

started from standby conditions. Standby conditions for a DG means that 

the diesel engine coolant and oil are being continuously circulated and 

temperature is being maintained consistent with manufacturer 

recommendations. 

[ In order to reduce stress and wear on diesel engines, some 

manufacturers recommend a modified start in which the starting speed of 

DGs is limited, warmup is limited to this lower speed, and the DGs are 

gradually accelerated to synchronous speed prior to loading. This is the 

intent of Note 2, which is only applicable when such modified start 

procedures are recommended by the manufacturer. ]

SR 3.8.1.7 requires that, at a 184 day Frequency, the DG starts from 

standby conditions and achieves required voltage and frequency within 

10 seconds. The 10 second start requirement supports the assumptions 

of the design basis LOCA analysis in the FSAR, Chapter [15] (Ref. 5). 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-16 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The 10 second start requirement is not applicable to SR 3.8.1.2 (see 

Note 2) when a modified start procedure as described above is used. If a 

modified start is not used, the 10 second start requirement of SR 3.8.1.7 

applies. 

Since SR 3.8.1.7 requires a 10 second start, it is more restrictive than 

SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2. 

In addition to the SR requirements, the time for the DG to reach steady 

state operation, unless the modified DG start method is employed, is 

periodically monitored and the trend evaluated to identify degradation of 

governor and voltage regulator performance. 

The 31 day Frequency for SR 3.8.1.2 is consistent with Regulatory 

Guide 1.9 (Ref. 3). The 184 day Frequency for SR 3.8.1.7 is a reduction 

in cold testing consistent with Generic Letter 84-15 (Ref. 7). These 

Frequencies provide adequate assurance of DG OPERABILITY, while 

minimizing degradation resulting from testing. 

SR 3.8.1.3 

This Surveillance verifies that the DGs are capable of synchronizing with 

the offsite electrical system and accepting loads greater than or equal to 

the equivalent of the maximum expected accident loads. A minimum run 

time of 60 minutes is required to stabilize engine temperatures, while 

minimizing the time that the DG is connected to the offsite source. 

Although no power factor requirements are established by this SR, the 

DG is normally operated at a power factor between [0.8 lagging] and 

[1.0]. The [0.8] value is the design rating of the machine, while the [1.0] is 

an operational limitation [to ensure circulating currents are minimized]. 

The load band is provided to avoid routine overloading of the DG. 

Routine overloading may result in more frequent teardown inspections in 

accordance with vendor recommendations in order to maintain DG 

OPERABILITY. 

The 31 day Frequency for this Surveillance is consistent with Regulatory 

Guide 1.9 (Ref. 3). 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-17 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR is modified by four Notes. Note 1 indicates that diesel engine 

runs for this Surveillance may include gradual loading, as recommended 

by the manufacturer, so that mechanical stress and wear on the diesel 

engine are minimized. Note 2 states that momentary transients because 

of changing bus loads do not invalidate this test. Similarly, momentary 

power factor transients above the limit will not invalidate the test. Note 3 

indicates that this Surveillance should be conducted on only one DG at a 

time in order to avoid common cause failures that might result from offsite 

circuit or grid perturbations. Note 4 stipulates a prerequisite requirement 

for performance of this SR. A successful DG start must precede this test 

to credit satisfactory performance. 

SR 3.8.1.4

This SR provides verification that the level of fuel oil in the day tank [and 

engine mounted tank] is at or above the level at which fuel oil is 

automatically added. The level is expressed as an equivalent volume in 

gallons, and is selected to ensure adequate fuel oil for a minimum of 

1 hour of DG operation at full load plus 10%. 

The 31 day Frequency is adequate to assure that a sufficient supply of 

fuel oil is available, since low level alarms are provided and unit operators 

would be aware of any large uses of fuel oil during this period. 

SR 3.8.1.5

Microbiological fouling is a major cause of fuel oil degradation. There are 

numerous bacteria that can grow in fuel oil and cause fouling, but all must 

have a water environment in order to survive. Removal of water from the 

fuel oil day [and engine mounted] tanks once every [31] days eliminates 

the necessary environment for bacterial survival. This is the most 

effective means of controlling microbiological fouling. In addition, it 

eliminates the potential for water entrainment in the fuel oil during DG 

operation. Water may come from any of several sources, including 

condensation, ground water, rain water, contaminated fuel oil, and from 

breakdown of the fuel oil by bacteria. Frequent checking for and removal 

of accumulated water minimizes fouling and provides data regarding the 

watertight integrity of the fuel oil system. The Surveillance Frequencies 

are established by Regulatory Guide 1.137 (Ref. 10). This SR is for 

preventive maintenance. The presence of water does not necessarily 

represent failure of this SR, provided the accumulated water is removed 

during the performance of this Surveillance. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-18 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.6

This Surveillance demonstrates that each required fuel oil transfer pump 

operates and transfers fuel oil from its associated storage tank to its 

associated day tank. This is required to support continuous operation of 

standby power sources. This Surveillance provides assurance that the 

fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, 

the fuel delivery piping is not obstructed, and the controls and control 

systems for automatic fuel transfer systems are OPERABLE. 

[ The Frequency for this SR is variable, depending on individual system 

design, with up to a [92] day interval. The [92] day Frequency 

corresponds to the testing requirements for pumps as contained in the 

ASME Code, Section XI (Ref. 12); however, the design of fuel transfer 

systems is such that pumps will operate automatically or must be started 

manually in order to maintain an adequate volume of fuel oil in the day 

[and engine mounted] tanks during or following DG testing. In such a 

case, a 31 day Frequency is appropriate. Since proper operation of fuel 

transfer systems is an inherent part of DG OPERABILITY, the Frequency 

of this SR should be modified to reflect individual designs. ]

SR 3.8.1.7

See SR 3.8.1.2. 

[ SR 3.8.1.8

Transfer of each [4.16 kV ESF bus] power supply from the normal offsite 

circuit to the alternate offsite circuit demonstrates the OPERABILITY of 

the alternate circuit distribution network to power the shutdown loads. 

The [18 month] Frequency of the Surveillance is based on engineering 

judgment, taking into consideration the unit conditions required to perform 

the Surveillance, and is intended to be consistent with expected fuel cycle 

lengths. Operating experience has shown that these components usually 

pass the SR when performed at the [18 month] Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-19 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR is modified by a Note. The reason for the Note is that during 

operation with the reactor critical, performance of this SR could cause 

perturbations to the electrical distribution systems that could challenge 

continued steady state operation and, as a result, unit safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR.]

SR 3.8.1.9

Each DG is provided with an engine overspeed trip to prevent damage to 

the engine. Recovery from the transient caused by the loss of a large 

load could cause diesel engine overspeed, which, if excessive, might 

result in a trip of the engine. This Surveillance demonstrates the DG load 

response characteristics and capability to reject the largest single load 

without exceeding predetermined voltage and frequency and while 

maintaining a specified margin to the overspeed trip. For the CR-3 

emergency DGs, the largest single load is 616 kW (HPI pump). After 

performance of SR 3.8.1.17, the diesel load is reduced to approximately 

1200 kW and allowed to run at this load for 3 to 5 minutes. The load is 

then reduced to ≥ 616 kW and the DGs output breaker is opened. 

Verification that the DG did not trip is made. This Surveillance may be 

accomplished by either: 

a. Tripping the DG output breaker with the DG carrying greater than or 

equal to its associated single largest post-accident load while 

paralleled to offsite power, or while solely supplying the bus, or 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-20 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

b. Tripping its associated single largest post-accident load with the DG 

solely supplying the bus. 

As required by IEEE-308 (Ref. 13), the load rejection test is acceptable if 

the increase in diesel speed does not exceed 75% of the difference 

between synchronous speed and the overspeed trip setpoint, or 15% 

above synchronous speed, whichever is lower. 

The time, voltage, and frequency tolerances specified in this SR are 

derived from Regulatory Guide 1.9 (Ref. 3) recommendations for 

response during load sequence intervals. The [3] seconds specified is 

equal to 60% of a typical 5 second load sequence interval associated with 

sequencing of the largest load. The voltage and frequency specified are 

consistent with the design range of the equipment powered by the DG. 

SR 3.8.1.9.a corresponds to the maximum frequency excursion, while 

SR 3.8.1.9.b and SR 3.8.1.9.c are steady state voltage and frequency 

values to which the system must recover to following load rejection. The 

[18 month] Frequency is consistent with the recommendation of 

Regulatory Guide 1.108 (Ref. 9). 

This SR is modified by two Notes. The reason for Note 1 is that during 

operation with the reactor critical, performance of this SR could cause 

perturbations to the electrical distribution systems that could challenge 

continued steady state operation and, as a result, unit safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. Note 2 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-21 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

ensures that the DG is tested under load conditions that are as close to 

design basis conditions as possible. When synchronized with offsite 

power, testing should be performed at a power factor of ≤ [0.9]. This 

power factor is representative of the actual inductive loading a DG would 

see under design basis accident conditions. Under certain conditions, 

however, Note 2 allows the Surveillance to be conducted at a power 

factor other than ≤ [0.9]. These conditions occur when grid voltage is 

high, and the additional field excitation needed to get the power factor to 

≤ [0.9] results in voltages on the emergency busses that are too high. 

Under these conditions, the power factor should be maintained as close 

as practicable to [0.9] while still maintaining acceptable voltage limits on 

the emergency busses. In other circumstances, the grid voltage may be 

such that the DC excitation levels needed to obtain a power factor of [0.9] 

may not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DC. In such 

cases, the power factor shall be maintained as close as practicable to 

[0.9] without exceeding the DG excitation limits. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable: 

a. Performance of the SR will not render any safety system or 

component inoperable, 

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and 

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems. 

-------------------------------------------------------------------------------------------------- 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-22 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.10

This Surveillance demonstrates the DG capability to reject a full load 

without overspeed tripping or exceeding the predetermined voltage limits. 

The DG full load rejection may occur because of a system fault or 

inadvertent breaker tripping. This Surveillance ensures proper engine 

generator load response under the simulated test conditions. This test 

simulates the loss of the total connected load that the DG experiences 

following a full load rejection and verifies that the DG will not trip upon 

loss of the load. These acceptance criteria provide DG damage 

protection. While the DG is not expected to experience this transient 

during an event and continues to be available, this response ensures that 

the DG is not degraded for future application, including reconnection to 

the bus if the trip initiator can be corrected or isolated. 

The [18 month] Frequency is consistent with the recommendation of 

Regulatory Guide 1.108 (Ref. 9) and is intended to be consistent with 

expected fuel cycle lengths. 

This SR is modified by two Notes. The reason for Note 1 is that during 

operation with the reactor critical, performance of this SR could cause 

perturbation to the electrical distribution systems that could challenge 

continued steady state operation and, as a result, unit safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-23 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Note 2 ensures that the DG is tested under load conditions that are as 

close to design basis conditions as possible. When synchronized with 

offsite power, testing should be performed at a power factor of ≤ [0.9]. 

This power factor is representative of the actual inductive loading a DG 

would see under design basis accident conditions. Under certain 

conditions, however, Note 2 allows the Surveillance to be conducted at a 

power factor other than ≤ [0.9]. These conditions occur when grid voltage 

is high, and the additional field excitation needed to get the power factor 

to ≤ [0.9] results in voltages on the emergency busses that are too high. 

Under these conditions, the power factor should be maintained as close 

as practicable to [0.9] while still maintaining acceptable voltage limits on 

the emergency busses. In other circumstances, the grid voltage may be 

such that the DC excitation levels needed to obtain a power factor of [0.9] 

may not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DC. In such 

cases, the power factor shall be maintained as close as practicable to 

[0.9] without exceeding the DG excitation limits. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable: 

a. Performance of the SR will not render any safety system or 

component inoperable, 

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and 

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems. 

-------------------------------------------------------------------------------------------------- 

SR 3.8.1.11

As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), this 

Surveillance demonstrates the as designed operation of the standby 

power sources during loss of the offsite source. This test verifies all 

actions encountered from the loss of offsite power, including shedding of 

the non-essential loads and energization of the emergency buses and 

respective loads from the DG. It further demonstrates the capability of 

the DG to automatically achieve the required voltage and frequency within 

the specified time. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-24 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The DG auto-start time of [10] seconds is derived from requirements of 

the accident analysis to respond to a design basis large break LOCA. 

The Surveillance should be continued for a minimum of 5 minutes in order 

to demonstrate that all starting transients have decayed and stability has 

been achieved. 

The requirement to verify the connection and power supply of permanent 

and auto-connected loads is intended to satisfactorily show the 

relationship of these loads to the DG loading logic. In certain 

circumstances, many of these loads can not actually be connected or 

loaded without undue hardship or potential for undesired operation. For 

instance, Emergency Core Cooling Systems (ECCS) injection valves are 

not desired to be stroked open, high pressure injection systems are not 

capable of being operated at full flow, or decay heat removal (DHR) 

systems performing a DHR function are not desired to be realigned to the 

ECCS mode of operation. In lieu of actual demonstration of connection 

and loading of loads, testing that adequately shows the capability of the 

DG system to perform these functions is acceptable. This testing may 

include any series of sequential, overlapping, or total steps so that the 

entire connection and loading sequence is verified. 

The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), takes into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths. 

This SR is modified by two Notes. The reason for Note 1 is to minimize 

wear and tear on the DGs during testing. For the purpose of this testing, 

the DGs must be started from standby conditions, that is, with the engine 

coolant and oil continuously circulated and temperature maintained 

consistent with manufacturer recommendations. The reason for Note 2 is 

that performing the Surveillance would remove a required offsite circuit 

from service, perturb the electrical distribution system, and challenge 

safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-25 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR. 

[ SR 3.8.1.12

This Surveillance demonstrates that the DG automatically starts and 

achieves the required voltage and frequency within the specified time 

([10] seconds) from the design basis actuation signal (LOCA signal) and 

operates for ≥ 5 minutes. The 5 minute period provides sufficient time to 

demonstrate stability. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that 

permanently connected loads and emergency loads are energized from 

the offsite electrical power system on an ESF signal without loss of offsite 

power. 

The requirement to verify the connection of permanent and autoconnected loads is intended to satisfactorily show the relationship of 

these loads to the DG loading logic. In certain circumstances, many of 

these loads can not actually be connected or loaded without undue 

hardship or potential for undesired operation. For instance, ECCS 

injection valves are not desired to be stroked open, high pressure 

injection systems are not capable of being operated at full flow, or DHR 

systems performing a DHR function are not desired to be realigned to the 

ECCS mode of operation. In lieu of actual demonstration of connection 

and loading of loads, testing that adequately shows the capability of the 

DG system to perform these functions is acceptable. This testing may 

include any series of sequential, overlapping, or total steps so that the 

entire connection and loading sequence is verified. ]

[ The Frequency of [18 months] takes into consideration unit conditions 

required to perform the Surveillance and is intended to be consistent with 

the expected fuel cycle lengths. Operating experience has shown that 

these components usually pass the SR when performed at the [18 month] 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-26 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR is modified by two Notes. The reason for Note 1 is to minimize 

wear and tear on the DGs during testing. For the purpose of this testing, 

the DGs must be started from standby conditions, that is, with the engine 

coolant and oil continuously circulated and temperature maintained 

consistent with manufacturer recommendations. The reason for Note 2 is 

that during operation with the reactor critical, performance of this 

Surveillance could cause perturbations to the electrical distribution 

systems that could challenge continued steady state operation and, as a 

result, unit safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR.]

SR 3.8.1.13

This Surveillance demonstrates that DG noncritical protective functions 

(e.g., high jacket water temperature) are bypassed on a loss of voltage 

signal concurrent with an ESF actuation test signal. The noncritical trips 

are bypassed during DBAs and provide an alarm on an abnormal engine 

condition. This alarm provides the operator with sufficient time to react 

appropriately. The DG availability to mitigate the DBA is more critical 

than protecting the engine against minor problems that are not 

immediately detrimental to emergency operation of the DG. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-27 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The [18 month] Frequency is based on engineering judgment, taking into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths. Operating 

experience has shown that these components usually pass the SR when 

performed at the [18 month] Frequency. Therefore, the Frequency was 

concluded to be acceptable from a reliability standpoint. 

The SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required DG from service. This 

restriction from normally performing the Surveillance in MODE 1 or 2 is 

further amplified to allow the Surveillance to be performed for the purpose 

of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable: 

a. Performance of the SR will not render any safety system or 

component inoperable, 

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and 

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems. 

-------------------------------------------------------------------------------------------------- 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-28 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.14

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3), requires 

demonstration once per 18 months that the DGs can start and run 

continuously at full load capability for an interval of not less than 24 hours, 

≥ [2] hours of which is at a load equivalent to 110% of the continuous duty 

rating and the remainder of the time at a load equivalent to the continuous 

duty rating of the DG. The DG starts for this Surveillance can be 

performed either from standby or hot conditions. The provisions for 

prelubricating and warmup, discussed in SR 3.8.1.2, and for gradual 

loading, discussed in SR 3.8.1.3, are applicable to this SR. 

The load band is provided to avoid routine overloading of the DG. 

Routine overloading may result in more frequent teardown inspections, in 

accordance with vendor recommendations, in order to maintain DG 

OPERABILITY. 

The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 7), paragraph 2.a.(3), takes into 

consideration unit conditions required to perform the Surveillance and is 

intended to be consistent with expected fuel cycle lengths. 

This Surveillance is modified by three Notes. Note 1 states that 

momentary transients due to changing bus loads do not invalidate this 

test. Similarly, momentary power factor transients above the power factor 

limit will not invalidate the test. The reason for Note 2 is that during 

operation with the reactor critical, performance of this Surveillance could 

cause perturbations to the electrical distribution systems that could 

challenge continued steady state operation and, as a result, unit safety 

systems. Note 3 ensures that the DG is tested under load conditions that 

are as close to design basis conditions as possible. When synchronized 

with offsite power, testing should be performed at a power factor of 

≤ [0.9]. This power factor is representative of the actual inductive loading 

a DG would see under design basis accident conditions. Under certain 

conditions, however, Note 3 allows the Surveillance to be conducted at a 

power factor other than ≤ [0.9]. These conditions occur when grid voltage 

is high, and the additional field excitation needed to get the power factor 

to ≤ [0.9] results in voltages on the emergency busses that are too high. 

Under these conditions, the power factor should be maintained as close 

as practicable to [0.9] while still maintaining acceptable voltage limits on 

the emergency busses. In other circumstances, the grid voltage may be 

such that the DG excitation levels needed to obtain a power factor of [0.9] 

may not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DG. In such 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-29 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

cases, the power factor shall be maintained as close as practicable to 

[0.9] without exceeding the DG excitation limits. This restriction from 

normally performing the Surveillance in MODE 1 or 2 is further amplified 

to allow the Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g. post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed Surveillance, a successful Surveillance, and a 

perturbation of the offsite or onsite system when they are tied together or 

operated independently for the Surveillance; as well as the operator 

procedures available to cope with these outcomes. These shall be 

measured against the avoided risk of a plant shutdown and startup to 

determine that plant safety is maintained or enhanced when the 

Surveillance is performed in MODE 1 or 2. Risk insights or deterministic 

methods may be used for this assessment. Credit may be taken for 

unplanned events that satisfy this SR. 

SR 3.8.1.15

This Surveillance demonstrates that the diesel engine can restart from a 

hot condition, such as subsequent to shutdown from normal 

Surveillances, and achieve the required voltage and frequency within 

[10 seconds]. The [10 second] time is derived from the requirements of 

the accident analysis to respond to a design basis large break LOCA. 

The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(5). 

This SR is modified by two Notes. Note 1 ensures that the test is 

performed with the diesel sufficiently hot. The load band is provided to 

avoid routine overloading of the DG. Routine overloads may result in 

more frequent teardown inspections, in accordance with vendor 

recommendations, in order to maintain DG OPERABILITY. The 

requirement that the diesel has operated for at least [2] hours at full load 

conditions prior to performance of this Surveillance is based on 

manufacturer recommendations for achieving hot conditions. Momentary 

transients due to changing bus loads do not invalidate this test. Note 2 

allows all DG starts to be preceded by an engine prelube period to 

minimize wear and tear on the diesel during testing. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-30 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.16

As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), this 

Surveillance ensures that the manual synchronization and automatic load 

transfer from the DG to the offsite source can be made and the DG can 

be returned to ready to load status when offsite power is restored. It also 

ensures that the auto-start logic is reset to allow the DG to reload if a 

subsequent loss of offsite power occurs. The DG is considered to be in 

ready to load status when the DG is at rated speed and voltage, the 

output breaker is open and can receive and auto-close signal on bus 

undervoltage, and the load sequence timers are reset. 

