NUREG-1434 

 Vol 2, Rev. 3.0, 03/31/04 

Standard Technical Specifications 

General Electric Plants, 

BWR/6

Bases

Manuscript Completed: March 2004 

Date Published: June 2004 

Division of Regulatory Improvement Programs 

Office of Nuclear Reactor Regulation 

U.S. Nuclear Regulatory Commission 

Washington, DC 20555-0001
 

Availability of Reference Materials 

in NRC Publications

NRC Reference Material 

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC’s Public Electronic Reading Room at 

www.nrc.gov/NRC/ADAMS/index.htm. 

Publicly released documents include, to name a few, 

NUREG-series publications; Federal Register notices; 

applicant, licensee, and vendor documents and 

correspondence; NRC correspondence and internal 

memoranda; bulletins and information notices; 

inspection and investigation reports; licensee event 

reports; and Commission papers and their attachments. 

NRC publications in the NUREG series, NRC 

regulations, and Title 10, Energy, of the Code of 

Federal Regulations, may be purchased from one of 

these two sources: 

1. The Superintendent of Documents 

 U.S. Government Printing Office 

 Mail Stop SSOP 

 Washington, DC 20402-0001 

 Internet: bookstore.gpo.gov 

 Telephone : 202-512-1800 

 Fax: 202-512-2250 

2. The National Technical Information Service 

 Springfield, VA 22161-0002 

 www.ntis.gov 

 1-800-553-6847 or locally 703-605-6000 

A single copy of each NRC draft report for comment is 

available free, to the extent of supply, upon written 

request as follows: 

Address: Office of the Chief Information Officer 

 Reproduction and Distribution 

 Services Section 

 U.S. Nuclear Regulatory Commission 

 Washington, DC 20555-0001 

E-mail: DISTRIBUTION@nrc.gov 

Facsimile: 301-415-2289 

Some publications in the NUREG series that are 

posted at the NRC’s Web site address 

www.nrc.gov/NRC/NUREGS/indexnum.html 

are updated periodically and may differ from the last 

printed version. Although references to material found 

on a Web site bear the date the material was accessed, 

the material available on the date cited may 

subsequently be removed from the site. 

Non-NRC Reference Material 

Documents available from public and special 

technical libraries include all open literature items, 

such as books, journal articles, and transactions, 

Federal Register notices, Federal and State 

legislation, and congressional reports. Such 

documents as theses, dissertations, foreign reports 

and translations, and non-NRC conference 

proceedings may be purchased from their 

sponsoring organization. 

Copies of industry codes and standards used in a 

substantive manner in the NRC regulatory process 

are maintained at - 

The NRC Library 

Two White Flint North 

11545 Rockville Pike 

Rockville, MD 20852-2738 

These standards are available in the library for 

reference use by the public. Codes and standards 

are usually copyrighted and may be purchased from 

the originating organization or, if they are American 

National Standards, from— 

 American National Standards Institute 

 11 West 42nd Street 

 New York, NY 10036-8002 

 <http://www.ansi.org> 

 212-642-4900 

Legally binding regulatory requirements are 

stated only in laws; NRC regulations; licenses, 

including technical specifications; or orders, not 

in NUREG-series publications. The views 

expressed in contractor-prepared publications 

in this series are not necessarily those of the 

NRC. 

The NUREG series comprises (1) technical 

and administrative books prepared by the staff 

(NUREG-XXXX) or agency contractors 

(NUREG/CR-XXXX), (2) proceedings of 

conferences (NUREG/CP-XXXX), (3) reports 

resulting from international agreements 

(NUREG/IA-XXXX), (4) brochures 

(NUREG/BR-XXXX), and (5) compilations of 

legal decisions and orders of the Commission 

and Atomic and Safety Licensing Boards and 

of Director’s decisions under Section 2.206 of 

NRC’s regulations (NUREG-0750). 
BWR/6 STS iii Rev. 3.0, 03/31/04 

PREFACE 

This NUREG contains the improved Standard Technical Specifications (STS) for General 

Electric (GE) BWR/6 plants. Revision 3 incorporates the cumulative changes to Revision 1 and 

2, which was published in April 1995 and April 2001, respectively. The changes reflected in 

Revision 3 resulted from the experience gained from license amendment applications to convert 

to these improved STS or to adopt partial improvements to existing technical specifications. 

This publication is the result of extensive public technical meetings and discussions among the 

Nuclear Regulatory Commission (NRC) staff and various nuclear power plant licensees, Nuclear 

Steam Supply System (NSSS) Owners Groups, and the Nuclear Energy Institute (NEI). The 

improved STS were developed based on the criteria in the Final Commission Policy Statement 

on Technical Specifications Improvements for Nuclear Power Reactors, dated July 22, 1993 

(58 FR 39132), which was subsequently codified by changes to Section 36 of Part 50 of Title 10 

of the Code of Federal Regulations (10 CFR 50.36) (60 FR 36953). Licensees are encouraged 

to upgrade their technical specifications consistent with those criteria and conforming, to the 

practical extent, to Revision 3 to the improved STS. The Commission continues to place the 

highest priority on requests for complete conversions to the improved STS. Licensees adopting 

portions of the improved STS to existing technical specifications should adopt all related 

requirements, as applicable, to achieve a high degree of standardization and consistency. 

The Table of Contents is now a Table of Contents / Revision Summary where the revision 

number and date are listed for each specification and bases, in lieu of traditional page numbers. 

Each limiting condition for operation (LCO) starts with page 1, with a specification, e.g., "2.0" or 

bases "B 2.0" number prefix. Subsequent approved revisions to sections will be noted in the 

Table of Contents, as well as on each affected page, using a decimal number to indicate the 

number of revisions to that section, along with the date, e.g., (Rev 3.3, 04/01/04) indicates the 

third approved change and date since Revision 3.0 was published. Additionally, the final page 

of each LCO section will be a historical listing of the changes affecting that section. This 

publication will be maintained in electronic format. Subsequent revisions will not be printed in 

hard copy. Users may access the subsequent revisions to the STS in the PDF format at 

(http://www.nrc.gov/NRR/sts/sts.htm). This Web site will be updated as needed and the 

contents may differ from the last printed version. Users may print or download copies from the 

NRC Web site. 

PAPERWORK REDUCTION ACT STATEMENT 

The information collections contained in this NUREG are covered by the requirements of 

10 CFR Parts 20 and 50, which were approved by the Office of Management and Budget, 

approval numbers 3150-0014 and 0011. 

PUBLIC PROTECTION NOTIFICATION 

If a means used to impose an information collection does not display a currently valid OMB 

control number, the NRC may not conduct or sponsor, and a person is not required to respond 

to, the information collection. 
BWR/6 STS v Rev. 3.0, 03/31/04 

TABLE OF CONTENTS / REVISION SUMMARY Revision – Date 

B 2.0 SAFETY LIMITS (SLs) 

B 2.1.1 Reactor Core SLs...............................................................................3.0, 03/31/04 

B 2.1.2 Reactor Coolant System (RCS) Pressure SL.....................................3.0, 03/31/04 

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY..3.0, 03/31/04 

B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY.................3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.1 SHUTDOWN MARGIN (SDM)............................................................3.0, 03/31/04 

B 3.1.2 Reactivity Anomalies ..........................................................................3.0, 03/31/04 

B 3.1.3 Control Rod OPERABILITY................................................................3.0, 03/31/04 

B 3.1.4 Control Rod Scram Times ..................................................................3.0, 03/31/04 

B 3.1.5 Control Rod Scram Accumulators ......................................................3.0, 03/31/04 

B 3.1.6 Rod Pattern Control............................................................................3.0, 03/31/04 

B 3.1.7 Standby Liquid Control (SLC) System................................................3.0, 03/31/04 

B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves ...................3.0, 03/31/04 

B 3.2 POWER DISTRIBUTION LIMITS 

B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE 

 (APLHGR) ....................................................................................3.0, 03/31/04 

B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) .................................3.0, 03/31/04 

B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) (Optional) ..................3.0, 03/31/04 

B 3.2.4 Average Power Range Monitor (APRM) Gain and Setpoints.............3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.1.1 Reactor Protection System (RPS) Instrumentation ............................3.0, 03/31/04 

B 3.3.1.2 Source Range Monitor (SRM) Instrumentation ..................................3.0, 03/31/04 

B 3.3.2.1 Control Rod Block Instrumentation.....................................................3.0, 03/31/04 

B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation...............................3.0, 03/31/04 

B 3.3.3.2 Remote Shutdown System.................................................................3.0, 03/31/04 

B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation ..3.0, 03/31/04 

B 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip 

 (ATWS-RPT) Instrumentation.......................................................3.0, 03/31/04 

B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation ...............3.0, 03/31/04 

B 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation........3.0, 03/31/04 

B 3.3.6.1 Primary Containment Isolation Instrumentation..................................3.0, 03/31/04 

B 3.3.6.2 Secondary Containment Isolation Instrumentation.............................3.0, 03/31/04 

B 3.3.6.3 Residual Heat Removal (RHR) Containment Spray System 

 Instrumentation.............................................................................3.0, 03/31/04 

B 3.3.6.4 Suppression Pool Makeup (SPMU) System Instrumentation.............3.0, 03/31/04 

B 3.3.6.5 Relief and Low-Low Set (LLS) Instrumentation..................................3.0, 03/31/04 

B 3.3.7.1 Control Room Fresh Air (CRFA) System Instrumentation..................3.0, 03/31/04 

B 3.3.8.1 Loss of Power (LOP) Instrumentation ................................................3.0, 03/31/04 

B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring ............3.0, 03/31/04 
BWR/6 STS vi Rev. 3.0, 03/31/04 

TABLE OF CONTENTS / REVISION SUMMARY Revision - Date 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.1 Recirculation Loops Operating ...........................................................3.0, 03/31/04 

B 3.4.2 Flow Control Valves (FCVs) ...............................................................3.0, 03/31/04 

B 3.4.3 Jet Pumps ..........................................................................................3.0, 03/31/04 

B 3.4.4 Safety/Relief Valves (S/RVs)..............................................................3.0, 03/31/04 

B 3.4.5 RCS Operational LEAKAGE...............................................................3.0, 03/31/04 

B 3.4.6 RCS Pressure Isolation Valve (PIV) Leakage ....................................3.0, 03/31/04 

B 3.4.7 RCS Leakage Detection Instrumentation ...........................................3.0, 03/31/04 

B 3.4.8 RCS Specific Activity..........................................................................3.0, 03/31/04 

B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling System 

 – Hot Shutdown...........................................................................3.0, 03/31/04 

B 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling System 

 - Cold Shutdown ..........................................................................3.0, 03/31/04 

B 3.4.11 RCS Pressure and Temperature (P/T) Limits.....................................3.0, 03/31/04 

B 3.4.12 Reactor Steam Dome Pressure..........................................................3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND 

 REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM 

B 3.5.1 ECCS - Operating ..............................................................................3.0, 03/31/04 

B 3.5.2 ECCS - Shutdown ..............................................................................3.0, 03/31/04 

B 3.5.3 RCIC System......................................................................................3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.1 Primary Containment..........................................................................3.0, 03/31/04 

B 3.6.1.2 Primary Containment Air Locks..........................................................3.0, 03/31/04 

B 3.6.1.3 Primary Containment Isolation Valves (PCIVs)..................................3.0, 03/31/04 

B 3.6.1.4 Primary Containment Pressure ..........................................................3.0, 03/31/04 

B 3.6.1.5 Primary Containment Air Temperature...............................................3.0, 03/31/04 

B 3.6.1.6 Low-Low Set (LLS) Valves .................................................................3.0, 03/31/04 

B 3.6.1.7 Residual Heat Removal (RHR) Containment Spray System..............3.0, 03/31/04 

B 3.6.1.8 Penetration Valve Leakage Control System (PVLCS)........................3.0, 03/31/04 

B 3.6.1.9 Main Steam Isolation Valve (MSIV) Leakage Control System (LCS).3.0, 03/31/04 

B 3.6.2.1 Suppression Pool Average Temperature ...........................................3.0, 03/31/04 

B 3.6.2.2 Suppression Pool Water Level ...........................................................3.0, 03/31/04 

B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling ................3.0, 03/31/04 

B 3.6.2.4 Suppression Pool Makeup (SPMU) System.......................................3.0, 03/31/04 

B 3.6.3.1 Primary Containment and Drywell Hydrogen Ignitors.........................3.0, 03/31/04 

B 3.6.3.2 [Drywell Purge System] ......................................................................3.0, 03/31/04 

B 3.6.4.1 [Secondary Containment]...................................................................3.0, 03/31/04 

B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs) .............................3.0, 03/31/04 

B 3.6.4.3 Standby Gas Treatment (SGT) System..............................................3.0, 03/31/04 

B 3.6.5.1 Drywell................................................................................................3.0, 03/31/04 

B 3.6.5.2 Drywell Air Lock..................................................................................3.0, 03/31/04 

B 3.6.5.3 Drywell Isolation Valves .....................................................................3.0, 03/31/04 

B 3.6.5.4 Drywell Pressure ................................................................................3.0, 03/31/04 

B 3.6.5.5 Drywell Air Temperature.....................................................................3.0, 03/31/04 

B 3.6.5.6 Drywell Vacuum Relief System ..........................................................3.0, 03/31/04 
BWR/6 STS vii Rev. 3.0, 03/31/04 

TABLE OF CONTENTS / REVISION SUMMARY ................................................. Revision - Date 

B 3.7 PLANT SYSTEMS 

B 3.7.1 [Standby Service Water (SSW)] System and [Ultimate Heat 

 Sink (UHS)]...................................................................................3.0, 03/31/04 

B 3.7.2 High Pressure Core Spray (HPCS) Service Water System (SWS)....3.0, 03/31/04 

B 3.7.3 [Control Room Fresh Air (CRFA)] System..........................................3.0, 03/31/04 

B 3.7.4 [Control Room Air Conditioning (AC)] System....................................3.0, 03/31/04 

B 3.7.5 Main Condenser Offgas .....................................................................3.0, 03/31/04 

B 3.7.6 Main Turbine Bypass System.............................................................3.0, 03/31/04 

B 3.7.7 Fuel Pool Water Level ........................................................................3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.1 AC Sources - Operating .....................................................................3.0, 03/31/04 

B 3.8.2 AC Sources - Shutdown .....................................................................3.0, 03/31/04 

B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air Subsystem .......................3.0, 03/31/04 

B 3.8.4 DC Sources - Operating .....................................................................3.0, 03/31/04 

B 3.8.5 DC Sources - Shutdown.....................................................................3.0, 03/31/04 

B 3.8.6 Battery Parameters ............................................................................3.0, 03/31/04 

B 3.8.7 Inverters - Operating ..........................................................................3.0, 03/31/04 

B 3.8.8 Inverters - Shutdown ..........................................................................3.0, 03/31/04 

B 3.8.9 Distribution Systems - Operating........................................................3.0, 03/31/04 

B 3.8.10 Distribution Systems - Shutdown........................................................3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.1 Refueling Equipment Interlocks..........................................................3.0, 03/31/04 

B 3.9.2 Refuel Position One-Rod-Out Interlock ..............................................3.0, 03/31/04 

B 3.9.3 Control Rod Position ..........................................................................3.0, 03/31/04 

B 3.9.4 Control Rod Position Indication ..........................................................3.0, 03/31/04 

B 3.9.5 Control Rod OPERABILITY - Refueling .............................................3.0, 03/31/04 

B 3.9.6 Reactor Pressure Vessel (RPV) Water Level [ - Irradiated Fuel] .......3.0, 03/31/04 

B 3.9.7 Reactor Pressure Vessel (RPV) Water Level - New Fuel or Control 

 Rods .............................................................................................3.0, 03/31/04 

B 3.9.8 Residual Heat Removal (RHR) - High Water Level............................3.0, 03/31/04 

B 3.9.9 Residual Heat Removal (RHR) - Low Water Level.............................3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.1 Inservice Leak and Hydrostatic Testing Operation.............................3.0, 03/31/04 

B 3.10.2 Reactor Mode Switch Interlock Testing..............................................3.0, 03/31/04 

B 3.10.3 Single Control Rod Withdrawal - Hot Shutdown.................................3.0, 03/31/04 

B 3.10.4 Single Control Rod Withdrawal - Cold Shutdown...............................3.0, 03/31/04 

B 3.10.5 Single Control Rod Drive (CRD) Removal - Refueling .......................3.0, 03/31/04 

B 3.10.6 Multiple Control Rod Withdrawal - Refueling......................................3.0, 03/31/04 

B 3.10.7 Control Rod Testing - Operating.........................................................3.0, 03/31/04 

B 3.10.8 SHUTDOWN MARGIN (SDM) Test - Refueling .................................3.0, 03/31/04 

B 3.10.9 Recirculation Loops - Testing.............................................................3.0, 03/31/04 

B 3.10.10 Training Startups ................................................................................3.0, 03/31/04 
Reactor Core SLs 

B 2.1.1 

BWR/6 STS B 2.1.1-1 Rev. 3.0, 03/31/04 

B 2.0 SAFETY LIMITS (SLs) 

B 2.1.1 Reactor Core SLs 

BASES 

BACKGROUND GDC 10 (Ref. 1) requires, and SLs ensure, that specified acceptable fuel 

design limits are not exceeded during steady state operation, normal 

operational transients, and anticipated operational occurrences (AOOs). 

The fuel cladding integrity SL is set such that no significant fuel damage 

is calculated to occur if the limit is not violated. Because fuel damage is 

not directly observable, a stepback approach is used to establish an SL, 

such that the MCPR is not less than the limit specified in 

Specification 2.1.1.2 for [both General Electric Company (GE) and 

Advanced Nuclear Fuel Corporation (ANF) fuel]. MCPR greater than the 

specified limit represents a conservative margin relative to the conditions 

required to maintain fuel cladding integrity. 

The fuel cladding is one of the physical barriers that separate the 

radioactive materials from the environs. The integrity of this cladding 

barrier is related to its relative freedom from perforations or cracking. 

Although some corrosion or use related cracking may occur during the life 

of the cladding, fission product migration from this source is incrementally 

cumulative and continuously measurable. Fuel cladding perforations, 

however, can result from thermal stresses, which occur from reactor 

operation significantly above design conditions. 

While fission product migration from cladding perforation is just as 

measurable as that from use related cracking, the thermally caused 

cladding perforations signal a threshold beyond which still greater thermal 

stresses may cause gross, rather than incremental, cladding 

deterioration. Therefore, the fuel cladding SL is defined with a margin to 

the conditions that would produce onset of transition boiling (i.e., 

MCPR = 1.00). These conditions represent a significant departure from 

the condition intended by design for planned operation. The MCPR fuel 

cladding integrity SL ensures that during normal operation and during 

AOOs, at least 99.9% of the fuel rods in the core do not experience 

transition boiling. 

Operation above the boundary of the nucleate boiling regime could result 

in excessive cladding temperature because of the onset of transition 

boiling and the resultant sharp reduction in heat transfer coefficient. 

Inside the steam film, high cladding temperatures are reached, and a 

cladding water (zirconium water) reaction may take place. This chemical 

reaction results in oxidation of the fuel cladding to a structurally weaker 

form. This weaker form may lose its integrity, resulting in an uncontrolled 

release of activity to the reactor coolant. 
Reactor Core SLs 

B 2.1.1 

BWR/6 STS B 2.1.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The fuel cladding must not sustain damage as a result of normal 

SAFETY operation and AOOs. The reactor core SLs are established to preclude 

ANALYSES violation of the fuel design criterion that an MCPR limit is to be 

established, such that at least 99.9% of the fuel rods in the core would not 

be expected to experience the onset of transition boiling. 

The Reactor Protection System setpoints (LCO 3.3.1.1, "Reactor 

Protection System (RPS) Instrumentation"), in combination with other 

LCOs, are designed to prevent any anticipated combination of transient 

conditions for Reactor Coolant System water level, pressure, and 

THERMAL POWER level that would result in reaching the MCPR limit. 

2.1.1.1a Fuel Cladding Integrity [General Electric Company (GE) Fuel] 

GE critical power correlations are applicable for all critical power 

calculations at pressures ≥ 785 psig and core flows ≥ 10% of rated flow. 

For operation at low pressures or low flows, another basis is used, as 

follows: 

Since the pressure drop in the bypass region is essentially all 

elevation head, the core pressure drop at low power and flows will 

always be > 4.5 psi. Analyses (Ref. 2) show that with a bundle flow 

of 28 x 103

 lb/hr, bundle pressure drop is nearly independent of 

bundle power and has a value of 3.5 psi. Thus, the bundle flow with 

a 4.5 psi driving head will be > 28 x 103

 lb/hr. Full scale ATLAS test 

data taken at pressures from 14.7 psia to 800 psia indicate that the 

fuel assembly critical power at this flow is approximately 3.35 MWt. 

With the design peaking factors, this corresponds to a THERMAL 

POWER > 50% RTP. Thus, a THERMAL POWER limit of 25% RTP 

for reactor pressure < 785 psig is conservative. 

2.1.1.1b Fuel Cladding Integrity [Advanced Nuclear Fuel Corporation 

(ANF) Fuel] 

The use of the XN-3 correlation is valid for critical power calculations at 

pressures > 580 psig and bundle mass fluxes > 0.25 x 106

 lb/hr-ft2

(Ref. 3). For operation at low pressures or low flows, the fuel cladding 

integrity SL is established by a limiting condition on core THERMAL 

POWER, with the following basis: 

Provided that the water level in the vessel downcomer is maintained 

above the top of the active fuel, natural circulation is sufficient to 

ensure a minimum bundle flow for all fuel assemblies that have a 

relatively high power and potentially can approach a critical heat flux 

condition. For the ANF 9x9 fuel design, the minimum bundle flow 
Reactor Core SLs 

B 2.1.1 

BWR/6 STS B 2.1.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

is > 30 x 103

 lb/hr. For the ANF 8x8 fuel design, the minimum bundle 

flow is > 28 x 103

 lb/hr. For all designs, the coolant minimum bundle 

flow and maximum flow area are such that the mass flux is always 

> 0.25 x 106

 lb/hr-ft2. Full scale critical power tests taken at 

pressures down to 14.7 psia indicate that the fuel assembly critical 

power at 0.25 x 106

 lb/hr-ft2 is approximately 3.35 MWt. At 25% RTP, 

a bundle power of approximately 3.35 MWt corresponds to a bundle 

radial peaking factor of > 3.0, which is significantly higher than the 

expected peaking factor. Thus, a THERMAL POWER limit of 

25% RTP for reactor pressures < 785 psig is conservative. 

2.1.1.2a MCPR [GE Fuel] 

The fuel cladding integrity SL is set such that no significant fuel damage 

is calculated to occur if the limit is not violated. Since the parameters that 

result in fuel damage are not directly observable during reactor operation, 

the thermal and hydraulic conditions that result in the onset of transition 

boiling have been used to mark the beginning of the region in which fuel 

damage could occur. Although it is recognized that the onset of transition 

boiling would not result in damage to BWR fuel rods, the critical power at 

which boiling transition is calculated to occur has been adopted as a 

convenient limit. However, the uncertainties in monitoring the core 

operating state and in the procedures used to calculate the critical power 

result in an uncertainty in the value of the critical power. Therefore, the 

fuel cladding integrity SL is defined as the critical power ratio in the 

limiting fuel assembly for which more than 99.9% of the fuel rods in the 

core are expected to avoid boiling transition, considering the power 

distribution within the core and all uncertainties. 

The MCPR SL is determined using a statistical model that combines all 

the uncertainties in operating parameters and the procedures used to 

calculate critical power. The probability of the occurrence of boiling 

transition is determined using the approved General Electric Critical 

Power correlations. Details of the fuel cladding integrity SL calculation 

are given in Reference 2. Reference 2 also includes a tabulation of the 

uncertainties used in the determination of the MCPR SL and of the 

nominal values of the parameters used in the MCPR SL statistical 

analysis. 
Reactor Core SLs 

B 2.1.1 

BWR/6 STS B 2.1.1-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

2.1.1.2b MCPR [ANF Fuel] 

The MCPR SL ensures sufficient conservatism in the operating MCPR 

limit that, in the event of an AOO from the limiting condition of operation, 

at least 99.9% of the fuel rods in the core would be expected to avoid 

boiling transition. The margin between calculated boiling transition (i.e., 

MCPR = 1.00) and the MCPR SL is based on a detailed statistical 

procedure that considers the uncertainties in monitoring the core 

operating state. One specific uncertainty included in the SL is the 

uncertainty inherent in the XN-3 critical power correlation. Reference 3 

describes the methodology used in determining the MCPR SL. 

The XN-3 critical power correlation is based on a significant body of 

practical test data, providing a high degree of assurance that the critical 

power, as evaluated by the correlation, is within a small percentage of the 

actual critical power being estimated. As long as the core pressure and 

flow are within the range of validity of the XN-3 correlation, the assumed 

reactor conditions used in defining the SL introduce conservatism into the 

limit because bounding high radial power factors and bounding flat local 

peaking distributions are used to estimate the number of rods in boiling 

transition. Still further conservatism is induced by the tendency of the 

XN-3 correlation to overpredict the number of rods in boiling transition. 

These conservatisms and the inherent accuracy of the XN-3 correlation 

provide a reasonable degree of assurance that there would be no 

transition boiling in the core during sustained operation at the MCPR SL. 

If boiling transition were to occur, there is reason to believe that the 

integrity of the fuel would not be compromised. Significant test data 

accumulated by the NRC and private organizations indicate that the use 

of a boiling transition limitation to protect against cladding failure is a very 

conservative approach. Much of the data indicate that BWR fuel can 

survive for an extended period of time in an environment of boiling 

transition. 

2.1.1.3 Reactor Vessel Water Level

During MODES 1 and 2, the reactor vessel water level is required to be 

above the top of the active fuel to provide core cooling capability. With 

fuel in the reactor vessel during periods when the reactor is shut down, 

consideration must be given to water level requirements due to the effect 

of decay heat. If the water level should drop below the top of the active 

irradiated fuel during this period, the ability to remove decay heat is 

reduced. This reduction in cooling capability could lead to elevated 
Reactor Core SLs 

B 2.1.1 

BWR/6 STS B 2.1.1-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

cladding temperatures and clad perforation in the event that the water 

level becomes < 2/3 of the core height. The reactor vessel water level SL 

has been established at the top of the active irradiated fuel to provide a 

point that can be monitored and to also provide adequate margin for 

effective action. 

SAFETY LIMITS The reactor core SLs are established to protect the integrity of the fuel 

clad barrier to the release of radioactive materials to the environs. 

SL 2.1.1.1 and SL 2.1.1.2 ensure that the core operates within the fuel 

design criteria. SL 2.1.1.3 ensures that the reactor vessel water level is 

greater than the top of the active irradiated fuel in order to prevent 

elevated clad temperatures and resultant clad perforations. 

APPLICABILITY SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in all MODES. 

SAFETY LIMIT Exceeding an SL may cause fuel damage and create a potential for 

VIOLATIONS radioactive releases in excess of 10 CFR 100, "Reactor Site Criteria," 

limits (Ref. 4). Therefore, it is required to insert all insertable control rods 

and restore compliance with the SL within 2 hours. The 2 hour 

Completion Time ensures that the operators take prompt remedial action 

and the probability of an accident occurring during this period is minimal. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10. 

 2. NEDE-24011-P-A, (latest approved revision). 

 3. XN-NF524(A), Revision 1, November 1983. 

 4. 10 CFR 100. 
RCS Pressure SL 

B 2.1.2 

BWR/6 STS B 2.1.2-1 Rev. 3.0, 03/31/04 

B 2.0 SAFETY LIMITS (SLs) 

B 2.1.2 Reactor Coolant System (RCS) Pressure SL 

BASES 

BACKGROUND The SL on reactor steam dome pressure protects the RCS against 

overpressurization. In the event of fuel cladding failure, fission products 

are released into the reactor coolant. The RCS then serves as the 

primary barrier in preventing the release of fission products into the 

atmosphere. Establishing an upper limit on reactor steam dome pressure 

ensures continued RCS integrity. According to 10 CFR 50, Appendix A, 

GDC 14, "Reactor Coolant Pressure Boundary," and GDC 15, "Reactor 

Coolant System Design" (Ref. 1), the reactor coolant pressure boundary 

(RCPB) shall be designed with sufficient margin to ensure that the design 

conditions are not exceeded during normal operation and anticipated 

operational occurrences (AOOs). 

During normal operation and AOOs, RCS pressure is limited from 

exceeding the design pressure by more than 10%, in accordance with 

Section III of the ASME Code (Ref. 2). To ensure system integrity, all 

RCS components are hydrostatically tested at 125% of design pressure, 

in accordance with ASME Code requirements, prior to initial operation 

when there is no fuel in the core. Any further hydrostatic testing with fuel 

in the core may be done under LCO 3.10.1, "Inservice Leak and 

Hydrostatic Testing Operation." Following inception of unit operation, 

RCS components shall be pressure tested in accordance with the 

requirements of ASME Code, Section XI (Ref. 3). 

Overpressurization of the RCS could result in a breach of the RCPB, 

reducing the number of protective barriers designed to prevent 

radioactive releases from exceeding the limits specified in 10 CFR 100, 

"Reactor Site Criteria" (Ref. 4). If this occurred in conjunction with a fuel 

cladding failure, the number of protective barriers designed to prevent 

radioactive releases from exceeding the limits would be reduced. 

APPLICABLE The RCS safety/relief valves and the Reactor Protection System Reactor 

SAFETY Vessel Steam Dome Pressure - High Function have settings established 

ANALYSES to ensure that the RCS pressure SL will not be exceeded. 

The RCS pressure SL has been selected such that it is at a pressure 

below which it can be shown that the integrity of the system is not 

endangered. The reactor pressure vessel is designed to ASME, Boiler 

and Pressure Vessel Code, Section III, [1971 Edition], including Addenda 

through the [winter of 1972] (Ref. 5), which permits a maximum pressure 

transient of 110%, 1375 psig, of design pressure 1250 psig. The SL of 
RCS Pressure SL 

B 2.1.2 

BWR/6 STS B 2.1.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

1325 psig, as measured in the reactor steam dome, is equivalent to 

1375 psig at the lowest elevation of the RCS. The RCS is designed to 

ASME Code, Section III, 1974 Edition (Ref. 6), for the reactor recirculation 

piping, which permits a maximum pressure transient of 110% of design 

pressures of 1250 psig for suction piping and 1650 psig for discharge 

piping. The RCS pressure SL is selected to be the lowest transient 

overpressure allowed by the applicable codes. 

SAFETY LIMITS The maximum transient pressure allowable in the RCS pressure vessel 

under the ASME Code, Section III, is 110% of design pressure. The 

maximum transient pressure allowable in the RCS piping, valves, and 

fittings is 110% of design pressures of 1250 psig for suction piping and 

1500 psig for discharge piping. The most limiting of these allowances is 

the 110% of the suction piping design pressure; therefore, the SL on 

maximum allowable RCS pressure is established at 1325 psig as 

measured at the reactor steam dome. 

APPLICABILITY SL 2.1.2 applies in all MODES. 

SAFETY LIMIT Exceeding the RCS pressure SL may cause immediate RCS failure and 

VIOLATIONS create a potential for radioactive releases in excess of 10 CFR 100, 

"Reactor Site Criteria," limits (Ref. 4). Therefore, it is required to insert all 

insertable control rods and restore compliance with the SL within 2 hours. 

The 2 hour Completion Time ensures that the operators take prompt 

remedial action and also assures that the probability of an accident 

occurring during this period is minimal. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28. 

 2. ASME, Boiler and Pressure Vessel Code, Section III, 

Article NB-7000. 

 3. ASME, Boiler and Pressure Vessel Code, Section XI, Article IW-5000 

 4. 10 CFR 100. 

 5. ASME, Boiler and Pressure Vessel Code, [1971 Edition], Addenda, 

[winter of 1972]. 

 6. ASME, Boiler and Pressure Vessel Code, [1974 Edition]. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-1 Rev. 3.0, 03/31/04 

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY 

BASES 

LCOs LCO 3.0.1 through LCO 3.0.7 establish the general requirements 

applicable to all Specifications and apply at all times, unless otherwise 

stated. 

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual 

Specification as the requirement for when the LCO is required to be met 

(i.e., when the unit is in the MODES or other specified conditions of the 

Applicability statement of each Specification). 

LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, 

the associated ACTIONS shall be met. The Completion Time of each 

Required Action for an ACTIONS Condition is applicable from the point in 

time that an ACTIONS Condition is entered. The Required Actions 

establish those remedial measures that must be taken within specified 

Completion Times when the requirements of an LCO are not met. This 

Specification establishes that: 

a. Completion of the Required Actions within the specified Completion 

Times constitutes compliance with a Specification and 

b. Completion of the Required Actions is not required when an LCO is 

met within the specified Completion Time, unless otherwise specified. 

There are two basic types of Required Actions. The first type of Required 

Action specifies a time limit in which the LCO must be met. This time limit 

is the Completion Time to restore an inoperable system or component to 

OPERABLE status or to restore variables to within specified limits. If this 

type of Required Action is not completed within the specified Completion 

Time, a shutdown may be required to place the unit in a MODE or 

condition in which the Specification is not applicable. (Whether stated as 

a Required Action or not, correction of the entered Condition is an action 

that may always be considered upon entering ACTIONS.) The second 

type of Required Action specifies the remedial measures that permit 

continued operation of the unit that is not further restricted by the 

Completion Time. In this case, compliance with the Required Actions 

provides an acceptable level of safety for continued operation. 

Completing the Required Actions is not required when an LCO is met or 

is no longer applicable, unless otherwise stated in the individual 

Specifications. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-2 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.2 (continued) 

The nature of some Required Actions of some Conditions necessitates 

that, once the Condition is entered, the Required Actions must be 

completed even though the associated Conditions no longer exist. The 

individual LCO's ACTIONS specify the Required Actions where this is the 

case. An example of this is in LCO 3.4.11, "RCS Pressure and 

Temperature (P/T) Limits." 

The Completion Times of the Required Actions are also applicable when 

a system or component is removed from service intentionally. The 

reasons for intentionally relying on the ACTIONS include, but are not 

limited to, performance of Surveillances, preventive maintenance, 

corrective maintenance, or investigation of operational problems. 

Entering ACTIONS for these reasons must be done in a manner that 

does not compromise safety. Intentional entry into ACTIONS should not 

be made for operational convenience. Additionally, if intentional entry into 

ACTIONS would result in redundant equipment being inoperable, 

alternatives should be used instead. Doing so limits the time both 

subsystems/divisions of a safety function are inoperable and limits the 

time conditions exist which may result in LCO 3.0.3 being entered. 

Individual Specifications may specify a time limit for performing an SR 

when equipment is removed from service or bypassed for testing. In this 

case, the Completion Times of the Required Actions are applicable when 

this time limit expires, if the equipment remains removed from service or 

bypassed. 

When a change in MODE or other specified condition is required to 

comply with Required Actions, the unit may enter a MODE or other 

specified condition in which another Specification becomes applicable. In 

this case, the Completion Times of the associated Required Actions 

would apply from the point in time that the new Specification becomes 

applicable, and the ACTIONS Condition(s) are entered. 

LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an 

LCO is not met and: 

a. An associated Required Action and Completion Time is not met and 

no other Condition applies or 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-3 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.3 (continued) 

b. The condition of the unit is not specifically addressed by the 

associated ACTIONS. This means that no combination of Conditions 

stated in the ACTIONS can be made that exactly corresponds to the 

actual condition of the unit. Sometimes, possible combinations of 

Conditions are such that entering LCO 3.0.3 is warranted; in such 

cases, the ACTIONS specifically state a Condition corresponding to 

such combinations and also that LCO 3.0.3 be entered immediately. 

This Specification delineates the time limits for placing the unit in a safe 

MODE or other specified condition when operation cannot be maintained 

within the limits for safe operation as defined by the LCO and its 

ACTIONS. It is not intended to be used as an operational convenience 

that permits routine voluntary removal of redundant systems or 

components from service in lieu of other alternatives that would not result 

in redundant systems or components being inoperable. 

Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly 

shutdown before initiating a change in unit operation. This includes time 

to permit the operator to coordinate the reduction in electrical generation 

with the load dispatcher to ensure the stability and availability of the 

electrical grid. The time limits specified to reach lower MODES of 

operation permit the shutdown to proceed in a controlled and orderly 

manner that is well within the specified maximum cooldown rate and 

within the capabilities of the unit, assuming that only the minimum 

required equipment is OPERABLE. This reduces thermal stresses on 

components of the Reactor Coolant System and the potential for a plant 

upset that could challenge safety systems under conditions to which this 

Specification applies. The use and interpretation of specified times to 

complete the actions of LCO 3.0.3 are consistent with the discussion of 

Section 1.3, Completion Times. 

A unit shutdown required in accordance with LCO 3.0.3 may be 

terminated and LCO 3.0.3 exited if any of the following occurs: 

a. The LCO is now met, 

b. A Condition exists for which the Required Actions have now been 

performed, or 

c. ACTIONS exist that do not have expired Completion Times. These 

Completion Times are applicable from the point in time that the 

Condition is initially entered and not from the time LCO 3.0.3 is 

exited. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-4 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.3 (continued) 

The time limits of LCO 3.0.3 allow 37 hours for the unit to be in MODE 4 

when a shutdown is required during MODE 1 operation. If the unit is in a 

lower MODE of operation when a shutdown is required, the time limit for 

reaching the next lower MODE applies. If a lower MODE is reached in 

less time than allowed, however, the total allowable time to reach 

MODE 4, or other applicable MODE, is not reduced. For example, if 

MODE 2 is reached in 2 hours, then the time allowed for reaching 

MODE 3 is the next 11 hours, because the total time for reaching 

MODE 3 is not reduced from the allowable limit of 13 hours. Therefore, if 

remedial measures are completed that would permit a return to MODE 1, 

a penalty is not incurred by having to reach a lower MODE of operation in 

less than the total time allowed. 

In MODES 1, 2, and 3, LCO 3.0.3 provides actions for Conditions not 

covered in other Specifications. The requirements of LCO 3.0.3 do not 

apply in MODES 4 and 5 because the unit is already in the most 

restrictive Condition required by LCO 3.0.3. The requirements of 

LCO 3.0.3 do not apply in other specified conditions of the Applicability 

(unless in MODE 1, 2, or 3) because the ACTIONS of individual 

Specifications sufficiently define the remedial measures to be taken. 

Exceptions to LCO 3.0.3 are provided in instances where requiring a unit 

shutdown, in accordance with LCO 3.0.3, would not provide appropriate 

remedial measures for the associated condition of the unit. An example 

of this is in LCO 3.7.7, "Fuel Pool Water Level." LCO 3.7.7 has an 

Applicability of "During movement of irradiated fuel assemblies in the 

associated fuel storage pool." Therefore, this LCO can be applicable in 

any or all MODES. If the LCO and the Required Actions of LCO 3.7.7 are 

not met while in MODE 1, 2, or 3, there is no safety benefit to be gained 

by placing the unit in a shutdown condition. The Required Action of 

LCO 3.7.7 of "Suspend movement of irradiated fuel assemblies in the 

associated fuel storage pool(s)" is the appropriate Required Action to 

complete in lieu of the actions of LCO 3.0.3. These exceptions are 

addressed in the individual Specifications. 

LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other 

specified conditions in the Applicability when an LCO is not met. It allows 

placing the unit in a MODE or other specified condition stated in that 

Applicability (e.g., the Applicability desired to be entered) when unit 

conditions are such that the requirements of the LCO would not be met, in 

accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-5 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.4 (continued) 

LCO 3.0.4.a allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met when the associated ACTIONS to be 

entered permit continued operation in the MODE or other specified 

condition in the Applicability for an unlimited period of time. Compliance 

with Required Actions that permit continued operation of the unit for an 

unlimited period of time in a MODE or other specified condition provides 

an acceptable level of safety for continued operation. This is without 

regard to the status of the unit before or after the MODE change. 

Therefore, in such cases, entry into a MODE or other specified condition 

in the Applicability may be made in accordance with the provisions of the 

Required Actions. 

LCO 3.0.4.b allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met after performance of a risk assessment 

addressing inoperable systems and components, consideration of the 

results, determination of the acceptability of entering the MODE or other 

specified condition in the Applicability, and establishment of risk 

management actions, if appropriate. 

The risk assessment may use quantitative, qualitative, or blended 

approaches, and the risk assessment will be conducted using the plant 

program, procedures, and criteria in place to implement 

10 CFR 50.65(a)(4), which requires that risk impacts of maintenance 

activities to be assessed and managed. The risk assessment, for the 

purposes of LCO 3.0.4.b, must take into account all inoperable Technical 

Specification equipment regardless of whether the equipment is included 

in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk 

assessments will be conducted using the procedures and guidance 

endorsed by Regulatory Guide 1.182, “Assessing and Managing Risk 

Before Maintenance Activities at Nuclear Power Plants.” Regulatory 

Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, 

“Industry Guideline for Monitoring the Effectiveness of Maintenance at 

Nuclear Power Plants.” These documents address general guidance for 

conduct of the risk assessment, quantitative and qualitative guidelines for 

establishing risk management actions, and example risk management 

actions. These include actions to plan and conduct other activities in a 

manner that controls overall risk, increased risk awareness by shift and 

management personnel, actions to reduce the duration of the condition, 

actions to minimize the magnitude of risk increases (establishment of 

backup success paths or compensatory measures), and determination 

that the proposed MODE change is acceptable. Consideration should 

also be given to the probability of completing restoration such that the 

requirements of the LCO would be met prior to the expiration of ACTIONS 

Completion Times that would require exiting the Applicability. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-6 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.4 (continued) 

LCO 3.0.4.b may be used with single, or multiple systems and 

components unavailable. NUMARC 93-01 provides guidance relative to 

consideration of simultaneous unavailability of multiple systems and 

components. 

The results of the risk assessment shall be considered in determining the 

acceptability of entering the MODE or other specified condition in the 

Applicability, and any corresponding risk management actions. The 

LCO 3.0.4.b risk assessments do not have to be documented. 

The Technical Specifications allow continued operation with equipment 

unavailable in MODE 1 for the duration of the Completion Time. Since 

this is allowable, and since in general the risk impact in that particular 

MODE bounds the risk of transitioning into and through the applicable 

MODES or other specified conditions in the Applicability of the LCO, the 

use of the LCO 3.0.4.b allowance should be generally acceptable, as long 

as the risk is assessed and managed as stated above. However, there is 

a small subset of systems and components that have been determined to 

be more important to risk and use of the LCO 3.0.4.b allowance is 

prohibited. The LCOs governing these systems and components contain 

Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not 

applicable. 

LCO 3.0.4.c allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met based on a Note in the Specification 

which states LCO 3.0.4.c is applicable. These specific allowances permit 

entry into MODES or other specified conditions in the Applicability when 

the associated ACTIONS to be entered do not provide for continued 

operation for an unlimited period of time and a risk assessment has not 

been performed. This allowance may apply to all the ACTIONS or to a 

specific Required Action of a Specification. The risk assessments 

performed to justify the use of LCO 3.0.4.b usually only consider systems 

and components. For this reason, LCO 3.0.4.c is typically applied to 

Specifications which describe values and parameters (e.g., [Containment 

Air Temperature, Containment Pressure, MCPR, Moderator Temperature 

Coefficient]), and may be applied to other Specifications based on NRC 

plant specific approval. 

The provisions of this Specification should not be interpreted as 

endorsing the failure to exercise the good practice of restoring systems or 

components to OPERABLE status before entering an associated MODE 

or other specified condition in the Applicability. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-7 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.4 (continued) 

The provisions of LCO 3.0.4 shall not prevent changes in MODES or 

other specified conditions in the Applicability that are required to comply 

with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent 

changes in MODES or other specified conditions in the Applicability that 

result from any unit shutdown. In this context, a unit shutdown is defined 

as a change in MODE or other specified condition in the Applicability 

associated with transitioning from MODE 1 to MODE 2, MODE 2 to 

MODE 3, and MODE 3 to MODE 4. 

Upon entry into a MODE or other specified condition in the Applicability 

with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the 

applicable Conditions and Required Actions until the Condition is 

resolved, until the LCO is met, or until the unit is not within the 

Applicability of the Technical Specification. 

Surveillances do not have to be performed on the associated inoperable 

equipment (or on variables outside the specified limits), as permitted by 

SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or 

SR 3.0.4 for any Surveillances that have not been performed on 

inoperable equipment. However, SRs must be met to ensure 

OPERABILITY prior to declaring the associated equipment OPERABLE 

(or variable within limits) and restoring compliance with the affected LCO. 

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service 

under administrative controls when it has been removed from service or 

declared inoperable to comply with ACTIONS. The sole purpose of this 

Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply 

with the applicable Required Action(s)) to allow the performance of 

required testing to demonstrate: 

a. The OPERABILITY of the equipment being returned to service or 

b. The OPERABILITY of other equipment. 

The administrative controls ensure the time the equipment is returned to 

service in conflict with the requirements of the ACTIONS is limited to the 

time absolutely necessary to perform the required testing to demonstrate 

OPERABILITY. This Specification does not provide time to perform any 

other preventive or corrective maintenance. 

An example of demonstrating the OPERABILITY of the equipment being 

returned to service is reopening a containment isolation valve that has 

been closed to comply with Required Actions and must be reopened to 

perform the required testing. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-8 Rev. 3.0, 03/31/04 

BASES 

 

LCO 3.0.5 (continued) 

An example of demonstrating the OPERABILITY of other equipment is 

taking an inoperable channel or trip system out of the tripped condition to 

prevent the trip function from occurring during the performance of 

required testing on another channel in the other trip system. A similar 

example of demonstrating the OPERABILITY of other equipment is taking 

an inoperable channel or trip system out of the tripped condition to permit 

the logic to function and indicate the appropriate response during the 

performance of required testing on another channel in the same trip 

system. 

 

LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for support systems that 

have an LCO specified in the Technical Specifications (TS). This 

exception is provided because LCO 3.0.2 would require that the 

Conditions and Required Actions of the associated inoperable supported 

system LCO be entered solely due to the inoperability of the support 

system. This exception is justified because the actions that are required 

to ensure the plant is maintained in a safe condition are specified in the 

support system LCO's Required Actions. These Required Actions may 

include entering the supported system's Conditions and Required Actions 

or may specify other Required Actions. 

When a support system is inoperable and there is an LCO specified for it 

in the TS, the supported system(s) are required to be declared inoperable 

if determined to be inoperable as a result of the support system 

inoperability. However, it is not necessary to enter into the supported 

systems' Conditions and Required Actions unless directed to do so by the 

support system's Required Actions. The potential confusion and 

inconsistency of requirements related to the entry into multiple support 

and supported systems' LCOs' Conditions and Required Actions are 

eliminated by providing all the actions that are necessary to ensure the 

plant is maintained in a safe condition in the support system's Required 

Actions. 

However, there are instances where a support system's Required Action 

may either direct a supported system to be declared inoperable or direct 

entry into Conditions and Required Actions for the supported system. 

This may occur immediately or after some specified delay to perform 

some other Required Action. Regardless of whether it is immediate or 

after some delay, when a support system's Required Action directs a 

supported system to be declared inoperable or directs entry into 

Conditions and Required Actions for a supported system, the applicable 

Conditions and Required Actions shall be entered in accordance with 

LCO 3.0.2. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-9 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.6 (continued) 

Specification 5.5.12, "Safety Function Determination Program (SFDP)," 

ensures loss of safety function is detected and appropriate actions are 

taken. Upon entry into LCO 3.0.6, an evaluation shall be made to 

determine if loss of safety function exists. Additionally, other limitations, 

remedial actions, or compensatory actions may be identified as a result of 

the support system inoperability and corresponding exception to entering 

supported system Conditions and Required Actions. The SFDP 

implements the requirements of LCO 3.0.6. 

Cross division checks to identify a loss of safety function for those support 

systems that support safety systems are required. The cross division 

check verifies that the supported systems of the redundant OPERABLE 

support system are OPERABLE, thereby ensuring safety function is 

retained. [ A loss of safety function may exist when a support system is 

inoperable, and: 

a. A required system redundant to system(s) supported by the 

inoperable support system is also inoperable (EXAMPLE B 3.0.6-1), 

b. A required system redundant to system(s) in turn supported by the 

inoperable supported system is also inoperable (EXAMPLE 

B 3.0.6-2), or 

c. A required system redundant to support system(s) for the supported 

systems (a) and (b) above is also inoperable (EXAMPLE B 3.0.6-3). 

EXAMPLE B 3.0.6-1

If System 2 of Train A is inoperable and System 5 of Train B is 

inoperable, a loss of safety function exists in supported System 5. 

EXAMPLE B 3.0.6-2

If System 2 of Train A is inoperable, and System 11 of Train B is 

inoperable, a loss of safety function exists in System 11 which is in turn 

supported by System 5. 

EXAMPLE B 3.0.6-3

If System 2 of Train A is inoperable, and System 1 of Train B is 

inoperable, a loss of safety function exists in Systems 2, 4, 5, 8, 9, 10 and 

11. ] 

If this evaluation determines that a loss of safety function exists, the 

appropriate Conditions and Required Actions of the LCO in which the loss 

of safety function exists are required to be entered. 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-10 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.6 (continued) 

[ Figure B 3.0-1 

Configuration of Trains and Systems ]

This loss of safety function does not require the assumption of additional 

single failures or loss of offsite power. Since operations is being 

restricted in accordance with the ACTIONS of the support system, any 

resulting temporary loss of redundancy or single failure protection is taken 

into account. Similarly, the ACTIONS for inoperable offsite circuit(s) and 

inoperable diesel generator(s) provide the necessary restriction for cross 

train inoperabilities. This explicit cross train verification for inoperable AC 

electrical power sources also acknowledges that supported system(s) are 

not declared inoperable solely as a result of inoperability of a normal or 

emergency electrical power source (refer to the definition of 

OPERABILITY). 

When loss of safety function is determined to exist, and the SFDP 

requires entry into the appropriate Conditions and Required Actions of the 

LCO in which the loss of safety function exists, consideration must be 

given to the specific type of function affected. Where a loss of function is 
LCO Applicability 

B 3.0 

BWR/6 STS B 3.0-11 Rev. 3.0, 03/31/04 

BASES 

LCO 3.0.6 (continued) 

solely due to a single Technical Specification support system (e.g., loss of 

automatic start due to inoperable instrumentation, or loss of pump suction 

source due to low tank level) the appropriate LCO is the LCO for the 

support system. The ACTIONS for a support system LCO adequately 

addresses the inoperabilities of that system without reliance on entering 

its supported system LCO. When the loss of function is the result of 

multiple support systems, the appropriate LCO is the LCO for the 

supported system. 

LCO 3.0.7 There are certain special tests and operations required to be performed at 

various times over the life of the unit. These special tests and operations 

are necessary to demonstrate select unit performance characteristics, to 

perform special maintenance activities, and to perform special evolutions. 

Special Operations LCOs in Section 3.10 allow specified TS requirements 

to be changed to permit performances of these special tests and 

operations, which otherwise could not be performed if required to comply 

with the requirements of these TS. Unless otherwise specified, all the 

other TS requirements remain unchanged. This will ensure all 

appropriate requirements of the MODE or other specified condition not 

directly associated with or required to be changed to perform the special 

test or operation will remain in effect. 

The Applicability of a Special Operations LCO represents a condition not 

necessarily in compliance with the normal requirements of the TS. 

Compliance with Special Operations LCOs is optional. A special 

operation may be performed either under the provisions of the 

appropriate Special Operations LCO or under the other applicable TS 

requirements. If it is desired to perform the special operation under the 

provisions of the Special Operations LCO, the requirements of the 

Special Operations LCO shall be followed. When a Special Operations 

LCO requires another LCO to be met, only the requirements of the LCO 

statement are required to be met regardless of that LCO's Applicability 

(i.e., should the requirements of this other LCO not be met, the ACTIONS 

of the Special Operations LCO apply, not the ACTIONS of the other 

LCO). However, there are instances where the Special Operations LCO 

ACTIONS may direct the other LCOs' ACTIONS be met. The 

Surveillances of the other LCO are not required to be met, unless 

specified in the Special Operations LCO. If conditions exist such that the 

Applicability of any other LCO is met, all the other LCO's requirements 

(ACTIONS and SRs) are required to be met concurrent with the 

requirements of the Special Operations LCO. 
SR Applicability 

B 3.0 

BWR/6 STS B 3.0-12 Rev. 3.0, 03/31/04 

B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY 

BASES 

SRs SR 3.0.1 through SR 3.0.4 establish the general requirements applicable 

to all Specifications and apply at all times, unless otherwise stated. 

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the 

MODES or other specified conditions in the Applicability for which the 

requirements of the LCO apply, unless otherwise specified in the 

individual SRs. This Specification is to ensure that Surveillances are 

performed to verify the OPERABILITY of systems and components, and 

that variables are within specified limits. Failure to meet a Surveillance 

within the specified Frequency, in accordance with SR 3.0.2, constitutes a 

failure to meet an LCO. Surveillances may be performed by means of 

any series of sequential, overlapping, or total steps provided the entire 

Surveillance is performed within the specified Frequency. Additionally, 

the definitions related to instrument testing (e.g., CHANNEL 

CALIBRATION) specify that these tests are performed by means of any 

series of sequential, overlapping, or total steps. 