The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), and takes into 

consideration unit conditions required to perform the Surveillance. 

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required offsite circuit from service, 

perturb the electrical distribution system, and challenge safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. 

[ SR 3.8.1.17

Demonstration of the test mode override ensures that the DG availability 

under accident conditions will not be compromised as the result of testing 

and the DG will automatically reset to ready to load operation if a LOCA 

actuation signal is received during operation in the test mode. Ready to 

load operation is defined as the DG running at rated speed and voltage 

with the DG output breaker open. These provisions for automatic 

switchover are required by IEEE-308 (Ref. 13), paragraph 6.2.6(2). 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-31 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The requirement to automatically energize the emergency loads with 

offsite power is essentially identical to that of SR 3.8.1.12. The intent in 

the requirement associated with SR 3.8.1.17.b is to show that the 

emergency loading was not affected by the DG operation in test mode. In 

lieu of actual demonstration of connection and loading of loads, testing 

that adequately shows the capability of the emergency loads to perform 

these functions is acceptable. This testing may include any series of 

sequential, overlapping, or total steps so that the entire connection and 

loading sequence is verified. 

The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(8), takes into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths. 

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required offsite circuit from service, 

perturb the electrical distribution system, and challenge safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow portions of the Surveillance to be performed 

for the purpose of reestablishing OPERABILITY (e.g., post work testing 

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed partial 

Surveillance, a successful partial Surveillance, and a perturbation of the 

offsite or onsite system when they are tied together or operated 

independently for the partial Surveillance; as well as the operator 

procedures available to cope with these outcomes. These shall be 

measured against the avoided risk of a plant shutdown and startup to 

determine that plant safety is maintained or enhanced when portions of 

the Surveillance are performed in MODE 1 or 2. Risk insights or 

deterministic methods may be used for the assessment. Credit may be 

taken for unplanned events that satisfy this SR. ]
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-32 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.18 

Under accident [and loss of offsite power] conditions loads are 

sequentially connected to the bus by the [automatic load sequencer]. The 

sequencing logic controls the permissive and starting signals to motor 

breakers to prevent overloading of the DGs due to high motor starting 

currents. The [10]% load sequence time interval tolerance ensures that 

sufficient time exists for the DG to restore frequency and voltage prior to 

applying the next load and that safety analysis assumptions regarding 

ESF equipment time delays are not violated. Reference 2 provides a 

summary of the automatic loading of ESF buses. 

The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(2), takes into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths. 

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required offsite circuit from service, 

perturb the electrical distribution system, and challenge safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-33 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable: 

a. Performance of the SR will not render any safety system or 

component inoperable, 

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and 

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems. 

-------------------------------------------------------------------------------------------------- 

SR 3.8.1.19

In the event of a DBA coincident with a loss of offsite power, the DGs are 

required to supply the necessary power to ESF systems so that the fuel, 

RCS, and containment design limits are not exceeded. 

This Surveillance demonstrates the DG operation, as discussed in the 

Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal 

in conjunction with an ESF actuation signal. In lieu of actual 

demonstration of connection and loading of loads, testing that adequately 

shows the capability of the DG system to perform these functions is 

acceptable. This testing may include any series of sequential, 

overlapping, or total steps so that the entire connection and loading 

sequence is verified. 

The Frequency of [18 months] takes into consideration unit conditions 

required to perform the Surveillance and is intended to be consistent with 

an expected fuel cycle length of [18 months]. 

This SR is modified by two Notes. The reason for Note 1 is to minimize 

wear and tear on the DGs during testing. For the purpose of this testing, 

the DGs must be started from standby conditions, that is, with the engine 

coolant and oil continuously circulated and temperature maintained 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-34 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

consistent with manufacturer recommendations for DGs. The reason for 

Note 2 is that performing the Surveillance would remove a required offsite 

circuit from service, perturb the electrical distribution system, and 

challenge safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR. 

SR 3.8.1.20

This Surveillance demonstrates that the DG starting independence has 

not been compromised. Also, this Surveillance demonstrates that each 

engine can achieve proper speed within the specified time when the DGs 

are started simultaneously. 

The 10 year Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9). 

This SR is modified by a Note. The reason for the Note is to minimize 

wear on the DG during testing. For the purpose of this testing, the DGs 

must be started from standby conditions, that is, with the engine coolant 

and oil continuously circulated, and temperature maintained consistent 

with manufacturer recommendations. 
AC Sources - Operating 

B 3.8.1 

BWOG STS B 3.8.1-35 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17. 

 2. FSAR, Chapter [8]. 

 3. Regulatory Guide 1.9, Rev. 3. 

 4. FSAR, Chapter [6]. 

 5. FSAR, Chapter [15]. 

 6. Regulatory Guide 1.93, Rev. [0], [date]. 

 7. Generic Letter 84-15. 

 8. 10 CFR 50, Appendix A, GDC 18. 

 9. Regulatory Guide 1.108, Rev. [1], [August 1977]. 

 10. Regulatory Guide 1.137, Rev. [ ] , [date]. 

 11. ANSI C84.1-1982. 

 12. ASME, Boiler and Pressure Vessel Code, Section XI. 

 13. IEEE Standard 308-[1978]. 
AC Sources - Shutdown 

B 3.8.2 

BWOG STS B 3.8.2-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.2 AC Sources - Shutdown 

BASES 

BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, 

"AC Sources - Operating." 

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 5 and 6 

SAFETY and during movement of [recently] irradiated fuel assemblies ensures 

ANALYSES that: 

a. The unit can be maintained in the shutdown or refueling condition for 

extended periods, 

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and 

c. Adequate AC electrical power is provided to mitigate events 

postulated during shutdown, such as a fuel handling accident 

[involving handling recently irradiated fuel. Due to radioactive decay, 

AC electrical power is only required to mitigate fuel handling 

accidents involving handling recently irradiated fuel (i.e., fuel that has 

occupied part of a critical reactor core within the previous [x] days)]. 

In general, when the unit is shut down, the Technical Specifications 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or all onsite power is not required. 

The rationale for this is based on the fact that many Design Basis 

Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no 

specific analyses in MODES 5 and 6. Worst-case bounding events are 

deemed not credible in MODES 5 and 6 because the energy contained 

within the reactor pressure boundary, reactor coolant temperature and 

pressure, and the corresponding stresses result in the probabilities of 

occurrence being significantly reduced or eliminated, and in minimal 

consequences. These deviations from DBA analysis assumptions and 

design requirements during shutdown conditions are allowed by the LCO 

for required systems. 
AC Sources - Shutdown 

B 3.8.2 

BWOG STS B 3.8.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

During MODES 1, 2, 3, and 4 various deviations from the analysis 

assumptions and design requirements are allowed within the Required 

Actions. This allowance is in recognition that certain testing and 

maintenance activities must be conducted provided an acceptable level of 

risk is not exceeded. During MODES 5 and 6, performance of a 

significant number of required testing and maintenance activities is also 

required. In MODES 5 and 6, the activities are generally planned and 

administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO 

requirements are acceptable during shutdown MODES based on: 

a. The fact that time in an outage is limited. This is a risk prudent goal 

as well as a utility economic consideration, 

b. Requiring appropriate compensatory measures for certain conditions. 

These may include administrative controls, reliance on systems that 

do not necessarily meet typical design requirements applied to 

systems credited in operating MODE analyses, or both, 

c. Prudent utility consideration of the risk associated with multiple 

activities that could affect multiple systems, and 

d. Maintaining, to the extent practical, the ability to perform required 

functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY 

requirements) with systems assumed to function during an event. 

In the event of an accident during shutdown, this LCO ensures the 

capability to support systems necessary to avoid immediate difficulty, 

assuming either a loss of all offsite power or a loss of all onsite diesel 

generator (DG) power. 

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO One offsite circuit capable of supplying the onsite Class 1E power 

distribution subsystem(s) of LCO 3.8.10, "Distribution Systems - 

Shutdown," ensures that all required loads are powered from offsite 

power. An OPERABLE DG, associated with a distribution system train 

required to be OPERABLE by LCO 3.8.10, ensures a diverse power 

source is available to provide electrical power support, assuming a loss 

of the offsite circuit. Together, OPERABILITY of the required offsite 

circuit and DG ensures the availability of sufficient AC sources to operate 

the unit in a safe manner and to mitigate the consequences of postulated 

events during shutdown (e.g., fuel handling accidents [involving handling 

recently irradiated fuel]). 
AC Sources - Shutdown 

B 3.8.2 

BWOG STS B 3.8.2-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The qualified offsite circuit must be capable of maintaining rated 

frequency and voltage, and accepting required loads during an accident, 

while connected to the Engineered Safety Feature (ESF) bus(es). 

Qualified offsite circuits are those that are described in the FSAR and are 

part of the licensing basis for the unit. 

[ Offsite circuit #1 consists of Safeguards Transformer B, which is supplied 

from Switchyard Bus B, and is fed through breaker 52-3 powering the 

ESF transformer XNB01, which, in turn, powers the #1 ESF bus through 

its normal feeder breaker. The second offsite circuit consists of the 

Startup Transformer, which is normally fed from the Switchyard Bus A, 

and is fed through breaker PA O201 powering the ESF transformer, 

which, in turn, powers the #2 ESF bus through its normal feeder 

breaker. ]

The DG must be capable of starting, accelerating to rated speed and 

voltage, and connecting to its respective ESF bus on detection of bus 

undervoltage. This sequence must be accomplished within [10] seconds. 

The DG must be capable of accepting required loads within the assumed 

loading sequence intervals, and must continue to operate until offsite 

power can be restored to the ESF buses. These capabilities are required 

to be met from a variety of initial conditions such as DG in standby with 

the engine hot and DG in standby at ambient conditions. 

Proper sequencing of loads, including tripping of non-essential loads, is a 

required function for DG OPERABILITY. 

[ In addition, proper sequencer operation is an integral part of offsite circuit 

OPERABILITY since its inoperability impacts on the ability to start and 

maintain energized loads required OPERABLE by LCO 3.8.10. ]

It is acceptable for trains to be cross tied during shutdown conditions, 

allowing a single offsite power circuit to supply all required trains. 

APPLICABILITY The AC sources required to be OPERABLE in MODES 5 and 6 and 

during movement of [recently] irradiated fuel assemblies provide 

assurance that: 

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel assemblies, 
AC Sources - Shutdown 

B 3.8.2 

BWOG STS B 3.8.2-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available, 

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and 

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition. 

The AC power requirements for MODES 1, 2, 3, and 4 are covered in 

LCO 3.8.1. 

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily. 

A.1

An offsite circuit would be considered inoperable if it were not available to 

one required ESF train. Although two trains are required by LCO 3.8.10, 

the one train with offsite power available may be capable of supporting 

sufficient required features to allow continuation of CORE ALTERATIONS 

and [recently] irradiated fuel movement. By the allowance of the option to 

declare features inoperable with no offsite power available, appropriate 

restrictions will be implemented in accordance with the affected required 

features LCO's ACTIONS. 
AC Sources - Shutdown 

B 3.8.2 

BWOG STS B 3.8.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.2.1, A.2.2, A.2.3, A.2.4, B.1, B.2, B.3, and B.4

With the offsite circuit not available to all required trains, the option would 

still exist to declare all required features inoperable. Since this option 

may involve undesired administrative efforts, the allowance for sufficiently 

conservative actions is made. With the required DG inoperable, the 

minimum required diversity of AC power sources is not available. It is, 

therefore, required to suspend CORE ALTERATIONS, movement of 

[recently] irradiated fuel assemblies, and operations involving positive 

reactivity additions that could result in loss of required SDM (MODE 5) or 

boron concentration (MODE 6). Suspending positive reactivity additions 

that could result in failure to meet the minimum SDM or boron 

concentration limit is required to assure continued safe operation. 

Introduction of coolant inventory must be from sources that have a boron 

concentration greater than that what would be required in the RCS for 

minimum SDM or refueling boron concentration. This may result in an 

overall reduction in RCS boron concentration, but provides acceptable 

margin to maintaining subcritical operation. Introduction of temperature 

changes including temperature increases when operating with a positive 

MTC must also be evaluated to ensure they do not result in a loss of 

required SDM. 

Suspension of these activities does not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability or the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required AC sources and to 

continue this action until restoration is accomplished in order to provide 

the necessary AC power to the unit safety systems. 

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required AC 

electrical power sources should be completed as quickly as possible in 

order to minimize the time during which the unit safety systems may be 

without sufficient power. 

Pursuant to LCO 3.0.6, the Distribution System's ACTIONS are not 

entered even if all AC sources to it are inoperable, resulting in deenergization. Therefore, the Required Actions of Condition A are 

modified by a Note to indicate that when Condition A is entered with no 

AC power to any required ESF bus, the ACTIONS for LCO 3.8.10 must 

be immediately entered. This Note allows Condition A to provide 

requirements for the loss of the offsite circuit, whether or not a train is deenergized. LCO 3.8.10 provides the appropriate restrictions for the 

situation involving a de-energized train. 
AC Sources - Shutdown 

B 3.8.2 

BWOG STS B 3.8.2-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.8.2.1

REQUIREMENTS 

SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for 

ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 

3, and 4. SR 3.8.1.8 is not required to be met since only one offsite 

circuit is required to be OPERABLE. SR 3.8.1.12 and SR 3.8.1.19 are 

not required to be met because the ESF actuation signal is not required to 

be OPERABLE. SR 3.8.1.6 is not required to be met because the 

required OPERABLE DG(s) is not required to undergo periods of being 

synchronized to the offsite circuit. SR 3.8.1.9 is excepted because 

starting independence is not required with the DG(s) that is not required 

to be OPERABLE. 

This SR is modified by a Note. The reason for the Note is to preclude 

requiring the OPERABLE DG(s) from being paralleled with the offsite 

power network or otherwise rendered inoperable during performance of 

SRs, and to preclude deenergizing a required 4160 V ESF bus or 

disconnecting a required offsite circuit during performance of SRs. With 

limited AC sources available, a single event could compromise both the 

required circuit and the DG. It is the intent that these SRs must still be 

capable of being met, but actual performance is not required during 

periods when the DG and offsite circuit is required to be OPERABLE. 

Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each 

SR. 

REFERENCES None. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWOG STS B 3.8.3-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air 

BASES 

BACKGROUND Each diesel generator (DG) is provided with a storage tank having a fuel 

oil capacity sufficient to operate that diesel for a period of 7 days while the 

DG is supplying maximum post loss of coolant accident load demand 

discussed in the FSAR, Section [9.5.4.2] (Ref. 1). The maximum load 

demand is calculated using the assumption that at least two DGs are 

available. This onsite fuel oil capacity is sufficient to operate the DGs for 

longer than the time to replenish the onsite supply from outside sources. 

Fuel oil is transferred from storage tank to day tank by either of two 

transfer pumps associated with each storage tank. Redundancy of 

pumps and piping precludes the failure of one pump, or the rupture of any 

pipe, valve or tank to result in the loss of more than one DG. All outside 

tanks, pumps, and piping are located underground. 

For proper operation of the standby DGs, it is necessary to ensure the 

proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses 

the recommended fuel oil practices as supplemented by ANSI N195 

(Ref. 3). The fuel oil properties governed by these SRs are the water and 

sediment content, the kinematic viscosity, specific gravity (or API gravity), 

and impurity level. 

The DG lubrication system is designed to provide sufficient lubrication to 

permit proper operation of its associated DG under all loading conditions. 

The system is required to circulate the lube oil to the diesel engine 

working surfaces and to remove excess heat generated by friction during 

operation. Each engine oil sump contains an inventory capable of 

supporting a minimum of [7] days of operation. [The onsite storage in 

addition to the engine oil sump is sufficient to ensure 7 days of continuous 

operation.] This supply is sufficient to allow the operator to replenish lube 

oil from outside sources. 

Each DG has an air start system with adequate capacity for five 

successive start attempts on the DG without recharging the air start 

receiver(s). 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWOG STS B 3.8.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 4) and Chapter [15] (Ref. 5), 

ANALYSES assume Engineered Safety Feature (ESF) systems are OPERABLE. The 

DGs are designed to provide sufficient capacity, capability, redundancy, 

and reliability to ensure the availability of necessary power to ESF 

systems so that fuel, Reactor Coolant System, and containment design 

limits are not exceeded. These limits are discussed in more detail in the 

Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor 

Coolant System (RCS); and Section 3.6, Containment Systems. 

Since diesel fuel oil, lube oil, and the air start subsystem support the 

operation of the standby AC power sources, they satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full 

load operation. It is also required to meet specific standards for quality. 

Additionally, sufficient lube oil supply must be available to ensure the 

capability to operate at full load for 7 days. This requirement, in 

conjunction with an ability to obtain replacement supplies within 7 days, 

supports the availability of DGs required to shut down the reactor and to 

maintain it in a safe condition for an anticipated operational occurrence 

(AOO) or a postulated DBA with loss of offsite power. DG day tank fuel 

requirements, as well as transfer capability from the storage tank to the 

day tank, are addressed in LCO 3.8.1, "AC Sources - Operating," and 

LCO 3.8.2, "AC Sources - Shutdown." 

The starting air system is required to have a minimum capacity for five 

successive DG start attempts without recharging the air start receivers. 

APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the 

availability of the required power to shut down the reactor and maintain it 

in a safe shutdown condition after an AOO or a postulated DBA. Since 

stored diesel fuel oil, lube oil, and the starting air subsystem support 

LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, lube oil, and starting air 

are required to be within limits when the associated DG is required to be 

OPERABLE. 

ACTIONS The ACTIONS Table is modified by a Note indicating that separate 

Condition entry is allowed for each DG. This is acceptable, since the 

Required Actions for each Condition provide appropriate compensatory 

actions for each inoperable DG subsystem. Complying with the Required 

Actions for one inoperable DG subsystem may allow for continued 

operation, and subsequent inoperable DG subsystem(s) are governed by 

separate Condition entry and application of associated Required Actions. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWOG STS B 3.8.3-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

In this Condition, the 7 day fuel oil supply for a DG is not available. 

However, the Condition is restricted to fuel oil level reductions, that 

maintain at least a 6 day supply. These circumstances may be caused by 

events, such as full load operation required after an inadvertent start 

while at minimum required level, or feed and bleed operations which may 

be necessitated by increasing particulate levels or any number of other oil 

quality degradations. This restriction allows sufficient time for obtaining 

the requisite replacement volume and performing the analyses required 

prior to addition of fuel oil to the tank. A period of 48 hours is considered 

sufficient to complete restoration of the required level prior to declaring 

the DG inoperable. This period is acceptable based on the remaining 

capacity (> 6 days), the fact that procedures will be initiated to obtain 

replenishment, and the low probability of an event during this brief period. 

B.1

With lube oil inventory < 500 gal, sufficient lube oil to support 7 days of 

continuous DG operation at full load conditions may not be available. 

However, the Condition is restricted to lube oil volume reductions that 

maintain at least a 6 day supply. This restriction allows sufficient time to 

obtain the requisite replacement volume. A period of 48 hours is 

considered sufficient to complete restoration of the required volume prior 

to declaring the DG inoperable. This period is acceptable based on the 

remaining capacity (> 6 days), the low rate of usage, the fact that 

procedures will be initiated to obtain replenishment, and the low 

probability of an event during this brief period. 

C.1

This Condition is entered as a result of a failure to meet the acceptance 

criterion of SR 3.8.3.5. Normally, trending of particulate levels allows 

sufficient time to correct high particulate levels prior to reaching the limit 

of acceptability. Poor sample procedures (bottom sampling), 

contaminated sampling equipment, and errors in laboratory analysis can 

produce failures that do not follow a trend. Since the presence of 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWOG STS B 3.8.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

particulates does not mean failure of the fuel oil to burn properly in the 

diesel engine, particulate concentration is unlikely to change significantly 

between Surveillance Frequency intervals, and proper engine 

performance has been recently demonstrated (within 31 days), it is 

prudent to allow a brief period prior to declaring the associated DG 

inoperable. The 7 day Completion Time allows for further evaluation, 

resampling, and re-analysis of the DG fuel oil. 

D.1

With the new fuel oil properties defined in the Bases for SR 3.8.3.4 not 

within the required limits, a period of 30 days is allowed for restoring the 

stored fuel oil properties. This period provides sufficient time to test the 

stored fuel oil to determine that the new fuel oil, when mixed with 

previously stored fuel oil, remains acceptable, or to restore the stored fuel 

oil properties. This restoration may involve feed and bleed procedures, 

filtering, or combinations of these procedures. Even if a DG start and 

load was required during this time interval and the fuel oil properties were 

outside limits, there is a high likelihood that the DG would still be capable 

of performing its intended function. 