Systems and components are assumed to be OPERABLE when the 

associated SRs have been met. Nothing in this Specification, however, is 

to be construed as implying that systems or components are OPERABLE 

when: 

a. The systems or components are known to be inoperable, although 

still meeting the SRs or 

b. The requirements of the Surveillance(s) are known to be not met 

between required Surveillance performances. 

Surveillances do not have to be performed when the unit is in a MODE or 

other specified condition for which the requirements of the associated 

LCO are not applicable, unless otherwise specified. The SRs associated 

with a Special Operations LCO are only applicable when the Special 

Operations LCO is used as an allowable exception to the requirements of 

a Specification. 

Unplanned events may satisfy the requirements (including applicable 

acceptance criteria) for a given SR. In this case, the unplanned event 

may be credited as fulfilling the performance of the SR. This allowance 

includes those SRs whose performance is normally precluded in a given 

MODE or other specified condition. 
SR Applicability 

B 3.0 

BWR/6 STS B 3.0-13 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.1 (continued) 

Surveillances, including Surveillances invoked by Required Actions, do 

not have to be performed on inoperable equipment because the 

ACTIONS define the remedial measures that apply. Surveillances have 

to be met and performed in accordance with SR 3.0.2, prior to returning 

equipment to OPERABLE status. 

Upon completion of maintenance, appropriate post maintenance testing is 

required to declare equipment OPERABLE. This includes ensuring 

applicable Surveillances are not failed and their most recent performance 

is in accordance with SR 3.0.2. Post maintenance testing may not be 

possible in the current MODE or other specified conditions in the 

Applicability due to the necessary unit parameters not having been 

established. In these situations, the equipment may be considered 

OPERABLE provided testing has been satisfactorily completed to the 

extent possible and the equipment is not otherwise believed to be 

incapable of performing its function. This will allow operation to proceed 

to a MODE or other specified condition where other necessary post 

maintenance tests can be completed. Some examples of this process 

are: 

a. Control Rod Drive maintenance during refueling that requires scram 

testing at > [800 psi]. However, if other appropriate testing is 

satisfactorily completed and the scram time testing of SR 3.1.4.3 is 

satisfied, the control rod can be considered OPERABLE. This allows 

startup to proceed to reach [800 psi] to perform other necessary 

testing. 

b. Reactor Core Isolation Cooling (RCIC) maintenance during shutdown 

that requires system functional tests at a specified pressure. 

Provided other appropriate testing is satisfactorily completed, startup 

can proceed with RCIC considered OPERABLE. This allows 

operation to reach the specified pressure to complete the necessary 

post maintenance testing. 

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified 

Frequency for Surveillances and any Required Action with a Completion 

Time that requires the periodic performance of the Required Action on a 

"once per..." interval. 

SR 3.0.2 permits a 25% extension of the interval specified in the 

Frequency. This extension facilitates Surveillance scheduling and 

considers plant operating conditions that may not be suitable for 

conducting the Surveillance (e.g., transient conditions or other ongoing 

Surveillance or maintenance activities). 
SR Applicability 

B 3.0 

BWR/6 STS B 3.0-14 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.2 (continued) 

The 25% extension does not significantly degrade the reliability that 

results from performing the Surveillance at its specified Frequency. This 

is based on the recognition that the most probable result of any particular 

Surveillance being performed is the verification of conformance with the 

SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 

25% extension of the interval specified in the Frequency does not apply. 

These exceptions are stated in the individual Specifications. The 

requirements of regulations take precedence over the TS. An example of 

where SR 3.0.2 does not apply is in the Primary Containment Leakage 

Rate Testing Program. This program establishes testing requirements 

and Frequencies in accordance with the requirements of regulations. The 

TS cannot in and of themselves extend a test interval specified in the 

regulations. 

As stated in SR 3.0.2, the 25% extension also does not apply to the initial 

portion of a periodic Completion Time that requires performance on a 

"once per ..." basis. The 25% extension applies to each performance 

after the initial performance. The initial performance of the Required 

Action, whether it is a particular Surveillance or some other remedial 

action, is considered a single action with a single Completion Time. One 

reason for not allowing the 25% extension to this Completion Time is that 

such an action usually verifies that no loss of function has occurred by 

checking the status of redundant or diverse components or accomplishes 

the function of the inoperable equipment in an alternative manner. 

The provisions of SR 3.0.2 are not intended to be used repeatedly merely 

as an operational convenience to extend Surveillance intervals (other 

than those consistent with refueling intervals) or periodic Completion 

Time intervals beyond those specified. 

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment 

inoperable or an affected variable outside the specified limits when a 

Surveillance has not been completed within the specified Frequency. A 

delay period of up to 24 hours or up to the limit of the specified 

Frequency, whichever is greater, applies from the point in time that it is 

discovered that the Surveillance has not been performed in accordance 

with SR 3.0.2, and not at the time that the specified Frequency was not 

met. 
SR Applicability 

B 3.0 

BWR/6 STS B 3.0-15 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.3 (continued) 

This delay period provides adequate time to complete Surveillances that 

have been missed. This delay period permits the completion of a 

Surveillance before complying with Required Actions or other remedial 

measures that might preclude completion of the Surveillance. 

The basis for this delay period includes consideration of unit conditions, 

adequate planning, availability of personnel, the time required to perform 

the Surveillance, the safety significance of the delay in completing the 

required Surveillance, and the recognition that the most probable result of 

any particular Surveillance being performed is the verification of 

conformance with the requirements. When a Surveillance with a 

Frequency based not on time intervals, but upon specified unit conditions, 

operating situations, or requirements of regulations (e.g., prior to entering 

MODE 1 after each fuel loading, or in accordance with 10 CFR 50, 

Appendix J, as modified by approved exemptions, etc.) is discovered to 

not have been performed when specified, SR 3.0.3 allows for the full 

delay period of up to the specified Frequency to perform the Surveillance. 

However, since there is not a time interval specified, the missed 

Surveillance should be performed at the first reasonable opportunity. 

SR 3.0.3 provides a time limit for, and allowances for the performance of, 

Surveillances that become applicable as a consequence of MODE 

changes imposed by Required Actions. 

Failure to comply with specified Frequencies for SRs is expected to be an 

infrequent occurrence. Use of the delay period established by SR 3.0.3 is 

a flexibility which is not intended to be used as an operational 

convenience to extend Surveillance intervals. While up to 24 hours or the 

limit of the specified Frequency is provided to perform the missed 

Surveillance, it is expected that the missed Surveillance will be performed 

at the first reasonable opportunity. The determination of the first 

reasonable opportunity should include consideration of the impact on 

plant risk (from delaying the Surveillance as well as any plant 

configuration changes required or shutting the plant down to perform the 

Surveillance) and impact on any analysis assumptions, in addition to unit 

conditions, planning, availability of personnel, and the time required to 

perform the Surveillance. This risk impact should be managed through 

the program in place to implement 10 CFR 50.65(a)(4) and its 

implementation guidance, NRC Regulatory Guide 1.182, “Assessing and 

Managing Risk Before Maintenance Activities at Nuclear Power Plants.” 

This Regulatory Guide addresses consideration of temporary and 

aggregate risk impacts, determination of risk management action 
SR Applicability 

B 3.0 

BWR/6 STS B 3.0-16 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.3 (continued) 

thresholds, and risk management action up to and including plant 

shutdown. The missed Surveillance should be treated as an emergent 

condition as discussed in the Regulatory Guide. The risk evaluation may 

use quantitative, qualitative, or blended methods. The degree of depth 

and rigor of the evaluation should be commensurate with the importance 

of the component. Missed Surveillances for important components 

should be analyzed quantitatively. If the results of the risk evaluation 

determine the risk increase is significant, this evaluation should be used 

to determine the safest course of action. All missed Surveillances will be 

placed in the licensee’s Corrective Action Program. 

If a Surveillance is not completed within the allowed delay period, then 

the equipment is considered inoperable or the variable is considered 

outside the specified limits and the Completion Times of the Required 

Actions for the applicable LCO Conditions begin immediately upon 

expiration of the delay period. If a Surveillance is failed within the delay 

period, then the equipment is inoperable, or the variable is outside the 

specified limits and the Completion Times of the Required Actions for the 

applicable LCO Conditions begin immediately upon the failure of the 

Surveillance. 

Completion of the Surveillance within the delay period allowed by this 

Specification, or within the Completion Time of the ACTIONS, restores 

compliance with SR 3.0.1. 

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met 

before entry into a MODE or other specified condition in the Applicability. 

This Specification ensures that system and component OPERABILITY 

requirements and variable limits are met before entry into MODES or 

other specified conditions in the Applicability for which these systems and 

components ensure safe operation of the unit. The provisions of this 

Specification should not be interpreted as endorsing the failure to 

exercise the good practice of restoring systems or components to 

OPERABLE status before entering an associated MODE or other 

specified condition in the Applicability. 

A provision is included to allow entry into a MODE or other specified 

condition in the Applicability when an LCO is not met due to a 

Surveillance not being met in accordance with LCO 3.0.4. 
SR Applicability 

B 3.0 

BWR/6 STS B 3.0-17 Rev. 3.0, 03/31/04 

BASES 

SR 3.0.4 (continued) 

However, in certain circumstances, failing to meet an SR will not result in 

SR 3.0.4 restricting a MODE change or other specified condition change. 

When a system, subsystem, division, component, device, or variable is 

inoperable or outside its specified limits, the associated SR(s) are not 

required to be performed, per SR 3.0.1, which states that surveillances do 

not have to be performed on inoperable equipment. When equipment is 

inoperable, SR 3.0.4 does not apply to the associated SR(s) since the 

requirement for the SR(s) to be performed is removed. Therefore, failing 

to perform the Surveillance(s) within the specified Frequency does not 

result in an SR 3.0.4 restriction to changing MODES or other specified 

conditions of the Applicability. However, since the LCO is not met in this 

instance, LCO 3.0.4 will govern any restrictions that may (or may not) 

apply to MODE or other specified condition changes. SR 3.0.4 does not 

restrict changing MODES or other specified conditions of the Applicability 

when a Surveillance has not been performed within the specified 

Frequency, provided the requirement to declare the LCO not met has 

been delayed in accordance with SR 3.0.3. 

The provisions of SR 3.0.4 shall not prevent entry into MODES or other 

specified conditions in the Applicability that are required to comply with 

ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent 

changes in MODES or other specified conditions in the Applicability that 

result from any unit shutdown. In this context, a unit shutdown is defined 

as a change in MODE or other specified condition in the Applicability 

associated with transitioning from MODE 1 to MODE 2, MODE 2 to 

MODE 3, and MODE 3 to MODE 4. 

The precise requirements for performance of SRs are specified such that 

exceptions to SR 3.0.4 are not necessary. The specific time frames and 

conditions necessary for meeting the SRs are specified in the Frequency, 

in the Surveillance, or both. This allows performance of Surveillances 

when the prerequisite condition(s) specified in a Surveillance procedure 

require entry into the MODE or other specified condition in the 

Applicability of the associated LCO prior to the performance or completion 

of a Surveillance. A Surveillance that could not be performed until after 

entering the LCO’s Applicability, would have its Frequency specified such 

that it is not "due" until the specific conditions needed are met. 

Alternately, the Surveillance may be stated in the form of a Note, as not 

required (to be met or performed) until a particular event, condition, or 

time has been reached. Further discussion of the specific formats of SRs' 

annotation is found in Section 1.4, Frequency. 
SDM 

B 3.1.1 

BWR/6 STS B 3.1.1-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.1 SHUTDOWN MARGIN (SDM) 

BASES 

BACKGROUND SDM requirements are specified to ensure: 

a. The reactor can be made subcritical from all operating conditions and 

transients and Design Basis Events, 

b. The reactivity transients associated with postulated accident 

conditions are controllable within acceptable limits, and 

c. The reactor will be maintained sufficiently subcritical to preclude 

inadvertent criticality in the shutdown condition. 

These requirements are satisfied by the control rods, as described in 

GDC 26 (Ref. 1), which can compensate for the reactivity effects of the 

fuel and water temperature changes experienced during all operating 

conditions. 

APPLICABLE The control rod drop accident (CRDA) analysis (Refs. 2 and 3) assumes 

SAFETY the core is subcritical with the highest worth control rod withdrawn. 

ANALYSES Typically, the first control rod withdrawn has a very high reactivity worth 

and, should the core be critical during the withdrawal of the first control 

rod, the consequences of a CRDA could exceed the fuel damage limits 

for a CRDA (see Bases for LCO 3.1.6, "Rod Pattern Control"). Also, SDM 

is assumed as an initial condition for the control rod removal error during 

a refueling accident (Ref. 4). The analysis of this reactivity insertion event 

assumes the refueling interlocks are OPERABLE when the reactor is in 

the refueling mode of operation. These interlocks prevent the withdrawal 

of more than one control rod from the core during refueling. (Special 

consideration and requirements for multiple control rod withdrawal during 

refueling are covered in Special Operations LCO 3.10.6, "Multiple Control 

Rod Withdrawal - Refueling.") The analysis assumes this condition is 

acceptable since the core will be shut down with the highest worth control 

rod withdrawn, if adequate SDM has been demonstrated. 

Prevention or mitigation of reactivity insertion events is necessary to limit 

energy deposition in the fuel to prevent significant fuel damage, which 

could result in undue release of radioactivity. Adequate SDM ensures 

inadvertent criticalities and potential CRDAs involving high worth control 

rods (namely the first control rod withdrawn) will not cause significant fuel 

damage. 

SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
SDM 

B 3.1.1 

BWR/6 STS B 3.1.1-2 Rev. 3.0, 03/31/04 

BASES 

LCO The specified SDM limit accounts for the uncertainty in the demonstration 

of SDM by testing. Separate SDM limits are provided for testing where 

the highest worth control rod is determined analytically or by 

measurement. This is due to the reduced uncertainty in the SDM test 

when the highest worth control rod is determined by measurement. 

When SDM is demonstrated by calculations not associated with a test 

(e.g., to confirm SDM during the fuel loading sequence), additional margin 

is included to account for uncertainties in the calculation. To ensure 

adequate SDM during the design process, a design margin is included to 

account for uncertainties in the design calculations (Ref. 5). 

APPLICABILITY In MODES 1 and 2, SDM must be provided because subcriticality with the 

highest worth control rod withdrawn is assumed in the CRDA analysis 

(Ref. 3). In MODES 3 and 4, SDM is required to ensure the reactor will 

be held subcritical with margin for a single withdrawn control rod. SDM is 

required in MODE 5 to prevent an inadvertent criticality during the 

withdrawal of a single control rod from a core cell containing one or more 

fuel assemblies. 

ACTIONS A.1

With SDM not within the limits of the LCO in MODE 1 or 2, SDM must be 

restored within 6 hours. Failure to meet the specified SDM may be 

caused by a control rod that cannot be inserted. The 6 hour Completion 

Time is acceptable, considering that the reactor can still be shut down, 

assuming no additional failures of control rods to insert, and the low 

probability of an event occurring during this interval. 

B.1

If the SDM cannot be restored, the plant must be brought to MODE 3 

within 12 hours, to prevent the potential for further reductions in available 

SDM (e.g., additional stuck control rods). The allowed Completion Time 

of 12 hours is reasonable, based on operating experience, to reach 

MODE 3 from full power conditions in an orderly manner and without 

challenging plant systems. 

C.1

With SDM not within limits in MODE 3, the operator must immediately 

initiate action to fully insert all insertable control rods. Action must 

continue until all insertable control rods are fully inserted. This action 

results in the least reactive condition for the core. 
SDM 

B 3.1.1 

BWR/6 STS B 3.1.1-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1, D.2, D.3, and D.4

With SDM not within limits in MODE 4, the operator must immediately 

initiate action to fully insert all insertable control rods. Action must 

continue until all insertable control rods are fully inserted. This action 

results in the least reactive condition for the core. Actions must also be 

initiated within 1 hour to provide means for control of potential radioactive 

releases. This includes ensuring secondary containment is OPERABLE; 

at least one Standby Gas Treatment (SGT) subsystem is OPERABLE; 

and [secondary containment] isolation capability (i.e., at least one 

secondary containment isolation valve and associated instrumentation 

are OPERABLE, or other acceptable administrative controls to assure 

isolation capability) in each associated penetration flow path not isolated 

that is assumed to be isolated to mitigate radioactivity releases. This may 

be performed as an administrative check, by examining logs or other 

information, to determine if the components are out of service for 

maintenance or other reasons. It is not necessary to perform the 

Surveillances needed to demonstrate the OPERABILITY of the 

components. If, however, any required component is inoperable, then it 

must be restored to OPERABLE status. In this case, SRs may need to 

be performed to restore the component to OPERABLE status. Actions 

must continue until all required components are OPERABLE. 

E.1, E.2, E.3, E.4, and E.5

With SDM not within limits in MODE 5, the operator must immediately 

suspend CORE ALTERATIONS that could reduce SDM, e.g., insertion of 

fuel in the core or the withdrawal of control rods. Suspension of these 

activities shall not preclude completion of movement of a component to a 

safe condition. Inserting control rods or removing fuel from the core will 

reduce the total reactivity and are therefore excluded from the suspended 

actions. 

Action must also be immediately initiated to fully insert all insertable 

control rods in core cells containing one or more fuel assemblies. Action 

must continue until all insertable control rods in core cells containing one 

or more fuel assemblies have been fully inserted. Control rods in core 

cells containing no fuel assemblies do not affect the reactivity of the core 

and therefore do not have to be inserted. 
SDM 

B 3.1.1 

BWR/6 STS B 3.1.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Action must also be initiated within 1 hour to provide means for control of 

potential radioactive releases. This includes ensuring secondary 

containment is OPERABLE; at least one SGT subsystem is OPERABLE; 

and [secondary containment] isolation capability (i.e., at least one 

secondary containment isolation valve and associated instrumentation 

are OPERABLE, or other acceptable administrative controls to assure 

isolation capability) in each associated penetration flow path not isolated 

that is assumed to be isolated to mitigate radioactivity releases. This may 

be performed as an administrative check, by examining logs or other 

information, to determine if the components are out of service for 

maintenance or other reasons. It is not necessary to perform the 

Surveillances needed to demonstrate the OPERABILITY of the 

components. If, however, any required component is inoperable, then it 

must be restored to OPERABLE status. In this case, SRs may need to 

be performed to restore the component to OPERABLE status. Actions 

must continue until all required components are OPERABLE. 

SURVEILLANCE SR 3.1.1.1

REQUIREMENTS 

Adequate SDM must be demonstrated to ensure the reactor can be made 

subcritical from any initial operating condition. Adequate SDM is 

demonstrated by testing before or during the first startup after fuel 

movement, control rod replacement, or shuffling within the reactor 

pressure vessel. Control rod replacement refers to the decoupling and 

removal of a control rod from a core location, and subsequent 

replacement with a new control rod or a control rod from another core 

location. Since core reactivity will vary during the cycle as a function of 

fuel depletion and poison burnup, the beginning of cycle (BOC) test must 

also account for changes in core reactivity during the cycle. Therefore, to 

obtain the SDM, the initial measured value must be increased by an 

adder, "R", which is the difference between the calculated value of 

maximum core reactivity during the operating cycle and the calculated 

BOC core reactivity. If the value of R is negative (i.e., BOC is the most 

reactive point in the cycle), no correction to the BOC measured value is 

required (Ref. 6). For the SDM demonstrations that rely solely on 

calculation of the highest worth control rod, additional margin 

(0.10% ∆k/k) must be added to the SDM limit as specified in the COLR to 

account for uncertainties in the calculation. 
SDM 

B 3.1.1 

BWR/6 STS B 3.1.1-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The SDM may be demonstrated during an in sequence control rod 

withdrawal, in which the highest worth control rod is analytically 

determined, or during local criticals, where the highest worth control rod is 

determined by testing. Local critical tests require the withdrawal of out of 

sequence control rods. This testing would therefore require bypassing of 

the Rod Pattern Control System to allow the out of sequence withdrawal, 

and therefore additional requirements must be met (see LCO 3.10.7, 

"Control Rod Testing - Operating"). 

The Frequency of 4 hours after reaching criticality is allowed to provide a 

reasonable amount of time to perform the required calculations and 

appropriate verification. 

During MODE 5, adequate SDM is also required to ensure the reactor 

does not reach criticality during control rod withdrawals. An evaluation of 

each in vessel fuel movement during fuel loading (including shuffling fuel 

within the core) is required to ensure adequate SDM is maintained during 

refueling. This evaluation ensures the intermediate loading patterns are 

bounded by the safety analyses for the final core loading pattern. For 

example, bounding analyses that demonstrate adequate SDM for the 

most reactive configurations during the refueling may be performed to 

demonstrate acceptability of the entire fuel movement sequence. These 

bounding analyses include additional margins to the associated 

uncertainties. Spiral offload or reload sequences inherently satisfy the 

SR, provided the fuel assemblies are reloaded in the same configuration 

analyzed for the new cycle. Removing fuel from the core will always 

result in an increase in SDM. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 

 2. FSAR, Section [15.4.9]. 

 3. NEDO-21231, "Banked Position Withdrawal Sequence 111," 

Section 4.1, January 1977. 

 4. FSAR, Section [15.4.1.1]. 

 5. FSAR, Section [4.3.2.4.1]. 

 6. NDE-24011-P-A-9, "GE Standard Application for Reactor Fuel," 

Section 3.2.4.1, Sept. 1988. 
Reactivity Anomalies 

B 3.1.2 

BWR/6 STS B 3.1.2-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.2 Reactivity Anomalies 

BASES 

BACKGROUND In accordance with GDC 26, GDC 28, and GDC 29 (Ref. 1), reactivity 

shall be controllable such that subcriticality is maintained under cold 

conditions and acceptable fuel design limits are not exceeded during 

normal operation and anticipated operational occurrences. Reactivity 

anomaly is used as a measure of the predicted versus measured core 

reactivity during power operation. The continual confirmation of core 

reactivity is necessary to ensure that the Design Basis Accident (DBA) 

and transient safety analyses remain valid. A large reactivity anomaly 

could be the result of unanticipated changes in fuel reactivity, control rod 

worth, or operation at conditions not consistent with those assumed in the 

predictions of core reactivity, and could potentially result in a loss of SDM 

or violation of acceptable fuel design limits. Comparing predicted versus 

measured core reactivity validates the nuclear methods used in the safety 

analysis and supports the SDM demonstrations (LCO 3.1.1, 

"SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought 

safely to cold, subcritical conditions. 

When the reactor core is critical or in normal power operation, a reactivity 

balance exists and the net reactivity is zero. A comparison of predicted 

and measured reactivity is convenient under such a balance, since 

parameters are being maintained relatively stable under steady state 

power conditions. The positive reactivity inherent in the core design is 

balanced by the negative reactivity of the control components, thermal 

feedback, neutron leakage, and materials in the core that absorb 

neutrons, such as burnable absorbers, producing zero net reactivity. 

In order to achieve the required fuel cycle energy output, the uranium 

enrichment in the new fuel loading and the fuel loaded in the previous 

cycles provide excess positive reactivity beyond that required to sustain 

steady state operation at the beginning of cycle (BOC). When the reactor 

is critical at RTP and operating moderator temperature, the excess 

positive reactivity is compensated by burnable absorbers (if any), control 

rods, and whatever neutron poisons (mainly xenon and samarium) are 

present in the fuel. 

The predicted core reactivity, as represented by k effective (keff), is 

calculated by a 3D core simulator code as a function of cycle exposure. 

This calculation is performed for projected operating states and conditions 

throughout the cycle. The monitored keff is calculated by the core 

monitoring system for actual plant conditions and is then compared to the 

predicted value for the cycle exposure. 
Reactivity Anomalies 

B 3.1.2 

BWR/6 STS B 3.1.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE Accurate prediction of core reactivity is either an explicit or implicit 

SAFETY assumption in the accident analysis evaluations (Ref. 2). In particular, 

ANALYSES SDM and reactivity transients, such as control rod withdrawal accidents or 

rod drop accidents, are very sensitive to accurate prediction of core 

reactivity. These accident analysis evaluations rely on computer codes 

that have been qualified against available test data, operating plant data, 

and analytical benchmarks. Monitoring reactivity anomaly provides 

additional assurance that the nuclear methods provide an accurate 

representation of the core reactivity. 

The comparison between measured and predicted initial core reactivity 

provides a normalization for the calculational models used to predict core 

reactivity. If the measured and predicted keff for identical core conditions 

at BOC do not reasonably agree, then the assumptions used in the reload 

cycle design analysis or the calculation models used to predict keff may 

not be accurate. If reasonable agreement between measured and 

predicted core reactivity exists at BOC, then the prediction may be 

normalized to the measured value. Thereafter, any significant deviations 

in the measured keff from the predicted keff that develop during fuel 

depletion may be an indication that the assumptions of the DBA and 

transient analyses are no longer valid, or that an unexpected change in 

core conditions has occurred. 

Reactivity anomalies satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The reactivity anomaly limit is established to ensure plant operation is 

maintained within the assumptions of the safety analyses. Large 

differences between monitored and predicted core reactivity may indicate 

that the assumptions of the DBA and transient analyses are no longer 

valid, or that the uncertainties in the Nuclear Design Methodology are 

larger than expected. A limit on the difference between the monitored 

core keff and the predicted core keff of 1% ∆k/k has been established 

based on engineering judgment. A > 1% deviation in reactivity from that 

predicted is larger than expected for normal operation and should 

therefore be evaluated. 

APPLICABILITY In MODE 1, most of the control rods are withdrawn and steady state 

operation is typically achieved. Under these conditions, the comparison 

between predicted and monitored core reactivity provides an effective 

measure of the reactivity anomaly. In MODE 2, control rods are typically 

being withdrawn during a startup. In MODES 3 and 4, all control rods are 

fully inserted, and, therefore, the reactor is in the least reactive state, 

where monitoring core reactivity is not necessary. In MODE 5, fuel 

loading results in a continually changing core reactivity. SDM 
Reactivity Anomalies 

B 3.1.2 

BWR/6 STS B 3.1.2-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

requirements (LCO 3.1.1) ensure that fuel movements are performed 

within the bounds of the safety analysis, and an SDM demonstration is 

required during the first startup following operations that could have 

altered core reactivity (e.g., fuel movement, control rod replacement, 

control rod shuffling). The SDM test, required by LCO 3.1.1, provides a 

direct comparison of the predicted and monitored core reactivity at cold 

conditions; therefore, reactivity anomaly is not required during these 

conditions. 

ACTIONS A.1

Should an anomaly develop between measured and predicted core 

reactivity, the core reactivity difference must be restored to within the limit 

to ensure continued operation is within the core design assumptions. 

Restoration to within the limit could be performed by an evaluation of the 

core design and safety analysis to determine the reason for the anomaly. 

This evaluation normally reviews the core conditions to determine their 

consistency with input to design calculations. Measured core and 

process parameters are also normally evaluated to determine that they 

are within the bounds of the safety analysis, and safety analysis 

calculational models may be reviewed to verify that they are adequate for 

representation of the core conditions. The required Completion Time of 

72 hours is based on the low probability of a DBA during this period, and 

allows sufficient time to assess the physical condition of the reactor and 

complete the evaluation of the core design and safety analysis. 

B.1

If the core reactivity cannot be restored to within the 1% ∆k/k limit, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

12 hours. The allowed Completion Time of 12 hours is reasonable, 

based on operating experience, to reach MODE 3 from full power 

conditions in an orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.1.2.1

REQUIREMENTS 

Verifying the reactivity difference between the monitored and predicted 

core keff is within the limits of the LCO provides further assurance that 

plant operation is maintained within the assumptions of the DBA and 

transient analyses. The Core Monitoring System calculates the core keff

for the reactor conditions obtained from plant instrumentation. A 
Reactivity Anomalies 

B 3.1.2 

BWR/6 STS B 3.1.2-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

comparison of the monitored core keff to the predicted core keff at the 

same cycle exposure is used to calculate the reactivity difference. The 

comparison is required when the core reactivity has potentially changed 

by a significant amount. This may occur following a refueling in which 

new fuel assemblies are loaded, fuel assemblies are shuffled within the 

core, or control rods are replaced or shuffled. Control rod replacement 

refers to the decoupling and removal of a control rod from a core location, 

and subsequent replacement with a new control rod or a control rod from 

another core location. Also, core reactivity changes during the cycle. 

The 24 hour interval after reaching equilibrium conditions following a 

startup is based on the need for equilibrium xenon concentrations in the 

core, such that an accurate comparison between the monitored and 

predicted core keff values can be made. For the purposes of this SR, the 

reactor is assumed to be at equilibrium conditions when steady state 

operations (no control rod movement or core flow changes) at ≥ 75% RTP 

have been obtained. The 1000 MWD/T Frequency was developed, 

considering the relatively slow change in core reactivity with exposure 

and operating experience related to variations in core reactivity. This 

comparison requires the core to be operating at power levels which 

minimize the uncertainties and measurement errors, in order to obtain 

meaningful results. Therefore, the comparison is only done when in 

MODE 1. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29. 

 2. FSAR, Chapter [15]. 
Control Rod OPERABILITY 

B 3.1.3 

BWR/6 STS B 3.1.3-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.3 Control Rod OPERABILITY 

BASES 

BACKGROUND Control rods are components of the Control Rod Drive (CRD) System, 

which is the primary reactivity control system for the reactor. In 

conjunction with the Reactor Protection System, the CRD System 

provides the means for the reliable control of reactivity changes to ensure 

that under conditions of normal operation, including anticipated 

operational occurrences, specified acceptable fuel design limits are not 

exceeded. In addition, the control rods provide the capability to hold the 

reactor core subcritical under all conditions and to limit the potential 

amount and rate of reactivity increase caused by a malfunction in the 

CRD System. The CRD System is designed to satisfy the requirements 

of GDC 26, GDC 27, GDC 28, and GDC 29, (Ref. 1). 

The CRD System consists of 193 locking piston control rod drive 

mechanisms (CRDMs) and a hydraulic control unit for each drive 

mechanism. The locking piston type CRDM is a double acting hydraulic 

piston, which uses condensate water as the operating fluid. 

Accumulators provide additional energy for scram. An index tube and 

piston, coupled to the control rod, are locked at fixed increments by a 

collet mechanism. The collet fingers engage notches in the index tube to 

prevent unintentional withdrawal of the control rod, but without restricting 

insertion. 

This Specification, along with LCO 3.1.4, "Control Rod Scram Times," and 

LCO 3.1.5, "Control Rod Scram Accumulators," ensure that the 

performance of the control rods in the event of a Design Basis Accident 

(DBA) or transient meets the assumptions used in the safety analyses of 

References 2, 3, 4, 5, and 6. 

APPLICABLE The analytical methods and assumptions used in the evaluations 

SAFETY involving control rods are presented in References 2, 3, 4, 5, and 6. The 

ANALYSES control rods provide the primary means for rapid reactivity control (reactor 

scram), for maintaining the reactor subcritical, and for limiting the 

potential effects of reactivity insertion events caused by malfunctions in 

the CRD System. 

The capability of inserting the control rods provides assurance that the 

assumptions for scram reactivity in the DBA and transient analyses are 

not violated. Since the SDM ensures the reactor will be subcritical with 

the highest worth control rod withdrawn (assumed single failure), the 
Control Rod OPERABILITY 

B 3.1.3 

BWR/6 STS B 3.1.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

additional failure of a second control rod to insert could invalidate the 

demonstrated SDM and potentially limit the ability of the CRD System to 

hold the reactor subcritical. If the control rod is stuck at an inserted 

position and becomes decoupled from the CRD, a control rod drop 

accident (CRDA) can possibly occur. Therefore, the requirement that all 

control rods be OPERABLE ensures the CRD System can perform its 

intended function. 

The control rods also protect the fuel from damage that could result in 

release of radioactivity. The limits protected are the MCPR Safety Limit 

(SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, 

"MINIMUM CRITICAL POWER RATIO (MCPR)"), the 1% cladding plastic 

strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE PLANAR 

LINEAR HEAT GENERATION RATE (APLHGR)" and LCO 3.2.3, 

"LINEAR HEAT GENERATION RATE (LHGR)"), and the fuel damage 

limit (see Bases for LCO 3.1.6, "Rod Pattern Control") during reactivity 

insertion events. 

The negative reactivity insertion (scram) provided by the CRD System 

provides the analytical basis for determination of plant thermal limits and 

provides protection against fuel damage limits during a CRDA. Bases for 

LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6 discuss in more detail how the SLs 

are protected by the CRD System. 

Control rod OPERABILITY satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO OPERABILITY of an individual control rod is based on a combination of 

factors, primarily the scram insertion times, the control rod coupling 

integrity, and the ability to determine the control rod position. 

Accumulator OPERABILITY is addressed by LCO 3.1.5. The associated 

scram accumulator status for a control rod only affects the scram 

insertion times and therefore an inoperable accumulator does not 

immediately require declaring a control rod inoperable. Although not all 

control rods are required to be OPERABLE to satisfy the intended 

reactivity control requirements, strict control over the number and 

distribution of inoperable control rods is required to satisfy the 

assumptions of the DBA and transient analyses. 

APPLICABILITY In MODES 1 and 2, the control rods are assumed to function during a 

DBA or transient and are therefore required to be OPERABLE in these 

MODES. In MODES 3 and 4, control rods are not able to be withdrawn 

since the reactor mode switch is in shutdown and a control rod block is 

applied. This provides adequate requirements for control rod 

OPERABILITY during these conditions. Control rod requirements in 

MODE 5 are located in LCO 3.9.5, "Control Rod OPERABILITY - 

Refueling." 
Control Rod OPERABILITY 

B 3.1.3 

BWR/6 STS B 3.1.3-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS The ACTIONS Table is modified by a Note indicating that a separate 

Condition entry is allowed for each control rod. This is acceptable, since 

the Required Actions for each Condition provide appropriate 

compensatory actions for each inoperable control rod. Complying with 

the Required Actions may allow for continued operation, and subsequent 

inoperable control rods are governed by subsequent Condition entry and 

application of associated Required Actions. 

A.1, A.2, A.3, and A.4

A control rod is considered stuck if it will not insert by either CRD drive 

water or scram pressure. With a fully inserted control rod stuck, no 

actions are required as long as the control rod remains fully inserted. The 

Required Actions are modified by a Note that allows a stuck control rod to 

be bypassed in the Rod Action Control System (RACS) to allow continued 

operation. SR 3.3.2.1.9 provides additional requirements when control 

rods are bypassed in RACS to ensure compliance with the CRDA 

analysis. With one withdrawn control rod stuck, the local scram reactivity 

rate assumptions may not be met if the stuck control rod separation 

criteria are not met. Therefore, a verification that the separation criteria 

are met must be performed immediately. The separation criteria are not 

met if: a) the stuck control rod occupies a location adjacent to two "slow" 

control rods, b) the stuck control rod occupies a location adjacent to one 

"slow" control rod, and the one "slow" control rod is also adjacent to 

another "slow" control rod, or c) if the stuck control rod occupies a 

location adjacent to one "slow" control rod when there is another pair of 

"slow" control rods adjacent to one another. The description of "slow" 

control rods is provided in LCO 3.1.4, "Control Rod Scram Times." In 

addition, the associated control rod drive must be disarmed within 

2 hours. The allowed Completion Time of 2 hours is acceptable, 

considering the reactor can still be shut down, assuming no additional 

control rods fail to insert, and provides a reasonable amount of time to 

perform the Required Action in an orderly manner. Isolating the control 

rod from scram prevents damage to the CRDM. The control rod can be 

isolated from scram by isolating the hydraulic control unit from scram and 

normal insert and withdraw pressure, yet still maintain cooling water to 

the CRD. 

Monitoring of the insertion capability for each withdrawn control rod must 

also be performed within 24 hours from discovery of Condition A 

concurrent with THERMAL POWER greater than the low power setpoint 

(LPSP) of the rod pattern controller (RPC). SR 3.1.3.2 and SR 3.1.3.3 

perform periodic tests of the control rod insertion capability of withdrawn 

control rods. Testing each withdrawn control rod ensures that a generic 
Control Rod OPERABILITY 

B 3.1.3 

BWR/6 STS B 3.1.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

problem does not exist. This Completion Time allows for an exception to 

the normal "time zero" for beginning the allowed outage time "clock." The 

Required Action A.2 Completion Time only begins upon discovery of 

Condition A concurrent with THERMAL POWER greater than the actual 

LPSP of the RPC, since the notch insertions may not be compatible with 

the requirements of rod pattern control (LCO 3.1.6) and the RPC 

(LCO 3.3.2.1, "Control Rod Block Instrumentation"). The allowed 

Completion Time of 24 hours from discovery of Condition A, concurrent 

with THERMAL POWER greater than the LPSP of the RPC, provides a 

reasonable time to test the control rods, considering the potential for a 

need to reduce power to perform the tests. 

To allow continued operation with a withdrawn control rod stuck, an 

evaluation of adequate SDM is also required within 72 hours. Should a 

DBA or transient require a shutdown, to preserve the single failure 

criterion an additional control rod would have to be assumed to have 

failed to insert when required. Therefore, the original SDM demonstration 

may not be valid. The SDM must therefore be evaluated (by 

measurement or analysis) with the stuck control rod at its stuck position 

and the highest worth OPERABLE control rod assumed to be fully 

withdrawn. 

The allowed Completion Time of 72 hours to verify SDM is adequate, 

considering that with a single control rod stuck in a withdrawn position, 

the remaining OPERABLE control rods are capable of providing the 

required scram and shutdown reactivity. Failure to reach MODE 4 is only 

likely if an additional control rod adjacent to the stuck control rod also fails 

to insert during a required scram. Even with the postulated additional 

single failure of an adjacent control rod to insert, sufficient reactivity 

control remains to reach and maintain MODE 3 conditions (Ref. 7). 

B.1

With two or more withdrawn control rods stuck, the plant must be brought 

to MODE 3 within 12 hours. The occurrence of more than one control rod 

stuck at a withdrawn position increases the probability that the reactor 

cannot be shut down if required. Insertion of all insertable control rods 

eliminates the possibility of an additional failure of a control rod to insert. 

The allowed Completion Time of 12 hours is reasonable, based on 

operating experience, to reach MODE 3 from full power conditions in an 

orderly manner and without challenging plant systems. 
Control Rod OPERABILITY 

B 3.1.3 

BWR/6 STS B 3.1.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

With one or more control rods inoperable for reasons other than being 

stuck in the withdrawn position, operation may continue, provided the 

control rods are fully inserted within 3 hours and disarmed (electrically or 

hydraulically) within 4 hours. Inserting a control rod ensures the 

shutdown and scram capabilities are not adversely affected. The control 

rod is disarmed to prevent inadvertent withdrawal during subsequent 

operations. The control rods can be hydraulically disarmed by closing the 

drive water and exhaust water isolation valves. Electrically, the control 

rods can be disarmed by disconnecting power from all four directional 

control valve solenoids. Required Action C.1 is modified by a Note that 

allows control rods to be bypassed in the RACS if required to allow 

insertion of the inoperable control rods and continued operation. 

SR 3.3.2.1.9 provides additional requirements when the control rods are 

bypassed to ensure compliance with the CRDA analysis. 

The allowed Completion Times are reasonable, considering the small 

number of allowed inoperable control rods, and provide time to insert and 

disarm the control rods in an orderly manner and without challenging 

plant systems. 

D.1 and D.2

Out of sequence control rods may increase the potential reactivity worth 

of a dropped control rod during a CRDA. At ≤ 10% RTP, the generic 

banked position withdrawal sequence (BPWS) analysis (Ref. 7) requires 

inserted control rods not in compliance with BPWS to be separated by at 

least two OPERABLE control rods in all directions, including the diagonal. 

Therefore, if two or more inoperable control rods are not in compliance 

with BPWS and not separated by at least two OPERABLE control rods, 

action must be taken to restore compliance with BPWS or restore the 

control rods to OPERABLE status. A Note has been added to the 

Condition to clarify that the Condition is not applicable when > 10% RTP 

since the BPWS is not required to be followed under these conditions, as 

described in the Bases for LCO 3.1.6. The allowed Completion Time of 

4 hours is acceptable, considering the low probability of a CRDA 

occurring. 
Control Rod OPERABILITY 

B 3.1.3 

BWR/6 STS B 3.1.3-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1

In addition to the separation requirements for inoperable control rods, an 

assumption in the CRDA analysis for ANF fuel is that no more than three 

inoperable control rods are allowed in any one BPWS group. Therefore, 

with one or more BPWS groups having four or more inoperable control 

rods, the control rods must be restored to OPERABLE status. Required 

Action E.1 is modified by a Note indicating that the Condition is not 

applicable when THERMAL POWER is > 10% RTP since the BPWS is 

not required to be followed under these conditions, as described in the 

Bases for LCO 3.1.6. The allowed Completion Time of 4 hours is 

acceptable, considering the low probability of a CRDA occurring. 

F.1

If any Required Action and associated Completion Time of Condition A, 

C, D, or E are not met or nine or more inoperable control rods exist, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to MODE 3 within 12 hours. 

This ensures all insertable control rods are inserted and places the 

reactor in a condition that does not require the active function (i.e., scram) 

of the control rods. The number of control rods permitted to be 

inoperable when operating above 10% RTP (i.e., no CRDA 

considerations) could be more than the value specified, but the 

occurrence of a large number of inoperable control rods could be 

indicative of a generic problem, and investigation and resolution of the 

potential problem should be undertaken. The allowed Completion Time 

of 12 hours is reasonable, based on operating experience, to reach 

MODE 3 from full power conditions in an orderly manner and without 

challenging plant systems. 

SURVEILLANCE SR 3.1.3.1

REQUIREMENTS 

The position of each control rod must be determined, to ensure adequate 

information on control rod position is available to the operator for 

determining CRD OPERABILITY and controlling rod patterns. Control rod 

position may be determined by the use of OPERABLE position indicators, 

by moving control rods to a position with an OPERABLE indicator, or by 

the use of other appropriate methods. The 24 hour Frequency of this SR 

is based on operating experience related to expected changes in control 

rod position and the availability of control rod position indications in the 

control room. 
Control Rod OPERABILITY 

B 3.1.3 

BWR/6 STS B 3.1.3-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.1.3.2 and SR 3.1.3.3

Control rod insertion capability is demonstrated by inserting each partially 

or fully withdrawn control rod at least one notch and observing that the 

control rod moves. The control rod may then be returned to its original 

position. This ensures the control rod is not stuck and is free to insert on 

a scram signal. These Surveillances are not required when THERMAL 

POWER is less than or equal to the actual LPSP of the RPC since the 

notch insertions may not be compatible with the requirements of the 

Banked Position-Withdrawal Sequence (BPWS) (LCO 3.1.6) and the RPC 

(LCO 3.3.2.1). The 7 day Frequency of SR 3.1.3.2 is based on operating 

experience related to the changes in CRD performance and the ease of 

performing notch testing for fully withdrawn control rods. Partially 

withdrawn control rods are tested at a 31 day Frequency, based on the 

potential power reduction required to allow the control rod movement, and 

considering the large testing sample of SR 3.1.3.2. Furthermore, the 

31 day Frequency takes into account operating experience related to 

changes in CRD performance. At any time, if a control rod is immovable, 

a determination of that control rod's trippability (OPERABILITY) must be 

made and appropriate action taken. 

SR 3.1.3.4

Verifying the scram time for each control rod to notch position 13 is 

≤ [ ] seconds provides reasonable assurance that the control rod will 

insert when required during a DBA or transient, thereby completing its 

shutdown function. This SR is performed in conjunction with the control 

rod scram time testing of SR 3.1.4.1, SR 3.1.4.2, SR 3.1.4.3, and 

SR 3.1.4.4. The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1, 

"Reactor Protection System (RPS) Instrumentation," and the functional 

testing of SDV vent and drain valves in LCO 3.1.8, "Scram Discharge 

Volume (SDV) Vent and Drain Valves," overlap this Surveillance to 

provide complete testing of the assumed safety function. The associated 

Frequencies are acceptable, considering the more frequent testing 

performed to demonstrate other aspects of control rod OPERABILITY and 

operating experience, which shows scram times do not significantly 

change over an operating cycle. 
Control Rod OPERABILITY 

B 3.1.3 

BWR/6 STS B 3.1.3-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.1.3.5

Coupling verification is performed to ensure the control rod is connected 

to the CRDM and will perform its intended function when necessary. The 

Surveillance requires verifying that a control rod does not go to the 

withdrawn overtravel position when it is fully withdrawn. The overtravel 

position feature provides a positive check on the coupling integrity, since 

only an uncoupled CRD can reach the overtravel position. The 

verification is required to be performed anytime a control rod is withdrawn 

to the "full out" position (notch position 48) or prior to declaring the control 

rod OPERABLE after work on the control rod or CRD System that could 

affect coupling. This includes control rods inserted one notch and then 

returned to the "full out" position during the performance of SR 3.1.3.2. 

This Frequency is acceptable, considering the low probability that a 

control rod will become uncoupled when it is not being moved and 

operating experience related to uncoupling events. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 27, GDC 28, and GDC 29. 

 2. FSAR, Section [4.3.2.5.5]. 

 3. FSAR, Section [4.6.1.1.2.5.3]. 

 4. FSAR, Section [5.2.2.2.3]. 

 5. FSAR, Section [15.4.1]. 

 6. FSAR, Section [15.4.9]. 

 7. NEDO-21231, "Banked Position Withdrawal Sequence," Section 7.2, 

January 1977. 
Control Rod Scram Times 

B 3.1.4 

BWR/6 STS B 3.1.4-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.4 Control Rod Scram Times 

BASES 

BACKGROUND The scram function of the Control Rod Drive (CRD) System controls 

reactivity changes during abnormal operational transients to ensure that 

specified acceptable fuel design limits are not exceeded (Ref. 1). The 

control rods are scrammed by positive means, using hydraulic pressure 

exerted on the CRD piston. 

When a scram signal is initiated, control air is vented from the scram 

valves, allowing them to open by spring action. Opening the exhaust 

valves reduces the pressure above the main drive piston to atmospheric 

pressure, and opening the inlet valve applies the accumulator or reactor 

pressure to the bottom of the piston. Since the notches in the index tube 

are tapered on the lower edge, the collet fingers are forced open by cam 

action, allowing the index tube to move upward without restriction 

because of the high differential pressure across the piston. As the drive 

moves upward and accumulator pressure drops below the reactor 

pressure, a ball check valve opens, letting the reactor pressure complete 

the scram action. If the reactor pressure is low, such as during startup, 

the accumulator will fully insert the control rod within the required time 

without assistance from reactor pressure. 

APPLICABLE The analytical methods and assumptions used in evaluating the control 

SAFETY rod scram function are presented in References 2, 3, 4, and 5. The 

ANALYSES Design Basis Accident (DBA) and transient analyses assume that all of 

the control rods scram at a specified insertion rate. The resulting 

negative scram reactivity forms the basis for the determination of plant 

thermal limits (e.g., the MCPR). Other distributions of scram times (e.g., 

several control rods scramming slower than the average time, with 

several control rods scramming faster than the average time) can also 

provide sufficient scram reactivity. Surveillance of each individual control 

rod's scram time ensures the scram reactivity assumed in the DBA and 

transient analyses can be met. 

The scram function of the CRD System protects the MCPR Safety Limit 

(SL) (see Bases for SL 2.1.1, "Reactor Core SLs," and LCO 3.2.2, 

"MINIMUM CRITICAL POWER RATIO (MCPR)"), and the 1% cladding 

plastic strain fuel design limit (see Bases for LCO 3.2.1, "AVERAGE 

PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and 

LCO 3.2.3, "LINEAR HEAT GENERATION RATE (LHGR)"), which ensure 

that no fuel damage will occur if these limits are not exceeded. Above 
Control Rod Scram Times 

B 3.1.4 

BWR/6 STS B 3.1.4-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

950 psig, the scram function is designed to insert negative reactivity at a 

rate fast enough to prevent the actual MCPR from becoming less than the 

MCPR SL during the analyzed limiting power transient. Below 950 psig, 

the scram function is assumed to perform during the control rod drop 

accident (Ref. 6) and, therefore, also provides protection against violating 

fuel damage limits during reactivity insertion accidents (see Bases for 

LCO 3.1.6, "Rod Pattern Control"). For the reactor vessel overpressure 

protection analysis, the scram function, along with the safety/relief valves, 

ensure that the peak vessel pressure is maintained within the applicable 

ASME Code limits. 

Control rod scram times satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The scram times specified in Table 3.1.4-1 (in the accompanying LCO) 

are required to ensure that the scram reactivity assumed in the DBA and 

transient analysis is met. To account for single failure and "slow" 

scramming control rods, the scram times specified in Table 3.1.4-1 are 

faster than those assumed in the design basis analysis. The scram times 

have a margin to allow up to 7.5% of the control rods (e.g., 193 x 7.5% 

= 14) to have scram times that exceed the specified limits (i.e., "slow" 

control rods) assuming a single stuck control rod (as allowed by 

LCO 3.1.3, "Control Rod OPERABILITY") and an additional control rod 

failing to scram per the single failure criterion. The scram times are 

specified as a function of reactor steam dome pressure to account for the 

pressure dependence of the scram times. The scram times are specified 

relative to measurements based on reed switch positions, which provide 

the control rod position indication. The reed switch closes ("pickup") 

when the index tube passes a specific location and then opens 

("dropout") as the index tube travels upward. Verification of the specified 

scram times in Table 3.1.4-1 is accomplished through measurement of 

the "dropout" times. 

To ensure that local scram reactivity rates are maintained within 

acceptable limits, no more than two of the allowed "slow" control rods 

may occupy adjacent locations. 

Table 3.1.4-1 is modified by two Notes, which state control rods with 

scram times not within the limits of the Table are considered "slow" and 

that control rods with scram times > [ ] seconds are considered 

inoperable as required by SR 3.1.3.4. 

This LCO applies only to OPERABLE control rods since inoperable 

control rods will be inserted and disarmed (LCO 3.1.3). Slow scramming 

control rods may be conservatively declared inoperable and not 

accounted for as "slow" control rods. 
Control Rod Scram Times 

B 3.1.4 

BWR/6 STS B 3.1.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1 and 2, a scram is assumed to function during transients and 

accidents analyzed for these plant conditions. These events are 

assumed to occur during startup and power operation; therefore, the 

scram function of the control rods is required during these MODES. In 

MODES 3 and 4, the control rods are not able to be withdrawn since the 

reactor mode switch is in shutdown and a control rod block is applied. 

This provides adequate requirements for control rod scram capability 

during these conditions. Scram requirements in MODE 5 are contained in 

LCO 3.9.5, "Control Rod OPERABILITY - Refueling." 

ACTIONS A.1

When the requirements of this LCO are not met, the rate of negative 

reactivity insertion during a scram may not be within the assumptions of 

the safety analyses. Therefore, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to MODE 3 within 12 hours. The allowed Completion Time of 

12 hours is reasonable, based on operating experience, to reach MODE 3 

from full power conditions in an orderly manner and without challenging 

plant systems. 

SURVEILLANCE The four SRs of this LCO are modified by a Note stating that during a 

REQUIREMENTS single control rod scram time surveillance, the CRD pumps shall be 

isolated from the associated scram accumulator. With the CRD pump 

isolated (i.e., charging valve closed), the influence of the CRD pump head 

does not affect the single control rod scram times. During a full core 

scram, the CRD pump head would be seen by all control rods and would 

have a negligible effect on the scram insertion times. 

SR 3.1.4.1

The scram reactivity used in DBA and transient analyses is based on 

assumed control rod scram time. Measurement of the scram times with 

reactor steam dome pressure ≥ 950 psig demonstrates acceptable scram 

times for the transients analyzed in References 3 and 4. 

Scram insertion times increase with increasing reactor pressure because 

of the competing effects of reactor steam dome pressure and stored 

accumulator energy. Therefore, demonstration of adequate scram times 

at reactor steam dome pressure ≥ 950 psig ensures that the scram times 

will be within the specified limits at higher pressures. Limits are specified 

as a function of reactor pressure to account for the sensitivity of the 

scram insertion times with pressure and to allow a range of pressures 
Control Rod Scram Times 

B 3.1.4 

BWR/6 STS B 3.1.4-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

over which scram time testing can be performed. To ensure scram time 

testing is performed within a reasonable time following a shutdown 

≥ 120 days, control rods are required to be tested before exceeding 

40% RTP. This Frequency is acceptable, considering the additional 

surveillances performed for control rod OPERABILITY, the frequent 

verification of adequate accumulator pressure, and the required testing of 

control rods affected by fuel movement within the associated core cell 

and by work on control rods or the CRD System. 

SR 3.1.4.2

Additional testing of a sample of control rods is required to verify the 

continued performance of the scram function during the cycle. A 

representative sample contains at least 10% of the control rods. The 

sample remains representative if no more than 20% of the control rods in 

the sample tested are determined to be "slow." If more than 20% of the 

sample is declared to be "slow" per the criteria in Table 3.1.4-1, additional 

control rods are tested until this 20% criterion (e.g., 20% of the entire 

sample size) is satisfied, or until the total number of "slow" control rods 

(throughout the core, from all Surveillances) exceeds the LCO limit. For 

planned testing, the control rods selected for the sample should be 

different for each test. Data from inadvertent scrams should be used 

whenever possible to avoid unnecessary testing at power, even if the 

control rods with data were previously tested in a sample. The 120 day 

Frequency is based on operating experience that has shown control rod 

scram times do not significantly change over an operating cycle. This 

Frequency is also reasonable, based on the additional Surveillances done 

on the CRDs at more frequent intervals in accordance with LCO 3.1.3 and 

LCO 3.1.5, "Control Rod Scram Accumulators." 