E.1

With starting air receiver pressure < [225] psig, sufficient capacity for five 

successive DG start attempts does not exist. However, as long as the 

receiver pressure is > [125] psig, there is adequate capacity for at least 

one start attempt, and the DG can be considered OPERABLE while the 

air receiver pressure is restored to the required limit. A period of 48 hours 

is considered sufficient to complete restoration to the required pressure 

prior to declaring the DG inoperable. This period is acceptable based on 

the remaining air start capacity, the fact that most DG starts are 

accomplished on the first attempt, and the low probability of an event 

during this brief period. 

F.1

With a Required Action and associated Completion Time not met, or one 

or more DGs with fuel oil, lube oil, or starting air subsystem not within 

limits for reasons other than addressed by Conditions A through E, the 

associated DG may be incapable of performing its intended function and 

must be immediately declared inoperable. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWOG STS B 3.8.3-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.8.3.1

REQUIREMENTS 

This SR provides verification that there is an adequate inventory of fuel oil 

in the storage tanks to support each DG's operation for 7 days at full load. 

The 7 day period is sufficient time to place the unit in a safe shutdown 

condition and to bring in replenishment fuel from an offsite location. 

The 31 day Frequency is adequate to ensure that a sufficient supply of 

fuel oil is available, since low level alarms are provided and unit operators 

would be aware of any large uses of fuel oil during this period. 

SR 3.8.3.2

This Surveillance ensures that sufficient lube oil inventory is available to 

support at least 7 days of full load operation for each DG. The [500] gal 

requirement is based on the DG manufacturer consumption values for the 

run time of the DG. Implicit in this SR is the requirement to verify the 

capability to transfer the lube oil from its storage location to the DG, when 

the DG lube oil sump does not hold adequate inventory for 7 days of full 

load operation without the level reaching the manufacturer recommended 

minimum level. 

A 31 day Frequency is adequate to ensure that a sufficient lube oil supply 

is onsite, since DG starts and run time are closely monitored by the unit 

staff. 

SR 3.8.3.3

The tests listed below are a means of determining whether new fuel oil is 

of the appropriate grade and has not been contaminated with substances 

that would have an immediate, detrimental impact on diesel engine 

combustion. If results from these tests are within acceptable limits, the 

fuel oil may be added to the storage tanks without concern for 

contaminating the entire volume of fuel oil in the storage tanks. These 

tests are to be conducted prior to adding the new fuel to the storage 

tank(s), but in no case is the time between receipt of new fuel and 

conducting the tests to exceed 31 days. The tests, limits, and applicable 

ASTM Standards are as follows: 

a. Sample the new fuel oil in accordance with ASTM D4057-[ ] 

(Ref. 6), 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWOG STS B 3.8.3-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

b. Verify in accordance with the tests specified in ASTM D975-[ ] 

(Ref. 6) that the sample has an absolute specific gravity at 60/60°F of 

≥ 0.83 and ≥ 0.89 or an API gravity at 60°F of ≥ 27° and ≤ 39° when 

tested in accordance with ASTM D1298-[ ] (Ref. 6), a kinematic 

viscosity at 40°C of ≥ 1.9 centistokes and ≤ 4.1 centistokes, and a 

flash point of ≥ 125°F, and 

c. Verify that the new fuel oil has a clear and bright appearance with 

proper color when tested in accordance with ASTM D4176-[ ] or a 

water and sediment content within limits when tested in accordance 

with [ASTM D2709-[ ]] (Ref. 6). 

Failure to meet any of the above limits is cause for rejecting the new fuel 

oil, but does not represent a failure to meet the LCO concern since the 

fuel oil is not added to the storage tanks. 

Within 31 days following the initial new fuel oil sample, the fuel oil is 

analyzed to establish that the other properties specified in Table 1 of 

ASTM D975-[ ] (Ref. 7) are met for new fuel oil when tested in 

accordance with ASTM D975-[ ] (Ref. 6), except that the analysis for 

sulfur may be performed in accordance with ASTM D1552-[ ], 

ASTM D2622-[ ], or ASTM D4294-[ ] (Ref. 6). The 31 day period is 

acceptable because the fuel oil properties of interest, even if they were 

not within stated limits, would not have an immediate effect on DG 

operation. This Surveillance ensures the availability of high quality fuel oil 

for the DGs. 

Fuel oil degradation during long term storage shows up as an increase in 

particulate, due mostly to oxidation. The presence of particulate does not 

mean the fuel oil will not burn properly in a diesel engine. The particulate 

can cause fouling of filters and fuel oil injection equipment, however, 

which can cause engine failure. 

Particulate concentrations should be determined in accordance with 

ASTM D5452-[ ] (Ref. 6). This method involves a gravimetric 

determination of total particulate concentration in the fuel oil and has a 

limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent 

laboratory testing in lieu of field testing. [For those designs in which the 

total stored fuel oil volume is contained in two or more interconnected 

tanks, each tank must be considered and tested separately.] 

The Frequency of this test takes into consideration fuel oil degradation 

trends that indicate that particulate concentration is unlikely to change 

significantly between Frequency intervals. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWOG STS B 3.8.3-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.3.4

This Surveillance ensures that, without the aid of the refill compressor, 

sufficient air start capacity for each DG is available. The system design 

requirements provide for a minimum of [five] engine start cycles without 

recharging. [A start cycle is defined by the DG vendor, but usually is 

measured in terms of time (seconds of cranking) or engine cranking 

speed.] The pressure specified in this SR is intended to reflect the lowest 

value at which the [five] starts can be accomplished. 

The 31 day Frequency takes into account the capacity, capability, 

redundancy, and diversity of the AC sources and other indications 

available in the control room, including alarms, to alert the operator to 

below normal air start pressure. 

SR 3.8.3.5

Microbiological fouling is a major cause of fuel oil degradation. There are 

numerous bacteria that can grow in fuel oil and cause fouling, but all must 

have a water environment in order to survive. Removal of water from the 

fuel storage tanks once every [31] days eliminates the necessary 

environment for bacterial survival. This is the most effective means of 

controlling microbiological fouling. In addition, it eliminates the potential 

for water entrainment in the fuel oil during DG operation. Water may 

come from any of several sources, including condensation, ground water, 

rain water, contaminated fuel oil, and from breakdown of the fuel oil by 

bacteria. Frequent checking for and removal of accumulated water 

minimizes fouling and provides data regarding the watertight integrity of 

the fuel oil system. The Surveillance Frequencies are established by 

Regulatory Guide 1.137 (Ref. 2). This SR is for preventive maintenance. 

The presence of water does not necessarily represent failure of this SR, 

provided the accumulated water is removed during performance of the 

Surveillance. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWOG STS B 3.8.3-8 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [9.5.4.2]. 

 2. Regulatory Guide 1.137. 

 3. ANSI N195-1976, Appendix B. 

 4. FSAR, Chapter [6]. 

 5. FSAR, Chapter [15]. 

 6. ASTM Standards: D4057-[ ]; D975-[ ]; D1298-[ ]; D4176-[ ]; 

[D2709-[ ];] D1552-[ ]; D2622-[ ]; D4294-[ ]; D5452-[ ]. 

 7. ASTM Standards, D975-[ ] , Table 1. 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.4 DC Sources - Operating 

BASES 

BACKGROUND The station DC electrical power system provides the AC emergency 

power system with control power. It also provides both motive and 

control power to selected safety related equipment and preferred AC vital 

bus power (via inverters). As required by 10 CFR 50, Appendix A, 

GDC 17 (Ref. 1), the DC electrical power system is designed to have 

sufficient independence, redundancy, and testability to perform its safety 

functions, assuming a single failure. The DC electrical power system also 

conforms to the recommendations of Regulatory Guide 1.6 (Ref. 2) and 

IEEE-308 (Ref. 3). 

The [125/250] VDC electrical power system consists of two independent 

and redundant safety related Class 1E DC electrical power subsystems 

([Train A and Train B]). Each subsystem consists of [two] 125 VDC 

batteries [(each battery [50]% capacity)], the associated battery charger[s] 

for each battery, and all the associated control equipment and 

interconnecting cabling. 

[ The 250 VDC source is obtained by use of the two 125 VDC batteries 

connected in series. Additionally, there is [one] spare battery charger per 

subsystem, which provides backup service in the event that the preferred 

battery charger is out of service. If the spare battery charger is 

substituted for one of the preferred battery chargers, then the 

requirements of independence and redundancy between subsystems are 

maintained. ]

During normal operation, the [125/250] VDC load is powered from the 

battery chargers with the batteries floating on the system. In case of loss 

of normal power to the battery charger, the DC load is automatically 

powered from the station batteries. 

The [Train A and Train B] DC electrical power subsystems provide the 

control power for its associated Class 1E AC power load group, [4.16] kV 

switchgear, and [480] V load centers. The DC electrical power 

subsystems also provide DC electrical power to the inverters, which in 

turn power the AC vital buses. 

The DC power distribution system is described in more detail in Bases for 

LCO 3.8.9, "Distributions System - Operating," and for LCO 3.8.10, 

"Distribution Systems - Shutdown." 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Each 125/250 VDC battery is separately housed in a ventilated room 

apart from its charger and distribution centers. Each subsystem is 

located in an area separated physically and electrically from the other 

subsystem to ensure that a single failure in one subsystem does not 

cause a failure in a redundant subsystem. There is no sharing between 

redundant Class 1E subsystems, such as batteries, battery chargers, or 

distribution panels. 

Each battery has adequate storage capacity to meet the duty cycle(s) 

discussed in the FSAR, Chapter [8] (Ref 4). The battery is designed with 

additional capacity above that required by the design duty cycle to allow 

for temperature variations and other factors. 

The batteries for Train A and Train B DC electrical power subsystems are 

sized to produce required capacity at 80% of nameplate rating, 

corresponding to warranted capacity at end of life cycles and the 100% 

design demand. The minimum design voltage limit is 105/210 V. 

The battery cells are of flooded lead acid construction with a nominal 

specific gravity of [1.215]. This specific gravity corresponds to an open 

circuit battery voltage of approximately 120 V for a [58] cell battery (i.e., 

cell voltage of [2.065] volts per cell (Vpc)). The open circuit voltage is the 

voltage maintained when there is no charging or discharging. Once fully 

charged with its open circuit voltage ≥ [2.065] Vpc, the battery cell will 

maintain its capacity for [30] days without further charging per 

manufacturer's instructions. Optimal long term performance however, is 

obtained by maintaining a float voltage [2.20 to 2.25] Vpc. This provides 

adequate over-potential, which limits the formation of lead sulfate and self 

discharge. The nominal float voltage of [2.22] Vpc corresponds to a total 

float voltage output of [128.8] V for a [58] cell battery as discussed in the 

FSAR, Chapter [8] (Ref. 4). 

Each Train A and Train B DC electrical power subsystem battery charger 

has ample power output capacity for the steady state operation of 

connected loads required during normal operation, while at the same time 

maintaining its battery bank fully charged. Each battery charger also has 

sufficient excess capacity to restore the battery from the design minimum 

charge to its fully charged state within 24 hours while supplying normal 

steady state loads discussed in the FSAR, Chapter [8] (Ref. 4). 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The battery charger is normally in the float-charge mode. Float-charge is 

the condition in which the charger is supplying the connected loads and 

the battery cells are receiving adequate current to optimally charge the 

battery. This assures the internal losses of a battery are overcome and 

the battery is maintained in a fully charged state. 

When desired, the charger can be placed in the equalize mode. The 

equalize mode is at a higher voltage than the float mode and charging 

current is correspondingly higher. The battery charger is operated in the 

equalize mode after a battery discharge or for routine maintenance. 

Following a battery discharge, the battery recharge characteristic accepts 

current at the current limit of the battery charger (if the discharge was 

significant, e.g., following a battery service test) until the battery terminal 

voltage approaches the charger voltage setpoint. Charging current then 

reduces exponentially during the remainder of the recharge cycle. Leadcalcium batteries have recharge efficiencies of greater than 95%, so once 

at least 105% of the ampere-hours discharged have been returned, the 

battery capacity would be restored to the same condition as it was prior to 

the discharge. This can be monitored by direct observation of the 

exponentially decaying charging current or by evaluating the amp-hours 

discharged from the battery and amp-hours returned to the battery. 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 5) and Chapter [15] (Ref. 6), 

ANALYSES assume that Engineered Safety Feature (ESF) systems are OPERABLE. 

The DC electrical power system provides normal and emergency DC 

electrical power for the DGs, emergency auxiliaries, and control and 

switching during all MODES of operation. 

The OPERABILITY of the DC sources is consistent with the initial 

assumptions of the accident analyses and is based upon meeting the 

design basis of the unit. This includes maintaining the DC sources 

OPERABLE during accident conditions in the event of: 

a. An assumed loss of all offsite AC power or all onsite AC power and 

b. A worst-case single failure. 

The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-4 Rev. 3.0, 03/31/04 

BASES 

LCO The DC electrical power subsystems, each subsystem consisting of [two] 

batteries, battery charger [for each battery] and the corresponding control 

equipment and interconnecting cabling supplying power to the associated 

bus within the train are required to be OPERABLE to ensure the 

availability of the required power to shut down the reactor and maintain it 

in a safe condition after an anticipated operational occurrence (AOO) or a 

postulated DBA. Loss of any train DC electrical power subsystem does 

not prevent the minimum safety function from being performed (Ref. 4). 

An OPERABLE DC electrical power subsystem requires all required 

batteries and respective chargers to be operating and connected to the 

associated DC bus(es). 

APPLICABILITY The DC electrical power sources are required to be OPERABLE in 

MODES 1, 2, 3, and 4 to ensure safe unit operation and to ensure that: 

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and 

b. Adequate core cooling is provided, and containment integrity and 

other vital functions are maintained in the event of a postulated DBA. 

The DC electrical power requirements for MODES 5 and 6 are addressed 

in the Bases for LCO 3.8.5, "DC Sources - Shutdown." 

ACTIONS A.1, A.2, and A.3

Condition A represents one train with one [or two] battery chargers 

inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The 

ACTIONS provide a tiered response that focuses on returning the battery 

to the fully charged state and restoring a fully qualified charger to 

OPERABLE status in a reasonable time period. Required Action A.1 

requires that the battery terminal voltage be restored to greater than or 

equal to the minimum established float voltage within 2 hours. This time 

provides for returning the inoperable charger to OPERABLE status or 

providing an alternate means of restoring battery terminal voltage to 

greater than or equal to the minimum established float voltage. Restoring 

the battery terminal voltage to greater than or equal to the minimum 

established float voltage provides good assurance that, within [12] hours, 

the battery will be restored to its fully charged condition (Required Action 

A.2) from any discharge that might have occurred due to the charger 

inoperability. 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3). 

-------------------------------------------------------------------------------------------------- 

A discharged battery having terminal voltage of at least the minimum 

established float voltage indicates that the battery is on the exponential 

charging current portion (the second part) of its recharge cycle. The time 

to return a battery to its fully charged state under this condition is simply a 

function of the amount of the previous discharge and the recharge 

characteristic of the battery. Thus there is good assurance of fully 

recharging the battery within [12] hours, avoiding a premature shutdown 

with its own attendant risk. 

If established battery terminal float voltage cannot be restored to greater 

than or equal to the minimum established float voltage within 2 hours, and 

the charger is not operating in the current-limiting mode, a faulty charger 

is indicated. A faulty charger that is incapable of maintaining established 

battery terminal float voltage does not provide assurance that it can revert 

to and operate properly in the current limit mode that is necessary during 

the recovery period following a battery discharge event that the DC 

system is designed for. 

If the charger is operating in the current limit mode after 2 hours that is an 

indication that the battery is partially discharged and its capacity margins 

will be reduced. The time to return the battery to its fully charged 

condition in this case is a function of the battery charger capacity, the 

amount of loads on the associated DC system, the amount of the 

previous discharge, and the recharge characteristic of the battery. The 

charge time can be extensive, and there is not adequate assurance that it 

can be recharged within [12] hours (Required Action A.2). 

Required Action A.2 requires that the battery float current be verified as 

less than or equal to [2] amps. This indicates that, if the battery had been 

discharged as the result of the inoperable battery charger, it has now 

been fully recharged. If at the expiration of the initial [12] hour period the 

battery float current is not less than or equal to [2] amps this indicates 

there may be additional battery problems and the battery must be 

declared inoperable. 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Action A.3 limits the restoration time for the inoperable battery 

charger to 7 days. This action is applicable if an alternate means of 

restoring battery terminal voltage to greater than or equal to the minimum 

established float voltage has been used (e.g., balance of plant non-Class 

1E battery charger). The 7 day Completion Time reflects a reasonable 

time to effect restoration of the qualified battery charger to OPERABLE 

status. 

B.1

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The 2 hour Completion Times of Required Actions B.1 and C.1 are in 

brackets. Any licensee wishing to request a longer Completion Time will 

need to demonstrate that the longer Completion Time is appropriate for 

the plant in accordance with the guidance in Regulatory Guide (RG) 

1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: 

Technical Specifications." 

------------------------------------------------------------------------------------------------- 

Condition B represents one train with one [or two] batter[y][ies] 

inoperable. With one [or two] batter[y][ies] inoperable, the DC bus is 

being supplied by the OPERABLE battery charger[s]. Any event that 

results in a loss of the AC bus supporting the battery charger[s] will also 

result in loss of DC to that train. Recovery of the AC bus, especially if it is 

due to a loss of offsite power, will be hampered by the fact that many of 

the components necessary for the recovery (e.g., diesel generator control 

and field flash, AC load shed and diesel generator output circuit breakers, 

etc.) likely rely upon the batter[y][ies]. In addition the energization 

transients of any DC loads that are beyond the capability of the battery 

charger[s] and normally require the assistance of the batter[y][ies] will not 

be able to be brought online. The [2] hour limit allows sufficient time to 

effect restoration of an inoperable battery given that the majority of the 

conditions that lead to battery inoperability (e.g., loss of battery charger, 

battery cell voltage less than [2.07] V, etc.) are identified in Specifications 

3.8.4, 3.8.5, and 3.8.6 together with additional specific Completion Times. 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

Condition C represents one train with a loss of ability to completely 

respond to an event, and a potential loss of ability to remain energized 

during normal operation. It is therefore, imperative that the operator's 

attention focus on stabilizing the unit, minimizing the potential for 

complete loss of DC power to the affected train. The 2 hour limit is 

consistent with the allowed time for an inoperable DC distribution system 

train. 

If one of the required DC electrical power subsystems is inoperable for 

reasons other than Condition A or B (e.g., inoperable battery charger and 

associated inoperable battery), the remaining DC electrical power 

subsystem has the capacity to support a safe shutdown and to mitigate 

an accident condition. Since a subsequent worst case single failure 

could, however, result in the loss of minimum necessary DC electrical 

subsystems to mitigate a worst case accident, continued power operation 

should not exceed 2 hours. The 2 hour Completion Time is based on 

Regulatory Guide 1.93 (Ref. 7) and reflects a reasonable time to assess 

unit status as a function of the inoperable DC electrical power subsystem 

and, if the DC electrical power subsystem is not restored to OPERABLE 

status, to prepare to effect an orderly and safe unit shutdown. 

D.1 and D.2

If the inoperable DC electrical power subsystem cannot be restored to 

OPERABLE status within the required Completion Time, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and to 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging plant 

systems. The Completion Time to bring the unit to MODE 5 is consistent 

with the time required in Regulatory Guide 1.93 (Ref. 7). 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.8.4.1

REQUIREMENTS 

Verifying battery terminal voltage while on float charge helps to ensure 

the effectiveness of the battery chargers, which support the ability of the 

batteries to perform their intended function. Float charge is the condition 

in which the charger is supplying the continuous charge required to 

overcome the internal losses of a battery and maintain the battery in a 

fully charged state while supplying the continuous steady state loads of 

the associated DC subsystem. On float charge, battery cells will receive 

adequate current to optimally charge the battery. The voltage 

requirements are based on the nominal design voltage of the battery and 

are consistent with the minimum float voltage established by the battery 

manufacturer ([2.20] Vpc or [127.6] V at the battery terminals). This 

voltage maintains the battery plates in a condition that supports 

maintaining the grid life (expected to be approximately 20 years). The 

7 day Frequency is consistent with manufacturer recommendations and 

IEEE-450 (Ref. 8). 