SR 3.1.4.3

When work that could affect the scram insertion time is performed on a 

control rod or the CRD System, testing must be done to demonstrate that 

each affected control rod retains adequate scram performance over the 

range of applicable reactor pressures from zero to the maximum 

permissible pressure. The scram testing must be performed once before 

declaring the control rod OPERABLE. The required scram time testing 

must demonstrate that the affected control rod is still within acceptable 

limits. The limits for reactor pressures < 950 psig are established based 

on a high probability of meeting the acceptance criteria at reactor 
Control Rod Scram Times 

B 3.1.4 

BWR/6 STS B 3.1.4-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

pressures ≥ 950 psig. Limits for reactor pressures ≥ 950 psig are found in 

Table 3.1.4-1. If testing demonstrates the affected control rod does not 

meet these limits, but is within 7-second limit of Table 3.1.4-1, Note 2, the 

control rod can be declared OPERABLE and "slow." 

Specific examples of work that could affect the scram times include (but 

are not limited to) the following: removal of any CRD for maintenance or 

modification; replacement of a control rod; and maintenance or 

modification of a scram solenoid pilot valve, scram valve, accumulator 

isolation valve, or check valves in the piping required for scram. 

The Frequency of once prior to declaring the affected control rod 

OPERABLE is acceptable because of the capability of testing the control 

rod over a range of operating conditions and the more frequent 

surveillances on other aspects of control rod OPERABILITY. 

SR 3.1.4.4

When work that could affect the scram insertion time is performed on a 

control rod or CRD System, or when fuel movement within the reactor 

pressure vessel occurs, testing must be done to demonstrate each 

affected control rod is still within the limits of Table 3.1.4-1 with the 

reactor steam dome pressure ≥ 950 psig. Where work has been 

performed at high reactor pressure, the requirements of SR 3.1.4.3 and 

SR 3.1.4.4 will be satisfied with one test. For a control rod affected by 

work performed while shut down, however, a zero pressure and a high 

pressure test may be required. This testing ensures that the control rod 

scram performance is acceptable for operating reactor pressure 

conditions prior to withdrawing the control rod for continued operation. 

Alternatively, a test during hydrostatic pressure testing could also satisfy 

both criteria. When fuel movement within the reactor pressure vessel 

occurs, only those control rods associated with the core cells affected by 

the fuel movement are required to be scram time tested. During a routine 

refueling outage, it is expected that all control rods will be affected. 

The Frequency of once prior to exceeding 40% RTP is acceptable 

because of the capability of testing the control rod at the different 

conditions and the more frequent surveillances on other aspects of 

control rod OPERABILITY. 
Control Rod Scram Times 

B 3.1.4 

BWR/6 STS B 3.1.4-6 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10. 

 2. FSAR, Section [4.3.2.5.5]. 

 3. FSAR, Section [4.6.1.1.2.5.3]. 

 4. FSAR, Section [5.2.2.2.2.3]. 

 5. FSAR, Section [15.4.1]. 

 6. FSAR, Section [15.4.9]. 
Control Rod Scram Accumulators 

B 3.1.5 

BWR/6 STS B 3.1.5-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.5 Control Rod Scram Accumulators 

BASES 

BACKGROUND The control rod scram accumulators are part of the Control Rod Drive 

(CRD) System and are provided to ensure that the control rods scram 

under varying reactor conditions. The control rod scram accumulators 

store sufficient energy to fully insert a control rod at any reactor vessel 

pressure. The accumulator is a hydraulic cylinder with a free floating 

piston. The piston separates the water used to scram the control rods 

from the nitrogen, which provides the required energy. The scram 

accumulators are necessary to scram the control rods within the required 

insertion times of LCO 3.1.4, "Control Rod Scram Times." 

APPLICABLE The analytical methods and assumptions used in evaluating the control 

SAFETY rod scram function are presented in References 1, 2, 3, and 4. The 

ANALYSES Design Basis Accident (DBA) and transient analyses assume that all of 

the control rods scram at a specified insertion rate. OPERABILITY of 

each individual control rod scram accumulator, along with LCO 3.1.3, 

"Control Rod OPERABILITY," and LCO 3.1.4, ensures that the scram 

reactivity assumed in the DBA and transient analyses can be met. The 

existence of an inoperable accumulator may invalidate prior scram time 

measurements for the associated control rod. 

The scram function of the CRD System, and, therefore, the 

OPERABILITY of the accumulators, protects the MCPR Safety Limit (see 

Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") 

and the 1% cladding plastic strain fuel design limit (see Bases for 

LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE 

(APLHGR)," and LCO 3.2.3, "LINEAR HEAT GENERATION RATE 

(LHGR)"), which ensure that no fuel damage will occur if these limits are 

not exceeded (see Bases for LCO 3.1.4). Also, the scram function at low 

reactor vessel pressure (i.e., startup conditions) provides protection 

against violating fuel design limits during reactivity insertion accidents 

(see Bases for LCO 3.1.6, "Rod Pattern Control"). 

Control rod scram accumulators satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The OPERABILITY of the control rod scram accumulators is required to 

ensure that adequate scram insertion capability exists when needed over 

the entire range of reactor pressures. The OPERABILITY of the scram 

accumulators is based on maintaining adequate accumulator pressure. 
Control Rod Scram Accumulators 

B 3.1.5 

BWR/6 STS B 3.1.5-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1 and 2, the scram function is required for mitigation of DBAs 

and transients and, therefore, the scram accumulators must be 

OPERABLE to support the scram function. In MODES 3 and 4, control 

rods are only allowed to be withdrawn since the reactor mode switch is in 

shutdown and a control rod block is applied. This provides adequate 

requirements for control rod scram accumulator OPERABILITY under 

these conditions. Requirements for scram accumulators in MODE 5 are 

contained in LCO 3.9.5, "Control Rod OPERABILITY - Refueling." 

ACTIONS The ACTIONS table is modified by a Note indicating that a separate 

Condition entry is allowed for each control rod. This is acceptable since 

the Required Actions for each Condition provide appropriate 

compensatory action for each affected control rod. Complying with the 

Required Actions may allow for continued operation and subsequent 

affected control rods governed by subsequent Condition entry and 

application of associated Required Actions. 

A.1 and A.2

With one control rod scram accumulator inoperable and the reactor steam 

dome pressure ≥ 900 psig, the control rod may be declared "slow," since 

the control rod will still scram at the reactor operating pressure but may 

not satisfy the required scram times in Table 3.1.4-1. Required 

Action A.1 is modified by a Note, which clarifies that declaring the control 

rod "slow" is only applicable if the associated control scram time was 

within the limits of Table 3.1.4-1 during the last scram time test. 

Otherwise, the control rod would already be considered "slow" and the 

further degradation of scram performance with an inoperable accumulator 

could result in excessive scram times. In this event, the associated 

control rod is declared inoperable (Required Action A.2) and LCO 3.1.3 

entered. This would result in requiring the affected control rod to be fully 

inserted and disarmed, thereby satisfying its intended function in 

accordance with ACTIONS of LCO 3.1.3. 

The allowed Completion Time of 8 hours is considered reasonable, based 

on the large number of control rods available to provide the scram 

function and the ability of the affected control rod to scram only with 

reactor pressure at high reactor pressures. 
Control Rod Scram Accumulators 

B 3.1.5 

BWR/6 STS B 3.1.5-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1, B.2.1, and B.2.2

With two or more control rod scram accumulators inoperable and reactor 

steam dome pressure ≥ 900 psig, adequate pressure must be supplied to 

the charging water header. With inadequate charging water pressure, all 

of the accumulators could become inoperable, resulting in a potentially 

severe degradation of the scram performance. Therefore, within 

20 minutes from discovery of charging water header pressure < 1520 psig 

concurrent with Condition B, adequate charging water header pressure 

must be restored. The allowed Completion Time of 20 minutes is 

considered a reasonable time to place a CRD pump into service to 

restore the charging header pressure, if required. This Completion Time 

also recognizes the ability of the reactor pressure alone to fully insert all 

control rods. 

The control rod may be declared "slow," since the control rod will still 

scram using only reactor pressure, but may not satisfy the times in 

Table 3.1.4-1. Required Action B.2.1 is modified by a Note indicating that 

declaring the control rod "slow" is only applicable if the associated control 

scram time was within the limits of Table 3.1.4-1 during the last scram 

time test. Otherwise, the control rod would already be considered "slow" 

and the further degradation of scram performance with an inoperable 

accumulator could result in excessive scram times. In this event, the 

associated control rod is declared inoperable (Required Action B.2.2) and 

LCO 3.1.3 entered. This would result in requiring the affected control rod 

to be fully inserted and disarmed, thereby satisfying its intended function 

in accordance with ACTIONS of LCO 3.1.3. 

The allowed Completion Time of 1 hour is considered reasonable, based 

on the ability of only the reactor pressure to scram the control rods and 

the low probability of a DBA or transient occurring while the affected 

accumulators are inoperable. 

C.1 and C.2

With one or more control rod scram accumulators inoperable and the 

reactor steam dome pressure < 900 psig, the pressure supplied to the 

charging water header must be adequate to ensure that accumulators 

remain charged. With the reactor steam dome pressure < 900 psig, the 

function of the accumulators in providing the scram force becomes much 

more important since the scram function could become severely 
Control Rod Scram Accumulators 

B 3.1.5 

BWR/6 STS B 3.1.5-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

degraded during a depressurization event or at low reactor pressures. 

Therefore, immediately upon discovery of charging water header 

pressure < [1520] psig, concurrent with Condition C, all control rods 

associated with inoperable accumulators must be verified to be fully 

inserted. Withdrawn control rods with inoperable scram accumulators 

may fail to scram under these low pressure conditions. The associated 

control rods must also be declared inoperable within 1 hour. The allowed 

Completion Time of 1 hour is reasonable for Required Action C.2, 

considering the low probability of a DBA or transient occurring during the 

time the accumulator is inoperable. 

D.1

The reactor mode switch must be immediately placed in the shutdown 

position if either Required Action and associated Completion Time 

associated with loss of the CRD charging pump (Required Actions B.1 

and C.1) cannot be met. This ensures that all insertable control rods are 

inserted and that the reactor is in a condition that does not require the 

active function (i.e., scram) of the control rods. This Required Action is 

modified by a Note stating that the Required Action is not applicable if all 

control rods associated with the inoperable scram accumulators are fully 

inserted, since the function of the control rods has been performed. 

SURVEILLANCE SR 3.1.5.1

REQUIREMENTS 

SR 3.1.5.1 requires that the accumulator pressure be checked every 

7 days to ensure adequate accumulator pressure exists to provide 

sufficient scram force. The primary indicator of accumulator 

OPERABILITY is the accumulator pressure. A minimum accumulator 

pressure is specified, below which the capability of the accumulator to 

perform its intended function becomes degraded and the accumulator is 

considered inoperable. The minimum accumulator pressure of 1520 psig 

is well below the expected pressure of 1750 psig to 2000 psig (Ref. 2). 

Declaring the accumulator inoperable when the minimum pressure is not 

maintained ensures that significant degradation in scram times does not 

occur. The 7 day Frequency has been shown to be acceptable through 

operating experience and takes into account indications available in the 

control room. 
Control Rod Scram Accumulators 

B 3.1.5 

BWR/6 STS B 3.1.5-5 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [4.3.2.5.5]. 

 2. FSAR, Section [4.6.1.1.2.5.3]. 

 3. FSAR, Section [5.2.2.2.2.3]. 

 4. FSAR, Section [15.4.1]. 
Rod Pattern Control 

B 3.1.6 

BWR/6 STS B 3.1.6-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.6 Rod Pattern Control 

BASES 

BACKGROUND Control rod patterns during startup conditions are controlled by the 

operator and the rod pattern controller (RPC) (LCO 3.3.2.1, "Control Rod 

Block Instrumentation"), so that only specified control rod sequences and 

relative positions are allowed over the operating range of all control rods 

inserted to [10]% RTP. The sequences effectively limit the potential 

amount of reactivity addition that could occur in the event of a control rod 

drop accident (CRDA). 

This Specification assures that the control rod patterns are consistent with 

the assumptions of the CRDA analyses of References 1, 2, and 3. 

APPLICABLE The analytical methods and assumptions used in evaluating the CRDA 

SAFETY are summarized in References 1, 2, and 3. CRDA analyses assume that 

ANALYSES the reactor operator follows prescribed withdrawal sequences. These 

sequences define the potential initial conditions for the CRDA analysis. 

The RPC (LCO 3.3.2.1) provides backup to operator control of the 

withdrawal sequences to ensure that the initial conditions of the CRDA 

analysis are not violated. 

Prevention or mitigation of positive reactivity insertion events is necessary 

to limit the energy deposition in the fuel, thereby preventing significant 

fuel damage, which could result in undue release of radioactivity. Since 

the failure consequences for UO2 have been shown to be insignificant 

below fuel energy depositions of 300 cal/gm (Ref. 4), the fuel damage 

limit of 280 cal/gm provides a margin of safety from significant core 

damage, which would result in release of radioactivity (Refs. 5 and 6). 

Generic evaluations (Refs. 1 and 7) of a design basis CRDA (i.e., a 

CRDA resulting in a peak fuel energy deposition of 280 cal/gm) have 

shown that if the peak fuel enthalpy remains below 280 cal/gm, then the 

maximum reactor pressure will be less than the required ASME Code 

limits (Ref. 8) and the calculated offsite doses will be well within the 

required limits (Ref. 6). 

Control rod patterns analyzed in Reference 1 follow the banked position 

withdrawal sequence (BPWS) described in Reference 9. The BPWS is 

applicable from the condition of all control rods fully inserted to 10% RTP 

(Ref. 2). For the BPWS, the control rods are required to be moved in 

groups, with all control rods assigned to a specific group required to be 

within specified banked positions (e.g., between notches 08 and 12). The 

banked positions are defined to minimize the maximum incremental 
Rod Pattern Control 

B 3.1.6 

BWR/6 STS B 3.1.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

control rod worths without being overly restrictive during normal plant 

operation. The generic BPWS analysis (Ref. 9) also evaluated the effect 

of fully inserted, inoperable control rods not in compliance with the 

sequence, to allow a limited number (i.e., eight) and distribution of fully 

inserted, inoperable control rods. 

Rod pattern control satisfies the requirements of Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Compliance with the prescribed control rod sequences minimizes the 

potential consequences of a CRDA by limiting the initial conditions to 

those consistent with the BPWS. This LCO only applies to OPERABLE 

control rods. For inoperable control rods required to be inserted, 

separate requirements are specified in LCO 3.1.3, "Control Rod 

OPERABILITY," consistent with the allowances for inoperable control 

rods in the BPWS. 

APPLICABILITY In MODES 1 and 2, when THERMAL POWER is ≤ 10% RTP, the CRDA 

is a Design Basis Accident (DBA) and, therefore, compliance with the 

assumptions of the safety analysis is required. When THERMAL 

POWER is > 10% RTP, there is no credible control rod configuration that 

results in a control rod worth that could exceed the 280 cal/gm fuel 

damage limit during a CRDA (Ref. 2). In MODES 3, 4, and 5, since the 

reactor is shut down and only a single control rod can be withdrawn from 

a core cell containing fuel assemblies, adequate SDM ensures that the 

consequences of a CRDA are acceptable, since the reactor will remain 

subcritical with a single control rod withdrawn. 

ACTIONS A.1 and A.2

With one or more OPERABLE control rods not in compliance with the 

prescribed control rod sequence, action may be taken to either correct the 

control rod pattern or declare the associated control rods inoperable 

within 8 hours. Noncompliance with the prescribed sequence may be the 

result of "double notching," drifting from a control rod drive cooling water 

transient, leaking scram valves, or a power reduction to ≤ [10]% RTP 

before establishing the correct control rod pattern. The number of 

OPERABLE control rods not in compliance with the prescribed sequence 

is limited to eight to prevent the operator from attempting to correct a 

control rod pattern that significantly deviates from the prescribed 

sequence. When the control rod pattern is not in compliance with the 

prescribed sequence, all control rod movement should be stopped except 

for moves needed to correct the control rod pattern, or scram if 

warranted. 
Rod Pattern Control 

B 3.1.6 

BWR/6 STS B 3.1.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Action A.1 is modified by a Note, which allows control rods to be 

bypassed in Rod Action Control System (RACS) to allow the affected 

control rods to be returned to their correct position. This ensures that the 

control rods will be moved to the correct position. A control rod not in 

compliance with the prescribed sequence is not considered inoperable 

except as required by Required Action A.2. OPERABILITY of control 

rods is determined by compliance with LCO 3.1.3; LCO 3.1.4, "Control 

Rod Scram Times," and LCO 3.1.5, "Control Rod Scram Accumulators." 

The allowed Completion Time of 8 hours is reasonable, considering the 

restrictions on the number of allowed out of sequence control rods and 

the low probability of a CRDA occurring during the time the control rods 

are out of sequence. 

B.1 and B.2

If nine or more OPERABLE control rods are out of sequence, the control 

rod pattern significantly deviates from the prescribed sequence. Control 

rod withdrawal should be suspended immediately to prevent the potential 

for further deviation from the prescribed sequence. Control rod insertion 

to correct control rods withdrawn beyond their allowed position is allowed 

since, in general, insertion of control rods has less impact on control rod 

worth than withdrawals have. Required Action B.1 is modified by a Note 

that allows the affected control rods to be bypassed in RACS in 

accordance with SR 3.3.2.1.8 to allow insertion only. 

With nine or more OPERABLE control rods not in compliance with BPWS, 

the reactor mode switch must be placed in the shutdown position within 

1 hour. With the reactor mode switch in shutdown, the reactor is shut 

down, and therefore does not meet the applicability requirements of this 

LCO. The allowed Completion Time of 1 hour is reasonable to allow 

insertion of control rods to restore compliance, and is appropriate relative 

to the low probability of a CRDA occurring with the control rods out of 

sequence. 

SURVEILLANCE SR 3.1.6.1

REQUIREMENTS 

The control rod pattern is verified to be in compliance with the BPWS at a 

24 hour Frequency, ensuring the assumptions of the CRDA analyses are 

met. The 24 hour Frequency of this Surveillance was developed 

considering that the primary check of the control rod pattern compliance 

with the BPWS is performed by the RPC (LCO 3.3.2.1). The RPC 

provides control rod blocks to enforce the required control rod sequence 

and is required to be OPERABLE when operating at ≤ 10% RTP. 
Rod Pattern Control 

B 3.1.6 

BWR/6 STS B 3.1.6-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. Current Cycle Safety Analysis. 

 2. "Modifications to the Requirements for Control Rod Drop Accident 

Mitigating Systems," BWR Owners Group, July 1987. 

 3. FSAR, Section 15.4.9. 

 4. NUREG-0979, "NRC Safety Evaluation Report for GESSAR II BWR/6 

Nuclear Island Design, Docket No. 50-447," Section 4.2.1.3.2, 

April 1983. 

 5. NUREG-0800, "Standard Review Plan," Section 15.4.9, "Radiological 

Consequences of Control Rod Drop Accident (BWR)," Revision 2, 

July 1981. 

 6. 10 CFR 100.11, "Determination of Exclusion Area Low Population 

Zone and Population Center Distance." 

 7. NEDO-21778-A, "Transient Pressure Rises Affected Fracture 

Toughness Requirements for Boiling Water Reactors," 

December 1978. 

 8. ASME, Boiler and Pressure Vessel Code. 

 9. NEDO-21231, "Banked Position Withdrawal Sequence," 

January 1977. 
SLC System 

B 3.1.7 

BWR/6 STS B 3.1.7-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.7 Standby Liquid Control (SLC) System 

BASES 

BACKGROUND The SLC System is designed to provide the capability of bringing the 

reactor, at any time in a fuel cycle, from full power and minimum control 

rod inventory (which is at the peak of the xenon transient) to a subcritical 

condition with the reactor in the most reactive xenon free state without 

taking credit for control rod movement. The SLC System satisfies the 

requirements of 10 CFR 50.62 (Ref. 1) on anticipated transient without 

scram (ATWS). 

The SLC System consists of a boron solution storage tank, two positive 

displacement pumps, two explosive valves, which are provided in parallel 

for redundancy, and associated piping and valves used to transfer 

borated water from the storage tank to the reactor pressure vessel (RPV). 

The borated solution is discharged through the high pressure core spray 

system sparger. 

APPLICABLE The SLC System is manually initiated from the main control room, as 

SAFETY directed by the emergency operating procedures, if the operator believes 

ANALYSES the reactor cannot be shut down, or kept shut down, with the control rods. 

The SLC System is used in the event that not enough control rods can be 

inserted to accomplish shutdown and cooldown in the normal manner. 

The SLC System injects borated water into the reactor core to 

compensate for all of the various reactivity effects that could occur during 

plant operation. To meet this objective, it is necessary to inject a quantity 

of boron that produces a concentration of 660 ppm of natural boron in the 

reactor core at 68°F. To allow for potential leakage and imperfect mixing 

in the reactor system, an additional amount of boron equal to 25% of the 

amount cited above is added (Ref. 2). The temperature versus 

concentration limits in Figure 3.1.7-1 are calculated such that the required 

concentration is achieved accounting for dilution in the RPV with normal 

water level and including the water volume in the residual heat removal 

shutdown cooling piping and in the recirculation loop piping. This quantity 

of borated solution is the amount that is above the pump suction shutoff 

level in the boron solution storage tank. No credit is taken for the portion 

of the tank volume that cannot be injected. 

The SLC System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). 
SLC System 

B 3.1.7 

BWR/6 STS B 3.1.7-2 Rev. 3.0, 03/31/04 

BASES 

LCO The OPERABILITY of the SLC System provides backup capability for 

reactivity control, independent of normal reactivity control provisions 

provided by the control rods. The OPERABILITY of the SLC System is 

based on the conditions of the borated solution in the storage tank and 

the availability of a flow path to the RPV, including the OPERABILITY of 

the pumps and valves. Two SLC subsystems are required to be 

OPERABLE, each containing an OPERABLE pump, an explosive valve 

and associated piping, valves, and instruments and controls to ensure an 

OPERABLE flow path. 

APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, 

control rods are not able to be withdrawn since the reactor mode switch is 

in shutdown and a control rod block is applied. This provides adequate 

controls to ensure the reactor remains subcritical. In MODE 5, only a 

single control rod can be withdrawn from a core cell containing fuel 

assemblies. Demonstration of adequate SDM (LCO 3.1.1, "SHUTDOWN 

MARGIN (SDM)") ensures that the reactor will not become critical. 

Therefore, the SLC System is not required to be OPERABLE during these 

conditions, when only a single control rod can be withdrawn. 

ACTIONS A.1

If the boron solution concentration is less than the required limits for 

ATWS mitigation but greater than the concentration required for cold 

shutdown (original licensing basis), the concentration must be restored to 

within limits in 72 hours. It is not necessary under these conditions to 

enter Condition C for both SLC subsystems inoperable, since they are 

capable of performing their original design basis function. Because of the 

low probability of an ATWS event and that the SLC System capability still 

exists for vessel injection under these conditions, the allowed Completion 

Time of 72 hours is acceptable and provides adequate time to restore 

concentration to within limits. 

The second Completion Time for Required Action A.1 establishes a limit 

on the maximum time allowed for any combination of concentration out of 

limits or inoperable SLC subsystems during any single contiguous 

occurrence of failing to meet the LCO. If Condition A is entered while, for 

instance, an SLC subsystem is inoperable and that subsystem is 

subsequently returned to OPERABLE, the LCO may already have been 

not met for up to 7 days. This situation could lead to a total duration of 

10 days (7 days in Condition B, followed by 3 days in Condition A), since 

initial failure of the LCO, to restore the SLC System. Then an SLC 

subsystem could be found inoperable again, and concentration could be 

restored to within limits. This could continue indefinitely. 
SLC System 

B 3.1.7 

BWR/6 STS B 3.1.7-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

This Completion Time allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock", resulting in establishing the 

"time zero" at the time the LCO was initially not met instead of at the time 

Condition A was entered. The 10 day Completion Time is an acceptable 

limitation on this potential to fail to meet the LCO indefinitely. 

B.1

If one SLC System subsystem is inoperable for reasons other than 

Condition A, the inoperable subsystem must be restored to OPERABLE 

status within 7 days. In this condition, the remaining OPERABLE 

subsystem is adequate to perform the shutdown function. However, the 

overall reliability is reduced because a single failure in the remaining 

OPERABLE subsystem could result in reduced SLC System shutdown 

capability. The 7 day Completion Time is based on the availability of an 

OPERABLE subsystem capable of performing the intended SLC System 

function and the low probability of a Design Basis Accident (DBA) or 

severe transient occurring concurrent with the failure of the Control Rod 

Drive System to shut down the plant. 

The second Completion Time for Required Action B.1 establishes a limit 

on the maximum time allowed for any combination of concentration out of 

limits or inoperable SLC subsystems during any single contiguous 

occurrence of failing to meet the LCO. If Condition B is entered while, for 

instance, concentration is out of limits, and is subsequently returned to 

within limits, the LCO may already have been not met of up to 3 days. 

This situation could lead to a total duration of 10 days (3 days in 

Condition A, followed by 7 days in Condition B), since initial failure of the 

LCO, to restore the SLC System. Then concentration could be found out 

of limits again, and the SLC subsystem could be restored to OPERABLE. 

This could continue indefinitely. 

This Completion Time allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock", resulting in establishing the 

"time zero" at the time the LCO was initially not met instead of at the time 

Condition B was entered. The 10 day Completion Time is an acceptable 

limitation on this potential to fail to meet the LCO indefinitely. 
SLC System 

B 3.1.7 

BWR/6 STS B 3.1.7-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

If both SLC subsystems are inoperable for reasons other than 

Condition A, at least one subsystem must be restored to OPERABLE 

status within 8 hours. The allowed Completion Time of 8 hours is 

considered acceptable, given the low probability of a DBA or transient 

occurring concurrent with the failure of the control rods to shut down the 

reactor. 

D.1

If any Required Action and associated Completion Time is not met, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to MODE 3 within 12 hours. 

The allowed Completion Time of 12 hours is reasonable, based on 

operating experience, to reach MODE 3 from full power conditions in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.1.7.1, SR 3.1.7.2, and SR 3.1.7.3

REQUIREMENTS 

SR 3.1.7.1 through SR 3.1.7.3 are 24 hour Surveillances, verifying certain 

characteristics of the SLC System (e.g., the volume and temperature of 

the borated solution in the storage tank), thereby ensuring the SLC 

System OPERABILITY without disturbing normal plant operation. These 

Surveillances ensure the proper borated solution and temperature, 

including the temperature of the pump suction piping, are maintained. 

Maintaining a minimum specified borated solution temperature is 

important in ensuring that the boron remains in solution and does not 

precipitate out in the storage tank or in the pump suction piping. The 

24 hour Frequency of these SRs is based on operating experience that 

has shown there are relatively slow variations in the measured 

parameters of volume and temperature. 

SR 3.1.7.4 and SR 3.1.7.6

SR 3.1.7.4 verifies the continuity of the explosive charges in the injection 

valves to ensure proper operation will occur if required. Other 

administrative controls, such as those that limit the shelf life of the 

explosive charges, must be followed. The 31 day Frequency is based on 

operating experience that has demonstrated the reliability of the explosive 

charge continuity. 
SLC System 

B 3.1.7 

BWR/6 STS B 3.1.7-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.1.7.6 verifies each valve in the system is in its correct position, but 

does not apply to the squib (i.e., explosive) valves. Verifying the correct 

alignment for manual, power operated, and automatic valves in the SLC 

System flow path ensures that the proper flow paths will exist for system 

operation. A valve is also allowed to be in the nonaccident position, 

provided it can be aligned to the accident position from the control room, 

or locally by a dedicated operator at the valve control. This is acceptable 

since the SLC System is a manually initiated system. This Surveillance 

does not apply to valves that are locked, sealed, or otherwise secured in 

position, since they were verified to be in the correct position prior to 

locking, sealing, or securing. This verification of valve alignment does not 

apply to valves that cannot be inadvertently misaligned, such as check 

valves. This SR does not require any testing or valve manipulation; 

rather, it involves verification that those valves capable of being 

mispositioned are in the correct positions. The 31 day Frequency is 

based on engineering judgment and is consistent with the procedural 

controls governing valve operation that ensure correct valve positions. 

SR 3.1.7.5

This Surveillance requires an examination of the sodium pentaborate 

solution by using chemical analysis to ensure the proper concentration of 

boron exists in the storage tank. SR 3.1.7.5 must be performed anytime 

boron or water is added to the storage tank solution to establish that the 

boron solution concentration is within the specified limits. This 

Surveillance must be performed anytime the temperature is restored to 

within the limits of Figure 3.1.7-1, to ensure no significant boron 

precipitation occurred. The 31 day Frequency of this Surveillance is 

appropriate because of the relatively slow variation of boron concentration 

between surveillances. 

SR 3.1.7.7

Demonstrating each SLC System pump develops a flow rate ≥ 41.2 gpm 

at a discharge pressure ≥ 1300 psig ensures that pump performance has 

not degraded during the fuel cycle. This minimum pump flow rate 

requirement ensures that, when combined with the sodium pentaborate 

solution concentration requirements, the rate of negative reactivity 

insertion from the SLC System will adequately compensate for the 
SLC System 

B 3.1.7 

BWR/6 STS B 3.1.7-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

positive reactivity effects encountered during power reduction, cooldown 

of the moderator, and xenon decay. This test confirms one point on the 

pump design curve, and is indicative of overall performance. Such 

inservice inspections confirm component OPERABILITY, trend 

performance, and detect incipient failures by indicating abnormal 

performance. The Frequency of this Surveillance is [in accordance with 

the Inservice Testing Program or 92 days]. 

SR 3.1.7.8 and SR 3.1.7.9

These Surveillances ensure that there is a functioning flow path from the 

boron solution storage tank to the RPV, including the firing of an 

explosive valve. The replacement charge for the explosive valve shall be 

from the same manufactured batch as the one fired or from another batch 

that has been certified by having one of that batch successfully fired. The 

pump and explosive valve tested should be alternated such that both 

complete flow paths are tested every 36 months, at alternating 18 month 

intervals. The Surveillance may be performed in separate steps to 

prevent injecting boron into the RPV. An acceptable method for verifying 

flow from the pump to the RPV is to pump demineralized water from a 

test tank through one SLC subsystem and into the RPV. The 18 month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power. Operating experience has shown these components usually pass 

the Surveillance test when performed at the 18 month Frequency; 

therefore, the Frequency was concluded to be acceptable from a 

reliability standpoint. 

Demonstrating that all heat traced piping between the boron solution 

storage tank and the suction inlet to the injection pumps is unblocked 

ensures that there is a functioning flow path for injecting the sodium 

pentaborate solution. An acceptable method for verifying that the suction 

piping is unblocked is to pump from the storage tank to the test tank. The 

18 month Frequency is acceptable since there is a low probability that the 

subject piping will be blocked due to precipitation of the boron from 

solution in the heat traced piping. This is especially true in light of the 

daily temperature verification of this piping required by SR 3.1.7.3. 

However, if, in performing SR 3.1.7.3, it is determined that the 

temperature of this piping has fallen below the specified minimum, 

SR 3.1.7.9 must be performed once within 24 hours after the piping 

temperature is restored within the limits of Figure 3.1.7-1. 
SLC System 

B 3.1.7 

BWR/6 STS B 3.1.7-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.1.7.10

Enriched sodium pentaborate solution is made by mixing granular, 

enriched sodium pentaborate with water. Isotopic tests on the granular 

sodium pentaborate to verify the actual B-10 enrichment must be 

performed prior to addition to the SLC tank in order to ensure that the 

proper B-10 atom percentage is being used. 

REFERENCES 1. 10 CFR 50.62. 

 2. FSAR, Section [9.3.5.3]. 
SDV Vent and Drain Valves 

B 3.1.8 

BWR/6 STS B 3.1.8-1 Rev. 3.0, 03/31/04 

B 3.1 REACTIVITY CONTROL SYSTEMS 

B 3.1.8 Scram Discharge Volume (SDV) Vent and Drain Valves 

BASES 

BACKGROUND The SDV vent and drain valves are normally open and discharge any 

accumulated water in the SDV to ensure that sufficient volume is 

available at all times to allow a complete scram. During a scram, the 

SDV vent and drain valves close to contain reactor water. The SDV 

consists of header piping that connects to each hydraulic control unit 

(HCU) and drains into an instrument volume. There are two headers and 

two instrument volumes, each receiving approximately one half of the 

control rod drive (CRD) discharges. The two instrument volumes are 

connected to a common drain line with two valves in series. Each header 

is connected to a common vent line with two valves in series. The header 

piping is sized to receive and contain all the water discharged by the 

CRDs during a scram. The design and functions of the SDV are 

described in Reference 1. 

APPLICABLE The Design Basis Accident and transient analyses assume all the control 

SAFETY rods are capable of scramming. The primary function of the SDV is to 

ANALYSES limit the amount of reactor coolant discharged during a scram. The 

acceptance criteria for the SDV vent and drain valves are that they 

operate automatically to: 

a. Close during scram to limit the amount of reactor coolant discharged 

so that adequate core cooling is maintained and offsite doses remain 

within the limits of 10 CFR 100 (Ref. 2) and 

b. Open on scram reset to maintain the SDV vent and drain path open 

so there is sufficient volume to accept the reactor coolant discharged 

during a scram. 

Isolation of the SDV can also be accomplished by manual closure of the 

SDV valves. Additionally, the discharge of reactor coolant to the SDV can 

be terminated by scram reset or closure of the HCU manual isolation 

valves. For a bounding leakage case, the offsite doses are well within the 

limits of 10 CFR 100 (Ref. 2) and adequate core cooling is maintained 

(Ref. 3). The SDV vent and drain valves also allow continuous drainage 

of the SDV during normal plant operation to ensure the SDV has sufficient 

capacity to contain the reactor coolant discharge during a full core scram. 

To automatically ensure this capacity, a reactor scram (LCO 3.3.1.1, 
SDV Vent and Drain Valves 

B 3.1.8 

BWR/6 STS B 3.1.8-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

"Reactor Protection System (RPS) Instrumentation") is initiated if the SDV 

water level exceeds a specified setpoint. The setpoint is chosen such 

that all control rods are inserted before the SDV has insufficient volume to 

accept a full scram. 

SDV vent and drain valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The OPERABILITY of all SDV vent and drain valves ensures that, during 

a scram, the SDV vent and drain valves will close to contain reactor water 

discharged to the SDV piping. Since the vent and drain lines are 

provided with two valves in series, the single failure of one valve in the 

open position will not impair the isolation function of the system. 

Additionally, the valves are required to be open to ensure that a path is 

available for the SDV piping to drain freely at other times. 

APPLICABILITY In MODES 1 and 2, scram may be required, and therefore, the SDV vent 

and drain valves must be OPERABLE. In MODES 3 and 4, control rods 

are not able to be withdrawn since the reactor mode switch is in shutdown 

and a control rod block is applied. This provides adequate controls to 

ensure that only a single control rod can be withdrawn. Also, during 

MODE 5, only a single control rod can be withdrawn from a core cell 

containing fuel assemblies. Therefore, the SDV vent and drain valves are 

not required to be OPERABLE in these MODES since the reactor is 

subcritical and only one rod may be withdrawn and subject to scram. 

ACTIONS The ACTIONS table is modified by Note 1 indicating that a separate 

Condition entry is allowed for each SDV vent and drain line. This is 

acceptable, since the Required Actions for each Condition provide 

appropriate compensatory actions for each inoperable SDV line. 

Complying with the Required Actions may allow for continued operation, 

and subsequent inoperable SDV lines are governed by subsequent 

Condition entry and application of associated Required Actions. 

When a line is isolated, the potential for an inadvertent scram due to high 

SDV level is increased. During these periods, the line may be unisolated 

under administrative control. This allows any accumulated water in the 

line to be drained, to preclude a reactor scram on SDV high level. This is 

acceptable, since the administrative controls ensure the valve can be 

closed quickly, by a dedicated operator, if a scram occurs with the valve 

open. 
SDV Vent and Drain Valves 

B 3.1.8 

BWR/6 STS B 3.1.8-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

When one SDV vent or drain valve is inoperable in one or more lines, the 

associated line must be isolated to contain the reactor coolant during a 

scram. The 7 day Completion Time is reasonable, given the level of 

redundancy in the lines and the low probability of a scram occurring 

during the time the valve(s) are inoperable and the line is not isolated. 

The SDV is still isolable since the redundant valve in the affected line is 

OPERABLE. During these periods, the single failure criterion may not be 

preserved, and a higher risk exists to allow reactor water out of the 

primary system during a scram. 

B.1

If both valves in a line are inoperable, the line must be isolated to contain 

the reactor coolant during a scram. 

The 8 hour Completion Time to isolate the line is based on the low 

probability of a scram occurring while the line is not isolated and 

unlikelihood of significant CRD seal leakage. 

C.1

If any Required Action and associated Completion Time is not met, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to MODE 3 within 12 hours. 

The allowed Completion Time of 12 hours is reasonable, based on 

operating experience, to reach MODE 3 from full power conditions in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.1.8.1

REQUIREMENTS 

During normal operation, the SDV vent and drain valves should be in the 

open position (except when performing SR 3.1.8.2) to allow for drainage 

of the SDV piping. Verifying that each valve is in the open position 

ensures that the SDV vent and drain valves will perform their intended 

function during normal operation. This SR does not require any testing or 

valve manipulation; rather, it involves verification that the valves are in the 

correct position. The 31 day Frequency is based on engineering 

judgment and is consistent with the procedural controls governing valve 

operation, which ensure correct valve positions. Improper valve position 

(closed) would not affect the isolation function. 
SDV Vent and Drain Valves 

B 3.1.8 

BWR/6 STS B 3.1.8-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.1.8.2

During a scram, the SDV vent and drain valves should close to contain 

the reactor water discharged to the SDV piping. Cycling each valve 

through its complete range of motion (closed and open) ensures that the 

valve will function properly during a scram. The 92 day Frequency is 

based on operating experience and takes into account the level of 

redundancy in the system design. 

SR 3.1.8.3

SR 3.1.8.3 is an integrated test of the SDV vent and drain valves to verify 

total system performance. After receipt of a simulated or actual scram 

signal, the closure of the SDV vent and drain valves is verified. The 

closure time of [30] seconds after a receipt of a scram signal is based on 

the bounding leakage case evaluated in the accident analysis. Similarly, 

after receipt of a simulated or actual scram reset signal, the opening of 

the SDV vent and drain valves is verified. The LOGIC SYSTEM 

FUNCTIONAL TEST in LCO 3.3.1.1 and the scram time testing of control 

rods in LCO 3.1.3 overlap this Surveillance to provide complete testing of 

the assumed safety function. The 18 month Frequency is based on the 

need to perform this Surveillance under the conditions that apply during a 

plant outage and the potential for an unplanned transient if the 

Surveillance were performed with the reactor at power. Operating 

experience has shown these components usually pass the Surveillance 

when performed at the 18 month Frequency; therefore, the Frequency 

was concluded to be acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [4.6.1.1.2.4.2.6]. 

 2. 10 CFR 100. 

 3. NUREG-0803, "Generic Safety Evaluation Report Regarding Integrity 

of BWR Scram System Piping," August 1981. 
APLHGR 

B 3.2.1 

BWR/6 STS B 3.2.1-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTIONS LIMITS 

B 3.2.1 AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR) 

BASES 

BACKGROUND The APLHGR is a measure of the average LHGR of all the fuel rods in a 

fuel assembly at any axial location. Limits on the APLHGR are specified 

to ensure that the fuel design limits identified in Reference 1 are not 

exceeded during anticipated operational occurrences (AOOs) and that the 

peak cladding temperature (PCT) during the postulated design basis loss 

of coolant accident (LOCA) does not exceed the limits specified in 

10 CFR 50.46. 

APPLICABLE The analytical methods and assumptions used in evaluating the fuel 

SAFETY design limits are presented in the FSAR, Chapters 4, 6, and 15, and in 

ANALYSES References 1 and 2. The analytical methods and assumptions used in 

evaluating Design Basis Accidents (DBAs), anticipated operational 

transients, and normal operations that determine APLHGR limits are 

presented in FSAR, Chapters 4, 6, and 15, and in References 1, 2, and 3. 

Fuel design evaluations are performed to demonstrate that the 1% limit 

on the fuel cladding plastic strain and other fuel design limits described in 

Reference 1 are not exceeded during AOOs for operation with LHGR up 

to the operating limit LHGR. APLHGR limits are equivalent to the LHGR 

limit for each fuel rod divided by the local peaking factor of the fuel 

assembly. APLHGR limits are developed as a function of exposure and 

the various operating core flow and power states to ensure adherence to 

fuel design limits during the limiting AOOs (Refs. 2 and 3). Flow 

dependent APLHGR limits are determined using the three dimensional 

BWR simulator code (Ref. 4) to analyze slow flow runout transients. The 

flow dependent multiplier, MAPFACf, is dependent on the maximum core 

flow runout capability. MAPFACf curves are provided based on the 

maximum credible flow runout transient for Loop Manual and Non Loop 

Manual operation. The result of a single failure or single operator error 

during Loop Manual operation is the runout of only one loop because both 

recirculation loops are under independent control. Non Loop Manual 

operational modes allow simultaneous runout of both loops because a 

single controller regulates core flow. 

Based on analyses of limiting plant transients (other than core flow 

increases) over a range of power and flow conditions, power dependent 

multipliers, MAPFACp, are also generated. Due to the sensitivity of the 

transient response to initial core flow levels at power levels below those at 

which turbine stop valve closure and turbine control valve fast closure 
APLHGR 

B 3.2.1 

BWR/6 STS B 3.2.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

scram signals are bypassed, both high and low core flow MAPFACp limits 

are provided for operation at power levels between 25% RTP and the 

previously mentioned bypass power level. The exposure dependent 

APLHGR limits are reduced by MAPFACp and MAPFACf at various 

operating conditions to ensure that all fuel design criteria are met for 

normal operation and AOOs. A complete discussion of the analysis code 

is provided in References 1 and 3. 

LOCA analyses are then performed to ensure that the above determined 

APLHGR limits are adequate to meet the PCT and maximum oxidation 

limits of 10 CFR 50.46. The analysis is performed using calculational 

models that are consistent with the requirements of 10 CFR 50, 

Appendix K. A complete discussion of the analysis code is provided in 

Reference 5. The PCT following a postulated LOCA is a function of the 

average heat generation rate of all the rods of a fuel assembly at any 

axial location and is not strongly influenced by the rod to rod power 

distribution within an assembly. The APLHGR limits specified are 

equivalent to the LHGR of the highest powered fuel rod assumed in the 

LOCA analysis divided by its local peaking factor. A conservative 

multiplier is applied to the LHGR assumed in the LOCA analysis to 

account for the uncertainty associated with the measurement of the 

APLHGR. 

For single recirculation loop operation, the MAPFAC multiplier is limited to 

a maximum of 0.86 (Ref. 2). This limit is due to the conservative analysis 

assumption of an earlier departure from nucleate boiling with one 

recirculation loop available, resulting in a more severe cladding heatup 

during a LOCA. 

The APLHGR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The APLHGR limits specified in the COLR are the result of fuel design, 

DBA, and transient analyses. For two recirculation loops operating, the 

limit is determined by multiplying the smaller of the MAPFACf and 

MAPFACp factors times the exposure dependent APLHGR limits. With 

only one recirculation loop in operation, in conformance with the 

requirements of LCO 3.4.1, "Recirculation Loops Operating," the limit is 

determined by multiplying the exposure dependent APLHGR limit by the 

smallest of MAPFACf, MAPFACp, and 0.86, where 0.86 has been 

determined by a specific single recirculation loop analysis (Ref. 2). 
APLHGR 

B 3.2.1 

BWR/6 STS B 3.2.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The APLHGR limits are primarily derived from fuel design evaluations and 

LOCA and transient analyses that are assumed to occur at high power 

levels. Design calculations (Ref. 4) and operating experience have 

shown that as power is reduced, the margin to the required APLHGR 

limits increases. This trend continues down to the power range of 5% to 

15% RTP when entry into MODE 2 occurs. When in MODE 2, the 

intermediate range monitor (IRM) scram function provides prompt scram 

initiation during any significant transient, thereby effectively removing any 

APLHGR limit compliance concern in MODE 2. Therefore, at THERMAL 

POWER levels ≤ 25% RTP, the reactor operates with substantial margin 

to the APLHGR limits; thus, this LCO is not required. 

ACTIONS A.1

If any APLHGR exceeds the required limits, an assumption regarding an 

initial condition of the DBA and transient analyses may not be met. 

Therefore, prompt action is taken to restore the APLHGR(s) to within the 

required limits such that the plant will be operating within analyzed 

conditions and within the design limits of the fuel rods. The 2 hour 

Completion Time is sufficient to restore the APLHGR(s) to within its limits 

and is acceptable based on the low probability of a transient or DBA 

occurring simultaneously with the APLHGR out of specification. 

B.1

If the APLHGR cannot be restored to within its required limits within the 

associated Completion Time, the plant must be brought to a MODE or 

other specified condition in which the LCO does not apply. To achieve 

this status, THERMAL POWER must be reduced to < 25% RTP within 

4 hours. The allowed Completion Time is reasonable, based on 

operating experience, to reduce THERMAL POWER to < 25% RTP in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.2.1.1

REQUIREMENTS 

APLHGRs are required to be initially calculated within 12 hours after 

THERMAL POWER is ≥ 25% RTP and then every 24 hours thereafter. 

They are compared to the specified limits in the COLR to ensure that the 

reactor is operating within the assumptions of the safety analysis. The 

24 hour Frequency is based on both engineering judgment and 

recognition of the slowness of changes in power distribution under normal 

conditions. The 12 hour allowance after THERMAL POWER ≥ 25% RTP 

is achieved is acceptable given the large inherent margin to operating 

limits at low power levels. 
APLHGR 

B 3.2.1 

BWR/6 STS B 3.2.1-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. [Plant specific current cycle safety analysis]. 

 2. FSAR, [Chapter 15, Appendix C]. 

 3. FSAR, [Chapter 15, Appendix D]. 

 4. XN-NF-80-19(P)(A), "Exxon Nuclear Methodology for Boiling Water 

Reactors, Neutronics Methods for Design and Analysis," Volume 1, 

June 1981. 

 5. XN-NF-80-19(A), "Exxon Nuclear Methodology for Boiling Water 

Reactors, ECCS Evaluation Model," Volume 2, Revision 1, 

June 1981. 
MCPR 

B 3.2.2 

BWR/6 STS B 3.2.2-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTIONS LIMITS 

B 3.2.2 MINIMUM CRITICAL POWER RATIO (MCPR) 

BASES 

BACKGROUND MCPR is a ratio of the fuel assembly power that would result in the onset 

of boiling transition to the actual fuel assembly power. The MCPR Safety 

Limit (SL) is set such that 99.9% of the fuel rods avoid boiling transition if 

the limit is not violated (refer to the Bases for SL 2.1.1.2). The operating 

limit MCPR is established to ensure that no fuel damage results during 

anticipated operational occurrences (AOOs). Although fuel damage does 

not necessarily occur if a fuel rod actually experiences boiling transition 

(Ref. 1), the critical power at which boiling transition is calculated to occur 

has been adopted as a fuel design criterion. 

The onset of transition boiling is a phenomenon that is readily detected 

during the testing of various fuel bundle designs. Based on these 

experimental data, correlations have been developed to predict critical 

bundle power (i.e., the bundle power level at the onset of transition 

boiling) for a given set of plant parameters (e.g., reactor vessel pressure, 

flow, and subcooling). Because plant operating conditions and bundle 

power levels are monitored and determined relatively easily, monitoring 

the MCPR is a convenient way of ensuring that fuel failures due to 

inadequate cooling do not occur. 

APPLICABLE The analytical methods and assumptions used in evaluating the AOOs to 

SAFETY establish the operating limit MCPR are presented in the FSAR, 

ANALYSES Chapters 4, 6, and 15, and References 2, 3, 4, and 5. To ensure that the 

MCPR SL is not exceeded during any transient event that occurs with 

moderate frequency, limiting transients have been analyzed to determine 

the largest reduction in critical power ratio (CPR). The types of transients 

evaluated are loss of flow, increase in pressure and power, positive 

reactivity insertion, and coolant temperature decrease. The limiting 

transient yields the largest change in CPR (∆CPR). When the largest 

∆CPR is added to the MCPR SL, the required operating limit MCPR is 

obtained. 

The MCPR operating limits derived from the transient analysis are 

dependent on the operating core flow and power state (MCPRf and 

MCPRp, respectively) to ensure adherence to fuel design limits during the 

worst transient that occurs with moderate frequency (Refs. 3, 4, and 5). 

Flow dependent MCPR limits are determined by steady state thermal 

hydraulic methods using the three dimensional BWR simulator code 

(Ref. 6) and the multichannel thermal hydraulic code (Ref. 7). MCPRf 
MCPR 

B 3.2.2 

BWR/6 STS B 3.2.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

curves are provided based on the maximum credible flow runout transient 

for Loop Manual and Non Loop Manual operation. The result of a single 

failure or single operator error during Loop Manual operation is the runout 

of only one loop because both recirculation loops are under independent 

control. Non Loop Manual operational modes allow simultaneous runout 

of both loops because a single controller regulates core flow. 

Power dependent MCPR limits (MCPRp) are determined by the three 

dimensional BWR simulator code and the one dimensional transient code 

(Ref. 8). Due to the sensitivity of the transient response to initial core flow 

levels at power levels below those at which the turbine stop valve closure 

and turbine control valve fast closure scram trips are bypassed, high and 

low flow MCPRp operating limits are provided for operating between 

25% RTP and the previously mentioned bypass power level. 

The MCPR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The MCPR operating limits specified in the COLR are the result of the 

Design Basis Accident (DBA) and transient analysis. The MCPR 

operating limits are determined by the larger of the MCPRf and MCPRp

limits. 

APPLICABILITY The MCPR operating limits are primarily derived from transient analyses 

that are assumed to occur at high power levels. Below 25% RTP, the 

reactor is operating at a slow recirculation pump speed and the moderator 

void ratio is small. Surveillance of thermal limits below 25% RTP is 

unnecessary due to the large inherent margin that ensures that the 

MCPR SL is not exceeded even if a limiting transient occurs. 

Statistical analyses documented in Reference 9 indicate that the nominal 

value of the initial MCPR expected at 25% RTP is > 3.5. Studies of the 

variation of limiting transient behavior have been performed over the 

range of power and flow conditions. These studies (Ref. 5) encompass 

the range of key actual plant parameter values important to typically 

limiting transients. The results of these studies demonstrate that a 

margin is expected between performance and the MCPR requirements, 

and that margins increase as power is reduced to 25% RTP. This trend is 

expected to continue to the 5% to 15% power range when entry into 

MODE 2 occurs. When in MODE 2, the intermediate range monitor (IRM) 

provides rapid scram initiation for any significant power increase 

transient, which effectively eliminates any MCPR compliance concern. 

Therefore, at THERMAL POWER levels < 25% RTP, the reactor is 

operating with substantial margin to the MCPR limits and this LCO is not 

required. 
MCPR 

B 3.2.2 

BWR/6 STS B 3.2.2-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

If any MCPR is outside the required limits, an assumption regarding an 

initial condition of the design basis transient analyses may not be met. 

Therefore, prompt action should be taken to restore the MCPR(s) to 

within the required limits such that the plant remains operating within 

analyzed conditions. The 2 hour Completion Time is normally sufficient to 

restore the MCPR(s) to within its limits and is acceptable based on the 

low probability of a transient or DBA occurring simultaneously with the 

MCPR out of specification. 

B.1

If the MCPR cannot be restored to within the required limits within the 

associated Completion Time, the plant must be brought to a MODE or 

other specified condition in which the LCO does not apply. To achieve 

this status, THERMAL POWER must be reduced to < 25% RTP within 

4 hours. The allowed Completion Time is reasonable, based on 

operating experience, to reduce THERMAL POWER to < 25% RTP in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.2.2.1

REQUIREMENTS 

The MCPR is required to be initially calculated within 12 hours after 

THERMAL POWER is ≥ 25% RTP and then every 24 hours thereafter. It 

is compared to the specified limits in the COLR to ensure that the reactor 

is operating within the assumptions of the safety analysis. The 24 hour 

Frequency is based on both engineering judgment and recognition of the 

slowness of changes in power distribution during normal operation. The 

12 hour allowance after THERMAL POWER reaches ≥ 25% RTP is 

acceptable given the large inherent margin to operating limits at low 

power levels. 

REFERENCES 1. NUREG-0562, June 1979. 

 2. [Plant specific current cycle safety analysis]. 

 3. FSAR, [Appendix 15B]. 

 4. FSAR, [Appendix 15C]. 

 5. FSAR, [Appendix 15D]. 
MCPR 

B 3.2.2 

BWR/6 STS B 3.2.2-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES (continued) 

 6. XN-NF-80-19(P)(A), "Exxon Nuclear Methodology for Boiling Water 

Reactors, Neutronics Methods for Design and Analysis," Volume 1 

(as supplemented). 

 7. XN-NF-80-19(P)(A), "Exxon Nuclear Methodology for Boiling Water 

Reactors, THERMEX Thermal Limits Methodology Summary 

Description," Volume 3, Revision 2, January 1987. 

 8. XN-NF-79-71(P), "Exxon Nuclear Plant Methodology for Boiling 

Water Reactors," Revision 2, November 1981. 

 9. "BWR/6 Generic Rod Withdrawal Error Analysis," General Electric 

Standard Safety Analysis Report, GESSAR-II, Appendix 15B. 
LHGR (Optional) 

B 3.2.3 

BWR/6 STS B 3.2.3-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTIONS LIMITS 

B 3.2.3 LINEAR HEAT GENERATION RATE (LHGR) (Optional) 

BASES 

BACKGROUND The LHGR is a measure of the heat generation rate of a fuel rod in a fuel 

assembly at any axial location. Limits on the LHGR are specified to 

ensure that fuel design limits are not exceeded anywhere in the core 

during normal operation, including anticipated operational occurrences 

(AOOs). Exceeding the LHGR limit could potentially result in fuel damage 

and subsequent release of radioactive materials. Fuel design limits are 

specified to ensure that fuel system damage, fuel rod failure or inability to 

cool the fuel does not occur during the anticipated operating conditions 

identified in Reference 1. 

APPLICABLE The analytical methods and assumptions used in evaluating the fuel 

SAFETY system design are presented in References 1 and 2. The fuel assembly 

ANALYSES is designed to ensure (in conjunction with the core nuclear and thermal 

hydraulic design, plant equipment, instrumentation, and protection 

system) that fuel damage will not result in the release of radioactive 

materials in excess of the guidelines of 10 CFR, Parts 20, 50, and 100. 

The mechanisms that could cause fuel damage during operational 

transients and that are considered in fuel evaluations are: 

a. Rupture of the fuel rod cladding caused by strain from the relative 

expansion of the UO2 pellet and 

b. Severe overheating of the fuel rod cladding caused by inadequate 

cooling. 

A value of [1%] plastic strain of the fuel cladding has been defined as the 

limit below which fuel damage caused by overstraining of the fuel 

cladding is not expected to occur (Ref. 3). 

Fuel design evaluations have been performed and demonstrate that the 

[1%] fuel cladding plastic strain design limit is not exceeded during 

continuous operation with LHGRs up to the operating limit specified in 

the COLR. The analysis also includes allowances for short term transient 

operation above the operating limit to account for AOOs, plus an 

allowance for densification power spiking. 

The LHGR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
LHGR (Optional) 

B 3.2.3 

BWR/6 STS B 3.2.3-2 Rev. 3.0, 03/31/04 

BASES 

LCO The LHGR is a basic assumption in the fuel design analysis. The fuel has 

been designed to operate at rated core power with sufficient design 

margin to the LHGR calculated to cause a 1% fuel cladding plastic strain. 

The operating limit to accomplish this objective is specified in the COLR. 

APPLICABILITY The LHGR limits are derived from fuel design analysis that is limiting at 

high power level conditions. At core thermal power levels < 25% RTP, 

the reactor is operating with a substantial margin to the LHGR limits and, 

therefore, the Specification is only required when the reactor is operating 

at ≥ 25% RTP. 

ACTIONS A.1

If any LHGR exceeds its required limit, an assumption regarding an initial 

condition of the fuel design analysis is not met. Therefore, prompt action 

should be taken to restore the LHGR(s) to within its required limits such 

that the plant is operating within analyzed conditions. The 2 hour 

Completion Time is normally sufficient to restore the LHGR(s) to within its 

limits and is acceptable based on the low probability of a transient or 

Design Basis Accident occurring simultaneously with the LHGR out of 

specification. 

B.1

If the LHGR cannot be restored to within its required limits within the 

associated Completion Time, the plant must be brought to a MODE or 

other specified condition in which the LCO does not apply. To achieve 

this status, THERMAL POWER must be reduced to < 25% RTP within 

4 hours. The allowed Completion Time is reasonable, based on 

operating experience, to reduce THERMAL POWER to < 25% RTP in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.2.3.1

REQUIREMENTS 

The LHGR is required to be initially calculated within 12 hours after 

THERMAL POWER is ≥ 25% RTP and then every 24 hours thereafter. It 

is compared with the specified limits in the COLR to ensure that the 

reactor is operating within the assumptions of the safety analysis. The 

24 hour Frequency is based on both engineering judgment and 

recognition of the slowness of changes in power distribution under normal 

conditions. The 12 hour allowance after THERMAL POWER ≥ 25% RTP 

is achieved is acceptable given the large inherent margin to operating 

limits at lower power levels. 
LHGR (Optional) 

B 3.2.3 

BWR/6 STS B 3.2.3-3 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. [Non GE Fuel Analysis]. 

 2. FSAR, Chapter [4]. 

 3. NUREG-0800, Section II A.2(g), Revision 2, July 1981. 
APRM Gain and Setpoints 

B 3.2.4 

BWR/6 STS B 3.2.4-1 Rev. 3.0, 03/31/04 

B 3.2 POWER DISTRIBUTIONS LIMITS 

B 3.2.4 Average Power Range Monitor (APRM) Gain and Setpoints 

BASES 

BACKGROUND The OPERABILITY of the APRMs and their setpoints is an initial condition 

of all safety analyses that assure rod insertion upon reactor scram. 

Applicable GDCs are GDC 10, "Reactor Design," GDC 13, 

"Instrumentation and Control," GDC 20, "Protection System Functions," 

and GDC 29, "Protection against Anticipated Operation Occurrences" 

(Ref. 1). This LCO is provided to require the APRM gain or APRM flow 

biased scram setpoints to be adjusted when operating under conditions of 

excessive power peaking to maintain acceptable margin to the fuel 

cladding integrity Safety Limit (SL) and the fuel cladding 1% plastic strain 

limit. 

The condition of excessive power peaking is determined by the ratio of 

the actual power peaking to the limiting power peaking at RTP. This ratio 

is equal to the ratio of the core limiting MFLPD to the Fraction of RTP 

(FRTP) where FRTP is the measured THERMAL POWER divided by the 

RTP. Excessive power peaking exists when: 

 FRTP

MFLPD > 1, 

indicating that MFLPD is not decreasing proportionately to the overall 

power reduction, or conversely, that power peaking is increasing. To 

maintain margins similar to those at RTP conditions, the excessive power 

peaking is compensated by gain adjustment on the APRMs or adjustment 

of the APRM setpoints. Either of these adjustments has effectively the 

same result as maintaining MFLPD less than or equal to FRTP and thus 

maintains RTP margins for APLHGR and MCPR. 

The normally selected APRM setpoints position the scram above the 

upper bound of the normal power/flow operating region that has been 

considered in the design of the fuel rods. The setpoints are flow biased 

with a slope that approximates the upper flow control line, such that an 

approximately constant margin is maintained between the flow biased trip 

level and the upper operating boundary for core flows in excess of about 

45% of rated core flow. In the range of infrequent operations below 45% 

of rated core flow, the margin to scram or rod blocks is reduced because 

of the nonlinear core flow versus drive flow relationship. The normally 

selected APRM setpoints are supported by the analyses presented in 

References 1 and 2 that concentrate on events initiated from rated 

conditions. Design experience has shown that minimum deviations occur 

within expected margins to operating limits (APLHGR and MCPR), at 
APRM Gain and Setpoints 

B 3.2.4 

BWR/6 STS B 3.2.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

rated conditions for normal power distributions. However, at other than 

rated conditions, control rod patterns can be established that significantly 

reduce the margin to thermal limits. Therefore, the flow biased APRM 

scram setpoints may be reduced during operation when the combination 

of THERMAL POWER and MFLPD indicates an excessive power peaking 

distribution. 

The APRM neutron flux signal is also adjusted to more closely follow the 

fuel cladding heat flux during power transients. The APRM neutron flux 

signal is a measure of the core thermal power during steady state 

operation. During power transients, the APRM signal leads the actual 

core thermal power response because of the fuel thermal time constant. 

Therefore, on power increase transients, the APRM signal provides a 

conservatively high measure of core thermal power. By passing the 

APRM signal through an electronic filter with a time constant less than, 

but approximately equal to, that of the fuel thermal time constant, an 

APRM transient response that more closely follows actual fuel cladding 

heat flux is obtained, while a conservative margin is maintained. The 

delayed response of the filtered APRM signal allows the flow biased 

APRM scram levels to be positioned closer to the upper bound of the 

normal power and flow range, without unnecessarily causing reactor 

scrams during short duration neutron flux spikes. These spikes can be 

caused by insignificant transients such as performance of main steam line 

valve surveillances or momentary flow increases of only several percent. 

APPLICABLE The acceptance criteria for the APRM gain or setpoint adjustments are 

SAFETY that acceptable margins (to APLHGR and MCPR) be maintained to the 

ANALYSES fuel cladding integrity SL and the fuel cladding 1% plastic strain limit. 

FSAR safety analyses (Refs. 2 and 3) concentrate on the rated power 

condition for which the minimum expected margin to the operating limits 

(APLHGR and MCPR) occurs. LCO 3.2.1, "AVERAGE PLANAR LINEAR 

HEAT GENERATION RATE (APLHGR)," and LCO 3.2.2, "MINIMUM 

CRITICAL POWER RATIO (MCPR)," limit the initial margins to these 

operating limits at rated conditions so that specified acceptable fuel 

design limits are met during transients initiated from rated conditions. At 

initial power levels less than rated levels, the margin degradation of either 

the APLHGR or the MCPR during a transient can be greater than at the 

rated condition event. This greater margin degradation during the 

transient is primarily offset by the larger initial margin to limits at the lower 

than rated power levels. However, power distributions can be 
APRM Gain and Setpoints 

B 3.2.4 

BWR/6 STS B 3.2.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

hypothesized that would result in reduced margins to the pretransient 

operating limit. When combined with the increased severity of certain 

transients at other than rated conditions, the SLs could be approached. 

At substantially reduced power levels, highly peaked power distributions 

could be obtained that could reduce thermal margins to the minimum 

levels required for transient events. To prevent or mitigate such 

situations, either the APRM gain is adjusted upward by the ratio of the 

core limiting MFLPD to the FRTP, or the flow biased APRM scram level is 

required to be reduced by the ratio of FRTP to the core limiting MFLPD. 

Either of these adjustments effectively counters the increased severity of 

some events at other than rated conditions by proportionally increasing 

the APRM gain or proportionally lowering the flow biased APRM scram 

setpoints dependent on the increased peaking that may be encountered. 

The APRM gain and setpoints satisfy Criteria 2 and 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Meeting any one of the following conditions ensures acceptable operating 

margins for events described above: 

a. Limiting excess power peaking, 

b. Reducing the APRM flow biased neutron flux upscale scram 

setpoints by multiplying the APRM setpoints by the ratio of FRTP and 

the core limiting value of MFLPD, or 

c. Increasing the APRM gains to cause the APRM to read greater than 

100(%) times MFLPD. This Condition is to account for the reduction 

in margin to the fuel cladding integrity SL and the fuel cladding 1% 

plastic strain limit. 

MFLPD is the ratio of the limiting LHGR to the LHGR limit for the specific 

bundle type. As power is reduced, if the design power distribution is 

maintained, MFLPD is reduced in proportion to the reduction in power. 

However, if power peaking increases above the design value, the MFLPD 

is not reduced in proportion to the reduction in power. Under these 

conditions, the APRM gain is adjusted upward or the APRM flow biased 

scram setpoints are reduced accordingly. When the reactor is operating 

with peaking less than the design value, it is not necessary to modify the 

APRM flow biased scram setpoints. Adjusting the APRM gain or 

setpoints is equivalent to maintaining MFLPD less than or equal to FRTP, 

as stated in the LCO. 
APRM Gain and Setpoints 

B 3.2.4 

BWR/6 STS B 3.2.4-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

For compliance with LCO Item b (APRM setpoint adjustment) or Item c 

(APRM gain adjustment), only APRMs required to be OPERABLE per 

LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," are 

required to be adjusted. In addition, each APRM may be allowed to have 

its gain or setpoints adjusted independently of other APRMs that are 

having their gain or setpoints adjusted. 

APPLICABILITY The MFLPD limit, APRM gain adjustment, or APRM flow biased scram 

and associated setdowns are provided to ensure that the fuel cladding 

integrity SL and the fuel cladding 1% plastic strain limit are not violated 

during design basis transients. As discussed in the Bases for LCO 3.2.1 

and LCO 3.2.2 sufficient margin to these limits exists below 25% RTP 

and, therefore, these requirements are only necessary when the plant is 

operating at ≥ 25% RTP. 

ACTIONS A.1

If the APRM gain or setpoints are not within limits while the MFLPD has 

exceeded FRTP, the margin to the fuel cladding integrity SL and the fuel 

cladding 1% plastic strain limit may be reduced. Therefore, prompt action 

should be taken to restore the MFLPD to within its required limit or make 

acceptable APRM adjustments such that the plant is operating within the 

assumed margin of the safety analyses. 

The 6 hour Completion Time is normally sufficient to restore either the 

MFLPD to within limits or the APRM gain or setpoints to within limits and 

is acceptable based on the low probability of a transient or Design Basis 

Accident occurring simultaneously with the LCO not met. 

B.1

If the APRM gain or setpoints cannot be restored to within their required 

limits within the associated Completion Time, the plant must be brought to 

a MODE or other specified condition in which the LCO does not apply. 

To achieve this status, THERMAL POWER must be reduced to 

< 25% RTP within 4 hours. The allowed Completion Time is reasonable, 

based on operating experience, to reduce THERMAL POWER to 

< 25% RTP in an orderly manner and without challenging plant systems. 
APRM Gain and Setpoints 

B 3.2.4 

BWR/6 STS B 3.2.4-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.2.4.1 and SR 3.2.4.2

REQUIREMENTS 

The MFLPD is required to be calculated and compared to FRTP or APRM 

gain or setpoints to ensure that the reactor is operating within the 

assumptions of the safety analysis. These SRs are required only to 

determine the MFLPD and, assuming MFLPD is greater than FRTP, the 

appropriate gain or setpoint, and is not intended to be a CHANNEL 

FUNCTIONAL TEST for the APRM gain or flow biased neutron flux scram 

circuitry. The 24 hour Frequency of SR 3.2.4.1 is chosen to coincide with 

the determination of other thermal limits, specifically those for the 

APLHGR (LCO 3.2.1). The 24 hour Frequency is based on both 

engineering judgment and recognition of the slowness of changes in 

power distribution during normal operation. The 12 hour allowance after 

THERMAL POWER ≥ 25% RTP is achieved is acceptable given the large 

inherent margin to operating limits at low power levels. 

The 12 hour Frequency of SR 3.2.4.2 requires a more frequent 

verification than if MFLPD is less than or equal to fraction of rated power 

(FRP). When MFLPD is greater than FRP, more rapid changes in power 

distribution are typically expected. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10, GDC 13, GDC 20, and GDC 29. 

 2. FSAR, Section [ ]. 

 3. FSAR, Section [ ]. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.1.1 Reactor Protection System (RPS) Instrumentation 

BASES 

BACKGROUND The RPS initiates a reactor scram when one or more monitored 

parameters exceed their specified limit, to preserve the integrity of the 

fuel cladding and the Reactor Coolant System (RCS), and minimize the 

energy that must be absorbed following a loss of coolant accident 

(LOCA). This can be accomplished either automatically or manually. 

The protection and monitoring functions of the RPS have been designed 

to ensure safe operation of the reactor. This is achieved by specifying 

limiting safety system settings (LSSS) in terms of parameters directly 

monitored by the RPS, as well as LCOs on other reactor system 

parameters, and equipment performance. Technical Specifications are 

required by 10 CFR 50.36 to contain LSSS defined by the regulation as 

"...settings for automatic protective devices...so chosen that automatic 

protective action will correct the abnormal situation before a Safety Limit 

(SL) is exceeded." The Analytic Limit is the limit of the process variable 

at which a safety action is initiated, as established by the safety analysis, 

to ensure that a SL is not exceeded. Any automatic protection action that 

occurs on reaching the Analytic Limit therefore ensures that the SL is not 

exceeded. However, in practice, the actual settings for automatic 

protective devices must be chosen to be more conservative than the 

Analytic Limit to account for instrument loop uncertainties related to the 

setting at which the automatic protective action would actually occur. 

The trip setpoint is a predetermined setting for a protective device chosen 

to ensure automatic actuation prior to the process variable reaching the 

Analytic Limit and thus ensuring that the SL would not be exceeded. As 

such, the trip setpoint accounts for uncertainties in setting the device 

(e.g., calibration), uncertainties in how the device might actually perform 

(e.g., repeatability), changes in the point of action of the device over time 

(e.g., drift during surveillance intervals), and any other factors which may 

influence its actual performance (e.g., harsh accident environments). In 

this manner, the trip setpoint plays an important role in ensuring that SLs 

are not exceeded. As such, the trip setpoint meets the definition of an 

LSSS (Ref. 1) and could be used to meet the requirement that they be 

contained in the Technical Specifications. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Technical Specifications contain values related to the OPERABILITY of 

equipment required for safe operation of the facility. OPERABLE is 

defined in Technical Specifications as "...being capable of performing its 

safety function(s)." For automatic protective devices, the required safety 

function is to ensure that a SL is not exceeded and therefore the LSSS as 

defined by 10 CFR 50.36 is the same as the OPERABILITY limit for these 

devices. However, use of the trip setpoint to define OPERABILITY in 

Technical Specifications and its corresponding designation as the LSSS 

required by 10 CFR 50.36 would be an overly restrictive requirement if it 

were applied as an OPERABILITY limit for the "as found" value of a 

protective device setting during a Surveillance. This would result in 

Technical Specification compliance problems, as well as reports and 

corrective actions required by the rule which are not necessary to ensure 

safety. For example, an automatic protective device with a setting that 

has been found to be different from the trip setpoint due to some drift of 

the setting may still be OPERABLE since drift is to be expected. This 

expected drift would have been specifically accounted for in the setpoint 

methodology for calculating the trip setpoint and thus the automatic 

protective action would still have ensured that the SL would not be 

exceeded with the "as found" setting of the protective device. Therefore, 

the device would still be OPERABLE since it would have performed its 

safety function and the only corrective action required would be to reset 

the device to the trip setpoint to account for further drift during the next 

surveillance interval. 

Use of the trip setpoint to define "as found" OPERABILITY and its 

designation as the LSSS under the expected circumstances described 

above would result in actions required by both the rule and Technical 

Specifications that are clearly not warranted. However, there is also 

some point beyond which the device would have not been able to perform 

its function due, for example, to greater than expected drift. This value 

needs to be specified in the Technical Specifications in order to define 

OPERABILITY of the devices and is designated as the Allowable Value 

which, as stated above, is the same as the LSSS. 

The Allowable Valuable specified in Table 3.3.1-1 serves as the LSSS 

such that a channel is OPERABLE if the trip setpoint is found not to 

exceed the Allowable Value. As such, the Allowable Value differs from 

the trip setpoint by an amount primarily equal to the expected instrument 

loop uncertainties, such as drift, during the surveillance interval. In this 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

manner, the actual setting of the device will still meet the LSSS definition 

and ensure that a SL is not exceeded at any given point of time as long 

as the device has not drifted beyond that expected during the surveillance 

interval. If the actual setting of the device is found to have exceeded the 

Allowable Value the device would be considered inoperable from a 

Technical Specification perspective. This requires corrective action 

including those actions required by 10 CFR 50.36 when automatic 

protective devices do not function as required. Note that, although the 

channel is "OPERABLE" under these circumstances, the trip setpoint 

should be left adjusted to a value within the established trip setpoint 

calibration tolerance band, in accordance with uncertainty assumptions 

stated in the referenced setpoint methodology (as-left criteria), and 

confirmed to be operating within the statistical allowances of the 

uncertainty terms assigned. 

The RPS, as shown in the FSAR, Figure [ ] (Ref. 2), includes sensors, 

relays, bypass circuits, and switches that are necessary to cause initiation 

of a reactor scram. Functional diversity is provided by monitoring a wide 

range of dependent and independent parameters. The input parameters 

to the scram logic are from instrumentation that monitors reactor vessel 

water level, reactor vessel pressure, neutron flux main steam line 

isolation valve position, turbine control valve (TCV) fast closure trip oil 

pressure low, turbine stop valve (TSV) trip oil pressure low, drywell 

pressure and scram discharge volume (SDV) water level, as well as 

reactor mode switch in shutdown position and manual scram signals. 

There are at least four redundant sensor input signals from each of these 

parameters (with the exception of the reactor mode switch in shutdown 

scram signal). Most channels include electronic equipment (e.g., trip 

units) that compares measured input signals with pre-established 

setpoints. When a setpoint is exceeded, the channel output relay 

actuates, which then outputs an RPS trip signal to the trip logic. 

Table B 3.3.1.1-1 summarizes the diversity of sensors capable of initiating 

scrams during anticipated operating transients typically analyzed. 

The RPS is comprised of two independent trip systems (A and B), with 

two logic channels in each trip system (logic channels A1 and A2, B1 

and B2), as shown in Reference 2. The outputs of the logic channels in a 

trip system are combined in a one-out-of-two logic so either channel can 

trip the associated trip system. The tripping of both trip systems will 

produce a reactor scram. This logic arrangement is referred to as oneout-of-two taken twice logic. Each trip system can be reset by use of a 

reset switch. If a full scram occurs (both trip systems trip), a relay 

prevents reset of the trip systems for 10 seconds after the full scram 

signal is received. This 10 second delay on reset ensures that the scram 

function will be completed. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-4 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Two scram pilot valves are located in the hydraulic control unit (HCU) for 

each control rod drive (CRD). Each scram pilot valve is solenoid 

operated, with the solenoids normally energized. The scram pilot valves 

control the air supply to the scram inlet and outlet valves for the 

associated CRD. When either scram pilot valve solenoid is energized, air 

pressure holds the scram valves closed and, therefore, both scram pilot 

valve solenoids must be de-energized to cause a control rod to scram. 

The scram valves control the supply and discharge paths for the CRD 

water during a scram. One of the scram pilot valve solenoids for each 

CRD is controlled by trip system A, and the other solenoid is controlled by 

trip system B. Any trip of trip system A in conjunction with any trip in trip 

system B results in de-energizing both solenoids, air bleeding off, scram 

valves opening, and control rod scram. 

The backup scram valves, which energize on a scram signal to 

depressurize the scram air header, are also controlled by the RPS. 

Additionally, the RPS System controls the SDV vent and drain valves 

such that when both trip systems trip, the SDV vent and drain valves 

close to isolate the SDV. 

APPLICABLE The actions of the RPS are assumed in the safety analyses of 

SAFETY References 3, 4, and 5. The RPS initiates a reactor scram when 

ANALYSES, LCO, monitored parameter values exceed the Allowable Values specified by 

and APPLICABILITY the setpoint methodology and listed in Table 3.3.1.1-1 to preserve the 

integrity of the fuel cladding, the reactor coolant pressure boundary 

(RCPB), and the containment by minimizing the energy that must be 

absorbed following a LOCA. 

RPS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

Functions not specifically credited in the accident analysis are retained for 

the overall redundancy and diversity of the RPS as required by the NRC 

approved licensing basis. 

The OPERABILITY of the RPS is dependent on the OPERABILITY of the 

individual instrumentation channel Functions specified in Table 3.3.1.1-1. 

Each Function must have a required number of OPERABLE channels per 

RPS trip system, with their setpoints within the specified Allowable Value, 

where appropriate. The actual setpoint is calibrated consistent with 

applicable setpoint methodology assumptions. Each channel must also 

respond within its assumed response time. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Allowable Values are specified for each RPS Function specified in the 

Table. Nominal trip setpoints are specified in the setpoint calculations. 

The nominal setpoints are selected to ensure that the actual setpoints do 

not exceed the Allowable Value between successive CHANNEL 

CALIBRATIONS. Operation with a trip setpoint less conservative than 

the nominal trip setpoint, but within its Allowable Value, is acceptable. A 

channel is inoperable if its actual trip setpoint is not within its required 

Allowable Value. 

Trip setpoints are those predetermined values of output at which an 

action should take place. The setpoints are compared to the actual 

process parameter (e.g., reactor vessel water level), and when the 

measured output value of the process parameter exceeds the setpoint, 

the associated device (e.g., trip unit) changes state. The analytic limits 

are derived from the limiting values of the process parameters obtained 

from the safety analysis. The Allowable Values are derived from the 

analytic limits, corrected for calibration, process, and some of the 

instrument errors. The trip setpoints are then determined, accounting for 

the remaining instrument errors (e.g., drift). The trip setpoints derived in 

this manner provide adequate protection because instrumentation 

uncertainties, process effects, calibration tolerances, instrument drift, and 

severe environment errors (for channels that must function in harsh 

environments as defined by 10 CFR 50.49) are accounted for. 

The OPERABILITY of scram pilot valves and associated solenoids, 

backup scram valves, and SDV valves, described in the Background 

section, are not addressed by this LCO. 

The individual Functions are required to be OPERABLE in the MODES 

specified in the Table that may require an RPS trip to mitigate the 

consequences of a design basis accident or transient. To ensure a 

reliable scram function, a combination of Functions is required in each 

MODE to provide primary and diverse initiation signals. 

RPS is required to be OPERABLE in MODE 5 with any control rod 

withdrawn from a core cell containing one or more fuel assemblies. 

Control rods withdrawn from a core cell containing no fuel assemblies do 

not affect the reactivity of the core and therefore are not required to have 

the capability to scram. Provided all other control rods remain inserted, 

the RPS function is not required. In this condition, the required SDM 

(LCO 3.1.1) and refuel position one-rod-out interlock (LCO 3.9.2) ensure 

that no event requiring RPS will occur. During normal operation in 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-6 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

MODES 3 and 4, all control rods are fully inserted and the Reactor Mode 

Switch Shutdown Position control rod withdrawal block (LCO 3.3.2.1) 

does not allow any control rod to be withdrawn. Under these conditions, 

the RPS function is not required to be OPERABLE. 

The specific Applicable Safety Analyses, LCO, and Applicability 

discussions are listed below on a Function by Function basis. 

1.a. Intermediate Range Monitor (IRM) Neutron Flux - High

The IRMs monitor neutron flux levels from the upper range of the source 

range monitors (SRMs) to the lower range of the average power range 

monitors (APRMs). The IRMs are capable of generating trip signals that 

can be used to prevent fuel damage resulting from abnormal operating 

transients in the intermediate power range. In this power range, the most 

significant source of reactivity change is due to control rod withdrawal. 

The IRM provides diverse protection for the rod withdrawal limiter (RWL), 

which monitors and controls the movement of control rods at low power. 

The RWL prevents the withdrawal of an out of sequence control rod 

during startup that could result in an unacceptable neutron flux excursion 

(Ref. 6). The IRM provides mitigation of the neutron flux excursion. To 

demonstrate the capability of the IRM System to mitigate control rod 

withdrawal events, generic analyses have been performed (Ref. 7) to 

evaluate the consequences of control rod withdrawal events during 

startup that are mitigated only by the IRM. This analysis, which assumes 

that one IRM channel in each trip system is bypassed, demonstrates that 

the IRMs provide protection against local control rod withdrawal errors 

and results in peak fuel energy depositions below the 170 cal/gm fuel 

failure threshold criterion. 

The IRMs are also capable of limiting other reactivity excursions during 

startup, such as cold water injection events, although no credit is 

specifically assumed. 

The IRM System is divided into two groups of IRM channels, with four 

IRM channels inputting to each trip system. The analysis of Reference 7 

assumes that one channel in each trip system is bypassed. Therefore, 

six channels with three channels in each trip system are required for IRM 

OPERABILITY to ensure that no single instrument failure will preclude a 

scram from this Function on a valid signal. This trip is active in each of 

the 10 ranges of the IRM, which must be selected by the operator to 

maintain the neutron flux within the monitored level of an IRM range. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-7 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The analysis of Reference 7 has adequate conservation to permit an IRM 

Allowable Value of 120 divisions of a 125 division scale. 

The Intermediate Range Monitor Neutron Flux - High Function must be 

OPERABLE during MODE 2 when control rods may be withdrawn and the 

potential for criticality exists. In MODE 5, when a cell with fuel has its 

control rod withdrawn, the IRMs provide monitoring for and protection 

against unexpected reactivity excursions. In MODE 1, the APRM 

System, the RWL, and the Rod Pattern Controller (RPC) provide 

protection against control rod withdrawal error events and the IRMs are 

not required. 

1.b. Intermediate Range Monitor – Inop

This trip signal provides assurance that a minimum number of IRMs are 

OPERABLE. Anytime an IRM mode switch is moved to any position 

other than "Operate," the detector voltage drops below a preset level, or a 

module is not plugged in, an inoperative trip signal will be received by the 

RPS unless the IRM is bypassed. Since only one IRM in each trip system 

may be bypassed, only one IRM in each RPS trip system may be 

inoperable without resulting in an RPS trip signal. 

This Function was not specifically credited in the accident analysis, but it 

is retained for the overall redundancy and diversity of the RPS as 

required by the NRC approved licensing basis. 

Six channels of Intermediate Range Monitor - Inop with three channels in 

each trip system are required to be OPERABLE to ensure that no single 

instrument failure will preclude a scram from this Function on a valid 

signal. 

Since this Function is not assumed in the safety analysis, there is no 

Allowable Value for this Function. 

This Function is required to be OPERABLE when the Intermediate Range 

Monitor Neutron Flux - High Function is required. 

2.a. Average Power Range Monitor Neutron Flux - High, Setdown

The APRM channels receive input signals from the local power range 

monitors (LPRM) within the reactor core to provide an indication of the 

power distribution and local power changes. The APRM channels 

average these LPRM signals to provide a continuous indication of 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-8 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

average reactor power from a few percent to greater than RTP. For 

operation at low power (i.e., MODE 2), the Average Power Range Monitor 

Neutron Flux - High, Setdown Function is capable of generating a trip 

signal that prevents fuel damage resulting from abnormal operating 

transients in this power range. For most operation at low power levels, 

the Average Power Range Monitor Neutron Flux - High, Setdown 

Function will provide a secondary scram to the Intermediate Range 

Monitor Neutron Flux - High Function because of the relative setpoints. 

With the IRMs at Range 9 or 10, it is possible that the Average Power 

Range Monitor Neutron Flux - High, Setdown Function will provide the 

primary trip signal for a corewide increase in power. 

No specific safety analyses take direct credit for the Average Power 

Range Monitor Neutron Flux - High, Setdown Function. However, this 

Function indirectly ensures that, before the reactor mode switch is placed 

in the run position, reactor power does not exceed 25% RTP (SL 2.1.1.1) 

when operating at low reactor pressure and low core flow. Therefore, it 

indirectly prevents fuel damage during significant reactivity increases with 

THERMAL POWER < 25% RTP. 

The APRM System is divided into two groups of channels with three 

APRM channel inputs to each trip system. The system is designed to 

allow one channel in each trip system to be bypassed. Any one APRM 

channel in a trip system can cause the associated trip system to trip. Six 

channels of Average Power Range Monitor Neutron Flux - High, 

Setdown, with three channels in each trip system are required to be 

OPERABLE to ensure that no single failure will preclude a scram from 

this Function on a valid signal. In addition, to provide adequate coverage 

of the entire core, at least 11 LPRM inputs are required for each APRM 

channel, with at least two LPRM inputs from each of the four axial levels 

at which the LPRMs are located. 

The Allowable Value is based on preventing significant increases in 

power when THERMAL POWER is < 25% RTP. 

The Average Power Range Monitor Neutron Flux - High, Setdown 

Function must be OPERABLE during MODE 2 when control rods may be 

withdrawn, and in MODE 5 with any control rod withdrawn from a core 

cell containing one or more fuel assemblies, since the potential for 

criticality exists. In MODE 1, the Average Power Range Monitor Neutron 

Flux - High Function provides protection against reactivity transients and 

the RWL and RPC protect against control rod withdrawal error events. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-9 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

2.b. Average Power Range Monitor Flow Biased Simulated Thermal 

Power - High

The Average Power Range Monitor Flow Biased Simulated Thermal 

Power - High Function monitors neutron flux to approximate the 

THERMAL POWER being transferred to the reactor coolant. The APRM 

neutron flux is electronically filtered with a time constant representative of 

the fuel heat transfer dynamics to generate a signal proportional to the 

THERMAL POWER in the reactor. The trip level is varied as a function of 

recirculation drive flow (i.e., at lower core flows the setpoint is reduced 

proportional to the reduction in power experienced as core flow is 

reduced with a fixed control rod pattern) but is clamped at an upper limit 

that is always lower than the Average Power Range Monitor Fixed 

Neutron Flux - High Function Allowable Value. The Average Power 

Range Monitor Flow Biased Simulated Thermal Power - High Function 

provides protection against transients where THERMAL POWER 

increases slowly (such as the loss of feedwater heating event) and 

protects the fuel cladding integrity by ensuring that the MCPR SL is not 

exceeded. During these events, the THERMAL POWER increase does 

not significantly lag the neutron flux response and, because of a lower trip 

setpoint, will initiate a scram before the high neutron flux scram. For 

rapid neutron flux increase events, the THERMAL POWER lags the 

neutron flux and the Average Power Range Monitor Fixed Neutron Flux - 

High Function will provide a scram signal before the Average Power 

Range Monitor Flow Biased Simulated Thermal Power - High Function 

setpoint is exceeded. 

The APRM System is divided into two groups of channels with four APRM 

inputs to each trip system. The system is designed to allow one channel 

in each trip system to be bypassed. Any one Average Power Range 

Monitor channel in a trip system can cause the associated trip system to 

trip. Six channels of Average Power Range Monitor Flow Biased 

Simulated Thermal Power - High, with three channels in each trip system 

arranged in one-out-of-three logic, are required to be OPERABLE to 

ensure that no single instrument failure will preclude a scram from this 

Function on a valid signal. In addition, to provide adequate coverage of 

the entire core, at least 11 LPRM inputs are required for each APRM 

channel, with at least two LPRM inputs from each of the four axial levels 

at which the LPRMs are located. Each APRM channel receives one total 

drive flow signal representative of total core flow. The recirculation loop 

drive flow signals are generated by eight flow units. One flow unit from 

each recirculation loop is provided to each APRM channel. Total drive 

flow is determined by each APRM by summing up the flow signals 

provided to the APRM from the two recirculation loops. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-10 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The clamped Allowable Value is based on analyses that take credit for 

the Average Power Range Monitor Flow Biased Simulated Thermal 

Power - High Function for the mitigation of the loss of feedwater heater 

event. The THERMAL POWER time constant of < 7 seconds is based on 

the fuel heat transfer dynamics and provides a signal that is proportional 

to the THERMAL POWER. 

The Average Power Range Monitor Flow Biased Simulated Thermal 

Power - High Function is required to be OPERABLE in MODE 1 when 

there is the possibility of generating excessive THERMAL POWER and 

potentially exceeding the SL applicable to high pressure and core flow 

conditions (MCPR SL). During MODES 2 and 5, other IRM and APRM 

Functions provide protection for fuel cladding integrity. 

2.c. Average Power Range Monitor Fixed Neutron Flux - High

The APRM channels provide the primary indication of neutron flux within 

the core and respond almost instantaneously to neutron flux increases. 

The Average Power Range Monitor Fixed Neutron Flux - High Function is 

capable of generating a trip signal to prevent fuel damage or excessive 

RCS pressure. For the overpressurization protection analysis of 

Reference 3, the Average Power Range Monitor Fixed Neutron Flux - 

High Function is assumed to terminate the main steam isolation valve 

(MSIV) closure event and, along with the safety/relief valves (S/RVs), 

limits the peak reactor pressure vessel (RPV) pressure to less than the 

ASME Code limits. The control rod drop accident (CRDA) analysis 

(Ref. 8) takes credit for the Average Power Range Monitor Fixed Neutron 

Flux - High Function to terminate the CRDA. 

The APRM System is divided into two groups of channels with four APRM 

channels inputting to each trip system. The system is designed to allow 

one channel in each trip system to be bypassed. Any one APRM channel 

in a trip system can cause the associated trip system to trip. Six channels 

of Average Power Range Monitor Fixed Neutron Flux - High with three 

channels in each trip system arranged in a one-out-of-three logic are 

required to be OPERABLE to ensure that no single instrument failure will 

preclude a scram from this Function on a valid signal. In addition, to 

provide adequate coverage of the entire core, at least 11 LPRM inputs 

are required for each APRM channel, with at least two LPRM inputs from 

each of the four axial levels at which the LPRMs are located. 

The Allowable Value is based on the Analytical Limit assumed in the 

CRDA analyses. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-11 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Average Power Range Monitor Fixed Neutron Flux - High Function is 

required to be OPERABLE in MODE 1 where the potential consequences 

of the analyzed transients could result in the SLs (e.g., MCPR and RCS 

pressure) being exceeded. Although the Average Power Range Monitor 

Fixed Neutron Flux - High Function is assumed in the CRDA analysis that 

is applicable in MODE 2, the Average Power Range Monitor Neutron Flux 

- High, Setdown Function conservatively bounds the assumed trip and, 

together with the assumed IRM trips, provides adequate protection. 

Therefore, the Average Power Monitor Fixed Neutron Flux - High 

Function is not required in MODE 2. 

2.d. Average Power Range Monitor - Inop

This signal provides assurance that a minimum number of APRMs are 

OPERABLE. Anytime an APRM mode switch is moved to any position 

other than Operate, an APRM module is unplugged, the electronic 

operating voltage is low, or the APRM has too few LPRM inputs (< 11), an 

inoperative trip signal will be received by the RPS, unless the APRM is 

bypassed. Since only one APRM in each trip system may be bypassed, 

only one APRM in each trip system may be inoperable without resulting in 

an RPS trip signal. This Function was not specifically credited in the 

accident analysis, but it is retained for the overall redundancy and 

diversity of the RPS as required by the NRC approved licensing basis. 

Four channels of Average Power Range Monitor - Inop with two channels 

in each trip system are required to be OPERABLE to ensure that no 

single failure will preclude a scram from this Function on a valid signal. 

There is no Allowable Value for this Function. 

This Function is required to be OPERABLE in the MODES where the 

APRM Functions are required. 

3. Reactor Vessel Steam Dome Pressure - High

An increase in the RPV pressure during reactor operation compresses 

the steam voids and results in a positive reactivity insertion. This causes 

the neutron flux and THERMAL POWER transferred to the reactor 

coolant to increase, which could challenge the integrity of the fuel 

cladding and the RCPB. No specific safety analysis takes direct credit for 

this Function. However, the Reactor Vessel Steam Dome Pressure - 

High Function initiates a scram for transients that results in a pressure 

increase, counteracting the pressure increase by rapidly reducing core 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-12 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

power. For the overpressurization protection analysis of Reference 3, the 

reactor scram (the analyses conservatively assume scram on the 

Average Power Range Monitor Fixed Neutron Flux - High signal, not the 

Reactor Vessel Steam Dome Pressure-High signal), along with the 

S/RVs, limits the peak RPV pressure to less than the ASME Section III 

Code limits. 

High reactor pressure signals are initiated from four pressure transmitters 

that sense reactor pressure. The Reactor Vessel Steam Dome Pressure 

- High Allowable Value is chosen to provide a sufficient margin to the 

ASME Section III Code limits during the event. 

Four channels of Reactor Vessel Steam Dome Pressure - High Function, 

with two channels in each trip system arranged in a one-out-of-two logic, 

are required to be OPERABLE to ensure that no single instrument failure 

will preclude a scram from this Function on a valid signal. The Function is 

required to be OPERABLE in MODES 1 and 2 when the RCS is 

pressurized and the potential for pressure increase exists. 

4. Reactor Vessel Water Level - Low, Level 3

Low RPV water level indicates the capability to cool the fuel may be 

threatened. Should RPV water level decrease too far, fuel damage could 

result. Therefore, a reactor scram is initiated at Level 3 to substantially 

reduce the heat generated in the fuel from fission. The Reactor Vessel 

Water Level - Low, Level 3 Function is assumed in the analysis of the 

recirculation line break (Ref. 4). The reactor scram reduces the amount 

of energy required to be absorbed and, along with the actions of the 

Emergency Core Cooling Systems (ECCS), ensures that the fuel peak 

cladding temperature remains below the limits of 10 CFR 50.46. 

Reactor Vessel Water Level - Low, Level 3 signals are initiated from four 

level transmitters that sense the difference between the pressure due to a 

constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. 

Four channels of Reactor Vessel Water Level - Low, Level 3 Function, 

with two channels in each trip system arranged in a one-out-of-two logic, 

are required to be OPERABLE to ensure that no single instrument failure 

will preclude a scram from this Function on a valid signal. 

The Reactor Vessel Water Level - Low, Level 3 Allowable Value is 

selected to ensure that, for transients involving loss of all normal 

feedwater flow, initiation of the low pressure ECCS at RPV Water Level 1 

will not be required. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-13 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Function is required in MODES 1 and 2 where considerable energy 

exists in the RCS resulting in the limiting transients and accidents. ECCS 

initiations at Reactor Vessel Water Level - Low Low, Level 2 and Low 

Low Low, Level 1 provide sufficient protection for level transients in all 

other MODES. 

5. Reactor Vessel Water Level - High, Level 8

High RPV water level indicates a potential problem with the feedwater 

level control system, resulting in the addition of reactivity associated with 

the introduction of a significant amount of relatively cold feedwater. 

Therefore, a scram is initiated at Level 8 to ensure that MCPR is 

maintained above the MCPR SL. The Reactor Vessel Water Level - 

High, Level 8 Function is one of the many Functions assumed to be 

OPERABLE and capable of providing a reactor scram during transients 

analyzed in Reference 4. It is directly assumed in the analysis of 

feedwater controller failure, maximum demand (Ref. 5). 

Reactor Vessel Water Level - High, Level 8 signals are initiated from four 

level transmitters that sense the difference between the pressure due to a 

constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. The Reactor Vessel Water 

Level - High, Level 8 Allowable Value is specified to ensure that the 

MCPR SL is not violated during the assumed transient. 

Four channels of the Reactor Vessel Water Level - High, Level 8 

Function, with two channels in each trip system arranged in a one-out-oftwo logic, are available and are required to be OPERABLE when 

THERMAL POWER is ≥ 25% RTP to ensure that no single instrument 

failure will preclude a scram from this Function on a valid signal. With 

THERMAL POWER < 25% RTP, this Function is not required since 

MCPR is not a concern below 25% RTP. 

6. Main Steam Isolation Valve - Closure

MSIV closure results in loss of the main turbine and the condenser as a 

heat sink for the Nuclear Steam Supply System and indicates a need to 

shut down the reactor to reduce heat generation. Therefore, a reactor 

scram is initiated on a Main Steam Isolation Valve - Closure signal before 

the MSIVs are completely closed in anticipation of the complete loss of 

the normal heat sink and subsequent overpressurization transient. 

However, for the overpressurization protection analysis of Reference 3, 

the Average Power Range Monitor Fixed Neutron Flux - High Function, 

along with the S/RVs, limits the peak RPV pressure to less than the 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-14 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

ASME Code limits. That is, the direct scram on position switches for 

MSIV closure events is not assumed in the overpressurization analysis. 

Additionally, MSIV closure is assumed in the transients analyzed in 

Reference 5 (e.g., low steam line pressure, manual closure of MSIVs, 

high steam line flow). The reactor scram reduces the amount of energy 

required to be absorbed and, along with the actions of the ECCS, ensures 

that the fuel peak cladding temperature remains below the limits of 

10 CFR 50.46. 

MSIV closure signals are initiated from position switches located on each 

of the eight MSIVs. Each MSIV has two position switches; one inputs to 

RPS trip system A while the other inputs to RPS trip system B. Thus, 

each RPS trip system receives an input from eight Main Steam Isolation 

Valve - Closure channels, each consisting of one position switch. The 

logic for the Main Steam Isolation Valve - Closure Function is arranged 

such that either the inboard or outboard valve on three or more of the 

main steam lines (MSLs) must close in order for a scram to occur. 

The Main Steam Isolation Valve - Closure Allowable Value is specified to 

ensure that a scram occurs prior to a significant reduction in steam flow, 

thereby reducing the severity of the subsequent pressure transient. 

Sixteen channels of the Main Steam Isolation Valve - Closure Function 

with eight channels in each trip system are required to be OPERABLE to 

ensure that no single instrument failure will preclude the scram from this 

Function on a valid signal. This Function is only required in MODE 1 

since, with the MSIVs open and the heat generation rate high, a 

pressurization transient can occur if the MSIVs close. In MODE 2, the 

heat generation rate is low enough so that the other diverse RPS 

functions provide sufficient protection. 

7. Drywell Pressure - High

High pressure in the drywell could indicate a break in the RCPB. A 

reactor scram is initiated to minimize the possibility of fuel damage and to 

reduce the amount of energy being added to the coolant and the drywell. 

The Drywell Pressure - High Function is a secondary scram signal to 

Reactor Vessel Water Level - Low, Level 3 for LOCA events inside the 

drywell. This Function was not specifically credited in the accident 

analysis, but it is retained for the overall redundancy and diversity of the 

RPS as required by the NRC approved licensing basis. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-15 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

High drywell pressure signals are initiated from four pressure transmitters 

that sense drywell pressure. The Allowable Value was selected to be as 

low as possible and be indicative of a LOCA inside primary containment. 

Four channels of Drywell Pressure - High Function, with two channels in 

each trip system, are required to be OPERABLE to ensure that no single 

instrument failure will preclude a scram from this Function on a valid 

signal. The Function is required in MODES 1 and 2 where considerable 

energy exists in the RCS, resulting in the limiting transients and 

accidents. 

8.a, 8.b. Scram Discharge Volume Water Level – High

The SDV receives the water displaced by the motion of the CRD pistons 

during a reactor scram. Should this volume fill to a point where there is 

insufficient volume to accept the displaced water, control rod insertion 

would be hindered. Therefore, a reactor scram is initiated when the 

remaining free volume is still sufficient to accommodate the water from a 

full core scram. However, even though the two types of Scram Discharge 

Volume Water Level - High Functions are an input to the RPS logic, no 

credit is taken for a scram initiated from these Functions for any of the 

design basis accidents or transients analyzed in the FSAR. However, 

they are retained to ensure that the RPS remains OPERABLE. 

SDV water level is measured by two diverse methods. The level in each 

of the two SDVs is measured by two float type level switches and two 

transmitters and trip units for a total of eight level signals. The outputs of 

these devices are arranged so that there is a signal from a level switch 

and a transmitter and trip unit to each RPS logic channel. The level 

measurement instrumentation satisfies the recommendations of 

Reference 9. 

The Allowable Value is chosen low enough to ensure that there is 

sufficient volume in the SDV to accommodate the water from a full scram. 

Four channels of each type of Scram Discharge Volume Water Level - 

High Function, with two channels of each trip system, are required to be 

OPERABLE to ensure that no single instrument failure will preclude a 

scram from these Functions on a valid signal. These Functions are 

required in MODES 1 and 2, and in MODE 5 with any control rod 

withdrawn from a core cell containing one or more fuel assemblies, since 

these are the MODES and other specified conditions when control rods 

are withdrawn. At all other times, this Function may be bypassed. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-16 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

9. Turbine Stop Valve Closure, Trip Oil Pressure - Low

Closure of the TSVs results in the loss of a heat sink that produces 

reactor pressure, neutron flux, and heat flux transients that must be 

limited. Therefore, a reactor scram is initiated at the start of TSV closure 

in anticipation of the transients that would result from the closure of these 

valves. The Turbine Stop Valve Closure, Trip Oil Pressure - Low 

Function is the primary scram signal for the turbine trip event analyzed in 

Reference 5. For this event, the reactor scram reduces the amount of 

energy required to be absorbed and, along with the actions of the End of 

Cycle Recirculation Pump Trip (EOC-RPT) System, ensures that the 

MCPR SL is not exceeded. 

Turbine Stop Valve Closure, Trip Oil Pressure - Low signals are initiated 

by the electrohydraulic control (EHC) fluid pressure at each stop valve. 

Two independent pressure transmitters are associated with each stop 

valve. One of the two transmitters provides input to RPS trip system A; 

the other, to RPS trip system B. Thus, each RPS trip system receives an 

input from four Turbine Stop Valve Closure, Trip Oil Pressure - Low 

channels, each consisting of one pressure transmitter. The logic for the 

Turbine Stop Valve Closure, Trip Oil Pressure - Low Function is such that 

three or more TSVs must be closed to produce a scram. 

This Function must be enabled at THERMAL POWER ≥ 40% RTP. This 

is normally accomplished automatically by pressure transmitters sensing 

turbine first stage pressure; therefore, to consider this Function 

OPERABLE, the turbine bypass valves must remain shut at THERMAL 

POWER ≥ 40% RTP. The setpoint is feedwater temperature dependent 

as a result of the subcooling changes that affect the turbine first stage 

pressure/reactor power relationship. For RTP operation with feedwater 

temperature ≥ 420°F, an allowable setpoint of ≤ 26.9% of control valve 

wide open turbine first stage pressure is provided by the bypass function. 

The allowable setpoint is reduced to ≤ 22.5% of control valve wide open 

turbine first stage pressure for RTP operation with feedwater temperature 

> 370°F and < 420°F. 

The Turbine Stop Valve Closure, Trip Oil Pressure - Low Allowable Value 

is selected to be high enough to detect imminent TSV closure thereby 

reducing the severity of the subsequent pressure transient. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-17 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Eight channels of Turbine Stop Valve Closure, Trip Oil Pressure - Low 

Function, with four channels in each trip system, are required to be 

OPERABLE to ensure that no single instrument failure will preclude a 

scram from this Function even if one TSV should fail to close. This 

Function is required, consistent with analysis assumptions, whenever 

THERMAL POWER is ≥ 40% RTP. This Function is not required when 

THERMAL POWER is < 40% RTP since the Reactor Vessel Steam Dome 

Pressure - High and the Average Power Range Monitor Fixed Neutron 

Flux - High Functions are adequate to maintain the necessary safety 

margins. 

10. Turbine Control Valve Fast Closure, Trip Oil Pressure - Low

Fast closure of the TCVs results in the loss of a heat sink that produces 

reactor pressure, neutron flux, and heat flux transients that must be 

limited. Therefore, a reactor scram is initiated on TCV fast closure in 

anticipation of the transients that would result from the closure of these 

valves. The Turbine Control Valve Fast Closure, Trip Oil Pressure - Low 

Function is the primary scram signal for the generator load rejection event 

analyzed in Reference 5. For this event, the reactor scram reduces the 

amount of energy required to be absorbed and, along with the actions of 

the EOC-RPT System, ensures that the MCPR SL is not exceeded. 

Turbine Control Valve Fast Closure, Trip Oil Pressure - Low signals are 

initiated by the EHC fluid pressure at each control valve. There is one 

pressure transmitter associated with each control valve, the signal from 

each transmitter being assigned to a separate RPS logic channel. This 

Function must be enabled at THERMAL POWER ≥ 40% RTP. This is 

normally accomplished automatically by pressure transmitters sensing 

turbine first stage pressure; therefore, to consider this Function 

OPERABLE, the turbine bypass valves must remain shut at THERMAL 

POWER ≥ 40% RTP. The basis for the setpoint of this automatic bypass 

is identical to that described for the Turbine Stop Valve Closure, Trip Oil 

Pressure - Low Function. 

The Turbine Control Valve Fast Closure, Trip Oil Pressure - Low 

Allowable Value is selected high enough to detect imminent TCV fast 

closure. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-18 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Four channels of Turbine Control Valve Fast Closure, Trip Oil Pressure - 

Low Function, with two channels in each trip system arranged in a oneout-of-two logic, are required to be OPERABLE to ensure that no single 

instrument failure will preclude a scram from this Function on a valid 

signal. This Function is required, consistent with the analysis 

assumptions, whenever THERMAL POWER is ≥ 40% RTP. This 

Function is not required when THERMAL POWER is < 40% RTP since 

the Reactor Vessel Steam Dome Pressure - High and the Average Power 

Range Monitor Fixed Neutron Flux - High Functions are adequate to 

maintain the necessary safety margins. 

11. Reactor Mode Switch - Shutdown Position

The Reactor Mode Switch - Shutdown Position Function provides signals, 

via the manual scram logic channels, that are redundant to the automatic 

protective instrumentation channels and provide manual reactor trip 

capability. This Function was not specifically credited in the accident 

analysis, but it is retained for the overall redundancy and diversity of the 

RPS as required by the NRC approved licensing basis. 

The reactor mode switch is a single switch with four channels, each of 

which inputs into one of the RPS logic channels. 

There is no Allowable Value for this Function since the channels are 

mechanically actuated based solely on reactor mode switch position. 

Four channels of Reactor Mode Switch - Shutdown Position Function, 

with two channels in each trip system, are available and required to be 

OPERABLE. The Reactor Mode - Switch Shutdown Position Function is 

required to be OPERABLE in MODES 1 and 2, and in MODE 5 with any 

control rod withdrawn from a core cell containing one or more fuel 

assemblies, since these are the MODES and other specified conditions 

when control rods are withdrawn. 

12. Manual Scram

The Manual Scram push button channels provide signals, via the manual 

scram logic channels, to each of the four RPS logic channels that are 

redundant to the automatic protective instrumentation channels and 

provide manual reactor trip capability. This Function was not specifically 

credited in the accident analysis, but it is retained for the overall 

redundancy and diversity of the RPS as required by the NRC approved 

licensing basis. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-19 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

There is one Manual Scram push button channel for each of the four RPS 

logic channels. In order to cause a scram it is necessary that at least one 

channel in each trip system be actuated. 