SR 3.8.4.2

This SR verifies the design capacity of the battery chargers. According to 

Regulatory Guide 1.32 (Ref. 9), the battery charger supply is 

recommended to be based on the largest combined demands of the 

various steady state loads and the charging capacity to restore the 

battery from the design minimum charge state to the fully charged state, 

irrespective of the status of the unit during these demand occurrences. 

The minimum required amperes and duration ensure that these 

requirements can be satisfied. 

This SR provides two options. One option requires that each battery 

charger be capable of supplying [400] amps at the minimum established 

float voltage for [8] hours. The ampere requirements are based on the 

output rating of the chargers. The voltage requirements are based on the 

charger voltage level after a response to a loss of AC power. The time 

period if sufficient for the charger temperature to have stabilized and to 

have been maintained for at least [2] hours. 

The other option requires that each battery charger be capable of 

recharging the battery after a service test coincident with supplying the 

largest coincident demands of the various continuous steady state loads 

(irrespective of the status of the plant during which these demands 

occur). This level of loading may not normally be available following the 

battery service test and will need to be supplemented with additional 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

loads. The duration for this test may be longer than the charger sizing 

criteria since the battery recharge is affected by float voltage, 

temperature, and the exponential decay in charging current. The battery 

is recharged when the measured charging current is ≤ [2] amps. 

The Surveillance Frequency is acceptable, given the unit conditions 

required to perform the test and the other administrative controls existing 

to ensure adequate charger performance during these [18 month] 

intervals. In addition, this Frequency is intended to be consistent with 

expected fuel cycle lengths. 

SR 3.8.4.3

A battery service test is a special test of the battery capability, as found, 

to satisfy the design requirements (battery duty cycle) of the DC electrical 

power system. The discharge rate and test length should correspond to 

the design duty cycle requirements as specified in Reference 4. 

The Surveillance Frequency of [18 months] is consistent with the 

recommendations of Regulatory Guide 1.32 (Ref. 9) and Regulatory 

Guide 1.129 (Ref. 10), which state that the battery service test should be 

performed during refueling operations, or at some other outage, with 

intervals between tests not to exceed [18 months]. 

This SR is modified by two Notes. Note 1 allows the performance of a 

modified performance discharge test in lieu of a service test. 

The reason for Note 2 is that performing the Surveillance would perturb 

the electrical distribution system and challenge safety systems. This 

restriction from normally performing the Surveillance in MODE 1 or 2 is 

further amplified to allow portions of the Surveillance to be performed for 

the purpose of reestablishing OPERABILITY (e.g., post work testing 

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed partial 

Surveillance, a successful partial Surveillance, and a perturbation of the 

offsite or onsite system when they are tied together or operated 
DC Sources - Operating 

B 3.8.4 

BWOG STS B 3.8.4-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

independently for the partial Surveillance; as well as the operator 

procedures available to cope with these outcomes. These shall be 

measured against the avoided risk of a plant shutdown and startup to 

determine that plant safety is maintained or enhanced when portions of 

the Surveillance are performed in MODE 1 or 2. Risk insights or 

deterministic methods may be used for the assessment. Credit may be 

taken for unplanned event that satisfy this SR. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17. 

 2. Regulatory Guide 1.6, March 10, 1971. 

 3. IEEE-308-[1978]. 

 4. FSAR, Chapter [8]. 

 5. FSAR, Chapter [6]. 

 6. FSAR, Chapter [15]. 

 7. Regulatory Guide 1.93, December 1974. 

 8. IEEE-450-[1995]. 

 9. Regulatory Guide 1.32, February 1977. 

 10. Regulatory Guide 1.129, December 1974.
DC Sources - Shutdown 

B 3.8.5 

BWOG STS B 3.8.5-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.5 DC Sources - Shutdown 

BASES 

BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, 

"DC Sources - Operating." 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [15] (Ref. 2), 

ANALYSES assume that Engineered Safety Feature (ESF) systems are OPERABLE. 

The DC electrical power system provides normal and emergency DC 

electrical power for the DGs, emergency auxiliaries, and control and 

switching during all MODES of operation. 

The OPERABILITY of the DC subsystems is consistent with the initial 

assumptions of the accident analyses and the requirements for the 

supported systems' OPERABILITY. 

The OPERABILITY of the minimum DC electrical power sources during 

MODES 5 and 6 and during movement of [recently] irradiated fuel 

assemblies ensures that: 

a. The unit can be maintained in the shutdown or refueling condition for 

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and 

c. Adequate DC electrical power is provided to mitigate events 

postulated during shutdown, such as a fuel handling accident 

[involving handling recently irradiated fuel. Due to radioactive decay, 

DC electrical power is only required to mitigate fuel handling 

accidents involving handling recently irradiated fuel (i.e., fuel that has 

occupied part of a critical reactor core within the previous [X] days)]. 

In general, when the unit is shut down, the Technical Specifications 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or all onsite power is not required. 

The rationale for this is based on the fact that many DBAs that are 

analyzed in MODES [1, 2, 3, and 4] have no specific analyses in 
DC Sources - Shutdown 

B 3.8.5 

BWOG STS B 3.8.5-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

MODES [5 and 6] because the energy contained within the reactor 

pressure boundary, reactor coolant temperature and pressure, and the 

corresponding stresses result in the probabilities of occurrence being 

significantly reduced or eliminated, and in minimal consequences. These 

deviations from DBA analysis assumptions and design requirements 

during shutdown conditions are allowed by the LCO for required systems. 

The shutdown Technical Specification requirements are designed to 

ensure that the unit has the capability to mitigate the consequences of 

certain postulated accidents. Worst case DBAs which are analyzed for 

operating MODES are generally viewed not to be a significant concern 

during shutdown MODES due to the lower energies involved. The 

Technical Specifications therefore require a lesser complement of 

electrical equipment to be available during shutdown than is required 

during operating MODES. More recent work completed on the potential 

risks associated with shutdown, however, have found significant risk 

associated with certain shutdown evolutions. As a result, in addition to 

the requirements established in the Technical Specifications, the industry 

has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess 

Shutdown Management," as an Industry initiative to manage shutdown 

tasks and associated electrical support to maintain risk at an acceptable 

low level. This may require the availability of additional equipment 

beyond that required by the shutdown Technical Specifications. 

The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The DC electrical power subsystems, [each required] [the required] 

subsystem consisting of two batteries, one battery charger per battery, 

and the corresponding control equipment and interconnecting cabling 

within the train, [are] [is] required to be OPERABLE to support [required] 

[one] train[s] of the distribution systems [required OPERABLE by 

LCO 3.8.10, "Distribution Systems - Shutdown."] This ensures the 

availability of sufficient DC electrical power sources to operate the unit in 

a safe manner and to mitigate the consequences of postulated events 

during shutdown (e.g., fuel handling accidents [involving handling recently 

irradiated fuel]). 
DC Sources - Shutdown 

B 3.8.5 

BWOG STS B 3.8.5-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 5 

and 6 and during movement of [recently] irradiated fuel assemblies, 

provide assurance that: 

a. Required features to provide adequate coolant inventory makeup are 

available for the irradiated fuel assemblies in the core, 

b. Required features needed to mitigate a fuel handling accident 

[involving handling recently irradiated fuel (i.e., fuel that has occupied 

part of a critical reactor core within the previous [X] days)] are 

available, 

c. Required features necessary to mitigate the effects of events that can 

lead to core damage during shutdown are available, and 

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition. 

The DC electrical power requirements for MODES 1, 2, 3, and 4 are 

covered in LCO 3.8.4. 

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily. 

A.1, A.2, and A.3

-----------------------------------REVIEWER’S NOTE----------------------------------- 

ACTION A is included only when plant-specific implementation of 

LCO 3.8.5 includes the potential to require both trains of the DC System 

to be OPERABLE. If plant-specific implementation results in LCO 3.8.5 

requiring only one train of the DC System to be OPERABLE, then 

ACTION A is omitted and ACTION B is renumbered as ACTION A. 

-------------------------------------------------------------------------------------------------- 
DC Sources - Shutdown 

B 3.8.5 

BWOG STS B 3.8.5-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition A represents one train with one [or two] battery chargers 

inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The 

ACTIONS provide a tiered response that focuses on returning the battery 

to the fully charged state and restoring a fully qualified charger to 

OPERABLE status in a reasonable time period. Required Action A.1 

requires that the battery terminal voltage be restored to greater than or 

equal to the minimum established float voltage within 2 hours. This time 

provides for returning the inoperable charger to OPERABLE status or 

providing an alternate means of restoring battery terminal voltage to 

greater than or equal to the minimum established float voltage. Restoring 

the battery terminal voltage to greater than or equal to the minimum 

established float voltage provides good assurance that, within [12] hours, 

the battery will be restored to its fully charged condition (Required Action 

A.2) from any discharge that might have occurred due to the charger 

inoperability. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3). 

-------------------------------------------------------------------------------------------------- 

A discharged battery having terminal voltage of at least the minimum 

established float voltage indicates that the battery is on the exponential 

charging current portion (the second part) of its recharge cycle. The time 

to return a battery to its fully charged state under this condition is simply a 

function of the amount of the previous discharge and the recharge 

characteristic of the battery. Thus there is good assurance of fully 

recharging the battery within [12] hours, avoiding a premature shutdown 

with its own attendant risk. 

If established battery terminal float voltage cannot be restored to greater 

than or equal to the minimum established float voltage within 2 hours, and 

the charger is not operating in the current-limiting modes, a faulty charger 

is indicated. A faulty charger that is incapable of maintaining established 

battery terminal float voltage does not provide assurance that it can revert 

to and operate properly in the current limit modes that is necessary during 

the recovery period following a battery discharge event that the DC 

system is designed for. 
DC Sources - Shutdown 

B 3.8.5 

BWOG STS B 3.8.5-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

If the charger is operating in the current limit mode after 2 hours that is an 

indication that the battery is partially discharged and its capacity margins 

will be reduced. The time to return the battery to its fully charged 

condition in this case is a function of the battery charger capacity, the 

amount of loads on the associated DC system, the amount of the 

previous discharge, and the recharge characteristic of the battery. The 

charge time can be extensive, and there is not adequate assurance that it 

can be recharged within [12] hours (Required Action A.2). 

Required Action A.2 requires that the battery float current be verified as 

less than or equal to [2] amps. This indicates that, if the battery had been 

discharged as the result of the inoperable battery charger, it has now 

been fully recharged. If at the expiration of the initial [12] hour period the 

battery float current is not less than or equal to [2] amps this indicates 

there may be additional battery problems and the battery must be 

declared inoperable. 

Required Action A.3 limits the restoration time for the inoperable battery 

charger to 7 days. This action is applicable if an alternate means of 

restoring battery terminal voltage to greater than or equal to the minimum 

established float voltage has been used (e.g., balance of plant non-Class 

1E battery charger). The 7 day Completion Time reflects a reasonable 

time to effect restoration of the qualified battery charger to OPERABLE 

status. 

B.1, B.2.1, B.2.2, B.2.3, and B.2.4

[If two trains are required by LCO 3.8.10, the remaining train with DC 

power available may be capable of supporting sufficient systems to allow 

continuation of CORE ALTERATIONS and [recently] irradiated fuel 

movement]. By allowing the option to declare required features 

inoperable with the associated DC power source(s) inoperable, 

appropriate restrictions will be implemented in accordance with the 

affected required features LCO ACTIONS. In many instances this option 

may involve undesired administrative efforts. Therefore, the allowance 

for sufficiently conservative actions is made (i.e., to suspend CORE 

ALTERATIONS, movement of [recently] irradiated fuel assemblies, and 

operations involving positive reactivity additions that could result in 
DC Sources - Shutdown 

B 3.8.5 

BWOG STS B 3.8.5-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

loss of required SDM (MODE 5) or boron concentration (MODE 6).] 

Suspending positive reactivity additions that could result in failure to meet 

the minimum SDM or boron concentration limit is required to assure 

continued safe operation. Introduction of coolant inventory must be from 

sources that have a boron concentration greater than that what would be 

required in the RCS for minimum SDM or refueling boron concentration. 

This may result in an overall reduction in RCS boron concentration, but 

provides acceptable margin to maintaining subcritical operation. 

Introduction of temperature changes including temperature increases 

when operating with a positive MTC must also be evaluated to ensure 

they do not result in a loss of required SDM. 

Suspension of these activities shall not preclude completion of actions to 

establish a safe conservative condition. These actions minimize 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required DC electrical power 

subsystem[s] and to continue this action until restoration is accomplished 

in order to provide the necessary DC electrical power to the unit safety 

systems. 

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required DC 

electrical power subsystems should be completed as quickly as possible 

in order to minimize the time during which the unit safety systems may be 

without sufficient power. 

SURVEILLANCE SR 3.8.5.1

REQUIREMENTS 

SR 3.8.5.1 requires performance of all Surveillances required by 

SR 3.8.4.1 through SR 3.8.4.3. Therefore, see the corresponding Bases 

for LCO 3.8.4 for a discussion of each SR. 

This SR is modified by a Note. The reason for the Note is to preclude 

requiring the OPERABLE DC sources from being discharged below their 

capability to provide the required power supply or otherwise rendered 

inoperable during the performance of SRs. It is the intent that these SRs 

must still be capable of being met, but actual performance is not required. 

REFERENCES 1. FSAR, Chapter [6]. 

 2. FSAR, Chapter [15]. 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.6 Battery Parameters 

BASES 

BACKGROUND This LCO delineates the limits on battery float current as well as 

electrolyte temperature, level, and float voltage for the DC power 

subsystem batteries. A discussion of these batteries and their 

OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC 

Sources - Operating," and LCO 3.8.5, "DC Sources - Shutdown." In 

addition to the limitations of this Specification, the [licensee controlled 

program] also implements a program specified in Specification 5.5.17 for 

monitoring various battery parameters that is based on the 

recommendations of IEEE Standard 450-1995, "IEEE Recommended 

Practice For Maintenance, Testing, And Replacement Of Vented LeadAcid Batteries For Stationary Applications" (Ref. 1). 

The battery cells are of flooded lead acid construction with a nominal 

specific gravity of [1.215]. This specific gravity corresponds to an open 

circuit battery voltage of approximately 120 V for [58] cell battery (i.e., cell 

voltage of [2.065] volts per cell (Vpc)). The open circuit voltage is the 

voltage maintained when there is no charging or discharging. Once fully 

charged with its open circuit voltage ≥ [2.065] Vpc, the battery cell will 

maintain its capacity for [30] days without further charging per 

manufacturer's instructions. Optimal long term performance however, is 

obtained by maintaining a float voltage [2.20 to 2.25] Vpc. This provides 

adequate over-potential which limits the formation of lead sulfate and self 

discharge. The nominal float voltage of [2.22] Vpc corresponds to a total 

float voltage output of [128.8] V for a [58] cell battery as discussed in the 

FSAR, Chapter [8] (Ref. 2). 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 3) and Chapter [15] (Ref. 4), 

ANALYSES assume Engineered Safety Feature systems are OPERABLE. The DC 

electrical power system provides normal and emergency DC electrical 

power for the DGs, emergency auxiliaries, and control and switching 

during all MODES of operation. 

The OPERABILITY of the DC subsystems is consistent with the initial 

assumptions of the accident analyses and is based upon meeting the 

design basis of the unit. This includes maintaining at least one train of 

DC sources OPERABLE during accident conditions, in the event of: 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

a. An assumed loss of all offsite AC power or all onsite AC power and 

b. A worst-case single failure. 

Battery parameters satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Battery parameters must remain within acceptable limits to ensure 

availability of the required DC power to shut down the reactor and 

maintain it in a safe condition after an anticipated operational occurrence 

or a postulated DBA. Battery parameter limits are conservatively 

established, allowing continued DC electrical system function even with 

limits not met. Additional preventative maintenance, testing, and 

monitoring performed in accordance with the [licensee controlled 

program] is conducted as specified in Specification 5.5.17. 

APPLICABILITY The battery parameters are required solely for the support of the 

associated DC electrical power subsystems. Therefore, battery 

parameter limits are only required when the DC power source is required 

to be OPERABLE. Refer to the Applicability discussion in Bases for 

LCO 3.8.4 and LCO 3.8.5. 

ACTIONS A.1, A.2, and A.3

With one or more cells in one or more batteries in one train < [2.07] V, the 

battery cell is degraded. Within 2 hours verification of the required battery 

charger OPERABILITY is made by monitoring the battery terminal voltage 

(SR 3.8.4.1) and of the overall battery state of charge by monitoring the 

battery float charge current (SR 3.8.6.1). This assures that there is still 

sufficient battery capacity to perform the intended function. Therefore, 

the affected battery is not required to be considered inoperable solely as 

a result of one or more cells in one or more batteries < [2.07] V, and 

continued operation is permitted for a limited period up to 24 hours. 

Since the Required Actions only specify "perform," a failure of SR 3.8.4.1 

or SR 3.8.6.1 acceptance criteria does not result in this Required Action 

not met. However, if one of the SRs is failed the appropriate Condition(s), 

depending on the cause of the failures, is entered. If SR 3.8.6.1 is failed 

then there is not assurance that there is still sufficient battery capacity to 

perform the intended function and the battery must be declared 

inoperable immediately. 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

One or more batteries in one train with float current > [2] amps indicates 

that a partial discharge of the battery capacity has occurred. This may be 

due to a temporary loss of a battery charger or possibly due to one or 

more battery cells in a low voltage condition reflecting some loss of 

capacity. Within 2 hours verification of the required battery charger 

OPERABILITY is made by monitoring the battery terminal voltage. If the 

terminal voltage is found to be less than the minimum established float 

voltage there are two possibilities, the battery charger is inoperable or is 

operating in the current limit mode. Condition A addresses charger 

inoperability. If the charger is operating in the current limit mode after 

2 hours that is an indication that the battery has been substantially 

discharged and likely cannot perform its required design functions. The 

time to return the battery to its fully charged condition in this case is a 

function of the battery charger capacity, the amount of loads on the 

associated DC system, the amount of the previous discharge, and the 

recharge characteristic of the battery. The charge time can be extensive, 

and there is not adequate assurance that it can be recharged within 

[12] hours (Required Action B.2). The battery must therefore be declared 

inoperable. 

If the float voltage is found to be satisfactory but there are one or more 

battery cells with float voltage less than [2.07] V, the associated "OR" 

statement in Condition F is applicable and the battery must be declared 

inoperable immediately. If float voltage is satisfactory and there are no 

cells less than [2.07] V there is good assurance that, within [12] hours, the 

battery will be restored to its fully charged condition (Required Action B.2) 

from any discharge that might have occurred due to a temporary loss of 

the battery charger. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3). 

-------------------------------------------------------------------------------------------------- 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A discharged battery with float voltage (the charger setpoint) across its 

terminals indicates that the battery is on the exponential charging current 

portion (the second part) of its recharge cycle. The time to return a 

battery to its fully charged state under this condition is simply a function of 

the amount of the previous discharge and the recharge characteristic of 

the battery. Thus there is good assurance of fully recharging the battery 

within [12] hours, avoiding a premature shutdown with its own attendant 

risk. 

If the condition is due to one or more cells in a low voltage condition but 

still greater than [2.07] V and float voltage is found to be satisfactory, this 

is not indication of a substantially discharged battery and [12] hours is a 

reasonable time prior to declaring the battery inoperable. 

Since Required Action B.1 only specifies "perform," a failure of SR 3.8.4.1 

acceptance criteria does not result in the Required Action not met. 

However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending 

on the cause of the failure, is entered. 

C.1, C.2, and C.3

With one or more batteries in one train with one or more cells electrolyte 

level above the top of the plates, but below the minimum established 

design limits, the battery still retains sufficient capacity to perform the 

intended function. Therefore, the affected battery is not required to be 

considered inoperable solely as a result of electrolyte level not met. 

Within 31 days the minimum established design limits for electrolyte level 

must be re-established. 

With electrolyte level below the top of the plates there is a potential for 

dryout and plate degradation. Required Actions C.1 and C.2 address this 

potential (as well as provisions in Specification 5.5.17, Battery Monitoring 

and Maintenance Program). They are modified by a Note that indicates 

they are only applicable if electrolyte level is below the top of the plates. 

Within 8 hours level is required to be restored to above the top of the 

plates. The Required Action C.2 requirement to verify that there is no 

leakage by visual inspection and the Specification 5.5.17.b item to initiate 

action to equalize and test in accordance with manufacturer's 

recommendation are taken from Annex D of IEEE Standard 450-1995. 

They are performed following the restoration of the electrolyte level to 

above the top of the plates. Based on the results of the manufacturer's 

recommended testing the batter[y][ies] may have to be declared 

inoperable and the affected cell[s] replaced. 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1

With one or more batteries in one train with pilot cell temperature less 

than the minimum established design limits, 12 hours is allowed to restore 

the temperature to within limits. A low electrolyte temperature limits the 

current and power available. Since the battery is sized with margin, while 

battery capacity is degraded, sufficient capacity exists to perform the 

intended function and the affected battery is not required to be considered 

inoperable solely as a result of the pilot cell temperature not met. 

E.1

With one or more batteries in redundant trains with battery parameters 

not within limits there is not sufficient assurance that battery capacity has 

not been affected to the degree that the batteries can still perform their 

required function, given that redundant batteries are involved. With 

redundant batteries involved this potential could result in a total loss of 

function on multiple systems that rely upon the batteries. The longer 

Completion Times specified for battery parameters on non-redundant 

batteries not within limits are therefore not appropriate, and the 

parameters must be restored to within limits on at least one train within 

2 hours. 

F.1

With one or more batteries with any battery parameter outside the 

allowances of the Required Actions for Condition A, B, C, D, or E, 

sufficient capacity to supply the maximum expected load requirement is 

not assured and the corresponding battery must be declared inoperable. 

Additionally, discovering one or more batteries in one train with one or 

more battery cells float voltage less than [2.07] V and float current greater 

than [2] amps indicates that the battery capacity may not be sufficient to 

perform the intended functions. The battery must therefore be declared 

inoperable immediately. 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.8.6.1

REQUIREMENTS 

Verifying battery float current while on float charge is used to determine 

the state of charge of the battery. Float charge is the condition in which 

the charger is supplying the continuous charge required to overcome the 

internal losses of a battery and maintain the battery in a charged state. 

The float current requirements are based on the float current indicative of 

a charged battery. Use of float current to determine the state of charge of 

the battery is consistent with IEEE-450 (Ref. 1). The 7 day Frequency is 

consistent with IEEE-450 (Ref. 1). 

This SR is modified by a Note that states the float current requirement is 

not required to be met when battery terminal voltage is less than the 

minimum established float voltage of SR 3.8.4.1. When this float voltage 

is not maintained the Required Actions of LCO 3.8.4 ACTION A are being 

taken, which provide the necessary and appropriate verifications of the 

battery condition. Furthermore, the float current limit of [2] amps is 

established based on the nominal float voltage value and is not directly 

applicable when this voltage is not maintained. 

SR 3.8.6.2 and SR 3.8.6.5

Optimal long term battery performance is obtained by maintaining a float 

voltage greater than or equal to the minimum established design limits 

provided by the battery manufacturer, which corresponds to [130.5] V at 

the battery terminals, or [2.25] Vpc. This provides adequate overpotential, which limits the formation of lead sulfate and self discharge, 

which could eventually render the battery inoperable. Float voltages in 

this range or less, but greater than [2.07] Vpc, are addressed in 

Specification 5.5.17. SRs 3.8.6.2 and 3.8.6.5 require verification that the 

cell float voltages are equal to or greater than the short term absolute 

minimum voltage of [2.07] V. The Frequency for cell voltage verification 

every 31 days for pilot cell and 92 days for each connected cell is 

consistent with IEEE-450 (Ref. 1). 

SR 3.8.6.3

The limit specified for electrolyte level ensures that the plates suffer no 

physical damage and maintains adequate electron transfer capability. 

The Frequency is consistent with IEEE-450 (Ref. 1). 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.6.4

This Surveillance verifies that the pilot cell temperature is greater than or 

equal to the minimum established design limit (i.e., [40]°F). Pilot cell 

electrolyte temperature is maintained above this temperature to assure 

the battery can provide the required current and voltage to meet the 

design requirements. Temperatures lower than assumed in battery sizing 

calculations act to inhibit or reduce battery capacity. The Frequency is 

consistent with IEEE-450 (Ref. 1). 

SR 3.8.6.6

A battery performance discharge test is a test of constant current capacity 

of a battery, normally done in the as found condition, after having been in 

service, to detect any change in the capacity determined by the 

acceptance test. The test is intended to determine overall battery 

degradation due to age and usage. 

Either the battery performance discharge test or the modified 

performance discharge test is acceptable for satisfying SR 3.8.6.6; 

however, only the modified performance discharge test may be used to 

satisfy the battery service test requirements of SR 3.8.4.3. 

A modified discharge test is a test of the battery capacity and its ability to 

provide a high rate, short duration load (usually the highest rate of the 

duty cycle). This will often confirm the battery's ability to meet the critical 

period of the load duty cycle, in addition to determining its percentage of 

rated capacity. Initial conditions for the modified performance discharge 

test should be identical to those specified for a service test. 

It may consist of just two rates; for instance the one minute rate for the 

battery or the largest current load of the duty cycle, followed by the test 

rate employed for the performance test, both of which envelope the duty 

cycle of the service test. Since the ampere-hours removed by a one 

minute discharge represents a very small portion of the battery capacity, 

the test rate can be changed to that for the performance test without 

compromising the results of the performance discharge test. The battery 

terminal voltage for the modified performance discharge test must remain 

above the minimum battery terminal voltage specified in the battery 

service test for the duration of time equal to that of the service test. 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The acceptance criteria for this Surveillance are consistent with IEEE-450 

(Ref. 1) and IEEE-485 (Ref. 5). These references recommend that the 

battery be replaced if its capacity is below 80% of the manufacturer's 

rating. A capacity of 80% shows that the battery rate of deterioration is 

increasing, even if there is ample capacity to meet the load requirements. 

Furthermore, the battery is sized to meet the assumed duty cycle loads 

when the battery design capacity reaches this [80]% limit. 

The Surveillance Frequency for this test is normally 60 months. If the 

battery shows degradation, or if the battery has reached 85% of its 

expected life and capacity is < 100% of the manufacturer's rating, the 

Surveillance Frequency is reduced to 12 months. However, if the battery 

shows no degradation but has reached 85% of its expected life, the 

Surveillance Frequency is only reduced to 24 months for batteries that 

retain capacity ≥ 100% of the manufacturer's ratings. Degradation is 

indicated, according to IEEE-450 (Ref. 1), when the battery capacity 

drops by more than 10% relative to its capacity on the previous 

performance test or when it is ≥ [10%] below the manufacturer's rating. 

These Frequencies are consistent with the recommendations in IEEE-450 

(Ref. 1). 

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would perturb the electrical distribution system and 

challenge safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR. 
Battery Parameters 

B 3.8.6 

BWOG STS B 3.8.6-9 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. IEEE-450-[1995]. 

 2. FSAR, Chapter [8]. 

 3. FSAR, Chapter [6]. 

 4. FSAR, Chapter [15]. 

 5. IEEE-485-[1983], June 1983. 
Inverters - Operating 

B 3.8.7 

BWOG STS B 3.8.7-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.7 Inverters - Operating 

BASES 

BACKGROUND The inverters are the preferred source of power for the AC vital buses 

because of the stability and reliability they achieve. The function of the 

inverter is to provide AC electrical power to the vital bus. The inverters 

can be powered from an internal AC source/rectifier or from the station 

battery. The station battery provides an uninterruptible power source for 

the instrumentation and controls for the Reactor Protection System (RPS) 

and the Engineered Safety Feature Actuation System (ESFAS). Specific 

details on inverters and their operating characteristics are found in FSAR, 

Chapter [8] (Ref. 1). 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 2), and Chapter [14] (Ref. 3), 

ANALYSES assume Engineered Safety Feature systems are OPERABLE. The 

inverters are designed to provide the required capacity, capability, 

redundancy, and reliability to ensure the availability of necessary power to 

the RPS and ESFAS instrumentation and controls so that the fuel, 

Reactor Coolant System, and containment design limits are not 

exceeded. These limits are discussed in more detail in the Bases for 

Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant 

System (RCS); and Section 3.6, Containment Systems. 

The OPERABILITY of the inverters is consistent with the initial 

assumptions of the accident analyses and is based on meeting the design 

basis of the unit. This includes maintaining required AC vital buses 

OPERABLE during accident conditions in the event of: 

a. An assumed loss of all offsite AC electrical power or all onsite AC 

electrical power and 

b. A worst-case single failure. 

Inverters are a part of the distribution system and, as such, satisfy 

Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The inverters ensure the availability of AC electrical power for the 

systems instrumentation required to shut down the reactor and maintain it 

in a safe condition after an anticipated operational occurrence (AOO) or a 

postulated DBA. 
Inverters - Operating 

B 3.8.7 

BWOG STS B 3.8.7-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Maintaining the required inverters OPERABLE ensures that the 

redundancy incorporated into the design of the RPS and ESFAS 

instrumentation and controls is maintained. The four inverters [(two per 

train)] ensure an uninterruptible supply of AC electrical power to the AC 

vital buses even if the 4.16 kV safety buses are de-energized. 

OPERABLE inverters require the associated vital bus to be powered by 

the inverter with output voltage and frequency within tolerances, and 

power input to the inverter from a [125 VDC] station battery. Alternatively, 

power supply may be from an internal AC source via rectifier as long as 

the station battery is available as the uninterruptible power supply. 

This LCO is modified by a Note that allows [one/two] inverters to be 

disconnected from a [common] battery for ≥ 24 hours, if the vital bus(es) 

is powered from a [Class 1E constant voltage transformer or inverter 

using internal AC source] during the period and all other inverters are 

operable. This allows an equalizing charge to be placed on one battery. 

If the inverters were not disconnected, the resulting voltage condition 

might damage the inverter[s]. These provisions minimize the loss of 

equipment that would occur in the event of a loss of offsite power. The 

24 hour time period for the allowance minimizes the time during which a 

loss of offsite power could result in the loss of equipment energized from 

the affected AC vital bus while taking into consideration the time required 

to perform an equalizing charge on the battery bank. 

The intent of this Note is to limit the number of inverters that may be 

disconnected. Only those inverters associated with the single battery 

undergoing an equalizing charge may be disconnected. All other 

inverters must be aligned to their associated batteries, regardless of the 

number of inverters or unit design. 

APPLICABILITY The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to 

ensure that: 

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and 

b. Adequate core cooling is provided, and containment OPERABILITY 

and other vital functions are maintained in the event of a postulated 

DBA. 

Inverter requirements for MODES 5 and 6 are covered in the Bases for 

LCO 3.8.8, "Inverters - Shutdown." 
Inverters - Operating 

B 3.8.7 

BWOG STS B 3.8.7-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With a required inverter inoperable, its associated AC vital bus becomes 

inoperable until it is [manually] re-energized from its [Class 1E constant 

voltage source transformer or inverter using internal AC source]. 

For this reason, a Note has been included in Condition A requiring entry 

into the Conditions and Required Actions of LCO 3.8.9, "Distribution 

Systems - Operating." This ensures the vital bus is re-energized within 

2 hours. Required Action A.1 allows 24 hours to fix the inoperable 

inverter and return it to service. The 24 hour limit is based upon 

engineering judgment, taking into consideration the time required to repair 

an inverter and the additional risk to which the unit is exposed because of 

the inverter inoperability. This has to be balanced against the risk of an 

immediate shutdown, along with the potential challenges to safety 

systems such a shutdown might entail. When the AC vital bus is powered 

from its constant voltage source, it is relying upon interruptible AC 

electrical power sources (offsite and onsite). The uninterruptible inverter 

source to the AC vital buses is the preferred source for powering 

instrumentation trip setpoint devices. 

B.1 and B.2

If the inoperable devices or components cannot be restored to 

OPERABLE status within the required Completion Time, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and to 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE SR 3.8.7.1

REQUIREMENTS 

This Surveillance verifies that the inverters are functioning properly with 

all required circuit breakers closed and AC vital buses energized from the 

inverter. The verification of proper voltage and frequency output ensures 

that the required power is readily available for the instrumentation of the 

RPS and ESFAS connected to the AC vital buses. The 7 day Frequency 

takes into account the redundant capability of the inverters and other 

indications available in the control room that alert the operator to inverter 

malfunctions. 
Inverters - Operating 

B 3.8.7 

BWOG STS B 3.8.7-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Chapter [8]. 

 2. FSAR, Chapter [6]. 

 3. FSAR, Chapter [14]. 
Inverters - Shutdown 

B 3.8.8 

BWOG STS B 3.8.8-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.8 Inverters - Shutdown 

BASES 

BACKGROUND A description of the inverters is provided in the Bases for LCO 3.8.7, 

"Inverters - Operating." 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [14] (Ref. 2), 

ANALYSES assume Engineered Safety Feature systems are OPERABLE. The DC to 

AC inverters are designed to provide the required capacity, capability, 

redundancy, and reliability to ensure the availability of necessary power to 

the Reactor Protection System and Engineered Safety Features Actuation 

System (ESFAS) instrumentation and controls so that the fuel, Reactor 

Coolant System, and containment design limits are not exceeded. 

The OPERABILITY of the inverters is consistent with the initial 

assumptions of the accident analyses and the requirements for the 

supported systems' OPERABILITY. 

The OPERABILITY of the minimum inverters to each AC vital bus during 

MODES 5 and 6 ensures that: 

a. The unit can be maintained in the shutdown or refueling condition for 

extended periods, 

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and 

c. Adequate power is available to mitigate events postulated during 

shutdown, such as a fuel handling accident [involving handling 

recently irradiated fuel. Due to radioactive decay, the inverters are 

only required to mitigate fuel handling accidents involving handling 

recently irradiated fuel (i.e., fuel that has occupied part of a critical 

reactor core within the previous [X] days)]. 

In general, when the unit is shut down, the Technical Specification 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or all onsite power is not required. 

The rationale for this is based on the fact that many DBAs that are 

analyzed in MODES [1, 2, 3, and 4] have no specific analyses in 
Inverters - Shutdown 

B 3.8.8 

BWOG STS B 3.8.8-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

MODES [5 and 6] because the energy contained within the reactor 

pressure boundary, reactor coolant temperature and pressure, and the 

corresponding stresses result in the probabilities of occurrence being 

significantly reduced or eliminated, and in minimal consequences. These 

deviations from DBA analysis assumptions and design requirements 

during shutdown conditions are allowed by the LCO for required systems. 

The shutdown Technical Specification requirements are designed to 

ensure that the unit has the capability to mitigate the consequences of 

certain postulated accidents. Worst case DBAs which are analyzed for 

operating MODES are generally viewed not to be a significant concern 

during shutdown MODES due to the lower energies involved. The 

Technical Specifications therefore require a lesser complement of 

electrical equipment to be available during shutdown than is required 

during operating MODES. More recent work completed on the potential 

risks associated with shutdown, however, have found significant risk 

associated with certain shutdown evolutions. As a result, in addition to 

the requirements established in the Technical Specifications, the industry 

has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess 

Shutdown Management," as an Industry initiative to manage shutdown 

tasks and associated electrical support to maintain risk at an acceptable 

low level. This may require the availability of additional equipment 

beyond that required by the shutdown Technical Specifications. 

The inverters were previously identified as part of the distribution system 

and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The inverter[s] ensure the availability of electrical power for the 

instrumentation for systems required to shut down the reactor and 

maintain it in a safe condition after an anticipated operational occurrence 

or a postulated DBA. The battery powered inverter[s] provide[s] 

uninterruptible supply of AC electrical power to the AC vital bus[es] even 

if the 4.16 kV safety buses are de-energized. OPERABILITY of the 

inverter[s] requires that the vital bus be powered by the inverter. This 

ensures the availability of sufficient inverter power sources to operate the 

unit in a safe manner and to mitigate the consequences of postulated 

events during shutdown (e.g., fuel handling accidents [involving handling 

recently irradiated fuel]). 
Inverters - Shutdown 

B 3.8.8 

BWOG STS B 3.8.8-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The inverter[s] required to be OPERABLE in MODES 5 and 6, and during 

movement of [recently] irradiated fuel assemblies provide assurance that: 

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel in the core, 

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available, 

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and 

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition. 

Inverter requirements for MODES 1, 2, 3, and 4 are covered in 

LCO 3.8.7. 

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily. 

A.1, A.2.1, A.2.2, A.2.3, and A.2.4

[If two trains are required by LCO 3.8.10, "Distribution Systems - 

Shutdown," the remaining OPERABLE inverters may be capable of 

supporting sufficient required features to allow continuation of CORE 

ALTERATIONS, fuel movement [involving handling recently irradiated 

fuel], and operations with a potential for positive reactivity additions that 

could result in loss of required SDM (MODE 5) or boron concentration 

(MODE 6).] Suspending positive reactivity additions that could result in 

failure to meet the minimum SDM or boron concentration limit is required 

to assure continued safe operation. Introduction of coolant inventory 

must be from sources that have a boron concentration greater than that 

what would be required in the RCS for minimum SDM or refueling boron 

concentration. This may result in an overall reduction in RCS boron 
Inverters - Shutdown 

B 3.8.8 

BWOG STS B 3.8.8-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

concentration, but provides acceptable margin to maintaining subcritical 

operation. Introduction of temperature changes including temperature 

increases when operating with a positive MTC must also be evaluated to 

ensure they do not result in a loss of required SDM. By the allowance of 

the option to declare required features inoperable with the associated 

inverter(s) inoperable, appropriate restrictions will be implemented in 

accordance with the affected required features LCOs' Required Actions. 

In many instances, this option may involve undesired administrative 

efforts. Therefore, the allowance for sufficiently conservative actions is 

made (i.e., to suspend CORE ALTERATIONS, movement of [recently] 

irradiated fuel assemblies, and operations involving positive reactivity 

additions). 

Suspension of these activities shall not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required inverter[s] and to 

continue this action until restoration is accomplished in order to provide 

the necessary inverter power to the unit safety systems. 

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required 

inverters should be completed as quickly as possible in order to minimize 

the time the unit safety systems may be without power or powered from a 

constant voltage source transformer. 

SURVEILLANCE SR 3.8.8.1

REQUIREMENTS 

This Surveillance verifies that the inverters are functioning properly with 

all required circuit breakers closed and AC vital buses energized from the 

inverter. The verification of proper voltage and frequency output ensures 

that the required power is readily available for the instrumentation 

connected to the AC vital buses. The 7 day Frequency takes into account 

the redundant capability of the inverters and other indications available in 

the control room that alert the operator to inverter malfunctions. 

REFERENCES 1. FSAR, Chapter [6]. 

 2. FSAR, Chapter [14]. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.9 Distribution Systems - Operating 

BASES 

BACKGROUND The onsite Class 1E AC, DC, and AC vital bus electrical power 

distribution systems are divided by train into [two] redundant and 

independent AC, DC, and AC vital bus electrical power distribution 

subsystems. 

The AC electrical power subsystem for each train consists of a primary 

Engineered Safety Feature (ESF) 4.16 kV bus and secondary [480 and 

120] V buses, distribution panels, motor control centers and load centers. 

Each [4.16 kV ESF bus] has at least [one separate and independent 

offsite source of power] as well as a dedicated onsite diesel generator 

(DG) source. Each [4.16 kV ESF bus] is normally connected to a 

preferred offsite source. After a loss of the preferred offsite power source 

to a 4.16 kV ESF bus, a transfer to the alternate offsite source is 

accomplished by utilizing a time delayed bus undervoltage relay. If all 

offsite sources are unavailable, the onsite emergency DG supplies power 

to the 4.16 kV ESF bus. Control power for the 4.16 kV breakers is 

supplied from the Class 1E batteries. Additional description of this 

system may be found in the Bases for LCO 3.8.1, "AC Sources - 

Operating," and the Bases for LCO 3.8.4, "DC Sources - Operating." 

The secondary AC electrical power distribution subsystem for each train 

includes the safety related buses, load centers, motor control centers, 

and distribution panels shown in Table B 3.8.9-1. 

The 120 VAC vital buses are arranged in two load groups per train and 

are normally powered from the inverters. The alternate power supply for 

the vital buses are Class 1E constant voltage source transformers 

powered from the same train as the associated inverter, and its use is 

governed by LCO 3.8.7, "Inverters - Operating." Each constant voltage 

source transformer is powered from a Class 1E AC bus. 

The DC electrical distribution subsystem consists of [125] V bus(es) and 

distribution panel(s). 

The list of all required DC and vital AC distribution buses [and panels] is 

presented in Table B 3.8.9-1. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [14] (Ref. 2), 

ANALYSES assume ESF systems are OPERABLE. The AC, DC, and AC vital bus 

electrical power distribution systems are designed to provide sufficient 

capacity, capability, redundancy, and reliability to ensure the availability of 

necessary power to ESF systems so that the fuel, Reactor Coolant 

System, and containment design limits are not exceeded. These limits 

are discussed in more detail in the Bases for Section 3.2, "Power 

Distribution Limits," Section 3.4, "Reactor Coolant System (RCS)," and 

Section 3.6, "Containment Systems." 