There is no Allowable Value for this Function since the channels are 

mechanically actuated based solely on the position of the push buttons. 

Four channels of Manual Scram with two channels in each trip system 

arranged in a one-out-of-two logic, are available and required to be 

OPERABLE in MODES 1 and 2, and in MODE 5 with any control rod 

withdrawn from a core cell containing one or more fuel assemblies, since 

these are the MODES and other specified conditions when control rods 

are withdrawn. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

A Note has been provided to modify the ACTIONS related to RPS 

instrumentation channels. Section 1.3, Completion Times, specifies that 

once a Condition has been entered, subsequent divisions, subsystems, 

components, or variables expressed in the Condition, discovered to be 

inoperable or not within limits, will not result in separate entry into the 

Condition. Section 1.3 also specifies that Required Actions of the 

Condition continue to apply for each additional failure, with Completion 

Times based on initial entry into the Condition. However, the Required 

Actions for inoperable RPS instrumentation channels provide appropriate 

compensatory measures for separate, inoperable channels. As such, a 

Note has been provided that allows separate Condition entry for each 

inoperable RPS instrumentation channel. 

A.1 and A.2

Because of the diversity of sensors available to provide trip signals and 

the redundancy of the RPS design, an allowable out of service time of 

12 hours has been shown to be acceptable (Ref. 10) to permit restoration 

of any inoperable channel to OPERABLE status. However, this out of 

service time is only acceptable provided the associated Function's 

inoperable channel is in one trip system and the Function still maintains 

RPS trip capability (refer to Required Actions B.1, B.2, and C.1 Bases). If 

the inoperable channel cannot be restored to OPERABLE status within 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-20 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

the allowable out of service time, the channel or the associated trip 

system must be placed in the tripped condition per Required Actions A.1 

and A.2. Placing the inoperable channel in trip (or the associated trip 

system in trip) would conservatively compensate for the inoperability, 

restore capability to accommodate a single failure, and allow operation to 

continue. Alternately, if it is not desired to place the channel (or trip 

system) in trip (e.g., as in the case where placing the inoperable channel 

in trip would result in a full scram), Condition D must be entered and its 

Required Action taken. 

B.1 and B.2

Condition B exists when, for any one or more Functions, at least one 

required channel is inoperable in each trip system. In this condition, 

provided at least one channel per trip system is OPERABLE, the RPS still 

maintains trip capability for that Function, but cannot accommodate a 

single failure in either trip system. 

Required Actions B.1 and B.2 limit the time the RPS scram logic for any 

Function would not accommodate single failure in both trip systems (e.g., 

one-out-of-one and one-out-of-one arrangement for a typical four channel 

Function). The reduced reliability of this logic arrangement was not 

evaluated in Reference 10 for the 12 hour Completion Time. Within the 

6 hour allowance, the associated Function will have all required channels 

either OPERABLE or in trip (or in any combination) in one trip system. 

Completing one of these Required Actions restores RPS to an equivalent 

reliability level as that evaluated in Reference 10, which justified a 

12 hour allowable out of service time as presented in Condition A. The 

trip system in the more degraded state should be placed in trip or, 

alternatively, all the inoperable channels in that trip system should be 

placed in trip (e.g., a trip system with two inoperable channels could be in 

a more degraded state than a trip system with four inoperable channels, if 

the two inoperable channels are in the same Function while the four 

inoperable channels are all in different Functions). The decision as to 

which trip system is in the more degraded state should be based on 

prudent judgment and current plant conditions (i.e., what MODE the plant 

is in). If this action would result in a scram or recirculation pump trip, it is 

permissible to place the other trip system or its inoperable channels in 

trip. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-21 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The 6 hour Completion Time is judged acceptable based on the 

remaining capability to trip, the diversity of the sensors available to 

provide the trip signals, the low probability of extensive numbers of 

inoperabilities affecting all diverse Functions, and the low probability of an 

event requiring the initiation of a scram. 

Alternately, if it is not desired to place the inoperable channels (or one trip 

system) in trip (e.g., as in the case where placing the inoperable channel 

or associated trip system in trip would result in a scram [or RPT]), 

Condition D must be entered and its Required Action taken. 

C.1

Required Action C.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within the same trip 

system for the same Function result in the Function not maintaining RPS 

trip capability. A Function is considered to be maintaining RPS trip 

capability when sufficient channels are OPERABLE or in trip (or the 

associated trip system is in trip), such that both trip systems will generate 

a trip signal from the given Function on a valid signal. For the typical 

Function with one-out-of-two taken twice logic and the IRM and APRM 

Functions, this would require both trip systems to have one channel 

OPERABLE or in trip (or the associated trip system in trip). For 

Function 6 (Main Steam Isolation Valve - Closure), this would require both 

trip systems to have each channel associated with the MSIVs in three 

MSLs (not necessarily the same MSLs for both trip systems), OPERABLE 

or in trip (or the associated trip system in trip). 

For Function 9 (Turbine Stop Valve Closure, Trip Oil Pressure - Low), this 

would require both trip systems to have three channels, each OPERABLE 

or in trip (or the associated trip system in trip). 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. The 1 hour Completion Time is 

acceptable because it minimizes risk while allowing time for restoration or 

tripping of channels. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-22 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1

Required Action D.1 directs entry into the appropriate Condition 

referenced in Table 3.3.1.1-1. The applicable Condition specified in the 

Table is Function and MODE or other specified condition dependent and 

may change as the Required Action of a previous Condition is completed. 

Each time an inoperable channel has not met any Required Action of 

Condition A, B, or C, and the associated Completion Time has expired, 

Condition D will be entered for that channel and provides for transfer to 

the appropriate subsequent Condition. 

E.1, F.1, G.1, and H.1

If the channel(s) is not restored to OPERABLE status or placed in trip (or 

the associated trip system placed in trip) within the allowed Completion 

Time, the plant must be placed in a MODE or other specified condition in 

which the LCO does not apply. The Completion Times are reasonable, 

based on operating experience, to reach the specified condition from full 

power conditions in an orderly manner and without challenging plant 

systems. In addition, the Completion Time of Required Action E.1 is 

consistent with the Completion Time provided in LCO 3.2.2, "MINIMUM 

CRITICAL POWER RATIO (MCPR)." 

I.1

If the channel(s) is not restored to OPERABLE status or placed in trip (or 

the associated trip system placed in trip) within the allowed Completion 

Time, the plant must be placed in a MODE or other specified condition in 

which the LCO does not apply. This is done by immediately initiating 

action to fully insert all insertable control rods in core cells containing one 

or more fuel assemblies. Control rods in core cells containing no fuel 

assemblies do not affect the reactivity of the core and are, therefore, not 

required to be inserted. Action must continue until all insertable control 

rods in core cells containing one or more fuel assemblies are fully 

inserted. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-23 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

As noted at the beginning of the SRs, the SRs for each RPS 

instrumentation Function are located in the SRs column of 

Table 3.3.1.1-1. 

The Surveillances are modified by a Note to indicate that, when a channel 

is placed in an inoperable status solely for performance of required 

Surveillances, entry into associated Conditions and Required Actions may 

be delayed for up to 6 hours, provided the associated Function maintains 

trip capability. Upon completion of the Surveillance, or expiration of the 

6 hour allowance, the channel must be returned to OPERABLE status or 

the applicable Condition entered and Required Actions taken. This Note 

is based on the RPS reliability analysis (Ref. 10) assumption of the 

average time required to perform channel surveillance. That analysis 

demonstrated that the 6 hour testing allowance does not significantly 

reduce the probability that the RPS will trip when necessary. 

SR 3.3.1.1.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift 

on one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. 

Agreement criteria are determined by the plant staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The agreement criteria includes an expectation of one decade of overlap 

when transitioning between neutron flux instrumentation. The overlap 

between SRMs and IRMs must be demonstrated prior to withdrawing 

SRMs from the fully inserted position since indication is being transitioned 

from the SRMs to the IRMs. This will ensure that reactor power will not 

be increased into a neutron flux region without adequate indication. The 

overlap between IRMs and APRMs is of concern when reducing power 

into the IRM range (entry into MODE 2 from MODE 1). On power 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-24 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

increases, the system design will prevent further increases (by initiating a 

rod block) if adequate overlap is not maintained. Overlap between IRMs 

and APRMs exists when sufficient IRMs and APRMs concurrently have 

onscale readings such that the transition between MODE 1 and MODE 2 

can be made without either APRM downscale rod block or IRM upscale 

rod block. Overlap between SRMs and IRMs similarly exists when, prior 

to withdrawing the SRMs from the fully inserted position, IRMs are above 

mid-scale on Range 1 before SRMs have reached the upscale rod block. 

If overlap for a group of channels is not demonstrated (e.g., IRM/APRM 

overlap), the reason for the failure of the Surveillance should be 

determined and the appropriate channels(s) declared inoperable. Only 

those appropriate channels that are required in the current MODE or 

condition should be declared inoperable. 

The Frequency is based upon operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channels during normal operational use of 

the displays associated with the channels required by the LCO. 

SR 3.3.1.1.2

To ensure that the APRMs are accurately indicating the true core average 

power, the APRMs are calibrated to the reactor power calculated from a 

heat balance. LCO 3.2.4, "Average Power Range Monitor (APRM) Gain 

and Setpoints," allows the APRMs to be reading greater than actual 

THERMAL POWER to compensate for localized power peaking. When 

this adjustment is made, the requirement for the APRMs to indicate within 

2% RTP of calculated power is modified to require the APRMs to indicate 

within 2% RTP of calculated MFLPD. The Frequency of once per 7 days 

is based on minor changes in LPRM sensitivity, which could affect the 

APRM reading between performances of SR 3.3.1.1.6. 

A restriction to satisfying this SR when < 25% RTP is provided that 

requires the SR to be met only at ≥ 25% RTP because it is difficult to 

accurately maintain APRM indication of core THERMAL POWER 

consistent with a heat balance when < 25% RTP. At low power levels, a 

high degree of accuracy is unnecessary because of the large inherent 

margin to thermal limits (MCPR and APLHGR). At ≥ 25% RTP, the 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-25 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Surveillance is required to have been satisfactorily performed within the 

last 7 days in accordance with SR 3.0.2. A Note is provided which allows 

an increase in THERMAL POWER above 25% if the 7 day Frequency is 

not met per SR 3.0.2. In this event, the SR must be performed within 

12 hours after reaching or exceeding 25% RTP. Twelve hours is based 

on operating experience and in consideration of providing a reasonable 

time in which to complete the SR. 

SR 3.3.1.1.3

The Average Power Range Monitor Flow Biased Simulated Thermal 

Power - High Function uses the recirculation loop drive flows to vary the 

trip setpoint. This SR ensures that the total loop drive flow signals from 

the flow unit used to vary the setpoint are appropriately compared to a 

calibrated flow signal and therefore the APRM Function accurately 

reflects the required setpoint as a function of flow. Each flow signal from 

the respective flow unit must be ≤ 105% of the calibrated flow signal. If 

the flow unit signal is not within the limit, the APRMs that receive an input 

from the inoperable flow unit must be declared inoperable. 

The Frequency of 7 days is based on engineering judgment, operating 

experience, and the reliability of this instrumentation. 

SR 3.3.1.1.4

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-26 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

As noted, SR 3.3.1.1.4 is not required to be performed when entering 

MODE 2 from MODE 1 since testing of the MODE 2 required IRM and 

APRM Functions cannot be performed in MODE 1 without utilizing 

jumpers, lifted leads, or movable links. This allows entry into MODE 2 if 

the 7 day Frequency is not met per SR 3.0.2. In this event, the SR must 

be performed within 12 hours after entering MODE 2 from MODE 1. 

Twelve hours is based on operating experience and in consideration of 

providing a reasonable time in which to complete the SR. 

A Frequency of 7 days provides an acceptable level of system average 

unavailability over the Frequency interval and is based on reliability 

analysis (Ref. 10). 

SR 3.3.1.1.5

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended Function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. In accordance with Reference 10, the scram 

contacts must be tested as part of the Manual Scram Function. A 

Frequency of 7 days provides an acceptable level of system average 

availability over the Frequency and is based on the reliability analysis of 

Reference 10. (The Manual Scram Function's CHANNEL FUNCTIONAL 

TEST Frequency was credited in the analysis to extend many automatic 

scram Functions' Frequencies.) 

SR 3.3.1.1.6

LPRM gain settings are determined from the local flux profiles measured 

by the Traversing Incore Probe (TIP) System. This establishes the 

relative local flux profile for appropriate representative input to the APRM 

System. The 1000 MWD/T Frequency is based on operating experience 

with LPRM sensitivity changes. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-27 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.1.1.7 and SR 3.3.1.1.10

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. Any setpoint adjustment shall be consistent with 

the assumptions of the current plant specific setpoint methodology. The 

92 day Frequency of SR 3.3.1.1.7 is based on the reliability analysis of 

Reference 10. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

SR 3.3.1.1.8

The calibration of trip units provides a check of the actual trip setpoints. 

The channel must be declared inoperable if the trip setting is discovered 

to be less conservative than the Allowable Value specified in 

Table 3.3.1.1-1. If the trip setting is discovered to be less conservative 

than accounted for in the appropriate setpoint methodology, but is not 

beyond the Allowable Value, the channel performance is still within the 

requirements of the plant safety analysis. Under these conditions, the 

setpoint must be readjusted to be equal to or more conservative than 

accounted for in the appropriate setpoint methodology. 

The Frequency of 92 days for SR 3.3.1.1.8 is based on the reliability 

analysis of Reference 10. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-28 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.1.1.9 and SR 3.3.1.1.11

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 

Note 1 states that neutron detectors are excluded from CHANNEL 

CALIBRATION because of the difficulty of simulating a meaningful signal. 

Changes in neutron detector sensitivity are compensated for by 

performing the 7 day calorimetric calibration (SR 3.3.1.1.2) and the 

1000 MWD/T LPRM calibration against the TIPs (SR 3.3.1.1.6). A 

second Note is provided that requires the APRM and IRM SRs to be 

performed within 12 hours of entering MODE 2 from MODE 1. Testing of 

the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 

without utilizing jumpers, lifted leads, or movable links. This Note allows 

entry into MODE 2 from MODE 1 if the associated Frequency is not met 

per SR 3.0.2. Twelve hours is based on operating experience and in 

consideration of providing a reasonable time in which to complete the SR. 

The Frequency of SR 3.3.1.1.9 is based upon the assumption of a 

184 day calibration interval in the determination of the magnitude of 

equipment drift in the setpoint analysis. The Frequency of SR 3.3.1.1.11 

is based on the assumption of an 18 month calibration interval in the 

determination of the magnitude of equipment drift in the setpoint analysis. 

SR 3.3.1.1.12

The Average Power Range Monitor Flow Biased Simulated Thermal 

Power - High Function uses an electronic filter circuit to generate a signal 

proportional to the core THERMAL POWER from the APRM neutron flux 

signal. This filter circuit is representative of the fuel heat transfer 

dynamics that produce the relationship between the neutron flux and the 

core THERMAL POWER. The filter time constant must be verified to 

ensure that the channel is accurately reflecting the desired parameter. 

The Frequency of 18 months is based on engineering judgment and 

reliability of the components. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-29 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.1.1.13

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required trip logic for a specific channel. The 

functional testing of control rods, in LCO 3.1.3, "Control Rod 

OPERABILITY," and SDV vent and drain valves, in LCO 3.1.8, "Scram 

Discharge Volume (SDV) Vent and Drain Valves," overlaps this 

Surveillance to provide complete testing of the assumed safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

SR 3.3.1.1.14

This SR ensures that scrams initiated from the Turbine Stop Valve 

Closure, Trip Oil Pressure - Low and Turbine Control Valve Fast Closure, 

Trip Oil Pressure - Low Functions will not be inadvertently bypassed 

when THERMAL POWER is ≥ 40% RTP. This involves calibration of the 

bypass channels. Adequate margins for the instrument setpoint 

methodology are incorporated into the actual setpoint. Because main 

turbine bypass flow can affect this setpoint nonconservatively (THERMAL 

POWER is derived from turbine first stage pressure), the main turbine 

bypass valves must remain closed at THERMAL POWER ≥ 40% RTP to 

ensure that the calibration remains valid. 

If any bypass channel setpoint is nonconservative (i.e., the Functions are 

bypassed at ≥ 40% RTP, either due to open main turbine bypass valve(s) 

or other reasons), then the affected Turbine Stop Valve, Trip Oil Pressure 

- Low and Turbine Control Valve Fast Closure, Trip Oil Pressure - Low 

Functions are considered inoperable. Alternatively, the bypass channel 

can be placed in the conservative condition (nonbypass). If placed in the 

nonbypass condition, this SR is met and the channel is considered 

OPERABLE. 

The Frequency of 18 months is based on engineering judgment and 

reliability of the components. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-30 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.1.1.15

This SR ensures that the individual channel response times are less than 

or equal to the maximum values assumed in the accident analysis. The 

RPS RESPONSE TIME acceptance criteria are included in Reference 11. 

RPS RESPONSE TIME may be verified by actual response time 

measurements in any series of sequential, overlapping, or total channel 

measurements. 

[-----------------------------------REVIEWER’S NOTE---------------------------------- 

The following Bases are applicable for plants adopting NEDO-32291-A 

and/or Supplement 1. 

-------------------------------------------------------------------------------------------------- 

However, the sensors for Functions 3, 4, and 5 are allowed to be 

excluded from specific RPS RESPONSE TIME measurement if the 

conditions of Reference 12 are satisfied. If these conditions are satisfied, 

sensor response time may be allocated based on either assumed design 

sensor response time or the manufacturer's stated design response time. 

When the requirements of Reference 12 are not satisfied, sensor 

response time must be measured. Furthermore, measurement of the 

instrument loops response times for Functions 3, 4, and 5 is not required 

if the conditions of Reference 13 are satisfied.]

As noted, neutron detectors are excluded from RPS RESPONSE TIME 

testing because the principles of detector operation virtually ensure an 

instantaneous response time. 

RPS RESPONSE TIME tests are conducted on an 18 month 

STAGGERED TEST BASIS. Note 2 requires STAGGERED TEST BASIS 

Frequency to be determined based on 4 channels per trip system, in lieu 

of the 8 channels specified in Table 3.3.1.1-1 for the MSIV Closure 

Function. This Frequency is based on the logic interrelationships of the 

various channels required to produce an RPS scram signal. Therefore, 

staggered testing results in response time verification of these devices 

every 18 months. The 18 month Frequency is consistent with the typical 

industry refueling cycle and is based upon plant operating experience, 

which shows that random failures of instrumentation components causing 

serious time degradation, but not channel failure, are infrequent. 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-31 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety-Related 

Instrumentation." 

 2. FSAR, Figure [ ]. 

 3. FSAR, Section [5.2.2]. 

 4. FSAR, Section [6.3.3]. 

 5. FSAR, Chapter [15]. 

 6. FSAR, Section [15.4.1]. 

 7. NEDO-23842, "Continuous Control Rod Withdrawal in the Startup 

Range," April 18, 1978. 

 8. FSAR, Section [15.4.9]. 

 9. Letter, P. Check (NRC) to G. Lainas (NRC), "BWR Scram Discharge 

System Safety Evaluation," December 1, 1980. 

 10. NEDO-30851-P-A, "Technical Specification Improvement Analyses 

for BWR Reactor Protection System," March 1988. 

 11. FSAR, Table [ ]. 

 [12. NEDO-32291-A, "System Analyses For the Elimination of Selected 

Response Time Testing Requirements," October 1995. 

 13. NEDO-32291-A, Supplement 1, "System Analyses for The 

Elimination of Selected Response Time Testing Requirements," 

October 1999.] 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-32 Rev. 3.0, 03/31/04 

Table B 3.3.1.1-1 (page 1 of 1) 

RPS Instrumentation Sensor Diversity 

Scram Sensors for Initiating Events 

RPV Variables Anticipatory Fuel 

Initiation Events (a) (b) (c) (d) (e) (f) (g) 

MSIV Closure x 

 

x 

 

x x 

Turbine Trip (w/bypass) x x x x 

Generator Trip (w/bypass) x x x 

Pressure Regulator Failure 

(primary pressure decrease) 

(MSIV closure trip) 

x x x x x 

Pressure Regulator Failure 

(primary pressure decrease) 

(Level 8 trip) 

x x x 

Pressure Regulator Failure 

(primary pressure increase) 

x x 

Feedwater Controller Failure 

(high reactor water level) 

x x x x 

Feedwater Controller Failure 

(low reactor water level) 

x x x 

Loss of Condenser Vacuum x x x x 

Loss of AC Power (loss of 

transformer) 

x x x x 

Loss of AC Power (loss of 

grid connections) 

x x x x x x 

(a) Reactor Vessel Steam Dome Pressure - High 

(b) Reactor Vessel Water Level - High, Level 8 

(c) Reactor Vessel Water Level - Low, Level 3 

(d) Turbine Control Valve Fast Closure 

(e) Turbine Stop Valve - Closure 

(f) Main Steam Isolation Valve - Closure 

(g) Average Power Range Monitor Neutron Flux - High 
RPS Instrumentation 

B 3.3.1.1 

BWR/6 STS B 3.3.1.1-33 Rev. 3.0, 03/31/04 

---------------------------------------------REVIEWER’S NOTE-------------------------------------------- 

This Table for illustration purposes only. 

--------------------------------------------------------------------------------------------------------------------- 
SRM Instrumentation 

B 3.3.1.2 

BWR/6 STS B 3.3.1.2-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.1.2 Source Range Monitor (SRM) Instrumentation 

BASES 

BACKGROUND The SRMs provide the operator with information relative to the neutron 

level at very low flux levels in the core. As such, the SRM indication is 

used by the operator to monitor the approach to criticality and to 

determine when criticality is achieved. The SRMs are maintained fully 

inserted until the count rate is greater than a minimum allowed count rate 

(a control rod block is set at this condition). After SRM to intermediate 

range monitor (IRM) overlap is demonstrated (as required by 

SR 3.3.1.1.1), the SRMs are normally fully withdrawn from the core. 

The SRM subsystem of the Neutron Monitoring System (NMS) consists of 

five channels. Each of the SRM channels can be bypassed, but only one 

at any given time, by the operation of a bypass switch. Each channel 

includes one detector that can be physically positioned in the core. Each 

detector assembly consists of a miniature fission chamber with 

associated cabling, signal conditioning equipment, and electronics 

associated with the various SRM functions. The signal conditioning 

equipment converts the current pulses from the fission chamber to analog 

DC currents that correspond to the count rate. Each channel also 

includes indication, alarm, and control rod blocks. However, this LCO 

specifies OPERABILITY requirements only for the monitoring and 

indication functions of the SRMs. 

During refueling, shutdown, and low power operations, the primary 

indication of neutron flux levels is provided by the SRMs or special 

movable detectors connected to the normal SRM circuits. The SRMs 

provide monitoring of reactivity changes during fuel or control rod 

movement and give the control room operator early indication of 

unexpected subcritical multiplication that could be indicative of an 

approach to criticality. 

APPLICABLE Prevention and mitigation of prompt reactivity excursions during refueling 

SAFETY and low power operation are provided by: 

ANALYSES 

LCO 3.9.1, "Refueling Equipment Interlocks," 

LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," 

LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," 

Intermediate Range Monitor (IRM) Neutron Flux High and 

Average Power Range Monitor (APRM) Neutron Flux - 

High, Setdown Functions, and 

LCO 3.3.2.1, "Control Rod Block Instrumentation." 
SRM Instrumentation 

B 3.3.1.2 

BWR/6 STS B 3.3.1.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The SRMs have no safety function and are not assumed to function 

during any design basis accident or transient analysis. However, the 

SRMs provide the only on scale monitoring of neutron flux levels during 

startup and refueling. Therefore, they are being retained in the Technical 

Specifications. 

LCO During startup in MODE 2, four of the five SRM channels are required to 

be OPERABLE to monitor the reactor flux level prior to and during control 

rod withdrawal, to monitor subcritical multiplication and reactor criticality, 

and to monitor neutron flux level and reactor period until the flux level is 

sufficient to maintain the IRM on Range 3 or above. All channels but one 

are required in order to provide a representation of the overall core 

response during those periods when reactivity changes are occurring 

throughout the core. 

In MODES 3 and 4, with the reactor shut down, two SRM channels 

provide redundant monitoring of flux levels in the core. 

In MODE 5, during a spiral offload or reload, an SRM outside the fueled 

region will no longer be required to be OPERABLE, since it is not capable 

of monitoring neutron flux in the fueled region of the core. Thus, CORE 

ALTERATIONS are allowed in a quadrant with no OPERABLE SRM in an 

adjacent quadrant, as provided in the Table 3.3.1.2-1, footnote (b), 

requirement that the bundles being spiral reloaded or spiral offloaded are 

all in a single fueled region containing at least one OPERABLE SRM is 

met. Spiral reloading and offloading encompass reloading or offloading a 

cell on the edges of a continuous fueled region (the cell can be reloaded 

or offloaded in any sequence). 

In nonspiral routine operations, two SRMs are required to be OPERABLE 

to provide redundant monitoring of reactivity changes occurring in the 

reactor core. Because of the local nature of reactivity changes during 

refueling, adequate coverage is provided by requiring one SRM to be 

OPERABLE in the quadrant of the reactor core where CORE 

ALTERATIONS are being performed and the other SRM to be 

OPERABLE in an adjacent quadrant containing fuel. These requirements 

ensure that the reactivity of the core will be continuously monitored during 

CORE ALTERATIONS. 

Special movable detectors, according to Table 3.3.1.2-1, footnote (c), 

may be used during CORE ALTERATIONS in place of the normal SRM 

nuclear detectors. These special detectors must be connected to the 

normal SRM circuits in the NMS such that the applicable neutron flux 

indication can be generated. These special detectors provide more 
SRM Instrumentation 

B 3.3.1.2 

BWR/6 STS B 3.3.1.2-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

flexibility in monitoring reactivity changes during fuel loading, since they 

can be positioned anywhere within the core during refueling. They must 

still meet the location requirements of SR 3.3.1.2.2, and all other required 

SRs for SRMs. 

For an SRM channel to be considered OPERABLE, it must be providing 

neutron flux monitoring indication. 

APPLICABILITY The SRMs are required to be OPERABLE in MODES 2, 3, 4, and 5, prior 

to the IRMs being on scale on Range 3 to provide for neutron monitoring. 

In MODE 1, the APRMs provide adequate monitoring of reactivity 

changes in the core; therefore, the SRMs are not required. In MODE 2, 

with IRMs on Range 3 or above, the IRMs provide adequate monitoring 

and the SRMs are not required. 

ACTIONS A.1 and B.1

In MODE 2, with the IRMs on Range 2 or below, SRMs provide the 

means of monitoring core reactivity and criticality. With any number of 

the required SRMs inoperable, the ability to monitor is degraded. 

Therefore, a limited time is allowed to restore the inoperable channels to 

OPERABLE status. 

Providing that at least one SRM remains OPERABLE, Required 

Action A.1 allows 4 hours to restore the required SRMs to OPERABLE 

status. This is a reasonable time since there is adequate capability 

remaining to monitor the core, limited risk of an event during this time, 

and sufficient time to take corrective actions to restore the required SRMs 

to OPERABLE status or to establish alternate IRM monitoring capability. 

During this time, control rod withdrawal and power increase are not 

precluded by this Required Action. Having the ability to monitor the core 

with at least one SRM, proceeding to IRM Range 3 or greater (with 

overlap verified by SR 3.3.1.1.1) and thereby exiting the Applicability of 

this LCO, is acceptable for ensuring adequate core monitoring and 

allowing continued operation. 

With four required SRMs inoperable, Required Action B.1 allows no 

positive changes in reactivity (control rod withdrawal must be immediately 

suspended) due to the inability to monitor the changes. Required 

Action A.1 still applies and allows 4 hours to restore monitoring capability 

prior to requiring control rod insertion. This allowance is based on the 

limited risk of an event during this time, provided that no control rod 

withdrawals are allowed, and the desire to concentrate efforts on repair, 

rather than to immediately shut down, with no SRMs OPERABLE. 
SRM Instrumentation 

B 3.3.1.2 

BWR/6 STS B 3.3.1.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

In MODE 2, if the required number of SRMs is not restored to 

OPERABLE status within the allowed Completion Time, the reactor shall 

be placed in MODE 3. With all control rods fully inserted, the core is in its 

least reactive state with the most margin to criticality. The allowed 

Completion Time of 12 hours is reasonable, based on operating 

experience, to reach MODE 3 in an orderly manner and without 

challenging plant systems. 

D.1 and D.2

With one or more required SRM channels inoperable in MODE 3 or 4, the 

neutron flux monitoring capability is degraded or nonexistent. The 

requirement to fully insert all insertable control rods ensures that the 

reactor will be at its minimum reactivity level while no neutron monitoring 

capability is available. Placing the reactor mode switch in the shutdown 

position prevents subsequent control rod withdrawal by maintaining a 

control rod block. The allowed Completion Time of 1 hour is sufficient to 

accomplish the Required Action, and takes into account the low 

probability of an event requiring the SRM occurring during this time. 

E.1 and E.2

With one or more required SRMs inoperable in MODE 5, the capability to 

detect local reactivity changes in the core during refueling is degraded. 

CORE ALTERATIONS must be immediately suspended, and action must 

be immediately initiated to insert all insertable control rods in core cells 

containing one or more fuel assemblies. Suspending CORE 

ALTERATIONS prevents the two most probable causes of reactivity 

changes, fuel loading and control rod withdrawal, from occurring. 

Inserting all insertable control rods ensures that the reactor will be at its 

minimum reactivity, given that fuel is present in the core. Suspension of 

CORE ALTERATIONS shall not preclude completion of the movement of 

a component to a safe, conservative position. 

Action (once required to be initiated) to insert control rods must continue 

until all insertable rods in core cells containing one or more fuel 

assemblies are inserted. 
SRM Instrumentation 

B 3.3.1.2 

BWR/6 STS B 3.3.1.2-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE The SRs for each SRM Applicable MODE or other specified condition are 

REQUIREMENTS found in the SRs column of Table 3.3.1.2-1. 

SR 3.3.1.2.1 and SR 3.3.1.2.3

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to the same 

parameter indicated on other similar channels. It is based on the 

assumption that instrument channels monitoring the same parameter 

should read approximately the same value. Significant deviations 

between the instrument channels could be an indication of excessive 

instrument drift in one of the channels or something even more serious. 

A CHANNEL CHECK will detect gross channel failure; thus, it is key to 

verifying the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 

Agreement criteria are determined by the plant staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency of once every 12 hours for SR 3.3.1.2.1 is based on 

operating experience that demonstrates channel failure is rare. While in 

MODES 3 and 4, reactivity changes are not expected; therefore, the 

12 hour Frequency is relaxed to 24 hours for SR 3.3.1.2.3. The 

CHANNEL CHECK supplements less formal, but more frequent, checks 

of channels during normal operational use of the displays associated with 

the channels required by the LCO. 

SR 3.3.1.2.2

To provide adequate coverage of potential reactivity changes in the core, 

one SRM is required to be OPERABLE in the quadrant where CORE 

ALTERATIONS are being performed, and the other OPERABLE SRM 

must be in an adjacent quadrant containing fuel. Note 1 states that this 

SR is required to be met only during CORE ALTERATIONS. It is not 

required to be met at other times in MODE 5 since core reactivity 

changes are not occurring. This Surveillance consists of a review of plant 

logs to ensure that SRMs required to be OPERABLE for given CORE 

ALTERATIONS are, in fact, OPERABLE. In the event that only one SRM 

is required to be OPERABLE, per Table 3.3.1.2-1, footnote (b), only the 

a. portion of this SR is required. Note 2 clarifies that more than one of the 

three requirements can be met by the same OPERABLE SRM. The 
SRM Instrumentation 

B 3.3.1.2 

BWR/6 STS B 3.3.1.2-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

12 hour Frequency is based upon operating experience and supplements 

operational controls over refueling activities, which include steps to 

ensure that the SRMs required by the LCO are in the proper quadrant. 

SR 3.3.1.2.4

This Surveillance consists of a verification of the SRM instrument readout 

to ensure that the SRM reading is greater than a specified minimum count 

rate. This ensures that the detectors are indicating count rates indicative 

of neutron flux levels within the core. With few fuel assemblies loaded, 

the SRMs will not have a high enough count rate to satisfy the SR. 

Therefore, allowances are made for loading sufficient "source" material, in 

the form of irradiated fuel assemblies, to establish the minimum count 

rate. 

To accomplish this, the SR is modified by a Note that states that the 

count rate is not required to be met on an SRM that has less than or 

equal to four fuel assemblies adjacent to the SRM and no other fuel 

assemblies are in the associated core quadrant. With four or less fuel 

assemblies loaded around each SRM and no other fuel assemblies in the 

associated quadrant, even with a control rod withdrawn the configuration 

will not be critical. 

The Frequency is based upon channel redundancy and other information 

available in the control room, and ensures that the required channels are 

frequently monitored while core reactivity changes are occurring. When 

no reactivity changes are in progress, the Frequency is relaxed from 

12 hours to 24 hours. 

SR 3.3.1.2.5 and SR 3.3.1.2.6

Performance of a CHANNEL FUNCTIONAL TEST demonstrates the 

associated channel will function properly. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. 

This is acceptable because all of the other required contacts of the relay 

are verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. SR 3.3.1.2.5 is required in MODE 5, and the 7 day 
SRM Instrumentation 

B 3.3.1.2 

BWR/6 STS B 3.3.1.2-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Frequency ensures that the channels are OPERABLE while core 

reactivity changes could be in progress. This 7 day Frequency is 

reasonable, based on operating experience and on other Surveillances 

(such as a CHANNEL CHECK) that ensure proper functioning between 

CHANNEL FUNCTIONAL TESTS. 

SR 3.3.1.2.6 is required in MODE 2 with IRMs on Range 2 or below and 

in MODES 3 and 4. Since core reactivity changes do not normally take 

place, the Frequency has been extended from 7 days to 31 days. The 

31 day Frequency is based on operating experience and on other 

Surveillances (such as (CHANNEL CHECK) that ensure proper 

functioning between CHANNEL FUNCTIONAL TESTS. 

Verification of the signal to noise ratio also ensures that the detectors are 

inserted to a normal operating level. In a fully withdrawn condition, the 

detectors are sufficiently removed from the fueled region of the core to 

essentially eliminate neutrons from reaching the detector. Any count rate 

obtained while fully withdrawn is assumed to be "noise" only. 

The Note to the Surveillance allows the Surveillance to be delayed until 

entry into the specified condition of the Applicability. The SR must be 

performed in MODE 2 within 12 hours of entering MODE 2 with IRMs on 

Range 2 or below. The allowance to enter the Applicability with the 

31 day Frequency not met is reasonable, based on the limited time of 

12 hours allowed after entering the Applicability and the inability to 

perform the Surveillance while at higher power levels. Although the 

Surveillance could be performed while on IRM Range 3, the plant would 

not be expected to maintain steady state operation at this power level. In 

this event, the 12 hour Frequency is reasonable, based on the SRMs 

being otherwise verified to be OPERABLE (i.e., satisfactorily performing 

the CHANNEL CHECK) and the time required to perform the 

Surveillances. 

SR 3.3.1.2.7

Performance of a CHANNEL CALIBRATION verifies the performance of 

the SRM detectors and associated circuitry. The Frequency considers 

the plant conditions required to perform the test, the ease of performing 

the test, and the likelihood of a change in the system or component 

status. The neutron detectors are excluded from the CHANNEL 

CALIBRATION because they cannot readily be adjusted. The detectors 

are fission chambers that are designed to have a relatively constant 

sensitivity over the range, and with an accuracy specified for a fixed 

useful life. 
SRM Instrumentation 

B 3.3.1.2 

BWR/6 STS B 3.3.1.2-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Note 2 to the Surveillance allows the Surveillance to be delayed until 

entry into the specified condition of the Applicability. The SR must be 

performed in MODE 2 within 12 hours of entering MODE 2 with IRMs on 

Range 2 or below. The allowance to enter the Applicability with the 

18 month Frequency not met is reasonable, based on the limited time of 

12 hours allowed after entering the Applicability and the inability to 

perform the Surveillance while at higher power levels. Although the 

Surveillance could be performed while on IRM Range 3, the plant would 

not be expected to maintain steady state operation at this power level. In 

this event, the 12 hour Frequency is reasonable, based on the SRMs 

being otherwise verified to be OPERABLE (i.e., satisfactorily performing 

the CHANNEL CHECK) and the time required to perform the 

Surveillances. 

REFERENCES None. 
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.2.1 Control Rod Block Instrumentation 

BASES 

BACKGROUND Control rods provide the primary means for control of reactivity changes. 

Control rod block instrumentation includes channel sensors, logic 

circuitry, switches, and relays that are designed to ensure that specified 

fuel design limits are not exceeded for postulated transients and 

accidents. During high power operation, the rod withdrawal limiter (RWL) 

provides protection for control rod withdrawal error events. During low 

power operations, control rod blocks from the rod pattern controller (RPC) 

enforce specific control rod sequences designed to mitigate the 

consequences of the control rod drop accident (CRDA). During shutdown 

conditions, control rod blocks from the Reactor Mode Switch - Shutdown 

Position ensure that all control rods remain inserted to prevent 

inadvertent criticalities. 

The purpose of the RWL is to limit control rod withdrawal to preclude a 

MCPR Safety Limit (SL) violation. The RWL supplies a trip signal to the 

Rod Control and Information System (RCIS) to appropriately inhibit 

control rod withdrawal during power operation equal to or greater than the 

low power setpoint (LPSP). The RWL has two channels, either of which 

can initiate a control rod block when the channel output exceeds the 

control rod block setpoint. The rod block logic circuitry in the RCIS is 

arranged as two redundant and separate logic circuits. These circuits are 

energized when control rod movement is allowed. The output of each 

logic circuit is coupled to a comparator by the use of isolation devices in 

the rod drive control cabinet. The two logic circuit signals are compared 

and rod blocks are applied when either circuit trip signal is present. 

Control rod withdrawal is permitted only when the two signals agree. 

Each rod block logic circuit receives control rod position indication from a 

separate channel of the Rod Position Information System, each with a set 

of reed switches for control rod position indication. Control rod position is 

the primary data input for the RWL. First stage turbine pressure is used 

to determine reactor power level, with an LPSP and a high power setpoint 

(HPSP) used to determine allowable control rod withdrawal distances. 

Below the LPSP, the RWL is automatically bypassed (Ref. 1). 

The purpose of the RPC is to ensure control rod patterns during startup 

are such that only specified control rod sequences and relative positions 

are allowed over the operating range from all control rods inserted to 

10% RTP. The sequences effectively limit the potential amount and rate 

of reactivity increase during a CRDA. The RPC, in conjunction with the 
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

RCIS, will initiate control rod withdrawal and insert blocks when the actual 

sequence deviates beyond allowances from the specified sequence. The 

rod block logic circuitry is the same as that described above. The RPC 

also uses the turbine first stage pressure to determine when reactor 

power is above the power at which the RPC is automatically bypassed 

(Ref. 1). 

With the reactor mode switch in the shutdown position, a control rod 

withdrawal block is applied to all control rods to ensure that the shutdown 

condition is maintained. This function prevents criticality resulting from 

inadvertent control rod withdrawal during MODE 3 or 4, or during 

MODE 5 when the reactor mode switch is required to be in the shutdown 

position. The reactor mode switch has two channels, with each providing 

inputs into a separate rod block circuit. A rod block in either circuit will 

provide a control rod block to all control rods. 

APPLICABLE 1.a. Rod Withdrawal Limiter

SAFETY 

ANALYSES, LCO, The RWL is designed to prevent violation of the MCPR SL and the 

and APPLICABILITY cladding 1% plastic strain fuel design limit that may result from a single 

control rod withdrawal error (RWE) event. The analytical methods and 

assumptions used in evaluating the RWE event are summarized in 

Reference 2. A statistical analysis of RWE events was performed to 

determine the MCPR response as a function of withdrawal distance and 

initial operating conditions. From these responses, the fuel thermal 

performance was determined as a function of RWL allowable control rod 

withdrawal distance and power level. 

The RWL satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Two channels of 

the RWL are available and are required to be OPERABLE to ensure that 

no single instrument failure can preclude a rod block from this Function. 

Nominal trip set points are specified in the setpoint calculations. The 

nominal setpoints are selected to ensure that the setpoints do not exceed 

the Allowable Values between successive CHANNEL CALIBRATIONS. 

Operation with a trip setpoint less conservative than the nominal trip 

setpoint, but within its Allowable Value, is acceptable. Trip setpoints are 

those predetermined values of output at which an action should take 

place. The setpoints are compared to the actual process parameter (e.g., 

reactor power), and when the measured output value of the process 

parameter exceeds the setpoint, the associated device (e.g., trip unit) 
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

changes state. The analytic limits are derived from the limiting values of 

the process parameters obtained from the safety analysis. The Allowable 

Values are derived from the analytic limits, corrected for calibration, 

process, and some of the instrument errors. The trip setpoints are then 

determined accounting for the remaining instrument errors (e.g., drift). 

The trip setpoints derived in this manner provide adequate protection 

because instrumentation uncertainties, process effects, calibration 

tolerances, instrument drive, and severe environment errors (for channels 

that must function in harsh environments as defined by 10 CFR 50.49) 

are accounted for. 

The RWL is assumed to mitigate the consequences of an RWE event 

when operating > 35% RTP. Below this power level, the consequences 

of an RWE event will not exceed the MCPR, and therefore the RWL is not 

required to be OPERABLE (Ref. 3). 

1.b. Rod Pattern Controller

The RPC enforces the banked position withdrawal sequence (BPWS) to 

ensure that the initial conditions of the CRDA analysis are not violated. 

The analytical methods and assumptions used in evaluating the CRDA 

are summarized in References 4, 5, and 6. The BPWS requires that 

control rods be moved in groups, with all control rods assigned to a 

specific group required to be within specified banked positions. 

Requirements that the control rod sequence is in compliance with BPWS 

are specified in LCO 3.1.6, "Rod Pattern Control." 

The Rod Pattern Controller Function satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). Since the RPC is a backup to operator control of 

control rod sequences, only a single channel would be required 

OPERABLE to satisfy Criterion 3 (Ref. 6). However, the RPC is designed 

as a dual channel system and will not function without two OPERABLE 

channels. Required Actions of LCO 3.1.3, "Control Rod OPERABILITY," 

and LCO 3.1.6 may necessitate bypassing individual control rods in the 

Rod Action Control System (RACS) to allow continued operation with 

inoperable control rods or to allow correction of a control rod pattern not 

in compliance with the BPWS. The individual control rods may be 

bypassed as required by the conditions, and the RPC is not considered 

inoperable provided SR 3.3.2.1.9 is met. 
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Compliance with the BPWS, and therefore OPERABILITY of the RPC, is 

required in MODES 1 and 2 with THERMAL POWER ≤ 10% RTP. When 

THERMAL POWER is > 10% RTP, there is no possible control rod 

configuration that results in a control rod worth that could exceed the 

280 cal/gm fuel damage limit during a CRDA. In MODES 3 and 4, all 

control rods are required to be inserted in the core. In MODE 5, since 

only a single control rod can be withdrawn from a core cell containing fuel 

assemblies, adequate SDM ensures that the consequences of a CRDA 

are acceptable, since the reactor will be subcritical. 

2. Reactor Mode Switch - Shutdown Position

During MODES 3 and 4, and during MODE 5 when the reactor mode 

switch is required to be in the shutdown position, the core is assumed to 

be subcritical; therefore, no positive reactivity insertion events are 

analyzed. The Reactor Mode Switch - Shutdown Position control rod 

withdrawal block ensures that the reactor remains subcritical by blocking 

control rod withdrawal, thereby preserving the assumptions of the safety 

analysis. 

The Reactor Mode Switch - Shutdown Position Function satisfies 

Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

Two channels are required to be OPERABLE to ensure that no single 

channel failure will preclude a rod block when required. No Allowable 

Value is applicable for this Function since the channels are mechanically 

actuated based solely on reactor mode switch position. 

During shutdown conditions (MODE 3, 4, or 5) no positive reactivity 

insertion events are analyzed because assumptions are that control rod 

withdrawal blocks are provided to prevent criticality. Therefore, when the 

reactor mode switch is in the shutdown position, the control rod 

withdrawal block is required to be OPERABLE. During MODE 5, with the 

reactor mode switch in the refueling position, the required position onerod-out interlock (LCO 3.9.2) provides the required control rod withdrawal 

blocks. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

If either RWL channel is inoperable, the RWL may not be capable of 

performing its intended function. In most cases, with an inoperable 

channel, the RWL will initiate a control rod withdrawal block because the 

two channels will not agree. To ensure erroneous control rod withdrawal 

does not occur, however, Required Action A.1 requires that further control 

rod withdrawal be suspended immediately. 

B.1

If the RPC is inoperable, it may not be capable of performing its intended 

function even though, in most cases, all control rod movement will be 

blocked. All control rod movement should be suspended under these 

conditions until the RPC is restored to OPERABLE status. This action 

does not preclude a reactor scram. The RPC is not considered 

inoperable if individual control rods are bypassed in the RACS as 

required by LCO 3.1.3 or LCO 3.1.6. Under these conditions, continued 

operation is allowed if the bypassing of control rods and movement of 

control rods is verified by a second licensed operator or other qualified 

member of the technical staff per SR 3.3.2.1.9. 

C.1 and C.2

If one Reactor Mode Switch - Shutdown Position control rod withdrawal 

block channel is inoperable, the remaining OPERABLE channel is 

adequate to perform the control rod withdrawal block function. Required 

Action C.1 and Required Action C.2 are consistent with the normal action 

of an OPERABLE Reactor Mode Switch - Shutdown Position Function to 

maintain all control rods inserted. Therefore, there is no distinction 

between Required Actions for the Conditions of one or two channels 

inoperable. In both cases (one or both channels inoperable), suspending 

all control rod withdrawal immediately, and immediately fully inserting all 

insertable control rods in core cells containing one or more fuel 

assemblies will ensure that the core is subcritical, with adequate SDM 

ensured by LCO 3.1.1, "SHUTDOWN MARGIN (SDM)." Control rods in 

core cells containing no fuel assemblies do not affect the reactivity of the 

core and are therefore not required to be inserted. Action must continue 

until all insertable control rods in core cells containing one or more fuel 

assemblies are fully inserted. 
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

As noted at the beginning of the SR, the SRs for each Control Rod Block 

instrumentation Function are found in the SRs column of Table 3.3.2.1-1. 

The Surveillances are also modified by a Note to indicate that when an 

RWL channel is placed in an inoperable status solely for performance of 

required Surveillances, entry into associated Conditions and Required 

Actions may be delayed for up to 6 hours, provided the associated 

Function maintains control rod block capability. Upon completion of the 

Surveillance, or expiration of the 6 hour allowance, the channel must be 

returned to OPERABLE status or the applicable Condition entered and 

Required Actions taken. This Note is based on the reliability analysis 

(Ref. 8) assumption of the average time required to perform channel 

Surveillance. That analysis demonstrated that the 6 hour testing 

allowance does not significantly reduce the probability that a control rod 

block will be initiated when necessary. 

SR 3.3.2.1.1, SR 3.3.2.1.2, SR 3.3.2.1.3, and SR 3.3.2.1.4

The CHANNEL FUNCTIONAL TESTS for the RPC and RWL are 

performed by attempting to withdraw a control rod not in compliance with 

the prescribed sequence and verifying that a control rod block occurs. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. Any setpoint adjustment shall be consistent with 

the assumptions of the current plant specific setpoint methodology. As 

noted, the SRs are not required to be performed until 1 hour after 

specified conditions are met (e.g., after any control rod is withdrawn in 

MODE 2). This allows entry into the appropriate conditions needed to 

perform the required SRs. The Frequencies are based on reliability 

analysis (Ref. 7). 
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.2.1.5

The LPSP is the point at which the RPCS makes the transition between 

the function of the RPC and the RWL. This transition point is 

automatically varied as a function of power. This power level is inferred 

from the first stage turbine pressure (one channel to each trip system). 

These power setpoints must be verified periodically to be within the 

Allowable Values. If any LPSP is nonconservative, then the affected 

Functions are considered inoperable. Since this channel has both upper 

and lower required limits, it is not allowed to be placed in a condition to 

enable either the RPC or RWL Function. Because main turbine bypass 

steam flow can affect the LPSP nonconservatively for the RWL, the RWL 

is considered inoperable with any main turbine bypass valves open. The 

Frequency of 92 days is based on the setpoint methodology utilized for 

these channels. 

SR 3.3.2.1.6

This SR ensures the high power function of the RWL is not bypassed 

when power is above the HPSP. The power level is inferred from turbine 

first stage pressure signals. Periodic testing of the HPSP channels is 

required to verify the setpoint to be less than or equal to the limit. 

Adequate margins in accordance with setpoint methodologies are 

included. If the HPSP is nonconservative, then the RWL is considered 

inoperable. Alternatively, the HPSP can be placed in the conservative 

condition (nonbypass). If placed in the nonbypassed condition, the SR is 

met and the RWL would not be considered inoperable. Because main 

turbine bypass steam flow can affect the HPSP nonconservatively for the 

RWL, the RWL is considered inoperable with any main turbine bypass 

valve open. The Frequency of 92 days is based on the setpoint 

methodology utilized for these channels. 

SR 3.3.2.1.7

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies that the channel responds to the 

measured parameter within the necessary range and accuracy. 

CHANNEL CALIBRATION leaves the channel adjusted to account for 

instrument drifts between successive calibrations consistent with the plant 

specific setpoint methodology. Any setpoint adjustment shall be 

consistent with the assumptions of the current plant specific setpoint 

methodology. 
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Frequency is based upon the assumption of the magnitude of 

equipment drift in the setpoint analysis. 

SR 3.3.2.1.8

The CHANNEL FUNCTIONAL TEST for the Reactor Mode Switch - 

Shutdown Position Function is performed by attempting to withdraw any 

control rod with the reactor mode switch in the shutdown position and 

verifying a control rod block occurs. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable CHANNEL FUNCTIONAL TEST of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. 

As noted in the SR, the Surveillance is not required to be performed until 

1 hour after the reactor mode switch is in the shutdown position, since 

testing of this interlock with the reactor mode switch in any other position 

cannot be performed without using jumpers, lifted leads, or movable 

limits. This allows entry into MODES 3 and 4 if the 18 month Frequency 

is not met per SR 3.0.2. The 1 hour allowance is based on operating 

experience and in consideration of providing a reasonable time in which 

to complete the SRs. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

SR 3.3.2.1.9

LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be 

bypassed in RACS to allow insertion of an inoperable control rod or 

correction of a control rod pattern not in compliance with BPWS. With the 

control rods bypassed in the RACS, the RPC will not control the 

movement of these bypassed control rods. To ensure the proper 

bypassing and movement of those affected control rods, a second 

licensed operator or other qualified member of the technical staff must 

verify the bypassing and movement of these control rods. Compliance 

with this SR allows the RPC to be OPERABLE with these control rods 

bypassed.
Control Rod Block Instrumentation 

B 3.3.2.1 

BWR/6 STS B 3.3.2.1-9 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [7.6.1.7.3]. 

 2. FSAR, Section [15.4.2]. 

 3. NEDE-24011-P-A-9-US, "General Electrical Standard Application for 

Reload Fuel," Supplement for United States, Section S 2.2.3.1, 

September 1988. 

 4. "Modifications to the Requirements for Control Rod Drop Accident 

Mitigating Systems," BWR Owners Group, July 1986. 

 5. NEDO-21231, "Banked Position Withdrawal Sequence," 

January 1977. 

 6. NRC SER, Acceptance of Referencing of Licensing Topical Report 

NEDE-24011-P-A, "General Electric Standard Application for Reactor 

Fuel, Revision 8, Amendment 17," December 27, 1987. 

 7. NEDC-30851-P-A, "Technical Specification Improvement Analysis for 

BWR Control Rod Block Instrumentation," October 1988. 

 8. GENE-770-06-1, "Addendum to Bases for Changes to Surveillance 

Test Intervals and Allowed Out-of-Service Times for Selected 

Instrumentation Technical Specifications," February 1991. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.3.1 Post Accident Monitoring (PAM) Instrumentation 

BASES 

BACKGROUND The primary purpose of the PAM instrumentation is to display plant 

variables that provide information required by the control room operators 

during accident situations. This information provides the necessary 

support for the operator to take the manual actions for which no automatic 

control is provided and that are required for safety systems to accomplish 

their safety functions for Design Basis Events. The instruments that 

monitor these variables are designated as Type A, Category I, and nonType A, Category I in accordance with Regulatory Guide 1.97 (Ref. 1). 

The OPERABILITY of the accident monitoring instrumentation ensures 

that there is sufficient information available on selected plant parameters 

to monitor and assess plant status and behavior following an accident. 

This capability is consistent with the recommendations of Reference 1. 

APPLICABLE The PAM instrumentation LCO ensures the OPERABILITY of Regulatory 

SAFETY Guide 1.97, Type A, variables so that the control room operating staff 

ANALYSES can: 

• Perform the diagnosis specified in the Emergency Operating 

Procedures (EOP). These variables are restricted to preplanned 

actions for the primary success path of Design Basis Accidents 

(DBAs) (e.g., loss of coolant accident (LOCA)) and 

• Take the specified, preplanned, manually controlled actions for which 

no automatic control is provided, which are required for safety 

systems to accomplish their safety function. 

The PAM instrumentation LCO also ensures OPERABILITY of Category I, 

non-Type A, variables. This ensures the control room operating staff can: 

• Determine whether systems important to safety are performing their 

intended functions, 

• Determine the potential for causing a gross breach of the barriers to 

radioactivity release, 

• Determine whether a gross breach of a barrier has occurred, and 

• Initiate action necessary to protect the public and to obtain an 

estimate of the magnitude of any impending threat. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The plant specific Regulatory Guide 1.97 analysis (Ref. 2) documents the 

process that identified Type A and Category I, non-Type A, variables. 

PAM instrumentation that meets the definition of Type A in Regulatory 

Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category I, 

non-Type A, instrumentation is retained in the Technical Specifications 

(TS) because it is intended to assist operators in minimizing the 

consequences of accidents. Therefore, these Category I, non-Type A, 

variables are important for reducing public risk. 

LCO LCO 3.3.3.1 requires two OPERABLE channels for all but one Function to 

ensure no single failure prevents the operators from being presented with 

the information necessary to determine the status of the unit and to bring 

the unit to, and maintain it in, a safe condition following that accident. 

Furthermore, provision of two channels allows a CHANNEL CHECK 

during the post accident phase to confirm the validity of displayed 

information. [More than two channels may be required at some units if 

the Regulatory Guide 1.97 analysis determined that failure of one 

accident monitoring channel results in information ambiguity (e.g., the 

redundant displays disagree) that could lead operators to defeat or to fail 

to accomplish a required safety function.] 

The exception of the two channel requirement is primary containment 

isolation valve (PCIV) position. In this case, the important information is 

the status of the primary containment penetrations. The LCO requires 

one position indicator for each active PCIV. This is sufficient to 

redundantly verify the isolation status of each isolable penetration either 

via indicated status of the active valve and prior knowledge of passive 

valve or via system boundary status. If a normally active PCIV is known 

to be closed and deactivated, position indication is not needed to 

determine status. Therefore, the position indication for valves in this state 

is not required to be OPERABLE. 

Listed below is a discussion of the specified instrument Functions listed in 

Table 3.3.3.1-1, in the accompanying LCO. These discussions are 

intended as examples of what should be provided for each Function when 

the plant specific Bases are prepared. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

1. Reactor Steam Dome Pressure

Reactor steam dome pressure is a Category I variable provided to 

support monitoring of Reactor Coolant System (RCS) integrity and to 

verify operation of the Emergency Core Cooling Systems (ECCS). Two 

independent pressure transmitters with a range of 0 psig to 1500 psig 

monitor pressure. Wide range recorders are the primary indication used 

by the operator during an accident. Therefore, the PAM Specification 

deals specifically with this portion of the instrument channel. 

2. Reactor Vessel Water Level

Reactor vessel water level is a Category I variable provided to support 

monitoring of core cooling and to verify operation of the ECCS. The wide 

range water level channels provide the PAM Reactor Vessel Water Level 

Function. The wide range water level channels measure from 17 inches 

below the dryer skirt down to a point just below the bottom of the active 

fuel. Wide range water level is measured by two independent differential 

pressure transmitters. The output from these channels is recorded on 

two independent pen recorders. These recorders are the primary 

indication used by the operator during an accident. Therefore, the PAM 

Specification deals specifically with this portion of the instrument channel. 

The wide range water level instruments are uncompensated for variation 

in reactor water density and are calibrated to be most accurate at 

operational pressure and temperature. 

3. Suppression Pool Water Level

Suppression pool water level is a Category I variable provided to detect a 

breach in the reactor coolant pressure boundary (RCPB). This variable is 

also used to verify and provide long term surveillance of ECCS function. 

The wide range suppression pool water level measurement provides the 

operator with sufficient information to assess the status of the RCPB and 

to assess the status of the water supply to the ECCS. The wide range 

water level indicators monitor the suppression pool level from the center 

line of the ECCS suction lines to the top of the pool. Two wide range 

suppression pool water level signals are transmitted from separate 

differential pressure transmitters and are continuously recorded on two 

recorders in the control room. These recorders are the primary indication 

used by the operator during an accident. Therefore, the PAM 

Specification deals specifically with this portion of the instrument channel. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

4. Drywell Pressure

Drywell pressure is a Category I variable provided to detect breach of the 

RCPB and to verify ECCS functions that operate to maintain RCS 

integrity. Two wide range drywell pressure signals are transmitted from 

separate pressure transmitters and are continuously recorded and 

displayed on two control room recorders. These recorders are the 

primary indication used by the operator during an accident. Therefore, 

the PAM Specification deals specifically with this portion of the instrument 

channel. 

5. Primary Containment Area Radiation (High Range)

Primary containment area radiation (high range) is provided to monitor for 

the potential of significant radiation releases and to provide release 

assessment for use by operators in determining the need to invoke site 

emergency plans. 

[ For this plant, primary containment area radiation (high range) PAM 

instrumentation consists of the following: ] 

6. Drywell Sump Level

Drywell sump level is a Category I variable provided for verification of 

ECCS functions that operate to maintain RCS integrity. 

[ For this plant, the drywell sump level PAM instrumentation consists of the 

following: ] 

7. Drywell Drain Sump Level

Drywell drain sump level is a Category I variable provided to detect 

breach of the RCPB and for verification and long term surveillance of 

ECCS functions that operate to maintain RCS integrity. 

[ For this plant, the drywell drain sump level PAM instrumentation consists 

of the following: ]
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-5 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

8. Primary Containment Isolation Valve (PCIV) Position

PCIV position is provided for verification of containment integrity. In the 

case of PCIV position, the important information is the isolation status of 

the containment penetration. The LCO requires one channel of valve 

position indication in the control room to be OPERABLE for each active 

PCIV in a containment penetration flow path, i.e., two total channels of 

PCIV position indication for a penetration flow path with two active valves. 

For containment penetrations with only one active PCIV having control 

room indication, Note (b) requires a single channel of valve position 

indication to be OPERABLE. This is sufficient to verify redundantly the 

isolation status of each isolable penetration via indicated status of the 

active valve, as applicable, and prior knowledge of passive valve or 

system boundary status. If a penetration is isolated, position indication 

for the PCIV(s) in the associated penetration flow path is not needed to 

determine status. Therefore, the position indication for valves in an 

isolated penetration is not required to be OPERABLE. Each penetration 

is treated separately and each penetration flow path is considered a 

separate function. Therefore, separate Condition entry is allowed for 

each inoperable penetration flow path. 

[ For this plant, the PCIV position PAM instrumentation consists of the 

following: ]

9. Wide Range Neutron Flux

Wide range neutron flux is a Category I variable provided to verify reactor 

shutdown. 

[ For this plant, wide range neutron flux PAM instrumentation consists of 

the following: ] 

10. Primary Containment Pressure

Primary containment pressure is a Category I variable provided to verify 

RCS and containment integrity and to verify the effectiveness of ECCS 

actions taken to prevent containment breach. Two wide range primary 

containment pressure signals are transmitted from separate pressure 

transmitters and are continuously recorded and displayed on two control 

room recorders. These recorders are the primary indication used by the 

operator during an accident. Therefore, the PAM Specification deals 

specifically with this portion of the instrument channel. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-6 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

11. Suppression Pool Water Temperature

Suppression pool water temperature is a Category I variable provided to 

detect a condition that could potentially lead to containment breach, and 

to verify the effectiveness of ECCS actions taken to prevent containment 

breach. The suppression pool water temperature instrumentation allows 

operators to detect trends in suppression pool water temperature in 

sufficient time to take action to prevent steam quenching vibrations in the 

suppression pool. Twenty-four temperature sensors are arranged in six 

groups of four independent and redundant channels, located such that 

there is a group of sensors within a 30 ft line of sight of each relief valve 

discharge location. 

Thus, six groups of sensors are sufficient to monitor each relief valve 

discharge location. Each group of four sensors includes two sensors for 

normal suppression pool temperature monitoring and two sensors for 

PAM. The outputs for the PAM sensors are recorded on four 

independent recorders in the control room. (Channels A and C are 

redundant to channels B and D, respectively.) All four of these recorders 

must be OPERABLE to furnish two channels of PAM indication for each 

of the relief valve discharge locations. These recorders are the primary 

indication used by the operator during an accident. Therefore, the PAM 

Specification deals specifically with this portion of the instrument 

channels. Each suppression pool water temperature [relief valve 

discharge location] is treated separately and each [relief valve discharge 

location] is considered to be a separate function. Therefore, separate 

Condition entry is allowed for each inoperable [relief valve discharge 

location]. 

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1 and 2. These 

variables are related to the diagnosis and preplanned actions required to 

mitigate DBAs. The applicable DBAs are assumed to occur in MODES 1 

and 2. In MODES 3, 4, and 5, plant conditions are such that the 

likelihood of an event that would require PAM instrumentation is 

extremely low; therefore, PAM instrumentation is not required to be 

OPERABLE in these MODES. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A Note has been provided to modify the ACTIONS related 

to PAM instrumentation channels. Section 1.3, Completion Times, 

specifies that once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition, 

discovered to be inoperable or not within limits, will not result in separate 

entry into the Condition. Section 1.3 also specifies that Required Actions 

of the Condition continue to apply for each additional failure, with 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for inoperable PAM instrumentation channels provide 

appropriate compensatory measures for separate inoperable functions. 

As such, a Note has been provided that allows separate Condition entry 

for each inoperable PAM Function. 

A.1

When one or more Functions have one required channel that is 

inoperable, the required inoperable channel must be restored to 

OPERABLE status within 30 days. The 30 day Completion Time is based 

on operating experience and takes into account the remaining 

OPERABLE channel (or in the case of a Function that has only one 

required channel, other non-Regulatory Guide 1.97 instrument channels 

to monitor the Function), the passive nature of the instrument (no critical 

automatic action is assumed to occur from these instruments), and the 

low probability of an event requiring PAM instrumentation during this 

interval. 

B.1

If a channel has not been restored to OPERABLE status in 30 days, this 

Required Action specifies initiation of actions in accordance with 

Specification 5.6.7, which requires a written report to be submitted to the 

NRC. This report discusses the results of the root cause evaluation of the 

inoperability and identifies proposed restorative actions. This Action is 

appropriate in lieu of a shutdown requirement since alternative Actions 

are identified before loss of functional capability, and given the likelihood 

of plant conditions that would require information provided by this 

instrumentation. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

When one or more Functions have two required channels that are 

inoperable (i.e., two channels inoperable in the same Function), one 

channel in the Function should be restored to OPERABLE status within 

7 days. The Completion Time of 7 days is based on the relatively low 

probability of an event requiring PAM instrument operation and the 

availability of alternate means to obtain the required information. 

Continuous operation with two required channels inoperable in a Function 

is not acceptable because the alternate indications may not fully meet all 

performance qualification requirements applied to the PAM 

instrumentation. Therefore, requiring restoration of one inoperable 

channel of the Function limits the risk that the PAM Function will be in a 

degraded condition should an accident occur. Condition C is modified by 

a Note that excludes hydrogen monitor channels. Condition D provides 

appropriate Required Actions for two inoperable hydrogen monitor 

channels. 

D.1

This Required Action directs entry into the appropriate Condition 

referenced in Table 3.3.3.1-1. The applicable Condition referenced in 

the Table is Function dependent. Each time an inoperable channel has 

not met the Required Action of Condition C, and the associated 

Completion Time has expired, Condition D is entered for that channel and 

provides for transfer to the appropriate subsequent Condition. 

E.1

For the majority of Functions in Table 3.3.3.1-1, if the Required Action 

and associated Completion Time of Condition C is not met, the plant must 

be placed in a MODE in which the LCO does not apply. This is done by 

placing the plant in at least MODE 3 within 12 hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant condition from full power 

conditions in an orderly manner and without challenging plant systems. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-9 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

F.1

Since alternate means of monitoring primary containment area radiation 

have been developed and tested, the Required Action is not to shut down 

the plant but rather to follow the directions of Specification 5.6.7. These 

alternate means may be temporarily installed if the normal PAM channel 

cannot be restored to OPERABLE status within the allotted time. The 

report provided to the NRC should discuss the alternate means used, 

describe the degree to which the alternate means are equivalent to the 

installed PAM channels, justify the areas in which they are not equivalent, 

and provide a schedule for restoring the normal PAM channels. 

SURVEILLANCE The following SRs apply to each PAM instrumentation Function in 

REQUIREMENTS Table 3.3.3.1-1. 

SR 3.3.3.1.1

Performance of the CHANNEL CHECK once every 31 days ensures that 

a gross instrumentation failure has not occurred. A CHANNEL CHECK is 

normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between instrument 

channels could be an indication of excessive instrument drift in one of the 

channels or of something even more serious. CHANNEL CHECK will 

detect gross channel failure; thus, it is key to verifying the instrumentation 

continues to operate properly between each CHANNEL CALIBRATION. 

The high radiation instrumentation should be compared to similar plant 

instruments located throughout the plant. 

Agreement criteria are determined by the plant staff based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the sensor or the signal processing equipment has 

drifted outside its limit. 

The Frequency of 31 days is based upon plant operating experience with 

regard to channel OPERABILITY and drift, which demonstrates that 

failure of more than one channel of a given function in any 31 day interval 

is rare. The CHANNEL CHECK supplements less formal, but more 

frequent, checks of channels during normal operational use of those 

displays associated with the required channels of this LCO. 
PAM Instrumentation 

B 3.3.3.1 

BWR/6 STS B 3.3.3.1-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.3.1.2

A CHANNEL CALIBRATION is performed every 18 months, or 

approximately at every refueling. CHANNEL CALIBRATION is a 

complete check of the instrument loop including the sensor. The test 

verifies that the channel responds to the measured parameter with the 

necessary range and accuracy. The Frequency is based on operating 

experience and consistency with the typical industry refueling cycles. 

REFERENCES 1. Regulatory Guide 1.97, "Instrumentation for Light-Water Cooled 

Nuclear Power Plants to Assess Plant and Environs Conditions 

During and Following an Accident," [Date]. 

[ 2. Plant specific documents (e.g., FSAR, NRC Regulatory Guide 1.97, 

SER letter). ] 
Remote Shutdown System 

B 3.3.3.2 

BWR/6 STS B 3.3.3.2-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.3.2 Remote Shutdown System 

BASES 

BACKGROUND The Remote Shutdown System provides the control room operator with 

sufficient instrumentation and controls to place and maintain the plant in a 

safe shutdown condition from a location other than the control room. This 

capability is necessary to protect against the possibility of the control 

room becoming inaccessible. A safe shutdown condition is defined as 

MODE 3. With the plant in MODE 3, the Reactor Core Isolation Cooling 

(RCIC) System, the safety/relief valves, and the Residual Heat Removal 

Shutdown Cooling System can be used to remove core decay heat and 

meet all safety requirements. The long term supply of water for the RCIC 

and the ability to operate shutdown cooling from outside the control room 

allow extended operation in MODE 3. 

In the event that the control room becomes inaccessible, the operators 

can establish control at the remote shutdown panel and place and 

maintain the plant in MODE 3. Not all controls and necessary transfer 

switches are located at the remote shutdown panel. Some controls and 

transfer switches will have to be operated locally at the switchgear, motor 

control panels, or other local stations. The plant automatically reaches 

MODE 3 following a plant shutdown and can be maintained safely in 

MODE 3 for an extended period of time. 

The OPERABILITY of the Remote Shutdown System control and 

instrumentation Functions ensures that there is sufficient information 

available on selected plant parameters to place and maintain the plant in 

MODE 3 should the control room become inaccessible. 

APPLICABLE The Remote Shutdown System is required to provide equipment at 

SAFETY appropriate locations outside the control room with a design capability to 

ANALYSES promptly shut down the reactor to MODE 3, including the necessary 

instrumentation and controls, to maintain the plant in a safe condition in 

MODE 3. 

The criteria governing the design and the specific system requirements of 

the Remote Shutdown System are located in 10 CFR 50, Appendix A, 

GDC 19 (Ref. 1). 

The Remote Shutdown System satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii). 
Remote Shutdown System 

B 3.3.3.2 

BWR/6 STS B 3.3.3.2-2 Rev. 3.0, 03/31/04 

BASES 

LCO The Remote Shutdown System LCO provides the requirements for the 

OPERABILITY of the instrumentation and controls necessary to place 

and maintain the plant in MODE 3 from a location other than the control 

room. The instrumentation and controls required are listed in 

Table B 3.3.3.2-1. 

The controls, instrumentation, and transfer switches are those required 

for: 

• Reactor pressure vessel (RPV) pressure control, 

• Decay heat removal, 

• RPV inventory control, and 

• Safety support systems for the above functions, including service 

water, component cooling water, and onsite power, including the 

diesel generators. 

The Remote Shutdown System is OPERABLE if all instrument and 

control channels needed to support the remote shutdown function are 

OPERABLE. In some cases, Table B 3.3.3.2-1 may indicate that the 

required information or control capability is available from several 

alternate sources. In these cases, the Remote Shutdown System is 

OPERABLE as long as one channel of any of the alternate information or 

control sources for each Function is OPERABLE. 

The Remote Shutdown System instruments and control circuits covered 

by this LCO do not need to be energized to be considered OPERABLE. 

This LCO is intended to ensure that the instruments and control circuits 

will be OPERABLE if plant conditions require that the Remote Shutdown 

System be placed in operation. 

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1 and 2. 

This is required so that the plant can be placed and maintained in 

MODE 3 for an extended period of time from a location other than the 

control room. 

This LCO is not applicable in MODES 3, 4, and 5. In these MODES, the 

plant is already subcritical and in a condition of reduced Reactor Coolant 

System energy. Under these conditions, considerable time is available to 

restore necessary instrument control Functions if control room 

instruments or control becomes unavailable. Consequently, the TS do 

not require OPERABILITY in MODES 3, 4, and 5. 
Remote Shutdown System 

B 3.3.3.2 

BWR/6 STS B 3.3.3.2-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A Remote Shutdown System division is inoperable when 

each function is not accomplished by at least one designated Remote 

Shutdown System channel that satisfies the OPERABILITY criteria for the 

channel's Function. These criteria are outlined in the LCO section of the 

Bases. 

A Note has been provided to modify the ACTIONS related to Remote 

Shutdown System Functions. Section 1.3, Completion Times, specifies 

that once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition, 

discovered to be inoperable or not within limits, will not result in separate 

entry into the Condition. Section 1.3 also specifies that Required Actions 

of the Condition continue to apply for each additional failure, with 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for inoperable Remote Shutdown System Functions 

provide appropriate compensatory measures for separate Functions. 

As such, a Note has been provided that allows separate Condition entry 

for each inoperable Remote Shutdown System Function. 

A.1

Condition A addresses the situation where one or more required 

Functions of the Remote Shutdown System is inoperable. This includes 

the control and transfer switches for any required Function. 

The Required Action is to restore the Function (both divisions, if 

applicable) to OPERABLE status within 30 days. The Completion Time is 

based on operating experience and the low probability of an event that 

would require evacuation of the control room. 

B.1

If the Required Action and associated Completion Time of Condition A 

are not met, the plant must be brought to a MODE in which the LCO does 

not apply. To achieve this status, the plant must be brought to at least 

MODE 3 within 12 hours. The allowed Completion Time is reasonable, 

based on operating experience, to reach the required MODE from full 

power conditions in an orderly manner and without challenging plant 

systems. 
Remote Shutdown System 

B 3.3.3.2 

BWR/6 STS B 3.3.3.2-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.3.3.2.1

REQUIREMENTS 

Performance of the CHANNEL CHECK once every 31 days ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. 

Agreement criteria are determined by the plant staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit. As specified in the Surveillance, a CHANNEL CHECK is only 

required for those channels that are normally energized. 

The Frequency is based upon plant operating experience that 

demonstrates channel failure is rare. 

SR 3.3.3.2.2

SR 3.3.3.2.2 verifies each required Remote Shutdown System transfer 

switch and control circuit performs the intended function. This verification 

is performed from the remote shutdown panel and locally, as appropriate. 

Operation of the equipment from the remote shutdown panel is not 

necessary. The Surveillance can be satisfied by performance of a 

continuity check. This will ensure that if the control room becomes 

inaccessible, the plant can be placed and maintained in MODE 3 from the 

remote shutdown panel and the local control stations. However, this 

Surveillance is not required to be performed only during a plant outage. 

Operating experience demonstrates that Remote Shutdown System 

control channels usually pass the Surveillance when performed at the 

18 month Frequency. 
Remote Shutdown System 

B 3.3.3.2 

BWR/6 STS B 3.3.3.2-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.3.2.3

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. The test verifies the channel responds to measured 

parameter values with the necessary range and accuracy. 

The 18 month Frequency is based upon operating experience and is 

consistent with the typical industry refueling cycle. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19. 
Remote Shutdown System 

B 3.3.3.2 

BWR/6 STS B 3.3.3.2-6 Rev. 3.0, 03/31/04 

Table B 3.3.3.2-1 (page 1 of 1) 

Remote Shutdown System Instrumentation 

FUNCTION (INSTRUMENT OR CONTROL 

PARAMETER) 

REQUIRED NUMBER OF 

DIVISIONS 

1. Reactor Pressure Vessel Pressure Control 

 a. Reactor Pressure [1] 

2. Decay Heat Removal 

 a. RCIC Flow [1] 

 b. RCIC Controls [1] 

 c. RHR Flow [1] 

 d. RHR Controls [1] 

3. Reactor Pressure Vessel Inventory Control 

 a. RCIC Flow [1] 

 b. RCIC Controls [1] 

 c. RHR Flow [1] 

 d. RHR Controls [1] 

--------------------------------------------------REVIEWER’S NOTE------------------------------------------------- 

For channels that fulfill GDC 19 requirements, the number of OPERABLE channels required 

depends upon the plant's licensing basis as described in the NRC plant specific Safety 

Evaluation Report (SER). Generally, two divisions are required to be OPERABLE. However, 

only one channel per given Function is required if the plant has justified such a design and the 

NRC SER has accepted the justification. 

-------------------------------------------------------------------------------------------------------------------------------

This Table is for illustration purposes only. It does not attempt to encompass every Function 

used at every unit, but does contain the types of Functions commonly found. 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation 

BASES 

BACKGROUND The EOC-RPT instrumentation initiates a recirculation pump trip (RPT) to 

reduce the peak reactor pressure and power resulting from turbine trip or 

generator load rejection transients to provide additional margin to core 

thermal MCPR Safety Limits (SLs). 

The need for the additional negative reactivity in excess of that normally 

inserted on a scram reflects end of cycle reactivity considerations. Flux 

shapes at the end of cycle are such that the control rods may not be able 

to ensure that thermal limits are maintained by inserting sufficient 

negative reactivity during the first few feet of rod travel upon a scram 

caused by Turbine Control Valve (TCV) Fast Closure, Trip Oil Pressure - 

Low, or Turbine Stop Valve Closure, Trip Oil Pressure - Low (TSV). The 

physical phenomenon involved is that the void reactivity feedback due to 

a pressurization transient can add positive reactivity at a faster rate than 

the control rods can add negative reactivity. 

The EOC-RPT instrumentation as shown in Reference 1 is comprised of 

sensors that detect initiation of closure of the TSVs, or fast closure of the 

TCVs, combined with relays, logic circuits, and fast acting circuit breakers 

that interrupt the power from the recirculation pump motor generator (MG) 

set generators to each of the recirculation pump motors. The channels 

include electronic equipment (e.g., trip units) that compares measured 

input signals with pre-established setpoints. When the setpoint is 

exceeded, the channel output relay actuates, which then outputs an 

EOC-RPT signal to the trip logic. When the RPT breakers trip open, the 

recirculation pumps coast down under their own inertia. The EOC-RPT 

has two identical trip systems, either of which can actuate an RPT. 

Each EOC-RPT trip system is a two-out-of-two logic for each Function; 

thus, either two TSV Closure, Trip Oil Pressure - Low or two TCV Fast 

Closure, Trip Oil Pressure - Low signals are required for a trip system to 

actuate. If either trip system actuates, both recirculation pumps will trip. 

There are two EOC-RPT breakers in series per recirculation pump. One 

trip system trips one of the two EOC-RPT breakers for each recirculation 

pump and the second trip system trips the other EOC-RPT breaker for 

each recirculation pump. 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The TSV Closure, Trip Oil Pressure - Low and the TCV Fast Closure, Trip 

SAFETY Oil Pressure - Low Functions are designed to trip the recirculation pumps 

ANALYSES, LCO, in the event of a turbine trip or generator load rejection to mitigate the 

and APPLICABILITY neutron flux, heat flux and pressurize transients, and to increase the 

margin to the MCPR SL. The analytical methods and assumptions used 

in evaluating the turbine trip and generator load rejection, as well as other 

safety analyses that assume EOC-RPT, are summarized in References 2, 

3, and 4. 

To mitigate pressurization transient effects, the EOC-RPT must trip the 

recirculation pumps after initiation of initial closure movement of either the 

TSVs or the TCVs. The combined effects of this trip and a scram reduce 

fuel bundle power more rapidly than does a scram alone, resulting in an 

increased margin to the MCPR SL. Alternatively, MCPR limits for an 

inoperable EOC-RPT as specified in the COLR are sufficient to mitigate 

pressurization transient effects. The EOC-RPT function is automatically 

disabled when turbine first stage pressure is < [40%] RTP. 

EOC-RPT instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

The OPERABILITY of the EOC-RPT is dependent on the OPERABILITY 

of the individual instrumentation channel Functions. Each Function must 

have a required number of OPERABLE channels in each trip system, with 

their setpoints within the specified Allowable Value of SR 3.3.4.1.3. The 

actual setpoint is calibrated consistent with applicable setpoint 

methodology assumptions. Channel OPERABILITY also includes the 

associated EOC-RPT breakers. Each channel (including the associated 

EOC-RPT breakers) must also respond within its assumed response 

time. 

Allowable Values are specified for each EOC-RPT Function specified in 

the LCO. Nominal trip setpoints are specified in the setpoint calculations. 

A channel is inoperable if its actual trip setpoint is not within its required 

Allowable Value. The nominal setpoints are selected to ensure the 

setpoints do not exceed the Allowable Value between successive 

CHANNEL CALIBRATIONS. Operation with a trip setpoint less 

conservative than the nominal trip setpoint, but within its Allowable Value, 

is acceptable. Trip setpoints are those predetermined values of output at 

which an action should take place. The setpoints are compared to the 

actual process parameter (e.g., TSV electrohydraulic control (EHC) 

pressure), and when the measured output value of the process parameter 

exceeds the setpoint, the associated device (e.g., trip unit) changes state. 

The analytic limits are derived from the limiting values of the process 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

parameters obtained from the safety analysis. The Allowable Values are 

derived from the analytic limits, corrected for calibration, process, and 

some of the instrument errors. The trip setpoints are then determined 

accounting for the remaining instrument errors (e.g., drift). The trip 

setpoints derived in this manner provide adequate protection because 

instrumentation uncertainties, process effects, calibration tolerances, 

instrument drift, and severe environment errors (for channels that must 

function in harsh environments as defined by 10 CFR 50.49) are 

accounted for. 

The specific Applicable Safety Analysis, LCO, and Applicability 

discussions are listed below on a Function by Function basis. 

Alternately, since this instrumentation protects against a MCPR SL 

violation with the instrumentation inoperable, modifications to the MCPR 

limits (LCO 3.2.2) may be applied to allow this LCO to be met. The 

MCPR penalty for the Condition EOC-RPT inoperable is specified in the 

COLR. 

Turbine Stop Valve Closure, Trip Oil Pressure - Low

Closure of the TSVs and a main turbine trip result in the loss of a heat 

sink that produces reactor pressure, neutron flux, and heat flux transients 

that must be limited. Therefore, an RPT is initiated on TSV Closure, Trip 

Oil Pressure - Low in anticipation of the transients that would result from 

closure of these valves. EOC-RPT decreases reactor power and aids the 

reactor scram in ensuring the MCPR SL is not exceeded during the worst 

case transient. 

Closure of the TSVs is determined by measuring the EHC fluid pressure 

at each stop valve. There is one pressure transmitter associated with 

each stop valve, and the signal from each transmitter is assigned to a 

separate trip channel. The logic for the TSV Closure, Trip Oil Pressure - 

Low Function is such that two or more TSVs must be closed to produce 

an EOC-RPT. This Function must be enabled at THERMAL POWER 

≥ 40% RTP. This is normally accomplished automatically by pressure 

transmitters sensing turbine first stage pressure; therefore, to consider 

this Function OPERABLE, the turbine bypass valves must remain shut at 

THERMAL POWER ≥ 40% RTP. Four channels of TSV Closure, with two 

channels in each trip system, are available and required to be 

OPERABLE to ensure that no single instrument failure will preclude an 

EOC-RPT from this Function on a valid signal. The TSV Closure, Trip Oil 

Pressure - Low Allowable Value is selected high enough to detect 

imminent TSV closure. 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

This protection is required, consistent with the safety analysis 

assumptions, whenever THERMAL POWER is ≥ 40% RTP with any 

recirculating pump in fast speed. Below 40% RTP or with the 

recirculation in slow speed, the Reactor Vessel Steam Dome Pressure - 

High and the Average Power Range Monitor (APRM) Fixed Neutron Flux 

- High Functions of the Reactor Protection System (RPS) are adequate to 

maintain the necessary safety margins. 

The automatic enable setpoint is feedwater temperature dependent as a 

result of the subcooling changes that affect the turbine first stage 

pressure/reactor power relationship. For operation with feedwater 

temperature ≥ 420°F, an Allowable Value setpoint of ≤ 26.9% of control 

valves wide open turbine first stage pressure is provided for the bypass 

function. The Allowable Value setpoint is reduced to ≤ 22.5% of control 

valve wide open turbine first stage pressure for operation with a 

feedwater temperature between 370°F and 420°F. 

TCV Fast Closure, Trip Oil Pressure – Low

Fast closure of the TCVs during a generator load rejection results in the 

loss of a heat sink that produces reactor pressure, neutron flux, and heat 

flux transients that must be limited. Therefore, an RPT is initiated on TCV 

Fast Closure, Trip Oil Pressure - Low in anticipation of the transients that 

would result from the closure of these valves. The EOC-RPT decreases 

reactor power and aids the reactor scram in ensuring that the MCPR SL 

is not exceeded during the worst case transient. 

Fast closure of the TCVs is determined by measuring the EHC fluid 

pressure at each control valve. There is one pressure transmitter 

associated with each control valve, and the signal from each transmitter is 

assigned to a separate trip channel. The logic for the TCV Fast Closure, 

Trip Oil Pressure - Low Function is such that two or more TCVs must be 

closed (pressure transmitter trips) to produce an EOC-RPT. This 

Function must be enabled at THERMAL POWER ≥ 40% RTP. This is 

normally accomplished automatically by pressure transmitters sensing 

turbine first stage pressure; therefore, to consider this Function 

OPERABLE, the turbine bypass valves must remain shut at THERMAL 

POWER ≥ 40% RTP. Four channels of TCV Fast Closure, Trip Oil 

Pressure - Low, with two channels in each trip system, are available and 

required to be OPERABLE to ensure that no single instrument failure will 

preclude an EOC-RPT from this Function on a valid signal. The TCV 

Fast Closure, Trip Oil Pressure - Low Allowable Value is selected high 

enough to detect imminent TCV fast closure. 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

This protection is required consistent with the analysis, whenever the 

THERMAL POWER is ≥ 40% RTP with any recirculating pump in fast 

speed. Below 40% RTP or with recirculation pumps in slow speed, the 

Reactor Vessel Steam Dome Pressure - High and the APRM Fixed 

Neutron Flux - High Functions of the RPS are adequate to maintain the 

necessary safety margins. The turbine first stage pressure/reactor power 

relationship for the setpoint of the automatic enable is identical to that 

described for TSV closure. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

A Note has been provided to modify the ACTIONS related to EOC-RPT 

instrumentation channels. Section 1.3, Completion Times, specifies that 

once a Condition has been entered, subsequent divisions, subsystems, 

components, or variables expressed in the Condition, discovered to be 

inoperable or not within limits, will not result in separate entry into the 

Condition. Section 1.3 also specifies that Required Actions of the 

Condition continue to apply for each additional failure, with Completion 

Times based on initial entry into the Condition. However, the Required 

Actions for inoperable EOC-RPT instrumentation channels provide 

appropriate compensatory measures for separate inoperable channels. 

As such, a Note has been provided that allows separate Condition entry 

for each inoperable EOC-RPT instrumentation channel. 

A.1 and A.2

With one or more required channels inoperable, but with EOC-RPT trip 

capability maintained (refer to Required Action B.1 and B.2 Bases), the 

EOC-RPT System is capable of performing the intended function. 

However, the reliability and redundancy of the EOC-RPT instrumentation 

is reduced such that a single failure in the remaining trip system could 

result in the inability of the EOC-RPT System to perform the intended 

function. Therefore, only a limited time is allowed to restore compliance 

with the LCO. Because of the diversity of sensors available to provide trip 

signals, the low probability of extensive numbers of inoperabilities 

affecting all diverse Functions, and the low probability of an event 

requiring the initiation of an EOC-RPT, 72 hours is allowed to restore the 

inoperable channels (Required Action A.1) [or apply the EOC-RPT 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

inoperable MCPR limit]. Alternately, the inoperable channels may be 

placed in trip (Required Action A.2) since this would conservatively 

compensate for the inoperability, restore capability to accommodate a 

single failure, and allow operation to continue. As noted in Required 

Action A.2, placing the channel in trip with no further restrictions is not 

allowed if the inoperable channel is the result of an inoperable breaker, 

since this may not adequately compensate for the inoperable breaker 

(e.g., the breaker may be inoperable such that it will not open). If it is not 

desired to place the channel in trip (e.g., as in the case where placing the 

inoperable channel in trip would result in an RPT), or if the inoperable 

channel is the result of an inoperable breaker, Condition C must be 

entered and its Required Actions taken. 

B.1 and B.2

Required Actions B.1 and B.2 are intended to ensure that appropriate 

actions are taken if multiple, inoperable, untripped channels within the 

same Function result in the Function not maintaining EOC-RPT trip 

capability. A Function is considered to be maintaining EOC-RPT trip 

capability when sufficient channels are OPERABLE or in trip, such that 

the EOC-RPT System will generate a trip signal from the given Function 

on a valid signal and both recirculation pumps can be tripped. This 

requires two channels of the Function, in the same trip system, to each be 

OPERABLE or in trip, and the associated EOC-RPT breakers to be 

OPERABLE or in trip. Alternatively, Required Action B.2 requires the 

MCPR limit for inoperable EOC-RPT, as specified in the COLR, to be 

applied. This also restores the margin to MCPR assumed in the safety 

analysis. 

The 2 hour Completion Time is sufficient for the operator to take 

corrective action, and takes into account the likelihood of an event 

requiring actuation of the EOC-RPT instrumentation during this period. It 

is also consistent with the 2 hour Completion Time provided in LCO 3.2.2, 

Required Action A.1, since this instrumentation's purpose is to preclude a 

MCPR violation. 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

With any Required Action and associated Completion Time not met, 

THERMAL POWER must be reduced to < 40% RTP within 4 hours. 

Alternately, the associated recirculation pump may be removed from 

service since this performs the intended function of the instrumentation. 

The allowed Completion Time of 4 hours is reasonable, based on 

operating experience, to reduce THERMAL POWER to < 40% RTP from 

full power conditions in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

The Surveillances are modified by a Note to indicate that when a channel 

is placed in an inoperable status solely for performance of required 

Surveillances, entry into associated Conditions and Required Actions may 

be delayed for up to 6 hours, provided the associated Function maintains 

EOC-RPT trip capability. Upon completion of the Surveillance, or 

expiration of the 6 hour allowance, the channel must be returned to 

OPERABLE status or the applicable Condition entered and Required 

Actions taken. This Note is based on the reliability analysis (Ref. 5) 

assumption of the average time required to perform channel surveillance. 

That analysis demonstrated that the 6 hour testing allowance does not 

significantly reduce the probability that the recirculation pumps will trip 

when necessary. 

SR 3.3.4.1.1

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. Any setpoint adjustment shall be consistent with 

the assumptions of the current plant specific setpoint methodology. 

The Frequency of 92 days is based on reliability analysis (Ref. 5). 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.4.1.2

The calibration of trip units provides a check of the actual trip setpoints. 

The channel must be declared inoperable if the setting is discovered to be 

less conservative than the Allowable Value specified in SR 3.3.4.1.3. If 

the trip setting is discovered to be less conservative than accounted for in 

the appropriate setpoint methodology, but is not beyond the Allowable 

Value, the channel performance is still within the requirements of the 

plant safety analysis. Under these conditions, the setpoint must be 

readjusted to be equal to or more conservative than accounted for in the 

appropriate setpoint methodology. 

The Frequency of 92 days is based on assumptions of the reliability 

analysis (Ref. 5) and on the methodology included in the determination of 

the trip setpoint. 

SR 3.3.4.1.3

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. This test verifies the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 

The Frequency is based upon the assumption of an 18 month calibration 

interval, in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.4.1.4

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required trip logic for a specific channel. The 

system functional test of the pump breakers is included as a part of this 

test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide 

complete testing of the associated safety function. Therefore, if a breaker 

is incapable of operating, the associated instrument channel would also 

be inoperable. 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance test when performed at the 

18 month Frequency. 

SR 3.3.4.1.5

This SR ensures that an EOC-RPT initiated from the TSV Closure, Trip 

Oil Pressure - Low and TCV Fast Closure, Trip Oil Pressure - Low 

Functions will not be inadvertently bypassed when THERMAL POWER is 

≥ 40% RTP. This involves calibration of the bypass channels. Adequate 

margins for the instrument setpoint methodologies are incorporated into 

the actual setpoint. Because main turbine bypass flow can affect this 

setpoint nonconservatively (THERMAL POWER is derived from first stage 

pressure), the main turbine bypass valves must remain closed at 

THERMAL POWER ≥ 40% RTP to ensure that the calibration remains 

valid. If any bypass channel's setpoint is nonconservative (i.e., the 

Functions are bypassed at ≥ 40% RTP either due to open main turbine 

bypass valves or other reasons), the affected TSV Closure, Trip Oil 

Pressure - Low and TCV Fast Closure, Trip Oil Pressure - Low Functions 

are considered inoperable. Alternatively, the bypass channel can be 

placed in the conservative condition (nonbypass). If placed in the 

nonbypass condition, this SR is met and the channel considered 

OPERABLE. 

The Frequency of 18 months has shown that channel bypass failures 

between successive tests are rare. 

SR 3.3.4.1.6

This SR ensures that the individual channel response times are less than 

or equal to the maximum values assumed in the accident analysis. The 

EOC-RPT SYSTEM RESPONSE TIME acceptance criteria are included 

in Reference 6. 

A Note to the Surveillance states that breaker interruption time may be 

assumed from the most recent performance of SR 3.3.4.1.7. This is 

allowed since the time to open the contacts after energization of the trip 

coil and the arc suppression time are short and do not appreciably 

change, due to the design of the breaker opening device and the fact that 

the breaker is not routinely cycled. 
EOC-RPT Instrumentation 

B 3.3.4.1 

BWR/6 STS B 3.3.4.1-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

EOC-RPT SYSTEM RESPONSE TIME tests are conducted on an 

18 month STAGGERED TEST BASIS. Response times cannot be 

determined at power because operation of final actuated devices is 

required. Therefore, the 18 month Frequency is consistent with the 

typical industry refueling cycle and is based upon plant operating 

experience, which shows that random failures of instrumentation 

components that cause serious response time degradation, but not 

channel failure, are infrequent occurrences. 

SR 3.3.4.1.7

This SR ensures that the RPT breaker interruption time (arc suppression 

time plus time to open the contacts) is provided to the EOC-RPT 

SYSTEM RESPONSE TIME test. The 60 month Frequency of the testing 

is based on the difficulty of performing the test and the reliability of the 

circuit breakers. 

REFERENCES 1. FSAR, Figure [ ] (EOC-RPT instrumentation logic). 

 2. FSAR, Section [5.2.2]. 

 3. FSAR, Sections [15.1.1], [15.1.2], and [15.1.3]. 

 4. FSAR, Sections [5.5.16.1] and [7.6.10]. 

 5. GENE-770-06-1, "Bases for Changes To Surveillance Test Intervals 

And Allowed Out-Of-Service Times For Selected Instrumentation 

Technical Specifications," February 1991. 

 6. FSAR, Section [5.5.16.2]. 
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.4.2 Anticipated Transient Without Scram Recirculation Pump Trip 

 (ATWS-RPT) Instrumentation 

BASES 

BACKGROUND The ATWS-RPT System initiates a recirculation pump trip, adding 

negative reactivity, following events in which a scram does not (but 

should) occur, to lessen the effects of an ATWS event. Tripping the 

recirculation pumps adds negative reactivity from the increase in steam 

voiding in the core area as core flow decreases. When Reactor Vessel 

Water Level - Low Low, Level 2 or Reactor Steam Dome Pressure - High 

setpoint is reached, the recirculation pump motor breakers trip. 

The ATWS-RPT System (Ref. 1) includes sensors, relays, bypass 

capability, circuit breakers, and switches that are necessary to cause 

initiation of a recirculation pump trip. The channels include electronic 

equipment (e.g., trip units) that compares measured input signals with 

pre-established setpoints. When the setpoint is exceeded, the channel 

output relay actuates, which then outputs an ATWS-RPT signal to the trip 

logic. 

The ATWS-RPT consists of two independent trip systems, with two 

channels of Reactor Steam Dome Pressure - High and two channels of 

Reactor Vessel Water Level - Low Low, Level 2, in each trip system. 

Each ATWS-RPT trip system is a two-out-of-two logic for each Function. 

Thus, either two Reactor Water Level - Low Low, Level 2 or two Reactor 

Pressure - High signals are needed to trip a trip system. The outputs of 

the channels in a trip system are combined in a logic so that either trip 

system will trip both recirculation pumps (by tripping the respective fast 

speed and low frequency motor generator (LFMG) motor breakers). 

There is one fast speed motor breaker and one LFMG breaker provided 

for each of the two recirculation pumps for a total of four breakers. The 

output of each trip system is provided to all four breakers. 

APPLICABLE The ATWS-RPT is not assumed in the safety analysis. The ATWS-RPT 

SAFETY initiates an RPT to aid in preserving the integrity of the fuel cladding 

ANALYSES, LCO, following events in which scram does not, but should, occur. ATWS-RPT 

and APPLICABILITY instrumentation satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). 

The OPERABILITY of the ATWS-RPT is dependent on the 

OPERABILITY of the individual instrumentation channel Functions. Each 

Function must have a required number of OPERABLE channels in each 

trip system, with their setpoints within the specified Allowable Value of 

SR 3.3.4.2.4. The actual setpoint is calibrated consistent with applicable 

setpoint methodology assumptions. Channel OPERABILITY also 
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

includes the associated recirculation pump drive motor breakers. A 

channel is inoperable if its actual trip setpoint is not within its required 

Allowable Value. 

Allowable Values are specified for each ATWS-RPT Function specified in 

the LCO. Nominal trip setpoints are specified in the setpoint calculations. 

The nominal setpoints are selected to ensure the setpoints do not exceed 

the Allowable Value between CHANNEL CALIBRATIONS. Operation 

with a trip setpoint less conservative than the nominal trip setpoint, but 

within its Allowable Value, is acceptable. Trip setpoints are those 

predetermined values of output at which an action should take place. The 

setpoints are compared to the actual process parameter (e.g., reactor 

vessel water level), and when the measured output value of the process 

parameter exceeds the setpoint, the associated device (e.g., trip unit) 

changes state. The analytic limits are derived from the limiting values of 

the process parameters obtained from the safety analysis. The Allowable 

Values are derived from the analytic limits corrected for calibration, 

process, and some of the instrument errors. The trip setpoints are then 

determined accounting for the remaining instrument errors (e.g., drift). 

The trip setpoints derived in this manner provide adequate protection 

because instrumentation uncertainties, process effects, calibration 

tolerances, instrument drift, and severe environment errors (for channels 

that must function in harsh environments as defined by 10 CFR 50.49) 

are accounted for. 

The individual Functions are required to be OPERABLE in MODE 1 to 

protect against common mode failures of the Reactor Protection System 

by providing a diverse trip to mitigate the consequences of a postulated 

ATWS event. The Reactor Steam Dome Pressure - High and Reactor 

Vessel Water Level - Low Low, Level 2 Functions are required to be 

OPERABLE in MODE 1, since the reactor is producing significant power 

and the recirculation system could be at high flow. During this MODE, the 

potential exists for pressure increases or low water level, assuming an 

ATWS event. In MODE 2, the reactor is at low power and the 

recirculation system is at low flow; thus, the potential is low for a pressure 

increase or low water level, assuming an ATWS event. Therefore, the 

ATWS-RPT is not necessary. In MODES 3 and 4, the reactor is shut 

down with all control rods inserted; thus, an ATWS event is not significant 

and the possibility of a significant pressure increase or low water level is 

negligible. In MODE 5, the one-rod-out interlock ensures the reactor 

remains subcritical; thus, an ATWS event is not significant. In addition, 

the reactor pressure vessel (RPV) head is not fully tensioned and no 

pressure transient threat to the reactor coolant pressure boundary 

(RCPB) exists. 
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The specific Applicable Safety Analyses and LCO discussions are listed 

below on a Function by Function basis. 

a. Reactor Vessel Water Level - Low Low, Level 2

Low RPV water level indicates the capability to cool the fuel may be 

threatened. Should RPV water level decrease too far, fuel damage could 

result. Therefore, the ATWS-RPT System is initiated at Level 2 to aid in 

maintaining level above the top of the active fuel. The reduction of core 

flow reduces the neutron flux and THERMAL POWER and, therefore, the 

rate of coolant boiloff. 

Reactor vessel water level signals are initiated from four level transmitters 

that sense the difference between the pressure due to a constant column 

of water (reference leg) and the pressure due to the actual water level 

(variable leg) in the vessel. 

Four channels of Reactor Vessel Level - Low Low, Level 2, with two 

channels in each trip system, are available and required to be 

OPERABLE to ensure that no single instrument failure can preclude an 

ATWS-RPT from this Function on a valid signal. The Reactor Vessel 

Water Level - Low Low, Level 2, Allowable Value is chosen so that the 

system will not initiate after a Level 3 scram with feedwater still available, 

and for convenience with the reactor core isolation cooling (RCIC) 

initiation. 

b. Reactor Steam Dome Pressure - High

Excessively high RPV pressure may rupture the RCPB. An increase in 

the RPV pressure during reactor operation compresses the steam voids 

and results in a positive reactivity insertion. This increases neutron flux 

and THERMAL POWER, which could potentially result in fuel failure and 

RPV overpressurization. The Reactor Steam Dome Pressure - High 

Function initiates an RPT for transients that result in a pressure increase, 

counteracting the pressure increase by rapidly reducing core power 

generation. For the overpressurization event, the RPT aids in the 

termination of the ATWS event and, along with the safety/relief valves 

(S/RVs), limits the peak RPV pressure to less than the ASME Section III 

Code Service Level C limits (1500 psig). 
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Reactor Steam Dome Pressure - High signals are initiated from four 

pressure transmitters that monitor reactor steam dome pressure. Four 

channels of Reactor Steam Dome Pressure - High, with two channels in 

each trip system, are available and required to be OPERABLE to ensure 

that no single instrument failure can preclude an ATWS-RPT from this 

Function on a valid signal. The Reactor Steam Dome Pressure - High 

Allowable Value is chosen to provide an adequate margin to the ASME 

Section III Code Service Level C allowable Reactor Coolant System 

pressure. 

ACTIONS A Note has been provided to modify the ACTIONS related to ATWS-RPT 

instrumentation channels. Section 1.3, Completion Times, specifies that 

once a Condition has been entered, subsequent divisions, subsystems, 

components, or variables expressed in the Condition, discovered to be 

inoperable or not within limits, will not result in separate entry into the 

Condition. Section 1.3 also specifies that Required Actions of the 

Condition continue to apply for each additional failure, with Completion 

Times based on initial entry into the Condition. However, the Required 

Actions for inoperable ATWS-RPT instrumentation channels provide 

appropriate compensatory measures for separate inoperable channels. 

As such, a Note has been provided that allows separate Condition entry 

for each inoperable ATWS-RPT instrumentation channel. 

A.1 and A.2

With one or more channels inoperable, but with ATWS-RPT capability for 

each Function maintained (refer to Required Action B.1 and C.1 Bases), 

the ATWS-RPT System is capable of performing the intended function. 

However, the reliability and redundancy of the ATWS-RPT 

instrumentation is reduced, such that a single failure in the remaining trip 

system could result in the inability of the ATWS-RPT System to perform 

the intended function. Therefore, only a limited time is allowed to restore 

the inoperable channels to OPERABLE status. Because of the diversity 

of sensors available to provide trip signals, the low probability of 

extensive numbers of inoperabilities affecting all diverse Functions, and 

the low probability of an event requiring the initiation of ATWS-RPT, 

14 days is provided to restore the inoperable channel (Required 

Action A.1). Alternately, the inoperable channel may be placed in trip 

(Required Action A.2), since this would conservatively compensate for the 

inoperability, restore capability to accommodate a single failure, and allow 

operation to continue. As noted, placing the channel in trip with no further 

restrictions is not allowed if the inoperable channel is the result of an 
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

inoperable breaker, since this may not adequately compensate for the 

inoperable breaker (e.g., the breaker may be inoperable such that it will 

not open). If it is not desirable to place the channel in trip (e.g., as in the 

case where placing the inoperable channel would result in an RPT), or if 

the inoperable channel is the result of an inoperable breaker, Condition D 

must be entered and its Required Actions taken. 

B.1

Required Action B.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within the same Function 

result in the Function not maintaining ATWS-RPT trip capability. A 

Function is considered to be maintaining ATWS-RPT trip capability when 

sufficient channels are OPERABLE or in trip such that the ATWS-RPT 

System will generate a trip signal from the given Function on a valid 

signal, and both recirculation pumps can be tripped. This requires two 

channels of the Function in the same trip system to each be OPERABLE 

or in trip, and the four motor breakers (two fast speed and two LFMG) to 

be OPERABLE or in trip. 

The 72 hour Completion Time is sufficient for the operator to take 

corrective action (e.g., restoration or tripping of channels) and takes into 

account the likelihood of an event requiring actuation of the ATWS-RPT 

instrumentation during this period and the fact that one Function is still 

maintaining ATWS-RPT trip capability. 

C.1

Required Action C.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within both Functions 

result in both Functions not maintaining ATWS-RPT trip capability. The 

description of a Function maintaining ATWS-RPT trip capability is 

discussed in the Bases for Required Action B.1, above. 

The 1 hour Completion Time is sufficient for the operator to take 

corrective action and takes into account the likelihood of an event 

requiring actuation of the ATWS-RPT instrumentation during this period. 
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1 and D.2

With any Required Action and associated Completion Time not met, the 

plant must be brought to a MODE or other specified condition in which the 

LCO does not apply. To achieve this status, the plant must be brought to 

at least MODE 2 within 6 hours (Required Action D.2). Alternately, the 

associated recirculation pump may be removed from service since this 

performs the intended Function of the instrumentation (Required 

Action D.1). The allowed Completion Time of 6 hours is reasonable, 

based on operating experience, both to reach MODE 2 from full power 

conditions and to remove a recirculation pump from service in an orderly 

manner and without challenging plant systems. 

Required Action D.1 is modified by a Note which states that the Required 

Action is only applicable if the inoperable channel is the result of an 

inoperable RPT breaker. The Note clarifies the situations under which 

the associated Required Action would be the appropriate Required 

Action. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

The Surveillances are modified by a Note to indicate that when a channel 

is placed in an inoperable status solely for performance of required 

Surveillances, entry into associated Conditions and Required Actions may 

be delayed for up to 6 hours provided the associated Function maintains 

ATWS-RPT trip capability. Upon completion of the Surveillance, or 

expiration of the 6 hour allowance, the channel must be returned to 

OPERABLE status or the applicable Condition entered and Required 

Actions taken. This Note is based on the reliability analysis (Ref. 2) 

assumption of the average time required to perform channel surveillance. 

That analysis demonstrated that the 6 hour testing allowance does not 

significantly reduce the probability that the recirculation pumps will trip 

when necessary. 
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.4.2.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 

Agreement criteria are determined by the plant staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency is based upon operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channels during normal operational use of 

the displays associated with the required channels of this LCO. 

SR 3.3.4.2.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 2. 
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.4.2.3

Calibration of trip units provides a check of the actual trip setpoints. The 

channel must be declared inoperable if the trip setting is discovered to be 

less conservative than the Allowable Value specified in SR 3.3.4.2.4. If 

the trip setting is discovered to be less conservative than the setting 

accounted for in the appropriate setpoint methodology, but is not beyond 

the Allowable Value, the channel performance is still within the 

requirements of the plant safety analysis. Under these conditions, the 

setpoint must be readjusted to be equal to or more conservative than 

accounted for in the appropriate setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 2. 

SR 3.3.4.2.4

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies that the channel responds to the 

measured parameter within the necessary range and accuracy. 

CHANNEL CALIBRATION leaves the channel adjusted to account for 

instrument drifts between successive calibrations consistent with the plant 

specific setpoint methodology. 