The OPERABILITY of the AC, DC, and AC vital bus electrical power 

distribution systems is consistent with the initial assumptions of the 

accident analyses and is based upon meeting the design basis of the unit. 

This includes maintaining power distribution systems OPERABLE during 

accident conditions in the event of: 

a. An assumed loss of all offsite power or all onsite AC electrical power 

and 

b. A worst-case single failure. 

The distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The required power distribution subsystems listed in Table B 3.8.9-1 

ensure the availability of AC, DC, and AC vital bus electrical power for the 

systems required to shut down the reactor and maintain it in a safe 

condition after an anticipated operational occurrence (AOO) or a 

postulated DBA. The AC, DC, and AC vital bus electrical power 

distribution subsystems are required to be OPERABLE. 

Maintaining the Train A and Train B AC, DC, and AC vital bus electrical 

power distribution subsystems OPERABLE ensures that the redundancy 

incorporated into the design of ESF is not defeated. Therefore, a single 

failure within any system or within the electrical power distribution 

subsystems will not prevent safe shutdown of the reactor. 

OPERABLE AC electrical power distribution subsystems require the 

associated buses, load centers, motor control centers, and distribution 

panels to be energized to their proper voltages. OPERABLE DC 

electrical power distribution subsystems require the associated buses and 

distribution panels to be energized to their proper voltage from either the 

associated battery or charger. OPERABLE vital bus electrical power 

distribution subsystems require the associated buses to be energized to 

their proper voltage from the associated [inverter via inverted DC voltage, 

inverter using internal AC source, or Class 1E constant voltage 

transformer]. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

In addition, tie breakers between redundant safety related AC, DC, and 

AC vital bus power distribution subsystems, if they exist, must be open. 

This prevents any electrical malfunction in any power distribution 

subsystem from propagating to the redundant subsystem, that could 

cause the failure of a redundant subsystem and a loss of essential safety 

function(s). If any tie breakers are closed, the affected redundant 

electrical power distribution subsystems are considered inoperable. This 

applies to the onsite, safety related redundant electrical power distribution 

subsystems. It does not, however, preclude redundant Class 1E 4.16 kV 

buses from being powered from the same offsite circuit. 

APPLICABILITY The electrical power distribution subsystems are required to be 

OPERABLE in MODES 1, 2, 3, and 4 to ensure that: 

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and 

b. Adequate core cooling is provided, and containment OPERABILITY 

and other vital functions are maintained in the event of a postulated 

DBA. 

Electrical power distribution subsystem requirements for MODES 5 and 6 

are covered in the Bases for LCO 3.8.10, "Distribution Systems - 

Shutdown." 

ACTIONS A.1

With one or more Train A and B required AC buses, load centers, motor 

control centers, or distribution panels (except AC vital buses), in one train 

inoperable and a loss of function has not occurred, the remaining AC 

electrical power distribution subsystems are capable of supporting the 

minimum safety functions necessary to shut down the reactor and 

maintain it in a safe shutdown condition, assuming no single failure. The 

overall reliability is reduced, however, because a single failure in the 

remaining power distribution subsystems could result in the minimum 

required ESF functions not being supported. Therefore, the required AC 

buses, load centers, motor control centers, and distribution panels must 

be restored to OPERABLE status within 8 hours. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition A worst scenario is one train without AC power (i.e., no offsite 

power to the train and the associated DG inoperable). In this Condition, 

the unit is more vulnerable to a complete loss of AC power. It is, 

therefore, imperative that the unit operator's attention be focused on 

minimizing the potential for loss of power to the remaining train by 

stabilizing the unit, and on restoring power to the affected train. The 

8 hour time limit before requiring a unit shutdown in this Condition is 

acceptable because of: 

a. The potential for decreased safety if the unit operator's attention is 

diverted from the evaluations and actions necessary to restore power 

to the affected train to the actions associated with taking the unit to 

shutdown within this time limit and 

b. The potential for an event in conjunction with a single failure of a 

redundant component in the train with AC power. 

The second Completion Time for Required Action A.1 establishes a limit 

on the maximum time allowed for any combination of required distribution 

subsystems to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition A is entered while, for instance, a 

DC bus is inoperable and subsequently restored OPERABLE, the LCO 

may already have been not met for up to 2 hours. This could lead to a 

total of 10 hours, since initial failure of the LCO, to restore the AC 

distribution system. At this time, a DC circuit could again become 

inoperable, and AC distribution restored OPERABLE. This could 

continue indefinitely. 

The Completion Time allows for an exception to the normal "time zero" for 

beginning the allowed outage time "clock." This will result in establishing 

the "time zero" at the time the LCO was initially not met, instead of the 

time Condition A was entered. The 16 hour Completion Time is an 

acceptable limitation on this potential to fail to meet the LCO indefinitely. 

Required Action A.1 is modified by a Note that requires the applicable 

Conditions and Required Actions of LCO 3.8.4, "DC Sources - Operating," 

to be entered for DC trains made inoperable by inoperable power 

distribution subsystems. This is an exception to LCO 3.0.6 and ensures 

the proper actions are taken for these components. Inoperability of a 

distribution system can result in loss of charging power to batteries and 

eventual loss of DC power. This Note ensures that the appropriate 

attention is given to restoring charging power to batteries, if necessary, 

after loss of distribution systems. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

With one or more AC vital buses inoperable, and a loss of function has 

not yet occurred, the remaining OPERABLE AC vital buses are capable 

of supporting the minimum safety functions necessary to shut down the 

unit and maintain it in the safe shutdown condition. Overall reliability is 

reduced, however, since an additional single failure could result in the 

minimum required ESF functions not being supported. Therefore, the 

[required] AC vital bus must be restored to OPERABLE status within 

2 hours by powering the bus from the associated [inverter via inverted 

DC, inverter using internal AC Source, or Class 1E constant voltage 

transformer]. 

Condition B represents one or more AC vital buses without power; 

potentially both the DC source and the associated AC source are 

nonfunctioning. In this situation the unit is significantly more vulnerable to 

a complete loss of all noninterruptible power. It is, therefore, imperative 

that the operator's attention focus on stabilizing the unit, minimizing the 

potential for loss of power to the remaining vital buses and restoring 

power to the affected vital bus. 

This 2 hour limit is more conservative than Completion Times allowed for 

the vast majority of components that are without adequate vital AC power. 

Taking exception to LCO 3.0.2 for components without adequate vital AC 

power, that would have the Required Action Completion Times shorter 

than 2 hours if declared inoperable, is acceptable because of: 

a. The potential for decreased safety by requiring a change in unit 

conditions (i.e., requiring a shutdown) and not allowing stable 

operations to continue, 

b. The potential for decreased safety by requiring entry into numerous 

applicable Conditions and Required Actions for components without 

adequate vital AC power and not providing sufficient time for the 

operators to perform the necessary evaluations and actions for 

restoring power to the affected train, and 

c. The potential for an event in conjunction with a single failure of a 

redundant component. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The 2 hour Completion Time takes into account the importance to safety 

of restoring the AC vital bus to OPERABLE status, the redundant 

capability afforded by the other OPERABLE vital buses, and the low 

probability of a DBA occurring during this period. 

The second Completion Time for Required Action B.1 establishes a limit 

on the maximum time allowed for any combination of required distribution 

subsystems to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition B is entered while, for instance, an 

AC bus is inoperable and subsequently returned OPERABLE, the LCO 

may already have been not met for up to 8 hours. This could lead to a 

total of 10 hours, since initial failure of the LCO, to restore the vital bus 

distribution system. At this time, an AC train could again become 

inoperable, and vital bus distribution restored OPERABLE. This could 

continue indefinitely. 

This Completion Time allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." This will result in 

establishing the "time zero" at the time the LCO was initially not met, 

instead of the time Condition B was entered. The 16 hour Completion 

Time is an acceptable limitation on this potential to fail to meet the LCO 

indefinitely. 

C.1

With one or more DC buses or distribution panels inoperable, and a loss 

of function has not yet occurred, the remaining DC electrical power 

distribution subsystems are capable of supporting the minimum safety 

functions necessary to shut down the reactor and maintain it in a safe 

shutdown condition, assuming no single failure. The overall reliability is 

reduced, however, because a single failure in the remaining DC electrical 

power distribution subsystem could result in the minimum required ESF 

functions not being supported. Therefore, the [required] DC buses and 

distribution panels must be restored to OPERABLE status within 2 hours 

by powering the bus from the associated battery or charger. 

Condition C represents one or more DC buses or distribution panels 

without adequate DC power; potentially both with the battery significantly 

degraded and the associated charger nonfunctioning. In this situation, 

the unit is significantly more vulnerable to a complete loss of all DC 

power. It is, therefore, imperative that the operator's attention focus on 

stabilizing the unit, minimizing the potential for loss of power to the 

remaining trains and restoring power to the affected train. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

This 2 hour limit is more conservative than Completion Times allowed for 

the vast majority of components that are without power. Taking exception 

to LCO 3.0.2 for components without adequate DC power, which would 

have Required Action Completion Times shorter than 2 hours, is 

acceptable because of: 

a. The potential for decreased safety by requiring a change in unit 

conditions (i.e., requiring a shutdown) while allowing stable 

operations to continue, 

b. The potential for decreased safety by requiring entry into numerous 

applicable Conditions and Required Actions for components without 

DC power and not providing sufficient time for the operators to 

perform the necessary evaluations and actions to restore power to 

the affected train, and 

c. The potential for an event in conjunction with a single failure of a 

redundant component. 

The 2 hour Completion Time for DC buses is consistent with Regulatory 

Guide 1.93 (Ref. 3). 

The second Completion Time for Required Action C.1 establishes a limit 

on the maximum time allowed for any combination of required distribution 

subsystems to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition C is entered while, for instance, an 

AC bus is inoperable and subsequently returned OPERABLE, the LCO 

may already have been not met for up to 8 hours. This could lead to a 

total of 10 hours, since initial failure of the LCO, to restore the DC 

distribution system. At this time, an AC train could again become 

inoperable and DC distribution restored OPERABLE. This could continue 

indefinitely. 

This Completion Time allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." This will result in 

establishing the "time zero" at the time the LCO was initially not met, 

instead of the time Condition C was entered. The 16 hour Completion 

Time is an acceptable limitation on this potential to fail to meet the LCO 

indefinitely. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1 and D.2

If the inoperable distribution subsystem cannot be restored to 

OPERABLE status within the required Completion Time, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and to 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging plant 

systems. 

E.1

Condition E corresponds to a level of degradation in the electrical 

distribution system that causes a required safety function to be lost. 

When more than one inoperable electrical power distribution subsystem 

results in the loss of a required function, the plant is in a condition outside 

the accident analysis. Therefore, no additional time is justified for 

continued operation. LCO 3.0.3 must be entered immediately to 

commence a controlled shutdown. 

SURVEILLANCE SR 3.8.9.1

REQUIREMENTS 

This Surveillance verifies that the [required] AC, DC, and AC vital bus 

electrical power distribution systems are functioning properly, with the 

correct circuit breaker alignment. The correct breaker alignment ensures 

the appropriate separation and independence of the electrical divisions is 

maintained, and the appropriate voltage is available to each required 

bus. The verification of proper voltage availability on the buses ensures 

that the required voltage is readily available for motive as well as control 

functions for critical system loads connected to these buses. The 7 day 

Frequency takes into account the redundant capability of the AC, DC, and 

AC vital bus electrical power distribution subsystems, and other 

indications available in the control room that alert the operator to 

subsystem malfunctions. 

REFERENCES 1. FSAR, Chapter [6]. 

 2. FSAR, Chapter [14]. 

3. Regulatory Guide 1.93, December 1974. 
Distribution Systems - Operating 

B 3.8.9 

BWOG STS B 3.8.9-9 Rev. 3.0, 03/31/04 

Table B 3.8.9-1 (page 1 of 1) 

AC and DC Electrical Power Distribution Systems 

TYPE VOLTAGE TRAIN A* TRAIN B* 

AC safety buses [4160 V] [ESF Bus] [NB01] [ESF Bus] [NB02] 

 

[480 V] Load Centers 

[NG01, NG03] 

Load Centers 

[NG02, NG04] 

 

[480 V] Motor Control 

Centers 

[NG01A, NG01I, 

NG01B, NG03C, 

NG03I, NG03D] 

Motor Control 

Centers 

[NG02A, NG02I, 

NG02B, NG04C, 

NG04I, NG04D] 

 

[120 V] Distribution Panels 

[NP01, NP03] 

Distribution Panels 

[NP02, NP04] 

DC buses [125 V] Bus [NK01] Bus [NK02] 

 

Bus [NK03] Bus [NK04] 

Distribution Panels 

[NK41, NK43, NK51] 

Distribution Panels 

[NK42, NK44, NK52] 

AC vital buses [120 V] Bus [NN01] Bus [NN02] 

 

Bus [NN03] Bus [NN04] 

* Each train of the AC and DC electrical power distribution systems is a subsystem. 
Distribution Systems - Shutdown 

B 3.8.10 

BWOG STS B 3.8.10-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.10 Distribution Systems - Shutdown 

BASES 

BACKGROUND A description of the AC, DC and AC vital bus electrical power distribution 

systems is provided in the Bases for LCO 3.8.9, "Distribution Systems - 

Operating." 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [14] (Ref. 2), 

ANALYSES assume Engineered Safety Feature (ESF) systems are OPERABLE. The 

AC, DC, and AC vital bus electrical power distribution systems are 

designed to provide sufficient capacity, capability, redundancy, and 

reliability to ensure the availability of necessary power to ESF systems so 

that the fuel, Reactor Coolant System, and containment design limits are 

not exceeded. 

The OPERABILITY of the AC, DC, and AC vital bus electrical power 

distribution systems is consistent with the initial assumptions of the 

accident analyses and the requirements for the supported systems' 

OPERABILITY. 

The OPERABILITY of the minimum AC, DC, and AC vital bus electrical 

power distribution subsystems during MODES 5 and 6, and during 

movement of [recently] irradiated fuel assemblies ensures that: 

a. The unit can be maintained in the shutdown or refueling condition for 

extended periods, 

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and 

c. Adequate power is provided to mitigate events postulated during 

shutdown, such as a fuel handling accident [involving handling 

recently irradiated fuel. Due to radioactive decay, AC, DC, and AC 

vital bus electrical power is only required to mitigate fuel handling 

accidents involving handling recently irradiated fuel (i.e., fuel that has 

occupied part of a critical reactor core within the previous [X] days)]. 

The AC and DC electrical power distribution systems satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
Distribution Systems - Shutdown 

B 3.8.10 

BWOG STS B 3.8.10-2 Rev. 3.0, 03/31/04 

BASES 

LCO Various combinations of subsystems, equipment, and components are 

required OPERABLE by other LCOs, depending on the specific plant 

condition. Implicit in those requirements is the required OPERABILITY of 

necessary support required features. This LCO explicitly requires 

energization of the portions of the electrical distribution system necessary 

to support OPERABILITY of required systems, equipment, and 

components - all specifically addressed in each LCO and implicitly 

required via the definition of OPERABILITY. 

Maintaining these portions of the distribution system energized ensures 

the availability of sufficient power to operate the unit in a safe manner to 

mitigate the consequences of postulated events during shutdown (e.g., 

fuel handling accidents [involving handling recently irradiated fuel]). 

APPLICABILITY The AC and DC electrical power distribution subsystems required to be 

OPERABLE in MODES 5 and 6, and during movement of [recently] 

irradiated fuel assemblies, provide assurance that: 

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel in the core; 

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available, 

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and 

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition. 

The AC, DC, and AC vital bus electrical power distribution subsystem 

requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9. 

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily. 
Distribution Systems - Shutdown 

B 3.8.10 

BWOG STS B 3.8.10-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5

Although redundant required features may require redundant trains of 

electrical power distribution subsystems to be OPERABLE, one 

OPERABLE distribution subsystem train may be capable of supporting 

sufficient required features to allow continuation of CORE ALTERATIONS 

and [recently] irradiated fuel movement. By allowing the option to declare 

required features associated with an inoperable distribution subsystem 

inoperable, appropriate restrictions are implemented in accordance with 

the affected distribution subsystems LCO's Required Actions. In many 

instances, this option may involve undesired administrative efforts. 

Therefore, the allowance for sufficiently conservative actions is made 

(i.e., to suspend CORE ALTERATIONS, movement of [recently] irradiated 

fuel assemblies, and operations involving positive reactivity additions that 

could result in loss of required SDM (MODE 5) or boron concentration 

(MODE 6) with coolant at boron concentrations less than required to 

assure the RCS boron concentration is maintained. 

Suspension of these activities does not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required AC and DC electrical 

power distribution subsystems and to continue this action until restoration 

is accomplished in order to provide the necessary power to the unit safety 

systems. 

Notwithstanding performance of the above conservative Required 

Actions, a required decay heat removal (DHR) subsystem may be 

inoperable. In this case, Required Actions A.2.1 through A.2.5 do not 

adequately address the concerns relating to coolant circulation and heat 

removal. Pursuant to LCO 3.0.6, the DHR ACTIONS would not be 

entered. Therefore, Required Action A.2.6 is provided to direct declaring 

DHR inoperable, which results in taking the appropriate DHR actions. 

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required 

distribution subsystems should be completed as quickly as possible in 

order to minimize the time the unit safety systems may be without power. 
Distribution Systems - Shutdown 

B 3.8.10 

BWOG STS B 3.8.10-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.8.10.1

REQUIREMENTS 

This Surveillance verifies that the AC, DC, and AC vital bus electrical 

power distribution subsystems are functioning properly, with all the buses 

energized. The verification of proper voltage availability on the buses 

ensures that the required power is readily available for motive as well as 

control functions for critical system loads connected to these buses. The 

7 day Frequency takes into account the capability of the electrical power 

distribution subsystems, and other indications available in the control 

room that alert the operator to subsystem malfunctions. 

REFERENCES 1. FSAR, Chapter [6]. 

 2. FSAR, Chapter [14]. 
Boron Concentration 

B 3.9.1 

BWOG STS B 3.9.1-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELLING OPERATIONS 

B 3.9.1 Boron Concentration 

BASES 

BACKGROUND The limit on the boron concentrations of the Reactor Coolant System 

(RCS), the refueling canal, and the refueling cavity during refueling 

ensures that the reactor remains subcritical during MODE 6. Refueling 

boron concentration is the soluble boron concentration in the coolant in 

each of these volumes having direct access to the reactor core during 

refueling. 

The soluble boron concentration offsets the core reactivity and is 

measured by chemical analysis of a representative sample of the coolant 

in each of the volumes. The refueling boron concentration limit is 

specified in the COLR. Unit procedures ensure the specified boron 

concentration in order to maintain an overall core reactivity of keff ≤ 0.95 

during fuel handling, with control rods and fuel assemblies assumed to be 

in the most adverse configuration (least negative reactivity) allowed by 

unit procedures. 

GDC 26 of 10 CFR 50, Appendix A, requires that two independent 

reactivity control systems of different design principles be provided 

(Ref. 1). One of these systems must be capable of holding the reactor 

core subcritical under cold conditions. The Chemical Addition System 

serves as the system capable of maintaining the reactor subcritical in cold 

conditions by maintaining the boron concentration. 

The reactor is brought to shutdown conditions before beginning 

operations to open the reactor vessel for refueling. After the RCS is 

cooled and depressurized and the vessel head is unbolted, the head is 

slowly removed to form the refueling cavity. The refueling canal and the 

refueling cavity are then flooded with borated water from the borated 

water storage tank into the open reactor vessel by gravity feeding or by 

the use of the Decay Heat Removal (DHR) System pumps. 

The pumping action of the DHR System in the RCS, and the natural 

circulation due to thermal driving heads in the reactor vessel and the 

refueling cavity, mix the added concentrated boric acid with the water in 

the refueling canal. The DHR System is in operation during refueling (see 

LCO 3.9.4, "DHR and Coolant Circulation - High Water Level," and 

LCO 3.9.5, "DHR and Coolant Circulation - Low Water Level" ) to provide 

forced circulation in the RCS and assist in maintaining the boron 

concentrations in the RCS, the refueling canal, and the refueling cavity 

above the COLR limit. 
Boron Concentration 

B 3.9.1 

BWOG STS B 3.9.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE During refueling operations, the reactivity condition of the core is 

SAFETY consistent with the initial conditions assumed for the boron dilution 

ANALYSES accident in the accident analysis and is conservative for MODE 6. The 

boron concentration limit specified in the COLR is based on the core 

reactivity at the beginning of each fuel cycle (the end of refueling) and 

includes an uncertainty allowance. 

The required boron concentration and the unit refueling procedures that 

demonstrate the correct fuel loading plan (including full core mapping) 

ensure the keff of the core will remain ≤ 0.95 during the refueling 

operation. Hence, at least a 5% ∆k/k margin of safety is established 

during refueling. 

During refueling, the water volume in the spent fuel pool, the transfer 

canal, the refueling canal, the refueling cavity, and the reactor vessel form 

a single mass. As a result, the soluble boron concentration is relatively 

the same in each of these volumes. 

The RCS boron concentration satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO The LCO requires that a minimum boron concentration be maintained in 

the RCS, the refueling canal, and the refueling cavity while in MODE 6. 

The boron concentration limit specified in the COLR ensures a core keff of 

≤ 0.95 is maintained during fuel handling operations. 

Violation of the LCO could lead to an inadvertent criticality during 

MODE 6. 

APPLICABILITY This LCO is applicable in MODE 6 to ensure that the fuel in the reactor 

vessel will remain subcritical. The required boron concentration ensures 

a keff ≤ 0.95. Above MODE 6, LCO 3.1.1, "SHUTDOWN MARGIN 

(SDM)," and LCO 3.1.2, "Reactivity Balance," ensure that an adequate 

amount of negative reactivity is available to shut down the reactor and to 

maintain it subcritical. 

The Applicability is modified by a Note. The Note states that the limits on 

boron concentration are only applicable to the refueling canal and the 

refueling cavity when those volumes are connected to the RCS. When 

the refueling canal and the refueling cavity are isolated from the RCS, no 

potential path for boron dilution exists. 
Boron Concentration 

B 3.9.1 

BWOG STS B 3.9.1-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1 and A.2

Continuation of CORE ALTERATIONS or positive reactivity additions 

(including actions to reduce boron concentration) is contingent upon 

maintaining the unit in compliance with the LCO. If the boron 

concentration of any coolant volume in the RCS, the refueling canal, or 

the refueling cavity is less than its limit, all operations involving CORE 

ALTERATIONS or positive reactivity additions must be suspended 

immediately. 

Suspension of CORE ALTERATIONS and positive reactivity additions 

shall not preclude moving a component to a safe position. Operations 

that individually add limited positive reactivity (e.g., temperature 

fluctuations from inventory addition or temperature control fluctuations), 

but when combined with all other operations affecting core reactivity (e.g., 

intentional boration) result in overall net negative reactivity addition, are 

not precluded by this action. 

A.3

In addition to immediately suspending CORE ALTERATIONS and 

positive reactivity additions, action to restore the concentration must be 

initiated immediately. 

In determining the required combination of boration flow rate and 

concentration, there is no unique Design Basis Event that must be 

satisfied. The only requirement is to restore the boron concentration to its 

required value as soon as possible. In order to raise the boron 

concentration as soon as possible, the operator should begin boration 

with the best source available for unit conditions. 

Once actions have been initiated, they must be continued until the boron 

concentration is restored. The restoration time depends on the amount of 

boron that must be injected to reach the required concentration. 
Boron Concentration 

B 3.9.1 

BWOG STS B 3.9.1-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.9.1.1

REQUIREMENTS 

This SR ensures the coolant boron concentration in the RCS, and 

connected portions of the refueling canal and the refueling cavity, is within 

the COLR limits. The boron concentration of the coolant in each required 

volume is determined periodically by chemical analysis. Prior to reconnecting portions of the refueling canal or the refueling cavity to the 

RCS, this SR must be met per SR 3.0.4. If any dilution activity has 

occurred while the cavity or canal were disconnected from the RCS, this 

SR ensures the correct boron concentration prior to communication with 

the RCS. 

A minimum Frequency of once every 72 hours is therefore a reasonable 

amount of time to verify the boron concentration of representative 

samples. The Frequency is based on operating experience, which has 

shown 72 hours to be adequate. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 
Nuclear Instrumentation 

B 3.9.2 

BWOG STS B 3.9.2-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELLING OPERATIONS 

B 3.9.2 Nuclear Instrumentation 

BASES 

BACKGROUND The source range neutron flux monitors are used during refueling 

operations to monitor the core reactivity condition. The installed source 

range neutron flux monitors are part of the Nuclear Instrumentation 

System (NIS). These detectors are located external to the reactor vessel 

and detect neutrons leaking from the core. The use of portable detectors 

is permitted, provided the LCO requirements are met. 

The installed source range neutron flux monitors are BF3 detectors 

operating in the proportional region of the gas filled detector characteristic 

curve. The detectors monitor the neutron flux in counts per second. The 

instrument range covers six decades of neutron flux (1E+6 cps) with a 

[5]% instrument accuracy. The detectors also provide continuous visual 

indication in the control room and an audible alarm to alert operators to a 

possible dilution accident. The NIS is designed in accordance with the 

criteria presented in Reference 1. If used, portable detectors should be 

functionally equivalent to the installed NIS source range monitors. 

APPLICABLE Two OPERABLE source range neutron flux monitors are required to 

SAFETY provide a signal to alert the operator to unexpected changes in core 

ANALYSES reactivity, such as by a boron dilution accident or an improperly loaded 

fuel assembly. The safety analysis of the uncontrolled boron dilution 

accident is described in Reference 2. The analysis of the uncontrolled 

boron dilution accident shows that the normally available SDM would not 

be lost, and there is sufficient time for the operator to take corrective 

action. 

The source range neutron flux monitors satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO This LCO requires two source range neutron flux monitors OPERABLE to 

ensure that redundant monitoring capability is available to detect changes 

in core reactivity. 

APPLICABILITY In MODE 6, the source range neutron flux monitors must be OPERABLE 

to determine changes in core reactivity. There is no other direct means 

available to check core reactivity levels. In MODES 2, 3, 4, and 5, these 

same installed source range detectors and circuitry are also required to 

be OPERABLE by LCO 3.3.9, "Source Range Neutron Flux." 
Nuclear Instrumentation 

B 3.9.2 

BWOG STS B 3.9.2-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1 and A.2

With only one [required] source range neutron flux monitor OPERABLE, 

redundancy has been lost. Since these instruments are the only direct 

means of monitoring core reactivity conditions, CORE ALTERATIONS 

and introduction of coolant into the RCS with boron concentration less 

than required to meet the minimum boron concentration of LCO 3.9.1 

must be suspended immediately. Suspending positive reactivity additions 

that could result in failure to meet the minimum boron concentration limit 

is required to assure continued safe operation. Introduction of coolant 

inventory must be from sources that have a boron concentration greater 

than that what would be required in the RCS for minimum refueling boron 

concentration. This may result in an overall reduction in RCS boron 

concentration, but provides acceptable margin to maintaining subcritical 

operation. Performance of Required Action A.1 shall not preclude 

completion of movement of a component to a safe position. 

B.1

With no [required] source range neutron flux monitor OPERABLE, action 

to restore a monitor to OPERABLE status shall be initiated immediately. 

Once initiated, action shall be continued until a source range neutron flux 

monitor is restored to OPERABLE status. 

B.2

With no [required] source range neutron flux monitor OPERABLE, there is 

no direct means of detecting changes in core reactivity. However, since 

CORE ALTERATIONS and positive reactivity additions are not to be 

made, the core reactivity condition is stabilized until the source range 

neutron flux monitors are OPERABLE. This stabilized condition is 

determined by performing SR 3.9.1.1 to ensure that the required boron 

concentration exists. 

The Completion Time of once per 12 hours is sufficient to obtain and 

analyze a reactor coolant sample for boron concentration and ensures 

that unplanned changes in boron concentration would be identified. The 

12 hour Frequency is reasonable, considering the low probability of a 

change in core reactivity during this time period. 
Nuclear Instrumentation 

B 3.9.2 

BWOG STS B 3.9.2-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.9.2.1

REQUIREMENTS 

SR 3.9.2.1 is the performance of a CHANNEL CHECK, which is a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that the two 

indication channels should be consistent with core conditions. Changes 

in fuel loading and core geometry can result in significant differences 

between source range channels, but each channel should be consistent 

with its local conditions. 

The Frequency of 12 hours is consistent with the CHANNEL CHECK 

Frequency specified similarly for the same instruments in LCO 3.3.9. 

SR 3.9.2.2

SR 3.9.2.2 is the performance of a CHANNEL CALIBRATION every 

[18] months. This SR is modified by a Note stating that neutron detectors 

are excluded from the CHANNEL CALIBRATION. The CHANNEL 

CALIBRATION for the source range nuclear is a complete check and readjustment of the channels, from the pre-amplifier input to the indicators. 

The 18 month Frequency is based on the need to perform this 

Surveillance during the conditions that apply during a plant outage. 

Operating experience has shown these components usually pass the 

Surveillance when performed at the [18] month Frequency. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 13, GDC 26, GDC 28, and GDC 29. 

 2. FSAR, Section [ ] . 
Containment Penetrations 

B 3.9.3 

BWOG STS B 3.9.3-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELLING OPERATIONS 

B 3.9.3 Containment Penetrations 

BASES 

BACKGROUND During movement of [recently] irradiated fuel assemblies within 

containment, a release of fission product radioactivity within containment 

will be restricted from escaping to the environment when the LCO 

requirements are met. In MODES 1, 2, 3, and 4, this is accomplished by 

maintaining containment OPERABLE as described in LCO 3.6.1, 

"Containment." In MODE 6, the potential for containment pressurization 

as a result of an accident is not likely; therefore, requirements to isolate 

the containment from the outside atmosphere can be less stringent. The 

LCO requirements are referred to as "containment closure" rather than 

"containment OPERABILITY." Containment closure means that all 

potential escape paths are closed or capable of being closed. Since 

there is no potential for containment pressurization, the Appendix J 

leakage criteria and tests are not required. 

The containment serves to contain fission product radioactivity that may 

be released from the reactor core following an accident, such that offsite 

radiation exposures are maintained well within the requirements of 

10 CFR 100. Additionally, the containment provides radiation shielding 

from the fission products that may be present in the containment 

atmosphere following accident conditions. 

The containment equipment hatch, which is part of the containment 

pressure boundary, provides a means for moving large equipment and 

components into and out of containment. During movement of [recently] 

irradiated fuel assemblies within containment, the equipment hatch must 

be held in place by at least four bolts. Good engineering practice dictates 

that the bolts required by this LCO be approximately equally spaced. 

The containment air locks, which are also part of the containment 

pressure boundary, provide a means for personnel access during 

MODES 1, 2, 3, and 4 unit operation in accordance with LCO 3.6.2, 

"Containment Air Locks." Each air lock has a door at both ends. The 

doors are normally interlocked to prevent simultaneous opening when 

containment OPERABILITY is required. During periods of unit shutdown 

when containment closure is not required, the door interlock mechanism 

may be disabled, allowing both doors of an air lock to remain open for 

extended periods when frequent containment entry is necessary. During 

movement of [recently] irradiated fuel assemblies within containment, 

containment closure is required; therefore, the door interlock mechanism 

may remain disabled, but one air lock door must always remain [capable 

of being] closed. 
Containment Penetrations 

B 3.9.3 

BWOG STS B 3.9.3-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The requirements on containment penetration closure ensure that a 

release of fission product radioactivity within containment will be restricted 

to within regulatory limits. 

The Containment Purge and Exhaust System includes two subsystems. 

The normal subsystem includes a [42] inch purge penetration and a 

[42] inch exhaust penetration. The second subsystem, or minipurge 

system, includes an [8] inch purge penetration and an [8] inch exhaust 

penetration. During MODES 1, 2, 3, and 4, the two valves in each of the 

normal purge and exhaust penetrations are secured in the closed 

position. The two valves in each of the two minipurge penetrations can 

be opened intermittently but are closed automatically by the Engineered 

Safety Feature Actuation System (ESFAS). Neither of the subsystems is 

subject to a Specification in MODE 5. 

In MODE 6, large air exchangers are necessary to conduct refueling 

operations. The normal [42] inch purge system is used for this purpose, 

and all four valves are closed on a reactor building (RB) high radiation 

signal in accordance with LCO 3.3.15, "Reactor Building (RB) Purge 

Isolation - High Radiation. 

The other containment penetrations that provide direct access from 

containment atmosphere to outside atmosphere must be isolated on at 

least one side. Isolation may be achieved by an OPERABLE automatic 

isolation valve or by a manual isolation valve, blind flange, or equivalent. 

Equivalent isolation methods must be approved and may include use of a 

material that can provide a temporary, atmospheric pressure ventilation 

barrier for the other containment penetrations during fuel movements 

[involving handling recently irradiated fuel] (Ref. 1). 

APPLICABLE During movement of [recently] irradiated fuel assemblies within 

SAFETY containment, the most severe radiological consequences result from a 

ANALYSES fuel handling accident [involving handling recently irradiated fuel]. The 

fuel handling accident is a postulated event that involves damage to 

irradiated fuel (Ref. 2). Fuel handling accidents, analyzed in Ref. 3, 

include dropping a single irradiated fuel assembly and handling tool or a 

heavy object onto other irradiated fuel assemblies. The requirements of 

LCO 3.9.6, "Refueling Canal Water Level," in conjunction with minimum 

decay time of [100] hours prior to [irradiated] fuel movement [with 

containment closure capability or a minimum decay time of [X] days 

without containment closure capability], ensures that the release of fission 

product radioactivity subsequent to a fuel handling accident results in 

doses that are within the requirements specified in 10 CFR 100. The 

acceptance limits for offsite radiation exposure are contained in Ref. 2. 

Containment penetrations satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
Containment Penetrations 

B 3.9.3 

BWOG STS B 3.9.3-3 Rev. 3.0, 03/31/04 

BASES 

LCO -----------------------------------REVIEWER’S NOTE----------------------------------- 

The allowance to have containment personnel airlock doors open and 

penetration flow paths with direct access from the containment 

atmosphere to the outside atmosphere to be unisolated during fuel 

movement and CORE ALTERATIONS is based on (1) confirmatory dose 

calculations of a fuel handling accident as approved by the NRC staff 

which indicate acceptable radiological consequences and 

(2) commitments from the licensee to implement acceptable 

administrative procedures that ensure in the event of a refueling accident 

(even though the containment fission product control function is not 

required to meet acceptable dose consequences) that the open airlock 

can and will be promptly closed following containment evacuation and 

that the open penetration(s) can and will be promptly closed. The time to 

close such penetrations or combination of penetrations shall be included 

in the confirmatory dose calculations. 

-------------------------------------------------------------------------------------------------- 

This LCO limits the consequences of a fuel handling accident [involving 

handling recently irradiated fuel] in containment by limiting the potential 

escape paths for fission product radioactivity from containment. The LCO 

requires any penetration providing direct access from the containment 

atmosphere to the outside atmosphere to be closed except for the 

OPERABLE containment purge and exhaust penetrations [and the 

containment personnel airlocks]. For the OPERABLE containment purge 

and exhaust penetrations, this LCO ensures that these penetrations are 

isolable by the RB purge isolation signal. The OPERABILITY 

requirements for this LCO ensure that the automatic purge and exhaust 

valve closure times specified in the FSAR can be achieved and therefore 

meet the assumptions used in the safety analysis to ensure releases 

through the valves are terminated such that radiological doses are within 

the acceptance limit. 

The LCO is modified by a Note allowing penetration flow paths with direct 

access from the containment atmosphere to the outside atmosphere to be 

unisolated under administrative controls. Administrative controls ensure 

that 1) appropriate personnel are aware of the open status of the 

penetration flow path during CORE ALTERATIONS or movement of 

irradiated fuel assemblies within containment, and 2) specified individuals 

are designated and readily available to isolate the flow path in the event 

of a fuel handling accident. 

The containment personnel airlock doors may be open during movement 

of [recently] irradiated fuel in the containment provided that one door is 

capable of being closed in the event of a fuel handling accident. Should a 

fuel handling accident occur inside containment, one personnel airlock 

door will be closed following an evacuation of containment. 
Containment Penetrations 

B 3.9.3 

BWOG STS B 3.9.3-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The containment penetration requirements are applicable during 

movement of [recently] irradiated fuel assemblies within containment 

because this is when there is a potential for the limiting fuel handling 

accident. In MODES 1, 2, 3, and 4, containment penetration 

requirements are addressed by LCO 3.6.1. In MODES 5 and 6, when 

movement of irradiated fuel assemblies within containment is not being 

conducted, the potential for a fuel handling accident does not exist. 

[Additionally, due to radioactive decay, a fuel handling accident involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days) will result in doses that 

are well within the guideline values specified in 10 CFR 100 even without 

containment closure capability.] Therefore, under these conditions no 

requirements are placed on containment penetration status. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The addition of the term "recently" associated with handling irradiated fuel 

in all of the containment function Technical Specification requirements is 

only applicable to those licensees who have demonstrated by analysis 

that after sufficient radioactive decay has occurred, off-site doses 

resulting from a fuel handling accident remain below the Standard Review 

Plan limits (well within 10 CFR 100). 

Additionally, licensees adding the term "recently" must make the following 

commitment which is consistent with NUMARC 93-01, Revision 4, 

Section 11.3.6.5 "Safety Assessment for Removal of Equipment from 

Service During Shutdown Conditions," subheading "Containment - 

Primary (PWR)/Secondary (BWR)." 

"The following guidelines are included in the assessment of systems 

removed from service during movement of irradiated fuel: 

- During fuel handling/core alterations, ventilation system and 

radiation monitor availability (as defined in NUMARC 91-06) should 

be assessed, with respect to filtration and monitoring of releases from 

the fuel. Following shutdown, radioactivity in the fuel decays away 

fairly rapidly. The basis of the Technical Specification operability 

amendment is the reduction in doses due to such decay. The goal of 

maintaining ventilation system and radiation monitor availability is to 

reduce doses even further below that provided by the natural decay. 

- A single normal or contingency method to promptly close primary or 

secondary containment penetrations should be developed. Such 

prompt methods need not completely block the penetration or be 

capable of resisting pressure. 
Containment Penetrations 

B 3.9.3 

BWOG STS B 3.9.3-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

The purpose of the "prompt methods" mentioned above are to enable 

ventilation systems to draw the release from a postulated fuel handling 

accident in the proper direction such that it can be treated and 

monitored." 

-------------------------------------------------------------------------------------------------- 

ACTIONS A.1

With the containment equipment hatch, air locks, or any containment 

penetration that provides direct access from the containment atmosphere 

to the outside atmosphere not in the required status, including the 

Containment Purge and Exhaust Isolation System not capable of 

automatic actuation when the purge and exhaust valves are open, the 

unit must be placed in a condition in which the isolation function is not 

needed. This is accomplished by immediately suspending movement of 

[recently] irradiated fuel assemblies within containment. Performance of 

these actions shall not preclude moving a component to a safe position. 

SURVEILLANCE SR 3.9.3.1

REQUIREMENTS 

This Surveillance demonstrates that each of the containment penetrations 

required to be in its closed position is in that position. The Surveillance 

on the open purge and exhaust valves will demonstrate that the valves 

are not blocked from closing. Also the Surveillance will demonstrate that 

each valve operator has motive power, which will ensure each valve is 

capable of being closed by an OPERABLE automatic RB purge isolation 

signal. 

The Surveillance is performed every 7 days during movement of [recently] 

irradiated fuel assemblies within the containment. The Surveillance 

interval is selected to be commensurate with the normal duration of time 

to complete fuel handling operations. A surveillance before the start of 

refueling operations will provide two or three surveillance verifications 

during the applicable period for this LCO. 

As such, this Surveillance ensures that a postulated fuel handling 

accident [involving handling recently irradiated fuel] that releases fission 

product radioactivity within the containment will not result in a release of 

significant fission product radioactivity to the environment in excess of 

those recommended by Standard Review Plan Section 15.7.4 (Ref. 3). 
Containment Penetrations 

B 3.9.3 

BWOG STS B 3.9.3-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.9.3.2

This Surveillance demonstrates that each containment purge and exhaust 

valve actuates to its isolation position on manual initiation or on an actual 

or simulated high radiation signal. The 18 month Frequency maintains 

consistency with other similar ESFAS instrumentation and valve testing 

requirements. In LCO 3.3.15, "RB Purge Isolation - High Radiation," the 

isolation instrumentation requires a CHANNEL CHECK every 12 hours 

and a CHANNEL FUNCTIONAL TEST every 92 days to ensure the 

channel OPERABILITY during refueling operations. Every 18 months a 

CHANNEL CALIBRATION is performed. The system actuation response 

time is demonstrated every 18 months, during refueling, on a 

STAGGERED TEST BASIS. SR 3.6.3.5 demonstrates that the isolation 

time of each valve is in accordance with the Inservice Testing Program 

requirements. These Surveillances performed during MODE 6 will ensure 

that the valves are capable of closing after a postulated fuel handling 

accident [involving handling recently irradiated fuel] to limit a release of 

fission product radioactivity from the containment. 