The Frequency is based upon the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.4.2.5

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required trip logic for a specific channel. The 

system functional test of the pump breakers, included as part of this 

Surveillance, overlaps the LOGIC SYSTEM FUNCTIONAL TEST to 

provide complete testing of the assumed safety function. Therefore, if a 

breaker is incapable of operating, the associated instrument channel(s) 

would be inoperable. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

18 month Frequency.
ATWS-RPT Instrumentation 

B 3.3.4.2 

BWR/6 STS B 3.3.4.2-9 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Figure [ ]. 

 2. NEDE-770-06-1, "Bases For Changes To Surveillance Test Intervals 

and Allowed Out-of-Service Times For Selected Instrumentation 

Technical Specifications," February 1991. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.5.1 Emergency Core Cooling System (ECCS) Instrumentation 

BASES 

BACKGROUND The purpose of the ECCS instrumentation is to initiate appropriate 

responses from the systems to ensure that fuel is adequately cooled in 

the event of a design basis accident or transient. 

For most anticipated operational occurrences (AOOs) and Design Basis 

Accidents (DBAs), a wide range of dependent and independent 

parameters are monitored. 

The ECCS instrumentation actuates low pressure core spray (LPCS), low 

pressure coolant injection (LPCI), high pressure core spray (HPCS), 

Automatic Depressurization System (ADS), and the diesel generators 

(DGs). The equipment involved with each of these systems is described 

in the Bases for LCO 3.5.1, "ECCS - Operating." 

Low Pressure Core Spray System

The LPCS System may be initiated by either automatic or manual means. 

Automatic initiation occurs for conditions of Reactor Vessel Water Level - 

Low Low Low, Level 1 or Drywell Pressure - High. Each of these diverse 

variables is monitored by two redundant transmitters, which are, in turn, 

connected to two trip units. The outputs of the four trip units (two trip 

units from each of the two variables) are connected to relays whose 

contacts are arranged in a one-out-of-two taken twice logic. The high 

drywell pressure initiation signal is a sealed in signal and must be 

manually reset. The logic can also be initiated by use of a manual push 

button. Upon receipt of an initiation signal, the LPCS pump is started 

immediately after power is available. 

The LPCS test line isolation valve, which is also a primary containment 

isolation valve (PCIV), is closed on a LPCS initiation signal to allow full 

system flow assumed in the accident analysis and maintains containment 

isolation in the event LPCS is not operating. 

The LPCS pump discharge flow is monitored by a flow transmitter. When 

the pump is running and discharge flow is low enough that pump 

overheating may occur, the minimum flow return line valve is opened. 

The valve is automatically closed if flow is above the minimum flow 

setpoint to allow the full system flow assumed in the accident analysis. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The LPCS System also monitors the pressure in the reactor vessel to 

ensure that, before the injection valve opens, the reactor pressure has 

fallen to a value below the LPCS System's maximum design pressure. 

The variable is monitored by four redundant transmitters, which are, in 

turn, connected to trip units. The outputs of the trip units are connected 

to relays whose contacts are arranged in a one-out-of-two taken twice 

logic. 

Low Pressure Coolant Injection Subsystems

The LPCI is an operating mode of the Residual Heat Removal (RHR) 

System, with three LPCI subsystems. The LPCI subsystems may be 

initiated by automatic or manual means. Automatic initiation occurs for 

conditions of Reactor Vessel Water Level - Low Low Low, Level 1 or 

Drywell Pressure - High. Each of these diverse variables is monitored by 

two redundant transmitters per Division, which are, in turn, connected to 

two trip units. The outputs of the four Division 2 LPCI (loops B and C) trip 

units (two trip units from each of the two variables) are connected to 

relays whose contacts are arranged in a one-out-of-two taken twice logic. 

The Division 1 LPCI (loop A) receives its initiation signal from the LPCS 

logic, which uses a similar one-out-of-two taken twice logic. The two 

Divisions can also be initiated by use of a manual push button (one per 

Division). Once an initiation signal is received by the LPCI control 

circuitry, the signal is sealed in until manually reset. 

Upon receipt of an initiation signal, the LPCI Pump C is started 

immediately after power is available while LPCI A and LPCI B pumps are 

started after a 5 second delay, to limit the loading on the standby power 

sources. 

Each LPCI subsystem's discharge flow is monitored by a flow transmitter. 

When a pump is running and discharge flow is low enough that pump 

overheating may occur, the respective minimum flow return line valve is 

opened. The valve is automatically closed if flow is above the minimum 

flow setpoint to allow the full system flow assumed in the analyses. 

The RHR test line suppression pool cooling isolation and suppression 

pool spray isolation valves (which are also PCIVs) are closed on a LPCI 

initiation signal to allow full system flow assumed in the accident analysis 

and maintain containment isolated in the event LPCI is not operating. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The LPCI subsystems monitor the pressure in the reactor vessel to 

ensure that, prior to an injection valve opening, the reactor pressure has 

fallen to a value below the LPCI subsystem's maximum design pressure. 

The variable is monitored by four redundant transmitters per Division, 

which are, in turn, connected to four trip units. The outputs of the four 

Division 2 LPCI (loops B and C) trip units are connected to relays whose 

contacts are arranged in a one-out-of-two taken twice logic. The 

Division 1 LPCI (loop A) receives its signal from the LPCS logic, which 

uses a similar one-out-of-two taken twice logic. 

High Pressure Core Spray System

The HPCS System may be initiated by either automatic or manual means. 

Automatic initiation occurs for conditions of Reactor Vessel Water Level - 

Low Low, Level 2 or Drywell Pressure - High. The outputs of the trip units 

are connected to relays whose contacts are arranged in a one-out-of-two 

taken twice logic for each variable. The HPCS System initiation signal is 

a sealed in signal and must be manually reset. 

The HPCS pump discharge flow is monitored by a flow transmitter. When 

the pump is running and discharge flow is low enough that pump 

overheating may occur, the minimum flow return line valve is opened. 

The valve is automatically closed if flow is above the minimum flow 

setpoint to allow full system flow assumed in the accident analyses. 

The HPCS test line isolation valve (which is also a PCIV) is closed on a 

HPCS initiation signal to allow full system flow assumed in the accident 

analyses and maintain containment isolated in the event HPCS is not 

operating. 

The HPCS System also monitors the water levels in the condensate 

storage tank (CST) and the suppression pool, since these are the two 

sources of water for HPCS operation. Reactor grade water in the CST is 

the normal and preferred source. Upon receipt of a HPCS initiation 

signal, the CST suction valve is automatically signaled to open (it is 

normally in the open position), unless the suppression pool suction valve 

is open. If the water level in the CST falls below a preselected level, first 

the suppression pool suction valve automatically opens, and then the 

CST suction valve automatically closes. Two level transmitters are used 

to detect low water level in the CST. Either transmitter and associated 

trip unit can cause the suppression pool suction valve to open and the 

CST suction valve to close. The suppression pool suction valve also 

automatically opens and the CST suction valve closes if high water level 

is detected in the suppression pool. To prevent losing suction to the 

pump, the suction valves are interlocked so that one suction path must be 

open before the other automatically closes. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-4 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The HPCS System provides makeup water to the reactor until the reactor 

vessel water level reaches the high water level (Level 8) trip, at which 

time the HPCS injection valve closes. The HPCS pump will continue to 

run on minimum flow. The logic is two-out-of-two to provide high 

reliability of the HPCS System. The injection valve automatically reopens 

if a low low water level signal is subsequently received. 

Automatic Depressurization System

ADS may be initiated by either automatic or manual means. Automatic 

initiation occurs when signals indicating Reactor Vessel Water Level - 

Low Low Low, Level 1; Drywell Pressure - High or ADS Bypass Timer; 

confirmed Reactor Vessel Water Level - Low, Level 3; and either LPCS or 

LPCI Pump Discharge Pressure - High are all present, and the ADS 

Initiation Timer has timed out. There are two transmitters each for 

Reactor Vessel Water Level - Low Low Low, Level 1 and Drywell 

Pressure - High, and one transmitter for confirmed Reactor Vessel Water 

Level - Low, Level 3 in each of the two ADS trip systems. Each of these 

transmitters connects to a trip unit, which then drives a relay whose 

contacts form the initiation logic. 

Each ADS trip system (trip system A and trip system B) includes a time 

delay between satisfying the initiation logic and the actuation of the ADS 

valves. The time delay chosen is long enough that the HPCS has time to 

operate to recover to a level above Level 1, yet not so long that the LPCI 

and LPCS systems are unable to adequately cool the fuel if the HPCS 

fails to maintain level. An alarm in the control room is annunciated when 

either of the timers is running. Resetting the ADS initiation signals resets 

the ADS Initiation Timers. 

The ADS also monitors the discharge pressures of the three LPCI pumps 

and the LPCS pump. Each ADS trip system includes two discharge 

pressure permissive transmitters from each of the two low pressure 

ECCS pumps in the associated Division (i.e., Division 1 ECCS inputs to 

ADS trip system A and Division 2 ECCS inputs to ADS trip system B). 

The signals are used as a permissive for ADS actuation, indicating that 

there is a source of core coolant available once the ADS has 

depressurized the vessel. Any one of the four low pressure pumps 

provides sufficient core coolant flow to permit automatic depressurization. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-5 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The ADS logic in each trip system is arranged in two strings. One string 

has a contact from each of the following variables: Reactor Vessel Water 

Level - Low Low Low, Level 1; Drywell Pressure - High or ADS Bypass 

Timer; Reactor Vessel Water Level - Low, Level 3; ADS Initiation Timer; 

and two low pressure ECCS Discharge Pressure - High contacts. The 

other string has a contact from each of the following variables: Reactor 

Vessel Water Level - Low Low Low, Level 1; Drywell Pressure - High; 

ADS Bypass Timer; and two low pressure ECCS Discharge Pressure - 

High contacts. To initiate an ADS trip system, the following applicable 

contacts must close in the associated string: Reactor Vessel Water Level 

- Low Low Low, Level 1; Drywell Pressure - High or ADS Bypass Timer; 

Reactor Vessel Water Level - Low, Level 3; ADS Initiation Timer; and one 

of the two low pressure ECCS Discharge Pressure - High contacts. 

Either ADS trip system A or trip system B will cause all the ADS relief 

valves to open. Once the Drywell Pressure - High or ADS initiation 

signals are present, they are individually sealed in until manually reset. 

Manual initiation is accomplished by operating the control switch for each 

safety/relief valve (S/RV) associated with the ADS. Manual inhibit 

switches are provided in the control room for ADS; however, their function 

is not required for ADS OPERABILITY (provided ADS is not inhibited 

when required to be OPERABLE). 

Diesel Generators

The Division 1, 2, and 3 DGs may be initiated by either automatic or 

manual means. Automatic initiation occurs for conditions of Reactor 

Vessel Water Level - Low Low Low, Level 1 or Drywell Pressure - High 

for DGs 11 and 12, and Reactor Vessel Water Level - Low Low, Level 2 

or Drywell Pressure - High for DG 13. The DGs are also initiated upon 

loss of voltage signals. (Refer to Bases for LCO 3.3.8.1, "Loss of Power 

(LOP) Instrumentation," for a discussion of these signals.) Each of these 

diverse variables is monitored by two redundant transmitters per DG, 

which are, in turn, connected to two trip units. The outputs of the four 

divisionalized trip units (two trip units from each of the two variables) are 

connected to relays whose contacts are connected to a one-out-of-two 

taken twice logic. The DGs receive their initiation signals from the 

associated Divisions' ECCS logic (i.e., DG 11 receives an initiation signal 

from Division 1 ECCS (LPCS and LPCI A); DG 12 receives an initiation 

signal from Division 2 ECCS (LPCI B and LPCI C); and DG 13 receives 

an initiation signal from Division 3 ECCS (HPCS)). The DGs can also be 

started manually from the control room and locally in the associated DG 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-6 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

room. The DG initiation signal is a sealed in signal and must be manually 

reset. The DG initiation logic is reset by resetting the associated ECCS 

initiation logic. Upon receipt of a LOCA initiation signal, each DG is 

automatically started, is ready to load in approximately 10 seconds, and 

will run in standby conditions (rated voltage and speed, with the DG 

output breaker open). The DGs will only energize their respective 

Engineered Safety Feature (ESF) buses if a loss of offsite power occurs. 

(Refer to Bases for LCO 3.3.8.1.) 

APPLICABLE The actions of the ECCS are explicitly assumed in the safety analyses of 

SAFETY References 1, 2, and 3. The ECCS is initiated to preserve the integrity of 

ANALYSES, LCO, the fuel cladding by limiting the post LOCA peak cladding temperature to 

and APPLICABILITY less than the 10 CFR 50.46 limits. 

ECCS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

Certain instrumentation Functions are retained for other reasons and are 

described below in the individual Functions discussion. 

The OPERABILITY of the ECCS instrumentation is dependent upon the 

OPERABILITY of the individual instrumentation channel Functions 

specified in Table 3.3.5.1-1. Each Function must have a required number 

of OPERABLE channels, with their setpoints within the specified 

Allowable Values, where appropriate. The actual setpoint is calibrated 

consistent with applicable setpoint methodology assumptions. Each 

ECCS subsystem must also respond within its assumed response time. 

Table 3.3.5.1-1 is modified by two footnotes. Footnote (a) is added to 

clarify that the associated functions are required to be OPERABLE in 

MODES 4 and 5 only when their supported ECCS are required to be 

OPERABLE per LCO 3.5.2, ECCS - Shutdown. Footnote (b) is added to 

show that certain ECCS instrumentation Functions also perform DG 

initiation and actuation of other Technical Specifications (TS) equipment. 

Allowable Values are specified for each ECCS Function specified in the 

table. Nominal trip setpoints are specified in the setpoint calculations. 

The nominal setpoints are selected to ensure that the setpoints do not 

exceed the Allowable Value between CHANNEL CALIBRATIONS. 

Operation with a trip setpoint less conservative than the nominal trip 

setpoint, but within its Allowable Value, is acceptable. A channel is 

inoperable if its actual trip setpoint is not within its required Allowable 

Value. Trip setpoints are those predetermined values of output at which 

an action should take place. The setpoints are compared to the actual 

process parameter (e.g., reactor vessel water level), and when the 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-7 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

measured output value of the process parameter exceeds the setpoint, 

the associated device (e.g., trip unit) changes state. The analytic limits 

are derived from the limiting values of the process parameters obtained 

from the safety analysis. The Allowable Values are derived from the 

analytic limits, corrected for calibration, process, and some of the 

instrument errors. The trip setpoints are then determined, accounting for 

the remaining instrument errors (e.g., drift). The trip setpoints derived in 

this manner provide adequate protection because instrumentation 

uncertainties, process effects, calibration tolerances, instrument drift, and 

severe environment errors (for channels that must function in harsh 

environments as defined by 10 CFR 50.49) are accounted for. 

In general, the individual Functions are required to be OPERABLE in the 

MODES or other specified conditions that may require ECCS (or DG) 

initiation to mitigate the consequences of a design basis accident or 

transient. To ensure reliable ECCS and DG function, a combination of 

Functions is required to provide primary and secondary initiation signals. 

The specific Applicable Safety Analyses, LCO, and Applicability 

discussions are listed below on a Function by Function basis. 

Low Pressure Core Spray and Low Pressure Coolant Injection Systems

1.a, 2.a. Reactor Vessel Water Level - Low Low Low, Level 1

Low reactor pressure vessel (RPV) water level indicates that the 

capability to cool the fuel may be threatened. Should RPV water level 

decrease too far, fuel damage could result. The low pressure ECCS and 

associated DGs are initiated at Level 1 to ensure that core spray and 

flooding functions are available to prevent or minimize fuel damage. The 

Reactor Vessel Water Level - Low Low Low, Level 1 is one of the 

Functions assumed to be OPERABLE and capable of initiating the ECCS 

during the transients analyzed in References 1 and 3. In addition, the 

Reactor Vessel Water Level - Low Low Low, Level 1 Function is directly 

assumed in the analysis of the recirculation line break (Ref. 2). The core 

cooling function of the ECCS, along with the scram action of the Reactor 

Protection System (RPS), ensures that the fuel peak cladding 

temperature remains below the limits of 10 CFR 50.46. 

Reactor Vessel Water Level - Low Low Low, Level 1 signals are initiated 

from four level transmitters that sense the difference between the 

pressure due to a constant column of water (reference leg) and the 

pressure due to the actual water level (variable leg) in the vessel. The 

Reactor Vessel Water Level - Low Low Low, Level 1 Allowable Value is 

chosen to allow time for the low pressure core flooding systems to 

activate and provide adequate cooling. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-8 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Two channels of Reactor Vessel Water Level - Low Low Low, Level 1 

Function per associated Division are only required to be OPERABLE 

when the associated ECCS is required to be OPERABLE, to ensure that 

no single instrument failure can preclude ECCS initiation. (Two channels 

input to LPCS and LPCI A, while the other two channels input to LPCI B 

and LPCI C.) Per Footnote (a) to Table 3.3.5.1-1, this ECCS Function is 

only required to be OPERABLE in MODES 4 and 5 whenever the 

associated ECCS is required to be OPERABLE per LCO 3.5.2. Refer to 

LCO 3.5.1 and LCO 3.5.2, "ECCS - Shutdown," for Applicability Bases for 

the low pressure ECCS subsystems; LCO 3.8.1, "AC Sources - 

Operating," and LCO 3.8.2, "AC Sources - Shutdown," for Applicability 

Bases for the DGs. 

1.b, 2.b. Drywell Pressure – High

High pressure in the drywell could indicate a break in the reactor coolant 

pressure boundary (RCPB). The low pressure ECCS and associated 

DGs are initiated upon receipt of the Drywell Pressure - High Function in 

order to minimize the possibility of fuel damage. The core cooling 

function of the ECCS, along with the scram action of the RPS, ensures 

that the fuel peak cladding temperature remains below the limits of 

10 CFR 50.46. 

High drywell pressure signals are initiated from four pressure transmitters 

that sense drywell pressure. The Allowable Value was selected to be as 

low as possible and be indicative of a LOCA inside primary containment. 

Negative barometric fluctuations are accounted for in the Allowable 

Value. 

The Drywell Pressure - High Function is required to be OPERABLE when 

the associated ECCS and DGs are required to be OPERABLE in 

conjunction with times when the primary containment is required to be 

OPERABLE. Thus, four channels of the LPCS and LPCI Drywell 

Pressure - High Function are required to be OPERABLE in MODES 1, 2, 

and 3 to ensure that no single instrument failure can preclude ECCS 

initiation. (Two channels input to LPCS and LPCI A, while the other two 

channels input to LPCI B and LPCI C.) In MODES 4 and 5, the Drywell 

Pressure - High Function is not required since there is insufficient energy 

in the reactor to pressurize the primary containment to Drywell Pressure - 

High setpoint. Refer to LCO 3.5.1 for Applicability Bases for the low 

pressure ECCS subsystems and to LCO 3.8.1 for Applicability Bases for 

the DGs. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-9 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

1.c, 2.c. Low Pressure Coolant Injection Pump A and Pump B Start -

Time Delay Relay

The purpose of this time delay is to stagger the start of the two ECCS 

pumps that are in each of Divisions 1 and 2, thus limiting the starting 

transients on the 4.16 kV emergency buses. This Function is only 

necessary when power is being supplied from the standby power sources 

(DG). However, since the time delay does not degrade ECCS operation, 

it remains in the pump start logic at all times. The LPCI Pump Start - 

Time Delay Relays are assumed to be OPERABLE in the accident and 

transient analyses requiring ECCS initiation. That is, the analysis 

assumes that the pumps will initiate when required and excess loading 

will not cause failure of the power sources. 

There are two LPCI Pump Start - Time Delay Relays, one in each of the 

RHR "A" and RHR "B" pump start logic circuits. While each time delay 

relay is dedicated to a single pump start logic, a single failure of a LPCI 

Pump Start - Time Delay Relay could result in the failure of the two low 

pressure ECCS pumps, powered from the same ESF bus, to perform 

their intended function within the assumed ECCS RESPONSE TIMES 

(e.g., as in the case where both ECCS pumps on one ESF bus start 

simultaneously due to an inoperable time delay relay). This still leaves 

two of the four low pressure ECCS pumps OPERABLE; thus, the single 

failure criterion is met (i.e., loss of one instrument does not preclude 

ECCS initiation). The Allowable Value for the LPCI Pump Start - Time 

Delay Relay is chosen to be long enough so that most of the starting 

transient of the first pump is complete before starting the second pump on 

the same 4.16 kV emergency bus and short enough so that ECCS 

operation is not degraded. 

Each LPCI Pump Start - Time Delay Relay Function is only required to be 

OPERABLE when the associated LPCI subsystem is required to be 

OPERABLE. Per Footnote (a) to Table 3.3.5.1-1, this ECCS Function is 

only required to be OPERABLE in MODES 4 and 5 whenever the 

associated ECCS is required to be OPERABLE per LCO 3.5.2. Refer to 

LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the LPCI 

subsystems. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-10 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

1.d, 2.d. Reactor Steam Dome Pressure - Low (Injection Permissive)

Low reactor steam dome pressure signals are used as permissives for 

the low pressure ECCS subsystems. This ensures that, prior to opening 

the injection valves of the low pressure ECCS subsystems, the reactor 

pressure has fallen to a value below these subsystems' maximum design 

pressure. The Reactor Steam Dome Pressure - Low is one of the 

Functions assumed to be OPERABLE and capable of permitting initiation 

of the ECCS during the transients analyzed in References 1 and 3. In 

addition, the Reactor Steam Dome Pressure - Low Function is directly 

assumed in the analysis of the recirculation line break (Ref. 2). The core 

cooling function of the ECCS, along with the scram action of the RPS, 

ensures that the fuel peak cladding temperature remains below the limits 

of 10 CFR 50.46. 

The Reactor Steam Dome Pressure - Low signals are initiated from four 

pressure transmitters that sense the reactor dome pressure. The four 

pressure transmitters each drive a master and slave trip unit (for a total of 

eight trip units). 

The Allowable Value is low enough to prevent overpressurizing the 

equipment in the low pressure ECCS, but high enough to ensure that the 

ECCS injection prevents the fuel peak cladding temperature from 

exceeding the limits of 10 CFR 50.46. 

Three channels of Reactor Steam Dome Pressure - Low Function per 

associated Division are only required to be OPERABLE when the 

associated ECCS is required to be OPERABLE to ensure that no single 

instrument failure can preclude ECCS initiation. (Three channels are 

required for LPCS and LPCI A, while three other channels are required 

for LPCI B and LPCI C.) Per Footnote (a) to Table 3.3.5.1-1, this ECCS 

Function is only required to be OPERABLE in MODES 4 and 5 whenever 

the associated ECCS is required to be OPERABLE per LCO 3.5.2. Refer 

to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure 

ECCS subsystems. 

1.e, 1.f, 2.e. Low Pressure Coolant Injection and Low Pressure Core 

Spray Pump Discharge Flow - Low (Bypass)

The minimum flow instruments are provided to protect the associated low 

pressure ECCS pump from overheating when the pump is operating and 

the associated injection valve is not fully open. The minimum flow line 

valve is opened when low flow is sensed, and the valve is automatically 

closed when the flow rate is adequate to protect the pump. The LPCI and 

LPCS Pump Discharge Flow - Low Functions are assumed to be 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-11 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

OPERABLE and capable of closing the minimum flow valves to ensure 

that the low pressure ECCS flows assumed during the transients and 

accidents analyzed in References 1, 2, and 3 are met. The core cooling 

function of the ECCS, along with the scram action of the RPS, ensures 

that the fuel peak cladding temperature remains below the limits of 

10 CFR 50.46. 

One flow transmitter per ECCS pump is used to detect the associated 

subsystems' flow rates. The logic is arranged such that each transmitter 

causes its associated minimum flow valve to open. The logic will close 

the minimum flow valve once the closure setpoint is exceeded. The LPCI 

minimum flow valves are time delayed such that the valves will not open 

for 10 seconds after the switches detect low flow. The time delay is 

provided to limit reactor vessel inventory loss during the startup of the 

RHR shutdown cooling mode (for RHR A and RHR B). The Pump 

Discharge Flow - Low Allowable Values are high enough to ensure that 

the pump flow rate is sufficient to protect the pump, yet low enough to 

ensure that the closure of the minimum flow valve is initiated to allow full 

flow into the core. 

Each channel of Pump Discharge Flow - Low Function (one LPCS 

channel and three LPCI channels) is only required to be OPERABLE 

when the associated ECCS is required to be OPERABLE, to ensure that 

no single instrument failure can preclude the ECCS function. Refer to 

LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure 

ECCS subsystems. 

1.g, 2.f. Manual Initiation

The Manual Initiation push button channels introduce signals into the 

appropriate ECCS logic to provide manual initiation capability and are 

redundant to the automatic protective instrumentation. There is one push 

button for each of the two Divisions of low pressure ECCS (i.e., Division 1 

ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI B and LPCI C). 

The Manual Initiation Function is not assumed in any accident or transient 

analyses in the FSAR. However, the Function is retained for overall 

redundancy and diversity of the low pressure ECCS function as required 

by the NRC in the plant licensing basis. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-12 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

There is no Allowable Value for this Function since the channels are 

mechanically actuated based solely on the position of the push buttons. 

Each channel of the Manual Initiation Function (one channel per Division) 

is only required to be OPERABLE when the associated ECCS is required 

to be OPERABLE. Per Footnote (a) to Table 3.3.5.1-1, this ECCS 

Function is only required to be OPERABLE in MODES 4 and 5 whenever 

the associated ECCS is required to be OPERABLE per LCO 3.5.2. Refer 

to LCO 3.5.1 and LCO 3.5.2 for Applicability Bases for the low pressure 

ECCS subsystems. 

High Pressure Core Spray System

3.a. Reactor Vessel Water Level - Low Low, Level 2

Low RPV water level indicates that the capability to cool the fuel may be 

threatened. Should RPV water level decrease too far, fuel damage could 

result. Therefore, the HPCS System and associated DG is initiated at 

Level 2 to maintain level above the top of the active fuel. The Reactor 

Vessel Water Level - Low Low, Level 2 is one of the Functions assumed 

to be OPERABLE and capable of initiating HPCS during the transients 

analyzed in References 1 and 3. The Reactor Vessel Water Level - Low 

Low, Level 2 Function associated with HPCS is directly assumed in the 

analysis of the recirculation line break (Ref. 2). The core cooling function 

of the ECCS, along with the scram action of the RPS, ensures that the 

fuel peak cladding temperature remains below the limits of 10 CFR 50.46. 

Reactor Vessel Water Level - Low Low, Level 2 signals are initiated from 

four level transmitters that sense the difference between the pressure due 

to a constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. 

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value is 

chosen such that for complete loss of feedwater flow, the Reactor Core 

Isolation Cooling (RCIC) System flow with HPCS assumed to fail will be 

sufficient to avoid initiation of low pressure ECCS at Reactor Vessel 

Water Level - Low Low Low, Level 1. 

Four channels of Reactor Vessel Water Level - Low Low, Level 2 

Function are only required to be OPERABLE when HPCS is required to 

be OPERABLE to ensure that no single instrument failure can preclude 

HPCS initiation. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS 

Applicability Bases. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-13 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3.b. Drywell Pressure – High

High pressure in the drywell could indicate a break in the RCPB. The 

HPCS System and associated DG are initiated upon receipt of the 

Drywell Pressure - High Function in order to minimize the possibility of 

fuel damage. The Drywell Pressure - High Function is not assumed in the 

analysis of the recirculation line break (Ref. 2); that is, HPCS is assumed 

to be initiated on Reactor Water Level - Low Low, Level 2. The core 

cooling function of the ECCS, along with the scram action of the RPS, 

ensures that the fuel peak cladding temperature remains below the limits 

of 10 CFR 50.46. 

Drywell Pressure - High signals are initiated from four pressure 

transmitters that sense drywell pressure. The Allowable Value was 

selected to be as low as possible and be indicative of a LOCA inside 

primary containment. 

The Drywell Pressure - High Function is required to be OPERABLE when 

HPCS is required to be OPERABLE in conjunction with times when the 

primary containment is required to be OPERABLE. Thus, four channels 

of the HPCS Drywell Pressure - High Function are required to be 

OPERABLE in MODES 1, 2, and 3, to ensure that no single instrument 

failure can preclude ECCS initiation. In MODES 4 and 5, the Drywell 

Pressure - High Function is not required since there is insufficient energy 

in the reactor to pressurize the drywell to the Drywell Pressure - High 

Function's setpoint. Refer to LCO 3.5.1 for the Applicability Bases for the 

HPCS System. 

3.c. Reactor Vessel Water Level - High, Level 8

High RPV water level indicates that sufficient cooling water inventory 

exists in the reactor vessel such that there is no danger to the fuel. 

Therefore, the Level 8 signal is used to close the HPCS injection valve to 

prevent overflow into the main steam lines (MSLs). The Reactor Vessel 

Water Level - High, Level 8 Function is not assumed in the accident and 

transient analyses. It was retained since it is a potentially significant 

contributor to risk. Reactor Vessel Water Level - High, Level 8 signals for 

HPCS are initiated from two level transmitters from the narrow range 

water level measurement instrumentation. Both Level 8 signals are 

required in order to close the HPCS injection valve. This ensures that no 

single instrument failure can preclude HPCS initiation. The Reactor 

Vessel Water Level - High, Level 8 Allowable Value is chosen to isolate 

flow from the HPCS System prior to water overflowing into the MSLs. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-14 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Two channels of Reactor Vessel Water Level - High, Level 8 Function are 

only required to be OPERABLE when HPCS is required to be 

OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability 

Bases. 

3.d. Condensate Storage Tank Level – Low

Low level in the CST indicates the unavailability of an adequate supply of 

makeup water from this normal source. Normally the suction valves 

between HPCS and the CST are open and, upon receiving a HPCS 

initiation signal, water for HPCS injection would be taken from the CST. 

However, if the water level in the CST falls below a preselected level, first 

the suppression pool suction valve automatically opens, and then the 

CST suction valve automatically closes. This ensures that an adequate 

supply of makeup water is available to the HPCS pump. To prevent 

losing suction to the pump, the suction valves are interlocked so that the 

suppression pool suction valve must be open before the CST suction 

valve automatically closes. The Function is implicitly assumed in the 

accident and transient analyses (which take credit for HPCS) since the 

analyses assume that the HPCS suction source is the suppression pool. 

Condensate Storage Tank Level - Low signals are initiated from two level 

transmitters. The logic is arranged such that either transmitter and 

associated trip unit can cause the suppression pool suction valve to open 

and the CST suction valve to close. The Condensate Storage Tank Level 

- Low Function Allowable Value is high enough to ensure adequate pump 

suction head while water is being taken from the CST. 

Two channels of the Condensate Storage Tank Level - Low Function are 

only required to be OPERABLE when HPCS is required to be 

OPERABLE to ensure that no single instrument failure can preclude 

HPCS swap to suppression pool source. Thus, the Function is required 

to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, the 

Function is required to be OPERABLE only when HPCS is required to be 

OPERABLE to fulfill the requirements of LCO 3.5.2, HPCS is aligned to 

the CST, and the CST water level is not within the limits of SR 3.5.2.2. 

With CST water level within limits, a sufficient supply of water exists for 

injection to minimize the consequences of a vessel draindown event. 

Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-15 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3.e. Suppression Pool Water Level – High

Excessively high suppression pool water could result in the loads on the 

suppression pool exceeding design values should there be a blowdown of 

the reactor vessel pressure through the S/RVs. Therefore, signals 

indicating high suppression pool water level are used to transfer the 

suction source of HPCS from the CST to the suppression pool to 

eliminate the possibility of HPCS continuing to provide additional water 

from a source outside containment. To prevent losing suction to the 

pump, the suction valves are interlocked so that the suppression pool 

suction valve must be open before the CST suction valve automatically 

closes. This Function is implicitly assumed in the accident and transient 

analyses (which take credit for HPCS) since the analyses assume that 

the HPCS suction source is the suppression pool. 

Suppression Pool Water Level - High signals are initiated from two level 

transmitters. The logic is arranged such that either transmitter and 

associated trip unit can cause the suppression pool suction valve to open 

and the CST suction valve to close. The Allowable Value for the 

Suppression Pool Water Level - High Function is chosen to ensure that 

HPCS will be aligned for suction from the suppression pool before the 

water level reaches the point at which suppression pool design loads 

would be exceeded. 

Two channels of Suppression Pool Water Level - High Function are only 

required to be OPERABLE in MODES 1, 2, and 3 when HPCS is required 

to be OPERABLE to ensure that no single instrument failure can preclude 

HPCS swap to suppression pool source. In MODES 4 and 5, the 

Function is not required to be OPERABLE since the reactor is 

depressurized and vessel blowdown, which could cause the design 

values of the containment to be exceeded, cannot occur. Refer to 

LCO 3.5.1 for HPCS Applicability Bases. 

3.f, 3.g. HPCS Pump Discharge Pressure - High (Bypass) and HPCS 

System Flow Rate - Low (Bypass)

The minimum flow instruments are provided to protect the HPCS pump 

from overheating when the pump is operating and the associated injection 

valve is not fully open. The minimum flow line valve is opened when low 

flow and high pump discharge pressure are sensed, and the valve is 

automatically closed when the flow rate is adequate to protect the pump 

or the discharge pressure is low (indicating the HPCS pump is not 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-16 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

operating). The HPCS System Flow Rate - Low and HPCS Pump 

Discharge Pressure - High Functions are assumed to be OPERABLE and 

capable of closing the minimum flow valve to ensure that the ECCS flow 

assumed during the transients and accidents analyzed in References 1, 

2, and 3 are met. The core cooling function of the ECCS, along with the 

scram action of the RPS, ensures that the fuel peak cladding temperature 

remains below the limits of 10 CFR 50.46. 

One flow transmitter is used to detect the HPCS System's flow rate. The 

logic is arranged such that the transmitter causes the minimum flow valve 

to open, provided the HPCS pump discharge pressure, sensed by 

another transmitter, is high enough (indicating the pump is operating). 

The logic will close the minimum flow valve once the closure setpoint is 

exceeded. (The valve will also close upon HPCS pump discharge 

pressure decreasing below the setpoint.) 

The HPCS System Flow Rate - Low and HPCS Pump Discharge 

Pressure - High Allowable Value is high enough to ensure that pump flow 

rate is sufficient to protect the pump, yet low enough to ensure that the 

closure of the minimum flow valve is initiated to allow full flow into the 

core. The HPCS Pump Discharge Pressure - High Allowable Value is set 

high enough to ensure that the valve will not be open when the pump is 

not operating. 

One channel of each Function is required to be OPERABLE when the 

HPCS is required to be OPERABLE. Refer to LCO 3.5.1 and LCO 3.5.2 

for HPCS Applicability Bases. 

3.h. Manual Initiation

The Manual Initiation push button channel introduces a signal into the 

HPCS logic to provide manual initiation capability and is redundant to the 

automatic protective instrumentation. There is one push button for the 

HPCS System. 

The Manual Initiation Function is not assumed in any accident or transient 

analysis in the FSAR. However, the Function is retained for overall 

redundancy and diversity of the HPCS function as required by the NRC in 

the plant licensing basis. 

There is no Allowable Value for this Function since the channel is 

mechanically actuated based solely on the position of the push button. 

One channel of the Manual Initiation Function is only required to be 

OPERABLE when the HPCS System is required to be OPERABLE. 

Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-17 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Automatic Depressurization System

4.a, 5.a. Reactor Vessel Water Level - Low Low Low, Level 1

Low RPV water level indicates that the capability to cool the fuel may be 

threatened. Should RPV water level decrease too far, fuel damage could 

result. Therefore, ADS receives one of the signals necessary for initiation 

from this Function. The Reactor Vessel Water Level - Low Low Low, 

Level 1 is one of the Functions assumed to be OPERABLE and capable 

of initiating the ADS during the accidents analyzed in Reference 2. The 

core cooling function of the ECCS, along with the scram action of the 

RPS, ensures that the fuel peak cladding temperature remains below the 

limits of 10 CFR 50.46. 

Reactor Vessel Water Level - Low Low Low, Level 1 signals are initiated 

from four level transmitters that sense the difference between the 

pressure due to a constant column of water (reference leg) and the 

pressure due to the actual water level (variable leg) in the vessel. Four 

channels of Reactor Vessel Water Level - Low Low Low, Level 1 Function 

are only required to be OPERABLE when ADS is required to be 

OPERABLE to ensure that no single instrument failure can preclude ADS 

initiation. (Two channels input to ADS trip system A while the other two 

channels input to ADS trip system B). Refer to LCO 3.5.1 for ADS 

Applicability Bases. 

The Reactor Vessel Water Level - Low Low Low, Level 1 Allowable Value 

is high enough to allow time for the low pressure core flooding systems to 

initiate and provide adequate cooling. 

4.b, 5.b. Drywell Pressure – High

High pressure in the drywell could indicate a break in the RCPB. 

Therefore, ADS receives one of the signals necessary for initiation from 

this Function in order to minimize the possibility of fuel damage. The 

Drywell Pressure - High is assumed to be OPERABLE and capable of 

initiating the ADS during the accidents analyzed in Reference 2. The 

core cooling function of the ECCS, along with the scram action of the 

RPS, ensures that the fuel peak cladding temperature remains below the 

limits of 10 CFR 50.46. 

Drywell Pressure - High signals are initiated from four pressure 

transmitters that sense drywell pressure. The Allowable Value was 

selected to be as low as possible and be indicative of a LOCA inside 

primary containment. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-18 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Four channels of Drywell Pressure - High Function are only required to be 

OPERABLE when ADS is required to be OPERABLE to ensure that no 

single instrument failure can preclude ADS initiation. (Two channels input 

to ADS trip system A while the other two channels input to ADS trip 

system B.) Refer to LCO 3.5.1 for ADS Applicability Bases. 

4.c, 5.c. ADS Initiation Timer

The purpose of the ADS Initiation Timer is to delay depressurization of 

the reactor vessel to allow the HPCS System time to maintain reactor 

vessel water level. Since the rapid depressurization caused by ADS 

operation is one of the most severe transients on the reactor vessel, its 

occurrence should be limited. By delaying initiation of the ADS Function, 

the operator is given the chance to monitor the success or failure of the 

HPCS System to maintain water level, and then to decide whether or not 

to allow ADS to initiate, to delay initiation further by recycling the timer, or 

to inhibit initiation permanently. The ADS Initiation Timer Function is 

assumed to be OPERABLE for the accident analyses of Reference 2 that 

require ECCS initiation and assume failure of the HPCS System. 

There are two ADS Initiation Timer relays, one in each of the two ADS trip 

systems. The Allowable Value for the ADS Initiation Timer is chosen to 

be short enough so that there is still time after depressurization for the 

low pressure ECCS subsystems to provide adequate core cooling. 

Two channels of the ADS Initiation Timer Function are only required to be 

OPERABLE when the ADS is required to be OPERABLE to ensure that 

no single instrument failure can preclude ADS initiation. (One channel 

inputs to ADS trip system A while the other channel inputs to ADS trip 

system B.) Refer to LCO 3.5.1 for ADS Applicability Bases. 

4.d, 5.d. Reactor Vessel Water Level - Low, Level 3

The Reactor Vessel Water Level - Low, Level 3 Function is used by the 

ADS only as a confirmatory low water level signal. ADS receives one of 

the signals necessary for initiation from Reactor Vessel Water Level - Low 

Low Low, Level 1 signals. In order to prevent spurious initiation of the 

ADS due to spurious Level 1 signals, a Level 3 signal must also be 

received before ADS initiation commences. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-19 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Reactor Vessel Water Level - Low, Level 3 signals are initiated from two 

level transmitters that sense the difference between the pressure due to a 

constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. The Allowable Value for 

Reactor Vessel Water Level - Low, Level 3 is selected at the RPS Level 3 

scram Allowable Value for convenience. Refer to LCO 3.3.1.1, "Reactor 

Protection System (RPS) Instrumentation," for Bases discussion of this 

Function. 

Two channels of Reactor Vessel Water Level - Low, Level 3 Function are 

only required to be OPERABLE when the ADS is required to be 

OPERABLE to ensure that no single instrument failure can preclude ADS 

initiation. (One channel inputs to ADS trip system A while the other 

channel inputs to ADS trip system B.) Refer to LCO 3.5.1 for ADS 

Applicability Bases. 

4.e, 4.f, 5.e. Low Pressure Core Spray and Low Pressure Coolant 

Injection Pump Discharge Pressure – High

The Pump Discharge Pressure - High signals from the LPCS and LPCI 

pumps are used as permissives for ADS initiation, indicating that there is 

a source of low pressure cooling water available once the ADS has 

depressurized the vessel. Pump Discharge Pressure - High is one of the 

Functions assumed to be OPERABLE and capable of permitting ADS 

initiation during the events analyzed in References 2 and 3 with an 

assumed HPCS failure. For these events, the ADS depressurizes the 

reactor vessel so that the low pressure ECCS can perform the core 

cooling functions. This core cooling function of the ECCS, along with the 

scram action of the RPS, ensures that the fuel peak cladding temperature 

remains below the limits of 10 CFR 50.46. 

Pump discharge pressure signals are initiated from eight pressure 

transmitters, two on the discharge side of each of the four low pressure 

ECCS pumps. In order to generate an ADS permissive in one trip 

system, it is necessary that only one pump (both channels for the pump) 

indicate the high discharge pressure condition. The Pump Discharge 

Pressure - High Allowable Value is less than the pump discharge 

pressure when the pump is operating in a full flow mode, and high 

enough to avoid any condition that results in a discharge pressure 

permissive when the LPCS and LPCI pumps are aligned for injection and 

the pumps are not running. The actual operating point of this Function is 

not assumed in any transient or accident analysis. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-20 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Eight channels of LPCS and LPCI Pump Discharge Pressure - High 

Function (two LPCS and two LPCI A channels input to ADS trip system A, 

while two LPCI B and two LPCI C channels input to ADS trip system B) 

are only required to be OPERABLE when the ADS is required to be 

OPERABLE to ensure that no single instrument failure can preclude ADS 

initiation. Refer to LCO 3.5.1 for ADS Applicability Bases. 

4.g, 5.f. ADS Bypass Timer (High Drywell Pressure)

One of the signals required for ADS initiation is Drywell Pressure - High. 

However, if the event requiring ADS initiation occurs outside the drywell 

(for example, main steam line break outside primary containment), a high 

drywell pressure signal may never be present. Therefore, the ADS 

Bypass Timer is used to bypass the Drywell Pressure - High Function 

after a certain time period has elapsed. Operation of the ADS Bypass 

Timer Function is not assumed in any accident or transient analysis. The 

instrumentation is retained in the TS because ADS is part of the primary 

success path for mitigation of a DBA. 

There are four ADS Bypass Timer relays, two in each of the two ADS trip 

systems. The Allowable Value for the ADS Timer is chosen to be short 

enough that so that there is still time after depressurization for the low 

pressure ECCS subsystems to provide adequate core cooling. 

Four channels of the ADS Bypass Timer Function are only required to be 

OPERABLE when the ADS is required to be OPERABLE to ensure that 

no single instrument failure can preclude ADS initiation. Refer to 

LCO 3.5.1 for ADS Applicability Bases. 

4.h, 5.g. Manual Initiation

The Manual Initiation push button channels introduce signals into the 

ADS logic to provide manual initiation capability and are redundant to the 

automatic protective instrumentation. There are two push buttons for 

each ADS trip system (total of four). 

The Manual Initiation Function is not assumed in any accident or transient 

analyses in the FSAR. However, the Function is retained for overall 

redundancy and diversity of the ADS function as required by the NRC in 

the plant licensing basis. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-21 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

There is no Allowable Value for this Function since the channel is 

mechanically actuated based solely on the position of the push buttons. 

Four channels of the Manual Initiation Function (two channels per ADS 

trip system) are only required to be OPERABLE when the ADS is 

required to be OPERABLE. Refer to LCO 3.5.1 for ADS Applicability 

Bases. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

A Note has been provided to modify the ACTIONS related to ECCS 

instrumentation channels. Section 1.3, Completion Times, specifies that 

once a Condition has been entered, subsequent divisions, subsystems, 

components, or variables expressed in the Condition, discovered to be 

inoperable or not within limits, will not result in separate entry into the 

Condition. Section 1.3 also specifies that Required Actions of the 

Condition continue to apply for each additional failure, with Completion 

Times based on initial entry into the Condition. However, the Required 

Actions for inoperable ECCS instrumentation channels provide 

appropriate compensatory measures for separate inoperable Condition 

entry for each inoperable ECCS instrumentation channel. 

A.1

Required Action A.1 directs entry into the appropriate Condition 

referenced in Table 3.3.5.1-1. The applicable Condition specified in the 

Table is Function dependent. Each time a channel is discovered to be 

inoperable, Condition A is entered for that channel and provides for 

transfer to the appropriate subsequent Condition. 

B.1, B.2, and B.3

Required Actions B.1 and B.2 are intended to ensure that appropriate 

actions are taken if multiple, inoperable, untripped channels within the 

same Function (or in some cases, within the same variable) result in 

redundant automatic initiation capability being lost for the feature(s). 

Required Action B.1 features would be those that are initiated by 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-22 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Functions 1.a, l.b, 2.a, and 2.b (e.g., low pressure ECCS). The Required 

Action B.2 feature would be HPCS. For Required Action B.1, redundant 

automatic initiation capability is lost if either (a) one or more Function 1.a 

channels and one or more Function 2.a channels are inoperable and 

untripped, or (b) one or more Function 1.b channels and one or more 

Function 2.b channels are inoperable and untripped. 

For Divisions 1 and 2, since each inoperable channel would have 

Required Action B.1 applied separately (refer to ACTIONS Note), each 

inoperable channel would only require the affected portion of the 

associated Division of low pressure ECCS and DG to be declared 

inoperable. However, since channels in both Divisions are inoperable 

and untripped, and the Completion Times started concurrently for the 

channels in both Divisions, this results in the affected portions in both 

Divisions of ECCS and DG being concurrently declared inoperable. 

For Required Action B.2, redundant automatic initiation capability is lost if 

two Function 3.a or two Function 3.b channels are inoperable and 

untripped in the same trip system. In this situation (loss of redundant 

automatic initiation capability), the 24 hour allowance of Required 

Action B.3 is not appropriate and the feature(s) associated with the 

inoperable, untripped channels must be declared inoperable within 

1 hour. As noted (Note 1 to Required Action B.1 and Required 

Action B.2), the two Required Actions are only applicable in MODES 1, 2, 

and 3. In MODES 4 and 5, the specific initiation time of the ECCS is not 

assumed and the probability of a LOCA is lower. Thus, a total loss of 

initiation capability for 24 hours (as allowed by Required Action B.3) is 

allowed during MODES 4 and 5. Notes are also provided (Note 2 to 

Required Action B.1 and Required Action B.2) to delineate which 

Required Action is applicable for each Function that requires entry into 

Condition B if an associated channel is inoperable. This ensures that the 

proper loss of initiation capability check is performed. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action B.1, the Completion 

Time only begins upon discovery that a redundant feature in both 

Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be 

automatically initiated due to inoperable, untripped channels within the 

same variable as described in the paragraph above. For Required 

Action B.2, the Completion Time only begins upon discovery that the 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-23 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

HPCS System cannot be automatically initiated due to two inoperable, 

untripped channels for the associated Function in the same trip system. 

The 1 hour Completion Time from discovery of loss of initiation capability 

is acceptable because it minimizes risk while allowing time for restoration 

or tripping of channels. 

Because of the diversity of sensors available to provide initiation signals 

and the redundancy of the ECCS design, an allowable out of service time 

of 24 hours has been shown to be acceptable (Ref. 4) to permit 

restoration of any inoperable channel to OPERABLE status. If the 

inoperable channel cannot be restored to OPERABLE status within the 

allowable out of service time, the channel must be placed in the tripped 

condition per Required Action B.3. Placing the inoperable channel in trip 

would conservatively compensate for the inoperability, restore capability 

to accommodate a single failure, and allow operation to continue. 

Alternately, if it is not desired to place the channel in trip (e.g., as in the 

case where placing the inoperable channel in trip would result in an 

initiation), Condition H must be entered and its Required Action taken. 

C.1 and C.2

Required Action C.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable channels within the same Function (or in 

some cases, within the same variable) result in redundant automatic 

initiation capability being lost for the feature(s). Required Action C.1 

features would be those that are initiated by Functions 1.c, l.d, 2.c, 

and 2.d (i.e., low pressure ECCS). For Functions 1.c and 2.c, redundant 

automatic initiation capability is lost if the Function 1.c and Function 2.c 

channels are inoperable. For Functions 1.d and 2.d, redundant automatic 

initiation capability is lost if two Function 1.d channels in the same trip 

system and two Function 2.d channels in the same trip system (but not 

necessarily the same trip system as the Function 1.d channels) are 

inoperable. Since each inoperable channel would have Required 

Action C.1 applied separately (refer to ACTIONS Note), each inoperable 

channel would only require the affected portion of the associated Division 

to be declared inoperable. However, since channels in both Divisions are 

inoperable, and the Completion Times started concurrently for the 

channels in both Divisions, this results in the affected portions in both 

Divisions being concurrently declared inoperable. For Functions 1.c 

and 2.c, the affected portions of the Division are LPCI A and LPCI B, 

respectively. For Functions 1.d and 2.d, the affected portions of the 

Division are the low pressure ECCS pumps (Divisions 1 and 2, 

respectively). 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-24 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

In this situation (loss of redundant automatic initiation capability), the 

24 hour allowance of Required Action C.2 is not appropriate and the 

feature(s) associated with the inoperable channels must be declared 

inoperable within 1 hour. As noted (Note 1), the Required Action is only 

applicable in MODES 1, 2, and 3. In MODES 4 and 5, the specific 

initiation time of the ECCS is not assumed and the probability of a LOCA 

is lower. Thus, a total loss of automatic initiation capability for 24 hours 

(as allowed by Required Action C.2) is allowed during MODES 4 and 5. 

Note 2 states that Required Action C.1 is only applicable for 

Functions 1.c, 1.d, 2.c, and 2.d. The Required Action is not applicable to 

Functions 1.g, 2.f, and 3.h (which also require entry into this Condition if a 

channel in these Functions is inoperable), since they are the Manual 

Initiation Functions and are not assumed in any accident or transient 

analysis. Thus, a total loss of manual initiation capability for 24 hours (as 

allowed by Required Action C.2) is allowed. Required Action C.1 is also 

not applicable to Function 3.c (which also requires entry into this 

Condition if a channel in this Function is inoperable), since the loss of one 

channel results in a loss of the Function (two-out-of-two logic). This loss 

was considered during the development of Reference 4 and considered 

acceptable for the 24 hours allowed by Required Action C.2. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action C.1, the Completion 

Time only begins upon discovery that the same feature in both Divisions 

(e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically 

initiated due to inoperable channels within the same variable as described 

in the paragraph above. The 1 hour Completion Time from discovery of 

loss of initiation capability is acceptable because it minimizes risk while 

allowing time for restoration of channels. 

Because of the diversity of sensors available to provide initiation signals 

and the redundancy of the ECCS design, an allowable out of service time 

of 24 hours has been shown to be acceptable (Ref. 4) to permit 

restoration of any inoperable channel to OPERABLE status. If the 

inoperable channel cannot be restored to OPERABLE status within the 

allowable out of service time, Condition H must be entered and its 

Required Action taken. The Required Actions do not allow placing the 

channel in trip since this action would either cause the initiation or would 

not necessarily result in a safe state for the channel in all events. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-25 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1, D.2.1, and D.2.2

Required Action D.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within the same Function 

result in a complete loss of automatic component initiation capability for 

the HPCS System. Automatic component initiation capability is lost if two 

Function 3.d channels or two Function 3.e channels are inoperable and 

untripped. In this situation (loss of automatic suction swap), the 24 hour 

allowance of Required Actions D.2.1 and D.2.2 is not appropriate and the 

HPCS System must be declared inoperable within 1 hour after discovery 

of loss of HPCS initiation capability. As noted, the Required Action is only 

applicable if the HPCS pump suction is not aligned to the suppression 

pool, since, if aligned, the Function is already performed. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action D.1, the Completion 

Time only begins upon discovery that the HPCS System cannot be 

automatically aligned to the suppression pool due to two inoperable, 

untripped channels in the same Function. The 1 hour Completion Time 

from discovery of loss of initiation capability is acceptable because it 

minimizes risk while allowing time for restoration or tripping of channels. 