The SR is modified by a Note stating that this Surveillance is not required 

to be met for valves in isolated penetrations. The LCO provides the 

option to close penetrations in lieu of requiring automatic actuation 

capability. 

REFERENCES 1. GPU Nuclear Safety Evaluation SE-0002000-001, Rev. 0, 

May 20, 1988. 

 2. FSAR, Section [ ]. 

 3. NUREG-0800, Section 15.7.4, Rev. 1, July 1981. 
DHR and Coolant Circulation - High Water Level 

B 3.9.4 

BWOG STS B 3.9.4-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELLING OPERATIONS 

B 3.9.4 Decay Heat Removal (DHR) and Coolant Circulation - High Water Level 

BASES 

BACKGROUND The purposes of the DHR System in MODE 6 are to remove decay heat 

and sensible heat from the Reactor Coolant System (RCS), as required 

by GDC 34, to provide mixing of borated coolant, to provide sufficient 

coolant circulation to minimize the effects of a boron dilution accident, and 

to prevent boron stratification (Ref. 1). Heat is removed from the RCS by 

circulating reactor coolant through the DHR heat exchanger(s), where the 

heat is transferred to the Component Cooling Water System via the DHR 

heat exchanger(s). The coolant is then returned to the RCS via the RCS 

cold leg(s). Operation of the DHR System for normal cooldown or decay 

heat removal is manually accomplished from the control room. The heat 

removal rate is adjusted by control of the flow of reactor coolant through 

the DHR heat exchanger(s) and bypassing the heat exchanger(s). Mixing 

of the reactor coolant is maintained by this continuous circulation of 

reactor coolant through the DHR System. 

APPLICABLE If the reactor coolant temperature is not maintained below 200°F, boiling 

SAFETY of the reactor coolant could result. This could lead to inadequate cooling 

ANALYSES of the reactor fuel as a result of a loss of coolant in the reactor vessel. 

Additionally, boiling of the reactor coolant could lead to a reduction in 

boron concentration in the coolant due to boron plating out on 

components near the areas of the boiling activity, and because of the 

possible addition of water to the reactor vessel with a lower boron 

concentration than is required to keep the reactor subcritical. The loss of 

reactor coolant and the reduction in boron concentration in the reactor 

coolant would eventually challenge the integrity of the fuel cladding, which 

is a fission product barrier. One train of the DHR System is required to be 

operational in MODE 6, with the water level ≥ 23 ft above the top of the 

reactor vessel flange, to prevent this challenge. The LCO does permit the 

DHR pump to be removed from operation for short durations under the 

condition that the boron concentration is not diluted. This conditional 

stopping of the DHR pump does not result in a challenge to the fission 

product barrier. 

The DHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). 
DHR and Coolant Circulation - High Water Level 

B 3.9.4 

BWOG STS B 3.9.4-2 Rev. 3.0, 03/31/04 

BASES 

LCO Only one DHR loop is required for decay heat removal in MODE 6, with a 

water level ≥ 23 ft above the top of the reactor vessel flange. Only one 

DHR loop is required to be OPERABLE because the volume of water 

above the reactor vessel flange provides backup decay heat removal 

capability. At least one DHR loop must be OPERABLE and in operation 

to provide: 

a. Removal of decay heat, 

b. Mixing of borated coolant to minimize the possibility of criticality, and 

c. Indication of reactor coolant temperature. 

An OPERABLE DHR loop includes a DHR pump, a heat exchanger, 

valves, piping, instruments, and controls to ensure an OPERABLE flow 

path and to determine the low end temperature. The flow path starts in 

one of the RCS hot legs and is returned to the RCS cold legs. 

Additionally, each DHR loop is considered OPERABLE if it can be 

manually aligned (remote or local) in the shutdown cooling mode for 

removal of decay heat. Operation of one subsystem can maintain the 

reactor coolant temperature as required. 

The LCO is modified by a Note that allows the required DHR loop to be 

removed from operation for up to 1 hour in an 8 hour period, provided no 

operations are permitted that would dilute the RCS boron concentration 

by introduction of coolant into the RCS with boron concentration less than 

required to meet the minimum boron concentration of LCO 3.9.1. Boron 

concentration reduction with coolant at boron concentrations less than 

required to assure the RCS boron concentration is maintained is 

prohibited because uniform concentration distribution cannot be ensured 

without forced circulation. This permits operations such as core mapping 

or alterations in the vicinity of the reactor vessel hot leg nozzles and RCS 

to DHR isolation valve testing. During this 1 hour period, decay heat is 

removed by natural convection to the large mass of water in the refueling 

cavity. 
DHR and Coolant Circulation - High Water Level 

B 3.9.4 

BWOG STS B 3.9.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY One DHR loop must be OPERABLE and in operation in MODE 6, with the 

water level ≥ 23 ft above the top of the reactor vessel flange, to provide 

decay heat removal. The 23 ft water level was selected because it 

corresponds to the 23 ft requirement established for fuel movement in 

LCO 3.9.6, "Refueling Canal Water Level." Requirements for the DHR 

System in other MODES are covered by LCOs in Section 3.4, Reactor 

Coolant System (RCS), and Section 3.5, Emergency Core Cooling 

Systems (ECCS). DHR loop requirements in MODE 6, with the water 

level < 23 ft above the top of the reactor vessel flange, are located in 

LCO 3.9.5, "Decay Heat Removal (DHR) and Coolant Circulation - Low 

Water Level." 

ACTIONS DHR loop requirements are met by having one DHR loop OPERABLE 

and in operation, except as permitted in the Note to the LCO. 

A.1

If DHR loop requirements are not met, there will be no forced circulation 

to provide mixing to establish uniform boron concentrations. Suspending 

positive reactivity additions that could result in failure to meet the 

minimum boron concentration limit is required to assure continued safe 

operation. Introduction of coolant inventory must be from sources that 

have a boron concentration greater than that what would be required in 

the RCS for minimum refueling boron concentration. This may result in 

an overall reduction in RCS boron concentration, but provides acceptable 

margin to maintaining subcritical operation. 

A.2

If DHR loop requirements are not met, actions shall be taken immediately 

to suspend the loading of irradiated fuel assemblies in the core. With no 

forced circulation cooling, decay heat removal from the core occurs by 

natural convection to the heat sink provided by the water above the core. 

A minimum refueling water level 23 ft above the reactor vessel flange 

provides an adequate available heat sink. Suspending any operation that 

would increase decay heat load, such as loading a fuel assembly, is 

prudent under this condition. 
DHR and Coolant Circulation - High Water Level 

B 3.9.4 

BWOG STS B 3.9.4-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.3

If DHR loop requirements are not met, actions shall be initiated 

immediately in order to satisfy DHR loop requirements. 

A.4, A.5, A.6.1, and A.6.2

If no DHR is in operation, the following actions must be taken: 

a. The equipment hatch must be closed and secured with [four] bolts, 

b. One door in each air lock must be closed, and 

c. Each penetration providing direct access from the containment 

atmosphere to the outside atmosphere must be either closed by a 

manual or automatic isolation valve, blind flange, or equivalent, or 

verified to be capable of being closed by an OPERABLE 

Containment Purge and Exhaust Isolation System. 

With DHR loop requirements not met, the potential exists for the coolant 

to boil and release radioactive gas to the containment atmosphere. 

Performing the actions stated above ensures that all containment 

penetrations are either closed or can be closed so that the dose limits are 

not exceeded. 

The Completion Time of 4 hours allows fixing of most DHR problems and 

is reasonable, based on the low probability of the coolant boiling in that 

time. 

SURVEILLANCE SR 3.9.4.1

REQUIREMENTS 

This Surveillance demonstrates that the DHR loop is in operation and 

circulating reactor coolant. The flow rate is determined by the flow rate 

necessary to provide sufficient decay heat removal capability and to 

prevent thermal and boron stratification in the core. The Frequency of 

12 hours is sufficient, considering the flow, temperature, pump control, 

and alarm indications available to the operator in the control room for 

monitoring the DHR System. 

REFERENCES 1. FSAR, Section [ ] . 
DHR and Coolant Circulation - Low Water Level 

B 3.9.5 

BWOG STS B 3.9.5-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELLING OPERATIONS 

B 3.9.5 Decay Heat Removal (DHR) and Coolant Circulation - Low Water Level 

BASES 

BACKGROUND The purposes of the DHR System in MODE 6 are to remove decay heat 

and sensible heat from the Reactor Coolant System (RCS), as required 

by GDC 34, to provide mixing of borated coolant, to provide sufficient 

coolant circulation to minimize the effects of a boron dilution accident, and 

to prevent boron stratification (Ref. 1). Heat is removed from the RCS by 

circulating reactor coolant through the DHR heat exchanger(s), where the 

heat is transferred to the Component Cooling Water System via the DHR 

heat exchanger. The coolant is then returned to the RCS via the RCS 

cold leg(s). Operation of the DHR System for normal cooldown/decay 

heat removal is manually accomplished from the control room. The heat 

removal rate is adjusted by control of the flow of reactor coolant through 

the DHR heat exchanger(s) and bypassing the heat exchanger(s). Mixing 

of the reactor coolant is maintained by this continuous circulation of 

reactor coolant through the DHR System. 

APPLICABLE If the reactor coolant temperature is not maintained below 200°F, boiling 

SAFETY of the reactor coolant could result. This could lead to inadequate cooling 

ANALYSES of the reactor fuel due to resulting loss of coolant in the reactor vessel. 

Additionally, boiling of the reactor coolant could lead to a reduction in 

boron concentration in the coolant due to boron plating out on 

components near the areas of the boiling activity, and because of the 

possible addition of water to the reactor vessel with a lower boron 

concentration than is required to keep the reactor subcritical. The loss of 

reactor coolant and the reduction of boron concentration in the reactor 

coolant would eventually challenge the integrity of the fuel cladding, which 

is a fission product barrier. Two trains of the DHR System are required to 

be OPERABLE, and one is required to be in operation, to prevent this 

challenge. 

The DHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). 

LCO In MODE 6, with the water level < 23 ft above the top of the reactor vessel 

flange, two DHR loops must be OPERABLE. Additionally, one DHR loop 

must be in operation to provide: 

a. Removal of decay heat, 

b. Mixing of borated coolant to minimize the possibility of criticality, and 

c. Indication of reactor coolant temperature. 
DHR and Coolant Circulation - Low Water Level 

B 3.9.5 

BWOG STS B 3.9.5-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

This LCO is modified by two Notes. Note 1 permits the DHR pumps to be 

removed from operation for ≤ 15 minutes when switching from one train to 

another. The circumstances for stopping both DHR pumps are to be 

limited to situations when the outage time is short [and the core outlet 

temperature is maintained > 10 degrees F below saturation temperature]. 

The Note prohibits boron dilution of draining operations by introduction of 

coolant into the RCS with boron concentrations less than required to meet 

the minimum boron concentration of LCO 3.9.1 when DHR forced flow is 

stopped. 

Note 2 allows one DHR loop to be inoperable for a period of 2 hours 

provided the other loop is OPERABLE and in operation. Prior to 

declaring the loop inoperable, consideration should be given to the 

existing plant configuration. This consideration should include that the 

core time to boil is short, there is no draining operation to further reduce 

RCS water level and that the capability exists to inject borated water into 

the reactor vessel. This permits surveillance tests to be performed on the 

inoperable loop during a time when these tests are safe and possible. 

An OPERABLE DHR loop consists of a DHR pump, a heat exchanger, 

valves, piping, instruments, and controls to ensure an OPERABLE flow 

path and to determine the low end temperature. The flow path starts in 

one of the RCS hot legs and is returned to the RCS cold legs. 

Both DHR pumps may be aligned to the Refueling Water Storage Tank to 

support filling or draining the refueling cavity or for performance of 

required testing. 

APPLICABILITY Two DHR loops are required to be OPERABLE, and one in operation in 

MODE 6, with the water level < 23 ft above the top of the reactor vessel 

flange, to provide decay heat removal. Requirements for the DHR 

System in other MODES are covered by LCOs in Section 3.4, Reactor 

Coolant System (RCS), and Section 3.5, Emergency Core Cooling 

Systems (ECCS). DHR loop requirements in MODE 6, with the water 

level ≥ 23 ft above the top of the reactor vessel flange, are located in 

LCO 3.9.4, "Decay Heat Removal (DHR) and Coolant Circulation - High 

Water Level." 

ACTIONS A.1 and A.2

With fewer than the required loops OPERABLE, action shall be 

immediately initiated and continued until the DHR loop is restored to 

OPERABLE status or until ≥ 23 ft of water level is established above the 

reactor vessel flange. When the water level is established at ≥ 23 ft 

above the reactor vessel flange, the Applicability will change to that of 
DHR and Coolant Circulation - Low Water Level 

B 3.9.5 

BWOG STS B 3.9.5-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

LCO 3.9.4, and only one DHR loop is required to be OPERABLE and in 

operation. An immediate Completion Time is necessary for an operator 

to initiate corrective actions to restore the required forced circulation or 

water level. 

B.1

If no DHR loop is in operation or no DHR loop is OPERABLE, there will 

be no forced circulation to provide mixing to establish uniform boron 

concentrations. Suspending positive reactivity additions that could result 

in failure to meet the minimum boron concentration limit is required to 

assure continued safe operation. Introduction of coolant inventory must 

be from sources that have a boron concentration greater than that what 

would be required in the RCS for minimum refueling boron concentration. 

This may result in an overall reduction in RCS boron concentration, but 

provides acceptable margin to maintaining subcritical operation. 

B.2

If no DHR loop is in operation or no DHR loop is OPERABLE, actions 

shall be initiated immediately and continued without interruption to restore 

one DHR loop to OPERABLE status and operation. Since the unit is in 

Conditions A and B concurrently, the restoration of two OPERABLE DHR 

loops and one operating DHR loop should be accomplished expeditiously. 

If no DHR loop is OPERABLE or in operation, alternate actions shall have 

been initiated immediately under Condition A to establish ≥ 23 ft of water 

above the top of the reactor vessel flange. Furthermore, when the LCO 

cannot be fulfilled, alternate decay heat removal methods, as specified in 

the unit's Abnormal and Emergency Operating Procedures, should be 

implemented. This includes decay heat removal using the charging or 

safety injection pumps through the Chemical and Volume Control System 

with consideration for the boron concentration. The method used to 

remove decay heat should be the most prudent as well as the safest 

choice, based upon unit conditions. The choice could be different if the 

reactor vessel head is in place rather than removed. 

B.3, B.4, B.5.1, and B.5.2

If no DHR is in operation, the following actions must be taken: 

a. The equipment hatch must be closed and secured with [four] bolts, 
DHR and Coolant Circulation - Low Water Level 

B 3.9.5 

BWOG STS B 3.9.5-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

b. One door in each air lock must be closed, and 

c. Each penetration providing direct access from the containment 

atmosphere to the outside atmosphere must be either closed by a 

manual or automatic isolation valve, blind flange, or equivalent, or 

verified to be capable of being closed by an OPERABLE 

Containment Purge and Exhaust Isolation System. 

With DHR loop requirements not met, the potential exists for the coolant 

to boil and release radioactive gas to the containment atmosphere. 

Performing the actions stated above ensures that all containment 

penetrations are either closed or can be closed so that the dose limits are 

not exceeded. 

The Completion Time of 4 hours allows fixing of most DHR problems and 

is reasonable, based on the low probability of the coolant boiling in that 

time. 

SURVEILLANCE SR 3.9.5.1

REQUIREMENTS 

This Surveillance demonstrates that one DHR loop is in operation. The 

flow rate is determined by the flow rate necessary to provide efficient 

decay heat removal capability and to prevent thermal and boron 

stratification in the core. 

In addition, during operation of the DHR loop with the water level in the 

vicinity of the reactor vessel nozzles, the DHR loop flow rate 

determination must also consider the DHR pump suction requirement. 

The Frequency of 12 hours is sufficient, considering the flow, 

temperature, pump control, and alarm indications available to the 

operator to monitor the DHR System in the control room. 

SR 3.9.5.2

Verification that the required pump is OPERABLE ensures that an 

additional DHR pump can be placed in operation, if needed, to maintain 

decay heat removal and reactor coolant circulation. Verification is 

performed by verifying proper breaker alignment and power available to 

the required pump. The Frequency of 7 days is considered reasonable in 

view of other administrative controls available and has been shown to be 

acceptable by operating experience. 

REFERENCES 1. FSAR, Section [ ] . 
Refueling Canal Water Level 

B 3.9.6 

BWOG STS B 3.9.6-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELLING OPERATIONS 

B 3.9.6 Refueling Canal Water Level 

BASES 

BACKGROUND The movement of irradiated fuel assemblies within containment requires a 

minimum water level of 23 ft above the top of the reactor vessel flange. 

During refueling, this maintains sufficient water level in the containment, 

the refueling canal, the fuel transfer canal, the refueling cavity, and the 

spent fuel pool. Sufficient water is necessary to retain iodine fission 

product activity in the water in the event of a fuel handling accident 

(Refs. 1 and 2). Sufficient iodine activity would be retained to limit offsite 

doses from the accident within 10 CFR 100 limits, as provided by the 

guidance of Reference 3. 

APPLICABLE During movement of irradiated fuel assemblies, the water level in the 

SAFETY refueling canal and the refueling cavity is an initial condition design 

ANALYSES parameter in the analysis of the fuel handling accident in containment 

postulated by Regulatory Guide 1.25 (Ref. 1). A minimum water level of 

23 ft (Regulatory Position C.1.c of Ref. 1) allows a decontamination factor 

of 100 (Regulatory Position C.1.g of Ref. 1) to be used in the accident 

analysis for iodine. This relates to the assumption that 99% of the total 

iodine released from the pellet to cladding gap of all the dropped fuel 

assembly rods is retained by the refueling cavity water. The fuel pellet to 

cladding gap is assumed to contain 10% of the total fuel rod iodine 

inventory (Ref. 1). 

The fuel handling accident analysis inside containment is described in 

Reference 2. With a minimum water level of 23 ft, and a minimum decay 

time of [X] hours prior to fuel handling, the analysis and test programs 

demonstrate that the iodine release due to a postulated fuel handling 

accident is adequately captured by the water, and offsite doses are 

maintained within allowable limits (Ref. 3). 

Refueling canal water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO A minimum refueling cavity water level of 23 ft above the reactor vessel 

flange is required to ensure that the radiological consequences of a 

postulated fuel handling accident inside containment are within 

acceptable limits as provided by 10 CFR 100. 
Refueling Canal Water Level 

B 3.9.6 

BWOG STS B 3.9.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY LCO 3.9.6 is applicable when moving irradiated fuel assemblies within the 

containment. The LCO minimizes the possibility of a fuel handling 

accident in containment that is beyond the assumptions of the safety 

analysis. If irradiated fuel is not present in containment, there can be no 

significant radioactivity release as a result of a postulated fuel handling 

accident. Requirements for fuel handling accidents in the spent fuel pool 

are covered by LCO 3.7.14, "Fuel Storage Pool Water Level." 

ACTIONS A.1

With a water level of < 23 ft above the top of the reactor vessel flange, all 

operations involving movement of irradiated fuel assemblies shall be 

suspended immediately to ensure that a fuel handling accident cannot 

occur. 

The suspension of fuel movement shall not preclude completion of 

movement of a component to a safe position. 

SURVEILLANCE SR 3.9.6.1

REQUIREMENTS 

Verification of a minimum water level of 23 ft above the top of the reactor 

vessel flange ensures that the design basis for the postulated fuel 

handling accident analysis during refueling operations is met. Water at 

the required level above the top of the reactor vessel flange limits the 

consequences of damaged fuel rods that are postulated to result from a 

postulated fuel handling accident inside containment (Ref. 2). 

The Frequency of 24 hours is based on engineering judgment and is 

considered adequate in view of the large volume of water and the normal 

procedural controls of valve positions, which make significant unplanned 

level changes unlikely. 

REFERENCES 1. Regulatory Guide 1.25, March 23, 1972. 

 2. FSAR Section [ ] . 

 3. 10 CFR 100.10.