Because of the diversity of sensors available to provide initiation signals 

and the redundancy of the ECCS design, an allowable out of service time 

of 24 hours has been shown to be acceptable (Ref. 4) to permit 

restoration of any inoperable channel to OPERABLE status. If the 

inoperable channel cannot be restored to OPERABLE status within the 

allowable out of service time, the channel must be placed in the tripped 

condition per Required Action D.2.1 or the suction source must be aligned 

to the suppression pool per Required Action D.2.2. Placing the 

inoperable channel in trip performs the intended function of the channel 

(shifting the suction source to the suppression pool). Performance of 

either of these two Required Actions will allow operation to continue. If 

Required Action D.2.1 or Required Action D.2.2 is performed, measures 

should be taken to ensure that the HPCS System piping remains filled 

with water. Alternately, if it is not desired to perform Required 

Actions D.2.1 and D.2.2 (e.g., as in the case where shifting the suction 

source could drain down the HPCS suction piping), Condition H must be 

entered and its Required Action taken. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-26 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1 and E.2

Required Action E.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within the LPCS and 

LPCI Pump Discharge Flow - Low (Bypass) Functions result in redundant 

automatic initiation capability being lost for the feature(s). For Required 

Action E.1, the features would be those that are initiated by Functions 1.e, 

1.f, and 2.e (e.g., low pressure ECCS). Redundant automatic initiation 

capability is lost if three of the four channels associated with 

Functions 1.e, 1.f, and 2.e are inoperable. Since each inoperable 

channel would have Required Action E.1 applied separately (refer to 

ACTIONS Note), each inoperable channel would only require the affected 

low pressure ECCS pump to be declared inoperable. However, since 

channels for more than one low pressure ECCS pump are inoperable, 

and the Completion Times started concurrently for the channels of the low 

pressure ECCS pumps, this results in the affected low pressure ECCS 

pumps being concurrently declared inoperable. 

In this situation (loss of redundant automatic initiation capability), the 

7 day allowance of Required Action E.2 is not appropriate and the 

feature(s) associated with each inoperable channel must be declared 

inoperable within 1 hour after discovery of loss of initiation capability for 

feature(s) in both Divisions. As noted (Note 1 to Required Action E.1), 

Required Action E.1 is only applicable in MODES 1, 2, and 3. In 

MODES 4 and 5, the specific initiation time of the low pressure ECCS is 

not assumed and the probability of a LOCA is lower. Thus, a total loss of 

initiation capability for 7 days (as allowed by Required Action E.2) is 

allowed during MODES 4 and 5. A Note is also provided (Note 2 to 

Required Action E.1) to delineate that Required Action E.1 is only 

applicable to low pressure ECCS Functions. Required Action E.1 is not 

applicable to HPCS Functions 3.f and 3.g since the loss of one channel 

results in a loss of the Function (one-out-of-one logic). This loss was 

considered during the development of Reference 4 and considered 

acceptable for the 7 days allowed by Required Action E.2. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action E.1, the Completion 

Time only begins upon discovery that three channels of the variable 

(Pump Discharge Flow - Low) cannot be automatically initiated due to 

inoperable channels. The 1 hour Completion Time from discovery of loss 

of initiation capability is acceptable because it minimizes risk while 

allowing time for restoration of channels. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-27 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

If the instrumentation that controls the pump minimum flow valve is 

inoperable such that the valve will not automatically open, extended pump 

operation with no injection path available could lead to pump overheating 

and failure. If there were a failure of the instrumentation such that the 

valve would not automatically close, a portion of the pump flow could be 

diverted from the reactor injection path, causing insufficient core cooling. 

These consequences can be averted by the operator's manual control of 

the valve, which would be adequate to maintain ECCS pump protection 

and required flow. Furthermore, other ECCS pumps would be sufficient 

to complete the assumed safety function if no additional single failure 

were to occur. The 7 day Completion Time of Required Action E.2 to 

restore the inoperable channel to OPERABLE status is reasonable based 

on the remaining capability of the associated ECCS subsystems, the 

redundancy available in the ECCS design, and the low probability of a 

DBA occurring during the allowed out of service time. If the inoperable 

channel cannot be restored to OPERABLE status within the allowable out 

of service time, Condition H must be entered and its Required Action 

taken. The Required Actions do not allow placing the channel in trip 

since this action would not necessarily result in a safe state for the 

channel in all events. 

F.1 and F.2

Required Action F.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within similar ADS trip 

system Functions result in automatic initiation capability being lost for the 

ADS. Automatic initiation capability is lost if either (a) more than one 

Function 4.a channel and one Function 5.a channel are inoperable and 

untripped, (b) one Function 4.b channel and one Function 5.b channel are 

inoperable and untripped, or (c) one Function 4.d channel and one 

Function 5.d channel are inoperable and untripped. 

In this situation (loss of automatic initiation capability), the 96 hour or 

8 day allowance, as applicable, of Required Action F.2 is not appropriate, 

and all ADS valves must be declared inoperable within 1 hour after 

discovery of loss of ADS initiation capability in both trip systems. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action F.1, the Completion 

Time only begins upon discovery that the ADS cannot be automatically 

initiated due to inoperable, untripped channels within similar ADS trip 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-28 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

system Functions as described in the paragraph above. The 1 hour 

Completion Time from discovery of loss of initiation capability is 

acceptable because it minimizes risk while allowing time for restoration or 

tripping of channels. 

Because of the diversity of sensors available to provide initiation signals 

and the redundancy of the ECCS design, an allowable out of service time 

of 8 days has been shown to be acceptable (Ref. 4) to permit restoration 

of any inoperable channel to OPERABLE status if both HPCS and RCIC 

are OPERABLE. If either HPCS or RCIC is inoperable, the time is 

shortened to 96 hours. If the status of HPCS or RCIC changes such that 

the Completion Time changes from 8 days to 96 hours, the 96 hours 

begins upon discovery of HPCS or RCIC inoperability. However, total 

time for an inoperable, untripped channel cannot exceed 8 days. If the 

status of HPCS or RCIC changes such that the Completion Time changes 

from 96 hours to 8 days, the "time zero" for beginning the 8 day "clock" 

begins upon discovery of the inoperable, untripped channel. If the 

inoperable channel cannot be restored to OPERABLE status within the 

allowable out of service time, the channel must be placed in the tripped 

condition per Required Action F.2. Placing the inoperable channel in trip 

would conservatively compensate for the inoperability, restore capability 

to accommodate a single failure, and allow operation to continue. 

Alternately, if it is not desired to place the channel in trip (e.g., as in the 

case where placing the inoperable channel in trip would result in an 

initiation), Condition H must be entered and its Required Action taken. 

G.1 and G.2

Required Action G.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable channels within similar ADS trip system 

Functions result in automatic initiation capability being lost for the ADS. 

Automatic initiation capability is lost if either (a) one Function 4.c channel 

and one Function 5.c channel are inoperable, (b) one or more 

Function 4.e channels and one or more Function 5.e channels are 

inoperable, (c) one or more Function 4.f channels and one or more 

Function 5.e channels are inoperable, or (d) one or more Function 4.g 

channels and one or more Function 5.f channels are inoperable. 

In this situation (loss of automatic initiation capability), the 96 hour or 

8 day allowance, as applicable, of Required Action G.2 is not appropriate, 

and all ADS valves must be declared inoperable within 1 hour after 

discovery of loss of ADS initiation capability in both trip systems. The 

Note to Required Action G.1 states that Required Action G.1 is only 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-29 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

applicable for Functions 4.c, 4.e, 4.f, 4.g, 5.c, 5.e, and 5.f. Required 

Action G.1 is not applicable to Functions 4.h and 5.g (which also require 

entry into this Condition if a channel in these Functions is inoperable), 

since they are the Manual Initiation Functions and are not assumed in any 

accident or transient analysis. Thus, a total loss of manual initiation 

capability for 96 hours or 8 days (as allowed by Required Action G.2) is 

allowed. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action G.1, the Completion 

Time only begins upon discovery that the ADS cannot be automatically 

initiated due to inoperable channels within similar ADS trip system 

Functions, as described in the paragraph above. The 1 hour Completion 

Time from discovery of loss of initiation capability is acceptable because it 

minimizes risk while allowing time for restoration or tripping of channels. 

Because of the diversity of sensors available to provide initiation signals 

and the redundancy of the ECCS design, an allowable out of service time 

of 8 days has been shown to be acceptable (Ref. 4) to permit restoration 

of any inoperable channel to OPERABLE status if both HPCS and RCIC 

are OPERABLE (Required Action G.2). If either HPCS or RCIC is 

inoperable, the time is reduced to 96 hours. If the status of HCPS or 

RCIC changes such that the Completion Time changes from 8 days to 

96 hours, the 96 hours begins upon discovery of HPCS or RCIC 

inoperability. However, total time for an inoperable channel cannot 

exceed 8 days. If the status of HPCS or RCIC changes such that the 

Completion Time changes from 96 hours to 8 days, the "time zero" for 

beginning the 8 day "clock" begins upon discovery of the inoperable 

channel. If the inoperable channel cannot be restored to OPERABLE 

status within the allowable out of service time, Condition H must be 

entered and its Required Action taken. The Required Actions do not 

allow placing the channel in trip since this action would not necessarily 

result in a safe state for the channel in all events. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-30 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

H.1

With any Required Action and associated Completion Time not met, the 

associated feature(s) may be incapable of performing the intended 

function and the supported feature(s) associated with the inoperable 

untripped channels must be declared inoperable immediately. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

As noted at the beginning of the SRs, the SRs for each ECCS 

instrumentation Function are found in the SRs column of Table 3.3.5.1-1. 

The Surveillances are modified by a Note to indicate that when a channel 

is placed in an inoperable status solely for performance of required 

Surveillances, entry into associated Conditions and Required Actions may 

be delayed for up to 6 hours as follows: (a) for Functions 3.c, 3.f, 3.g, 

and 3.h; and (b) for Functions other than 3.c, 3.f, 3.g, and 3.h provided 

the associated Function or redundant Function maintains ECCS initiation 

capability. Upon completion of the Surveillance, or expiration of the 

6 hour allowance, the channel must be returned to OPERABLE status or 

the applicable Condition entered and Required Actions taken. This Note 

is based on the reliability analysis (Ref. 4) assumption of the average time 

required to perform channel Surveillance. That analysis demonstrated 

that the 6 hour testing allowance does not significantly reduce the 

probability that the ECCS will initiate when necessary. 

SR 3.3.5.1.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-31 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Agreement criteria are determined by the plant staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency is based upon operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channels during normal operational use of 

the displays associated with the channels required by the LCO. 

SR 3.3.5.1.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. 

The Frequency of 92 days is based on the reliability analyses of 

Reference 4. 

SR 3.3.5.1.3

The calibration of trip units provides a check of the actual trip setpoints. 

The channel must be declared inoperable if the trip setting is discovered 

to be not within its required Allowable Value specified in Table 3.3.5.1-1. 

If the trip setting is discovered to be less conservative than accounted for 

in the appropriate setpoint methodology, but is not beyond the Allowable 

Value, the channel performance is still within the requirements of the 

plant safety analyses. Under these conditions, the setpoint must be 

readjusted to be equal to or more conservative than the setting accounted 

for in the appropriate setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 4. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-32 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.5.1.4 and SR 3.3.5.1.5

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 

The Frequency of SR 3.3.5.1.4 is based upon the assumption of a 92 day 

calibration interval in the determination of the magnitude of equipment 

drift in the setpoint analysis. The Frequency of SR 3.3.5.1.5 is based 

upon the assumption of an [18] month calibration interval in the 

determination of the magnitude of equipment drift in the setpoint analysis. 

SR 3.3.5.1.6

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required initiation logic for a specific channel. The 

system functional testing performed in LCO 3.5.1, LCO 3.5.2, LCO 3.8.1, 

and LCO 3.8.2 overlaps this Surveillance to provide complete testing of 

the assumed safety function. 

The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for unplanned transients if the Surveillance were performed with 

the reactor at power. Operating experience has shown these components 

usually pass the Surveillance when performed at the [18] month 

Frequency. 

SR 3.3.5.1.7

This SR ensures that the individual channel response times are less than 

or equal to the maximum values assumed in the accident analysis. 

Response time testing acceptance criteria are included in Reference 5. 

ECCS RESPONSE TIME may be verified by actual response time 

measurements in any series of sequential, overlapping, or total channel 

measurements. 
ECCS Instrumentation 

B 3.3.5.1 

BWR/6 STS B 3.3.5.1-33 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[-----------------------------------REVIEWER’S NOTE---------------------------------- 

The following Bases are applicable for plants adopting NEDO-32291-A. 

-------------------------------------------------------------------------------------------------- 

However, the measurement of instrument loop response times may be 

excluded if the conditions of Reference 6 are satisfied.]

ECCS RESPONSE TIME tests are conducted on an [18] month 

STAGGERED TEST BASIS. The [18] month Frequency is consistent 

with the typical industry refueling cycle and is based upon plant operating 

experience, which shows that random failures of instrumentation 

components causing serious response time degradation, but not channel 

failure, are infrequent. 

REFERENCES 1. FSAR, Section [5.2]. 

 2. FSAR, Section [6.3]. 

 3. FSAR, Chapter [15]. 

 4. NEDC-30936-P-A, "BWR Owners' Group Technical Specification 

Improvement Analyses for ECCS Actuation Instrumentation, Part 2," 

December 1988. 

 5. FSAR, Section [6.3], Table [6.3-2]. 

 [6. NEDO-32291-A, "System Analyses for the Elimination of Selected 

Response Time Testing Requirements," October 1995.] 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.5.2 Reactor Core Isolation Cooling (RCIC) System Instrumentation 

BASES 

BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to 

ensure adequate core cooling when the reactor vessel is isolated from its 

primary heat sink (the main condenser) and normal coolant makeup flow 

from the Reactor Feedwater System is unavailable, such that initiation of 

the low pressure Emergency Core Cooling Systems (ECCS) pumps does 

not occur. A more complete discussion of RCIC System operation is 

provided in the Bases of LCO 3.5.3, "RCIC System." 

The RCIC System may be initiated by either automatic or manual means. 

Automatic initiation occurs for conditions of reactor vessel Low Low water 

level. The variable is monitored by four transmitters that are connected to 

four trip units. The outputs of the trip units are connected to relays whose 

contacts are arranged in a one-out-of-two taken twice logic arrangement. 

Once initiated, the RCIC logic seals in and can be reset by the operator 

only when the reactor vessel water level signals have cleared. 

The RCIC test line isolation valve (which is also a primary containment 

isolation valve) is closed on a RCIC initiation signal to allow full system 

flow and maintain containment isolated in the event RCIC is not 

operating. 

The RCIC System also monitors the water levels in the condensate 

storage tank (CST) and the suppression pool, since these are the two 

sources of water for RCIC operation. Reactor grade water in the CST is 

the normal source. Upon receipt of a RCIC initiation signal, the CST 

suction valve is automatically signaled to open (it is normally in the open 

position) unless the pump suction from the suppression pool valve is 

open. If the water level in the CST falls below a preselected level, first 

the suppression pool suction valve automatically opens and then the CST 

suction valve automatically closes. Two level transmitters are used to 

detect low water level in the CST. Either switch can cause the 

suppression pool suction valve to open and the CST suction valve to 

close. The suppression pool suction valve also automatically opens and 

the CST suction valve closes if high water level is detected in the 

suppression pool (one-out-of-two logic similar to the CST water level 

logic). To prevent losing suction to the pump, the suction valves are 

interlocked so that one suction path must be open before the other 

automatically closes. 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The RCIC System provides makeup water to the reactor until the reactor 

vessel water level reaches the high water level (Level 8) trip (two-out-oftwo logic), at which time the RCIC steam supply, steam supply bypass, 

and cooling water supply valves close (the injection valve also closes due 

to the closure of the steam supply valves). The RCIC System restarts if 

vessel level again drops to the low level initiation point (Level 2). 

APPLICABLE The function of the RCIC System, to provide makeup coolant to the 

SAFETY reactor, is to respond to transient events. The RCIC System is not an 

ANALYSES, LCO, Engineered Safety Feature System and no credit is taken in the safety 

and APPLICABILITY analysis for RCIC System operation. The RCIC System instrumentation 

satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). Certain instrumentation 

Functions are retained for other reasons and are described below in the 

individual Functions discussion. 

The OPERABILITY of the RCIC System instrumentation is dependent on 

the OPERABILITY of the individual instrumentation channel Functions 

specified in Table 3.3.5.2-1. Each Function must have a required number 

of OPERABLE channels with their setpoints within the specified Allowable 

Values, where appropriate. A channel is inoperable if its actual trip 

setpoint is not within its required Allowable Value. The actual setpoint is 

calibrated consistent with applicable setpoint methodology assumptions. 

Allowable Values are specified for each RCIC System instrumentation 

Function specified in the table. Nominal trip setpoints are specified in the 

setpoint calculations. The nominal setpoints are selected to ensure that 

the setpoints do not exceed the Allowable Value between CHANNEL 

CALIBRATIONS. Operation with a trip setpoint less conservative than 

the nominal trip setpoint, but within its Allowable Value, is acceptable. 

Each Allowable Value specified accounts for instrument uncertainties 

appropriate to the Function. These uncertainties are described in the 

setpoint methodology. 

The individual Functions are required to be OPERABLE in MODE 1, and 

in MODES 2 and 3 with reactor steam dome pressure > 150 psig, since 

this is when RCIC is required to be OPERABLE. (Refer to LCO 3.5.3 for 

Applicability Bases for the RCIC System.) 

The specific Applicable Safety Analyses, LCO, and Applicability 

discussions are listed below on a Function by Function basis. 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

1. Reactor Vessel Water Level - Low Low, Level 2

Low reactor pressure vessel (RPV) water level indicates that normal 

feedwater flow is insufficient to maintain reactor vessel water level and 

that the capability to cool the fuel may be threatened. Should RPV water 

level decrease too far, fuel damage could result. Therefore, the RCIC 

System is initiated at Level 2 to assist in maintaining water level above 

the top of the active fuel. 

Reactor Vessel Water Level - Low Low, Level 2 signals are initiated from 

four level transmitters that sense the difference between the pressure due 

to a constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. 

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value is 

set high enough such that for complete loss of feedwater flow, the RCIC 

System flow with high pressure core spray assumed to fail will be 

sufficient to avoid initiation of low pressure ECCS at Level 1. 

Four channels of Reactor Vessel Water Level - Low Low, Level 2 

Function are available and are required to be OPERABLE when RCIC is 

required to be OPERABLE to ensure that no single instrument failure can 

preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability 

Bases. 

2. Reactor Vessel Water Level - High, Level 8

High RPV water level indicates that sufficient cooling water inventory 

exists in the reactor vessel such that there is no danger to the fuel. 

Therefore, the Level 8 signal is used to close the RCIC steam supply, 

steam supply bypass, and cooling water supply valves to prevent 

overflow into the main steam lines (MSLs). (The injection valve also 

closes due to the closure of the steam supply valve.) 

Reactor Vessel Water Level - High, Level 8 signals for RCIC are initiated 

from two level transmitters from the narrow range water level 

measurement instrumentation, which sense the difference between the 

pressure due to a constant column of water (reference leg) and the 

pressure due to the actual water level (variable leg) in the vessel. 

The Reactor Vessel Water Level - High, Level 8 Allowable Value is high 

enough to preclude isolating the injection valve of the RCIC during normal 

operation, yet low enough to trip the RCIC System prior to water 

overflowing into the MSLs. 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Two channels of Reactor Vessel Water Level - High, Level 8 Function are 

available and are required to be OPERABLE when RCIC is required to be 

OPERABLE to ensure that no single instrument failure can preclude 

RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases. 

3. Condensate Storage Tank Level - Low

Low level in the CST indicates the unavailability of an adequate supply of 

makeup water from this normal source. Normally the suction valve 

between the RCIC pump and the CST is open and, upon receiving a 

RCIC initiation signal, water for RCIC injection would be taken from the 

CST. However, if the water level in the CST falls below a preselected 

level, first the suppression pool suction valve automatically opens and 

then the CST suction valve automatically closes. This ensures that an 

adequate supply of makeup water is available to the RCIC pump. To 

prevent losing suction to the pump, the suction valves are interlocked so 

that the suppression pool suction valve must be open before the CST 

suction valve automatically closes. 

Two level transmitters are used to detect low water level in the CST. The 

Condensate Storage Tank Level - Low Function Allowable Value is set 

high enough to ensure adequate pump suction head while water is being 

taken from the CST. 

Two channels of Condensate Storage Tank Level - Low Function are 

available and are required to be OPERABLE when RCIC is required to be 

OPERABLE to ensure that no single instrument failure can preclude 

RCIC swap to suppression pool source. Refer to LCO 3.5.3 for RCIC 

Applicability Bases. 

4. Suppression Pool Water Level - High

Excessively high suppression pool water level could result in the loads on 

the suppression pool exceeding design values should there be a 

blowdown of the reactor vessel pressure through the safety/relief valves. 

Therefore, signals indicating high suppression pool water level are used 

to transfer the suction source of RCIC from the CST to the suppression 

pool to eliminate the possibility of RCIC continuing to provide additional 

water from a source outside primary containment. This Function satisfies 

Criterion 3 of 10 CFR 50.36(c)(2)(ii). To prevent losing suction to the 

pump, the suction valves are interlocked so that the suppression pool 

suction valve must be open before the CST suction valve automatically 

closes. 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Suppression pool water level signals are initiated from two level 

transmitters. The Allowable Value for the Suppression Pool Water Level - 

High Function is set low enough to ensure that RCIC will be aligned to 

take suction from the suppression pool before the water level reaches the 

point at which suppression design loads would be exceeded. 

Two channels of Suppression Pool Water Level - High Function are 

available and are required to be OPERABLE when RCIC is required to be 

OPERABLE to ensure that no single instrument failure can preclude 

RCIC swap to suppression pool source. Refer to LCO 3.5.3 for RCIC 

Applicability Bases. 

5. Manual Initiation

The Manual Initiation push button switch introduces a signal into the 

RCIC System initiation logic that is redundant to the automatic protective 

instrumentation and provides manual initiation capability. There is one 

push button for the RCIC System. 

The Manual Initiation Function is not assumed in any accident or transient 

analyses in the FSAR. However, the Function is retained for overall 

redundancy and diversity of the RCIC function as required by the NRC in 

the plant licensing basis. 

There is no Allowable Value for this Function since the channel is 

mechanically actuated based solely on the position of the push button. 

One channel of Manual Initiation is required to be OPERABLE when 

RCIC is required to be OPERABLE. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the NRC staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

A Note has been provided to modify the ACTIONS related to RCIC 

System instrumentation channels. Section 1.3, Completion Times, 

specifies that once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition 

discovered to be inoperable or not within limits will not result in separate 

entry into the Condition. Section 1.3 also specifies that Required Actions 

of the Condition continue to apply for each additional failure, with 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for inoperable RCIC System instrumentation channels 

provide appropriate compensatory measures for separate inoperable 

channels. As such, a Note has been provided that allows separate 

Condition entry for each inoperable RCIC System instrumentation 

channel. 

A.1

Required Action A.1 directs entry into the appropriate Condition 

referenced in Table 3.3.5.2-1 in the accompanying LCO. The applicable 

Condition referenced in the Table is Function dependent. Each time a 

channel is discovered to be inoperable, Condition A is entered for that 

channel and provides for transfer to the appropriate subsequent 

Condition. 

B.1 and B.2

Required Action B.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within the same Function 

result in a complete loss of automatic initiation capability for the RCIC 

System. In this case, automatic initiation capability is lost if two 

Function 1 channels in the same trip system are inoperable and 

untripped. In this situation (loss of automatic initiation capability), the 

24 hour allowance of Required Action B.2 is not appropriate, and the 

RCIC System must be declared inoperable within 1 hour after discovery 

of loss of RCIC initiation capability. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action B.1, the Completion 

Time only begins upon discovery that the RCIC System cannot be 

automatically initiated due to two inoperable, untripped Reactor Vessel 

Water Level - Low Low, Level 2 channels in the same trip system. The 

1 hour Completion Time from discovery of loss of initiation capability is 

acceptable because it minimizes risk while allowing time for restoration or 

tripping of channels. 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Because of the redundancy of sensors available to provide initiation 

signals and the fact that the RCIC System is not assumed in any accident 

or transient analysis, an allowable out of service time of 24 hours has 

been shown to be acceptable (Ref. 1) to permit restoration of any 

inoperable channel to OPERABLE status. If the inoperable channel 

cannot be restored to OPERABLE status within the allowable out of 

service time, the channel must be placed in the tripped condition per 

Required Action B.2. Placing the inoperable channel in trip would 

conservatively compensate for the inoperability, restore capability to 

accommodate a single failure, and allow operation to continue. 

Alternately, if it is not desired to place the channel in trip (e.g., as in the 

case where placing the inoperable channel in trip would result in an 

initiation), Condition E must be entered and its Required Action taken. 

C.1

A risk based analysis was performed and determined that an allowable 

out of service time of 24 hours (Ref. 1) is acceptable to permit restoration 

of any inoperable channel to OPERABLE status (Required Action C.1). A 

Required Action (similar to Required Action B.1), limiting the allowable out 

of service time if a loss of automatic RCIC initiation capability exists, is 

not required. This Condition applies to the Reactor Vessel Water Level - 

High, Level 8 Function, whose logic is arranged such that any inoperable 

channel will result in a loss of automatic RCIC initiation capability. As 

stated above, this loss of automatic RCIC initiation capability was 

analyzed and determined to be acceptable. This Condition also applies 

to the Manual Initiation Function. Since this Function is not assumed in 

any accident or transient analysis, a total loss of manual initiation 

capability (Required Action C.1) for 24 hours is allowed. The Required 

Action does not allow placing a channel in trip since this action would not 

necessarily result in the safe state for the channel in all events. 

D.1, D.2.1, and D.2.2

Required Action D.1 is intended to ensure that appropriate actions are 

taken if multiple inoperable, untripped channels within the same Function 

result in automatic component initiation capability being lost for the 

feature(s). For Required Action D.1, the RCIC System is the only 

associated feature. In this case, automatic component initiation capability 

is lost if two Function 3 channels or two Function 4 channels are 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

inoperable and untripped. In this situation (loss of automatic suction 

swap), the 24 hour allowance of Required Actions D.2.1 and D.2.2 is not 

appropriate, and the RCIC System must be declared inoperable within 

1 hour from discovery of loss of RCIC initiation capability. As noted, 

Required Action D.1 is only applicable if the RCIC pump suction is not 

aligned to the suppression pool since, if aligned, the Function is already 

performed. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action D.1, the Completion 

Time only begins upon discovery that the RCIC System cannot be 

automatically aligned to the suppression pool due to two inoperable, 

untripped channels in the same Function. The 1 hour Completion Time 

from discovery of loss of initiation capability is acceptable because it 

minimizes risk while allowing time for restoration or tripping of channels. 

Because of the redundancy of sensors available to provide initiation 

signals and the fact that the RCIC System is not assumed in any accident 

or transient analysis, an allowable out of service time of 24 hours has 

been shown to be acceptable (Ref. 1) to permit restoration of any 

inoperable channel to OPERABLE status. If the inoperable channel 

cannot be restored to OPERABLE status within the allowable out of 

service time, the channel must be placed in the tripped condition per 

Required Action D.2.1, which performs the intended function of the 

channel (shifting the suction source to the suppression pool). 

Alternatively, Required Action D.2.2 allows the manual alignment of the 

RCIC suction to the suppression pool, which also performs the intended 

function. If Required Action D.2.1 or D.2.2 is performed, measures 

should be taken to ensure that the RCIC System piping remains filled with 

water. If it is not desired to perform Required Actions D.2.1 and D.2.2 

(e.g., as in the case where shifting the suction source could drain down 

the RCIC suction piping), Condition E must be entered and its Required 

Action taken. 

E.1

With any Required Action and associated Completion Time not met, the 

RCIC System may be incapable of performing the intended function, and 

the RCIC System must be declared inoperable immediately. 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

As noted in the beginning of the SRs, the SRs for each RCIC System 

instrumentation Function are found in the SRs column of Table 3.3.5.2-1. 

The Surveillances are modified by a Note to indicate that when a channel 

is placed in an inoperable status solely for performance of required 

Surveillances, entry into associated Conditions and Required Actions may 

be delayed as follows: (a) for up to 6 hours for Functions 2 and 5; and 

(b) for up to 6 hours for Functions 1, 3, and 4 provided the associated 

Function maintains trip capability. Upon completion of the Surveillance, 

or expiration of the 6 hour allowance, the channel must be returned to 

OPERABLE status or the applicable Condition entered and Required 

Actions taken. This Note is based on the reliability analysis (Ref. 1) 

assumption of the average time required to perform channel Surveillance. 

That analysis demonstrated that the 6 hour testing allowance does not 

significantly reduce the probability that the RCIC will initiate when 

necessary. 

SR 3.3.5.2.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 

Agreement criteria are determined by the plant staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency is based upon operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channel status during normal operational 

use of the displays associated with the channels required by the LCO. 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.5.2.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. Any setpoint adjustment shall be consistent with 

the assumptions of the current plant specific setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 1. 

SR 3.3.5.2.3

The calibration of trip units provides a check of the actual trip setpoints. 

The channel must be declared inoperable if the trip setting is discovered 

to be less conservative than the Allowable Value specified in 

Table 3.3.5.2-1. If the trip setting is discovered to be less conservative 

than accounted for in the appropriate setpoint methodology, but is not 

beyond the Allowable Value, the channel performance is still within the 

requirements of the plant safety analysis. Under these conditions, the 

setpoint must be re-adjusted to be equal to or more conservative than 

accounted for in the appropriate setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 1. 

SR 3.3.5.2.4

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. This test verifies the channel responds to the measured 

parameter with the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 

The Frequency is based on the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 
RCIC System Instrumentation 

B 3.3.5.2 

BWR/6 STS B 3.3.5.2-11 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.5.2.5

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required initiation logic for a specific channel. The 

system functional testing performed in LCO 3.5.3 overlaps this 

Surveillance to provide complete testing of the safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

REFERENCES 1. NEDE-770-06-2, "Addendum to Bases for Changes to Surveillance 

Test Intervals and Allowed Out-of-Service Times for Selected 

Instrumentation Technical Specifications," February 1991. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.6.1 Primary Containment Isolation Instrumentation 

BASES 

BACKGROUND The primary containment isolation instrumentation automatically initiates 

closure of appropriate primary containment isolation valves (PCIVs). The 

function of the PCIVs, in combination with other accident mitigation 

systems, is to limit fission product release during and following postulated 

Design Basis Accidents (DBAs). Primary containment isolation within the 

time limits specified for those isolation valves designed to close 

automatically ensures that the release of radioactive material to the 

environment will be consistent with the assumptions used in the analyses 

for a DBA. 

The isolation instrumentation includes the sensors, relays, and switches 

that are necessary to cause initiation of primary containment and reactor 

coolant pressure boundary (RCPB) isolation. Most channels include 

electronic equipment (e.g., trip units) that compares measured input 

signals with pre-established setpoints. When the setpoint is exceeded, 

the channel output relay actuates, which then outputs a primary 

containment isolation signal to the isolation logic. Functional diversity is 

provided by monitoring a wide range of independent parameters. The 

input parameters to the isolation logic are (a) reactor vessel water level, 

(b) ambient and differential temperatures, (c) main steam line (MSL) flow 

measurement, (d) Standby Liquid Control (SLC) System initiation, 

(e) condenser vacuum loss, (f) main steam line pressure, (g) reactor core 

isolation cooling (RCIC) and RCIC/residual heat removal (RHR) steam 

line flow, (h) ventilation exhaust radiation, (i) RCIC steam line pressure, 

(j) RCIC turbine exhaust diaphragm pressure, (k) reactor water cleanup 

(RWCU) differential flow, (l) reactor steam dome pressure, and 

(m) drywell pressure. Redundant sensor input signals are provided from 

each such isolation initiation parameter. The only exception is SLC 

System initiation. In addition, manual isolation of the logics is provided. 

The primary containment isolation instrumentation has inputs to the trip 

logic from the isolation Functions listed below. 

1. Main Steam Line Isolation

Most Main Steam Line Isolation Functions receive inputs from four 

channels. The outputs from these channels are combined in one-out-oftwo taken twice logic to initiate isolation of all main steam isolation valves 

(MSIVs). The outputs from the same channels are arranged into two twoout-of-two logic trip systems to isolate all MSL drain valves. Each MSL 

drain line has two isolation valves with one two-out-of-two logic system 

associated with each valve. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The exception to this arrangement is the Main Steam Line Flow - High 

Function. This Function uses 16 flow channels, four for each steam line. 

One channel from each steam line inputs to one of four trip strings. Two 

trip strings make up each trip system, and both trip systems must trip to 

cause an MSL isolation. Each trip string has four inputs (one per MSL), 

any one of which will trip the trip string. The trip strings within a trip 

system are arranged in a one-out-of-two taken twice logic. Therefore, this 

is effectively a one-out-of-eight taken twice logic arrangement to initiate 

isolation of the MSIVs. Similarly, the 16 flow channels are connected into 

two two-out-of-two logic trip systems (effectively, two one-out-of-four 

twice logic), with each trip system isolating one of the two MSL drain 

valves. 

2. Primary Containment Isolation

Each Primary Containment Isolation Function receives inputs from four 

channels. The outputs from these channels are arranged into two twoout-of-two logic trip systems. One trip system initiates isolation of all 

inboard PCIVs, while the other trip system initiates isolation of all 

outboard PCIVs. Each trip system logic closes one of the two valves on 

each penetration so that operation of either trip system isolates the 

penetration. 

3. Reactor Core Isolation Cooling System Isolation

Most Functions receive input from two channels, with each channel in one 

trip system using one-out-of-one logic. Functions 3.j and 3.k (RHR 

Equipment Room Temperature) have one channel in each trip system in 

each room for a total of four channels per Function; but the logic is the 

same (one-out-of-one). Each of the two trip systems is connected to one 

of the two valves on each RCIC penetration so that operation of either trip 

system isolates the penetration. The exception to this arrangement is the 

RCIC Turbine Exhaust Diaphragm Pressure - High Function. This 

Function receives input from four turbine exhaust diaphragm pressure 

channels. The outputs from the turbine exhaust diaphragm pressure 

channels are connected into two two-out-of-two trip systems, each trip 

system isolating one of the two RCIC valves. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

4. Reactor Water Cleanup System Isolation

Most Functions receive input from two channels with each channel in one 

trip system using one-out-of-one logic. Functions 4.e and 4.f (RWCU 

Pump Room Temperature) have one channel in each trip system in each 

room for a total of four channels per Function, but the logic is the same 

(one-out-of-one). Each of the two trip systems is connected to one of the 

two valves on each RWCU penetration so that operation of either trip 

system isolates the penetration. The exception to this arrangement is the 

Reactor Vessel Water Level - Low Low, Level 2 Function. This Function 

receives input from four reactor vessel water level channels. The outputs 

from the reactor vessel water level channels are connected into two twoout-of-two trip systems, each trip system isolating one of the two RWCU 

valves. 

5. Shutdown Cooling System Isolation

The Shutdown Cooling Isolation Function receives input signals from 

instrumentation for the Reactor Vessel Water Level - Low, Level 3; 

Drywell Pressure - High; Reactor Steam Dome Pressure - High; and RHR 

Equipment Room Ambient and Differential Temperature - High Functions. 

The Reactor Vessel Water Level - Low, Reactor Steam Dome Pressure - 

High, and Drywell Pressure - High Functions each have four channels. 

The outputs from the reactor vessel water level and drywell pressure 

channels are connected into two two-out-of-two trip systems. The reactor 

steam dome pressure is arranged into two one-out-of-two trip systems. 

The RHR Equipment Room Ambient and Differential Temperature 

Functions receive input from four channels with each channel in one trip 

system in one room using one-out-of-one logic. Each of the two trip 

systems is connected to one of the two valves on each shutdown cooling 

penetration so that operation of either trip system isolates the penetration. 

APPLICABLE The isolation signals generated by the primary containment isolation 

SAFETY instrumentation are implicitly assumed in the safety analyses of 

ANALYSES, LCO, References 1 and 2 to initiate closure of valves to limit offsite doses 

and APPLICABILITY Refer to LCO 3.6.1.3, "Primary Containment Isolation Valves (PCIVs)," 

Applicable Safety Analyses Bases, for more detail. 

Primary containment isolation instrumentation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained for 

other reasons and are described below in the individual Functions 

discussion. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The OPERABILITY of the primary containment instrumentation is 

dependent on the OPERABILITY of the individual instrumentation 

channel Functions specified in Table 3.3.6.1-1. Each Function must have 

a required number of OPERABLE channels, with their setpoints within the 

specified Allowable Values, where appropriate. A channel is inoperable if 

its actual trip setpoint is not within its required Allowable Value. The 

actual setpoint is calibrated consistent with applicable setpoint 

methodology assumptions. Each channel must also respond within its 

assumed response time, where appropriate. 

Allowable Values are specified for each Primary Containment Isolation 

Function specified in the Table. Nominal trip setpoints are specified in the 

setpoint calculations. The nominal setpoints are selected to ensure that 

the setpoints do not exceed the Allowable Value between CHANNEL 

CALIBRATIONS. Operation with a trip setpoint less conservative than 

the nominal trip setpoint, but within its Allowable Value, is acceptable. 

Trip setpoints are those predetermined values of output at which an 

action should take place. The setpoints are compared to the actual 

process parameter (e.g., reactor vessel water level), and when the 

measured output value of the process parameter exceeds the setpoint, 

the associated device (e.g., trip unit) changes state. The analytic limits 

are derived from the limiting values of the process parameters obtained 

from the safety analysis. The Allowable Values are derived from the 

analytic limits, corrected for calibration, process, and some of the 

instrument errors. The trip setpoints are then determined accounting for 

the remaining instrument errors (e.g., drift). The trip setpoints derived in 

this manner provide adequate protection because instrumentation 

uncertainties, process effects, calibration tolerances, instrument drift, and 

severe environment errors (for channels that must function in harsh 

environments as defined by 10 CFR 50.49) are accounted for. 

Certain Emergency Core Cooling Systems (ECCS) and RCIC valves 

(e.g., minimum flow) also serve the dual function of automatic PCIVs. 

The signals that isolate these valves are also associated with the 

automatic initiation of the ECCS and RCIC. The instrumentation and 

ACTIONS associated with these signals are addressed in LCO 3.3.5.1, 

"ECCS Instrumentation," and LCO 3.3.5.2, "RCIC Instrumentation," and 

are not included in this LCO. 

In general, the individual Functions are required to be OPERABLE in 

MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, 

"Primary Containment." Functions that have different Applicabilities are 

discussed below in the individual Functions discussion. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The specific Applicable Safety Analyses, LCO, and Applicability 

discussions are listed below on a Function by Function basis. 

1. Main Steam Line Isolation

1.a. Reactor Vessel Water Level - Low Low Low, Level 1

Low reactor pressure vessel (RPV) water level indicates that the 

capability to cool the fuel may be threatened. Should RPV water level 

decrease too far, fuel damage could result. Therefore, isolation of the 

MSIVs and other interfaces with the reactor vessel occurs to prevent 

offsite dose limits from being exceeded. The Reactor Vessel Water Level 

- Low Low Low, Level 1 Function is one of the many Functions assumed 

to be OPERABLE and capable of providing isolation signals. The 

Reactor Vessel Water Level - Low Low Low, Level 1 Function associated 

with isolation is assumed in the analysis of the recirculation line break 

(Ref. 1). The isolation of the MSL on Level 1 supports actions to ensure 

that offsite dose limits are not exceeded for a DBA. 

Reactor vessel water level signals are initiated from four level transmitters 

that sense the difference between the pressure due to a constant column 

of water (reference leg) and the pressure due to the actual water level 

(variable leg) in the vessel. Four channels of Reactor Vessel Water Level 

- Low Low Low, Level 1 Function are available and are required to be 

OPERABLE to ensure that no single instrument failure can preclude the 

isolation function. 

The Reactor Vessel Water Level - Low Low Low, Level 1 Allowable Value 

is chosen to be the same as the ECCS Level 1 Allowable Value 

(LCO 3.3.5.1) to ensure that the MSLs isolate on a potential loss of 

coolant accident (LOCA) to prevent offsite doses from exceeding 

10 CFR 100 limits. 

This Function isolates the Group 1 and 5 valves. 

1.b. Main Steam Line Pressure - Low

Low MSL pressure indicates that there may be a problem with the turbine 

pressure regulation, which could result in a low reactor vessel water level 

condition and the RPV cooling down more than 100°F/hour if the pressure 

loss is allowed to continue. The Main Steam Line Pressure - Low 

Function is directly assumed in the analysis of the pressure regulator 

failure (Ref. 2). For this event, the closure of the MSIVs ensures that the 

RPV temperature change limit (100°F/hour) is not reached. In addition, 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-6 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

this Function supports actions to ensure that Safety Limit 2.1.1.1 is not 

exceeded. (This Function closes the MSIVs prior to pressure decreasing 

below 785 psig, which results in a scram due to MSIV closure, thus 

reducing reactor power to < 25% RTP.) 

The MSL low pressure signals are initiated from four transmitters that are 

connected to the MSL header. The transmitters are arranged such that, 

even though physically separated from each other, each transmitter is 

able to detect low MSL pressure. Four channels of Main Steam Line 

Pressure - Low Function are available and are required to be OPERABLE 

to ensure that no single instrument failure can preclude the isolation 

function. 

The Allowable Value was selected to be high enough to prevent 

excessive RPV depressurization. 

The Main Steam Line Pressure - Low Function is only required to be 

OPERABLE in MODE 1 since this is when the assumed transient can 

occur (Ref. 2). 

This Function isolates the Group 1 valves. 

1.c. Main Steam Line Flow - High

Main Steam Line Flow - High is provided to detect a break of the MSL 

and to initiate closure of the MSIVs. If the steam were allowed to 

continue flowing out of the break, the reactor would depressurize and the 

core could uncover. If the RPV water level decreases too far, fuel 

damage could occur. Therefore, the isolation is initiated on high flow to 

prevent or minimize core damage. The Main Steam Line Flow - High 

Function is directly assumed in the analysis of the main stream line break 

(MSLB) accident (Ref. 1). The isolation action, along with the scram 

function of the RPS, ensures that the fuel peak cladding temperature 

remains below the limits of 10 CFR 50.46 and offsite doses do not exceed 

the 10 CFR 100 limits. 

The MSL flow signals are initiated from 16 transmitters that are connected 

to the four MSLs. The transmitters are arranged such that, even though 

physically separated from each other, all four connected to one steam line 

would be able to detect the high flow. Four channels of Main Steam Line 

Flow - High Function for each unisolated MSL (two channels per trip 

system) are available and are required to be OPERABLE so that no 

single instrument failure will preclude detecting a break in any individual 

MSL. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-7 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Allowable Value is chosen to ensure that offsite dose limits are not 

exceeded due to the break. 

This Function isolates the Group 1 valves. 

1.d. Condenser Vacuum - Low

The Condenser Vacuum - Low Function is provided to prevent 

overpressurization of the main condenser in the event of a loss of the 

main condenser vacuum. Since the integrity of the condenser is an 

assumption in offsite dose calculations, the Condenser Vacuum - Low 

Function is assumed to be OPERABLE and capable of initiating closure 

of the MSIVs. The closure of the MSIVs is initiated to prevent the addition 

of steam that would lead to additional condenser pressurization and 

possible rupture of the diaphragm installed to protect the turbine exhaust 

hood, thereby preventing a potential radiation leakage path following an 

accident. 

Condenser vacuum pressure signals are derived from four pressure 

transmitters that sense the pressure in the condenser. Four channels of 

Condenser Vacuum - Low Function are available and are required to be 

OPERABLE to ensure no single instrument failure can preclude the 

isolation function. 

The Allowable Value is chosen to prevent damage to the condenser due 

to pressurization, thereby ensuring its integrity for offsite dose analysis. 

As noted (footnote (a) to Table 3.3.6.1-1), the channels are not required 

to be OPERABLE in MODES 2 and 3, when all turbine stop valves 

(TSVs) are closed, since the potential for condenser overpressurization is 

minimized. Switches are provided to manually bypass the channels when 

all TSVs are closed. 

This Function isolates the Group 1 valves. 

1.e, 1.f. Main Steam Tunnel Ambient and Differential Temperature - High

Ambient and Differential Temperature - High is provided to detect a leak 

in the RCPB, and provides diversity to the high flow instrumentation. The 

isolation occurs when a very small leak has occurred. If the small leak is 

allowed to continue without isolation, offsite dose limits may be reached. 

However, credit for these instruments is not taken in any transient or 

accident analysis in the FSAR, since bounding analyses are performed 

for large breaks such as MSLBs. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-8 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Ambient temperature signals are initiated from thermocouples located in 

the area being monitored. Four channels of Main Steam Tunnel 

Temperature - High Function are available and are required to be 

OPERABLE to ensure that no single instrument failure can preclude the 

isolation function. Each Function has one temperature element. 

Eight thermocouples provide input to the Main Steam Tunnel Differential 

Temperature - High Function. The output of these thermocouples is used 

to determine the differential temperature. Each channel consists of a 

differential temperature instrument that receives inputs from 

thermocouples that are located in the inlet and outlet of the area cooling 

system for a total of four available channels. 

The ambient and differential temperature monitoring Allowable Value is 

chosen to detect a leak equivalent to 25 gpm. 

These Functions isolate the Group 1 valves. 

1.g. Manual Initiation

The Manual Initiation push button channels introduce signals into the 

MSL isolation logic that are redundant to the automatic protective 

instrumentation and provide manual isolation capability. There is no 

specific FSAR safety analysis that takes credit for this Function. It is 

retained for overall redundancy and diversity of the isolation function as 

required by the NRC in the plant licensing basis. 

There are four push buttons for the logic, two manual initiation push 

buttons per trip system. There is no Allowable Value for this Function 

since the channels are mechanically actuated based solely on the 

position of the push buttons. 

Four channels of Manual Initiation Function are available and are required 

to be OPERABLE in MODES 1, 2, and 3, since these are the MODES in 

which the MSL Isolation automatic Functions are required to be 

OPERABLE. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-9 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

2. Primary Containment Isolation

2.a, 2.e. Reactor Vessel Water Level - Low Low, Level 2

Low RPV water level indicates the capability to cool the fuel may be 

threatened. The valves whose penetrations communicate with the 

primary containment are isolated to limit the release of fission products. 

The isolation of the primary containment on Level 2 supports actions to 

ensure that offsite dose limits of 10 CFR 100 are not exceeded. The 

Reactor Vessel Water Level - Low Low, Level 2 Function associated with 

isolation is implicitly assumed in the FSAR analysis as these leakage 

paths are assumed to be isolated post LOCA. 

Reactor Vessel Water Level - Low Low, Level 2 signals are initiated from 

level transmitters that sense the difference between the pressure due to a 

constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. Four channels of Reactor 

Vessel Water Level - Low Low, Level 2 Function are available and are 

required to be OPERABLE to ensure no single instrument failure can 

preclude the isolation function. 

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was 

chosen to be the same as the ECCS Reactor Vessel Water Level - Low 

Low, Level 2 Allowable Value (LCO 3.3.5.1), since isolation of these 

valves is not critical to orderly plant shutdown. 

This Function isolates the Group 6A, 6B, and 7 valves. 

2.b, 2.d, 2.f. Drywell Pressure - High

High drywell pressure can indicate a break in the RCPB. The isolation of 

some of the PCIVs on high drywell pressure supports actions to ensure 

that offsite dose limits of 10 CFR 100 are not exceeded. The Drywell 

Pressure - High Function associated with isolation of the primary 

containment is implicitly assumed in the FSAR accident analysis as these 

leakage paths are assumed to be isolated post LOCA. 

High drywell pressure signals are initiated from pressure transmitters that 

sense the pressure in the drywell. Four channels of Drywell Pressure - 

High per Function are available and are required to be OPERABLE to 

ensure that no single instrument failure can preclude the isolation 

function. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-10 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Allowable Value was selected to be the same as the ECCS Drywell 

Pressure - High Allowable Value (LCO 3.3.5.1), since this may be 

indicative of a LOCA inside primary containment. 

These Functions isolate the Group 6A and 7 valves (Function 2.b), E61 

isolation valves (Function 2.d), and Group 6B valves (Function 2.f). 

2.c. Reactor Vessel Water Level - Low Low Low, Level 1

Low RPV water level indicates the capability to cool the fuel may be 

threatened. Should RPV water level decrease too far, fuel damage could 

result. Therefore, isolation of the primary containment occurs to prevent 

offsite dose limits from being exceeded. The Reactor Vessel Water Level 

- Low Low Low, Level 1 Function is one of the many Functions assumed 

to be OPERABLE and capable of providing isolation signals. The 

Reactor Vessel Water Level - Low Low Low, Level 1 Function associated 

with isolation is implicitly assumed in the FSAR analysis as these leakage 

paths are assumed to be isolated post LOCA. 

Reactor vessel water level signals are initiated from level transmitters that 

sense the difference between the pressure due to a constant column of 

water (reference leg) and the pressure due to the actual water level 

(variable leg) in the vessel. Four channels of Reactor Vessel Water Level 

- Low Low Low, Level 1 Function are available and are required to be 

OPERABLE to ensure that no single instrument failure can preclude the 

isolation function. 

The Reactor Vessel Water Level - Low Low Low, Level 1 Allowable Value 

is chosen to be the same as the ECCS Reactor Vessel Water Level - Low 

Low Low, Level 1 Allowable Value (LCO 3.3.5.1) to ensure the valves are 

isolated to prevent offsite doses from exceeding 10 CFR 100 limits. 

This Function isolates the E61 isolation valves. 

2.g. Containment and Drywell Ventilation Exhaust Radiation - High

High ventilation exhaust radiation is an indication of possible gross failure 

of the fuel cladding. The release may have originated from the primary 

containment due to a break in the RCPB. When Exhaust Radiation - High 

is detected, valves whose penetrations communicate with the primary 

containment atmosphere are isolated to limit the release of fission 

products. Additionally, the Ventilation Exhaust Radiation - High is 

assumed to initiate isolation of the primary containment during a fuel 

handling accident [involving handling recently irradiated fuel] (Ref. 2). 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-11 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Exhaust Radiation - High signals are initiated from radiation detectors 

that are located on the ventilation exhaust piping coming from the drywell 

and containment. The signal from each detector is input to an individual 

monitor whose trip outputs are assigned to an isolation channel. Four 

channels of Containment and Drywell Ventilation Exhaust - High Function 

are available and are required to be OPERABLE to ensure that no single 

instrument failure can preclude the isolation function. 

The Allowable Values are chosen to promptly detect gross failure of the 

fuel cladding and to ensure offsite doses remain below 10 CFR 20 and 

10 CFR 100 limits. 

The Function is required to be OPERABLE during operations with a 

potential for draining the reactor vessel (OPDRVs) and movement of 

[recently] irradiated fuel assemblies in the primary or secondary 

containment because the capability of detecting radiation releases due to 

fuel failures (due to fuel uncovery or dropped [recently] irradiated fuel 

assemblies) must be provided to ensure offsite dose limits are not 

exceeded. [Due to radioactive decay, this Function is only required to 

isolate primary containment during fuel handling accidents involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [x] days)]. 

These Functions isolate the Group 7 valves. 

2.h. Manual Initiation

The Manual Initiation push button channels introduce signals into the 

primary containment isolation logic that are redundant to the automatic 

protective instrumentation and provide manual isolation capability. There 

is no specific FSAR safety analysis that takes credit for this Function. It is 

retained for overall redundancy and diversity of the isolation function as 

required by the NRC in the plant licensing basis. 

There are four push buttons for the logic, two manual initiation push 

buttons per trip system. There is no Allowable Value for this Function 

since the channels are mechanically actuated based solely on the 

position of the push buttons. 

Four channels of the Manual Initiation Function are available and are 

required to be OPERABLE in MODES 1, 2, and 3, since these are the 

MODES in which the Primary Containment Isolation automatic Functions 

are required to be OPERABLE. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-12 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3. Reactor Core Isolation Cooling System Isolation

3.a. RCIC Steam Line Flow - High

RCIC Steam Line Flow - High Function is provided to detect a break of 

the RCIC steam lines and initiates closure of the steam line isolation 

valves. If the steam is allowed to continue flowing out of the break, the 

reactor will depressurize and core uncovery can occur. Therefore, the 

isolation is initiated on high flow to prevent or minimize core damage. 

The isolation action, along with the scram function of the Reactor 

Protection System (RPS), ensures that the fuel peak cladding 

temperature remains below the limits of 10 CFR 50.46. Specific credit for 

this Function is not assumed in any FSAR accident analyses since the 

bounding analysis is performed for large breaks such as recirculation and 

MSL breaks. However, these instruments prevent the RCIC steam line 

break from becoming bounding. 

The RCIC Steam Line Flow - High signals are initiated from two 

transmitters that are connected to the system steam lines. Two channels 

of RCIC Steam Line Flow - High Functions are available and are required 

to be OPERABLE to ensure that no single instrument failure can preclude 

the isolation function. 

The Allowable Value is chosen to be low enough to ensure that the trip 

occurs to prevent fuel damage and maintains the MSLB event as the 

bounding event. 

This Function isolates the Group 4 valves. 

3.b. RCIC Steam Line Flow Time Delay

The RCIC Steam Line Flow Time Delay is provided to prevent false 

isolations on RCIC Steam Line Flow - High during system startup 

transients and therefore improves system reliability. This Function is not 

assumed in any FSAR transient or accident analyses. 

The Allowable Value was chosen to be long enough to prevent false 

isolations due to system starts but not so long as to impact offsite dose 

calculations. 

Two channels for RCIC Steam Line Flow Time Delay Functions are 

available and are required to be OPERABLE to ensure that no single 

instrument failure can preclude the isolation function. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-13 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3.c. RCIC Steam Supply Line Pressure - Low

Low MSL pressure indicates that the pressure of the steam in the RCIC 

turbine may be too low to continue operation of the associated system's 

turbine. This isolation is for equipment protection and is not assumed in 

any transient or accident analysis in the FSAR. However, it also provides 

a diverse signal to indicate a possible system break. These instruments 

are included in the Technical Specifications (TS) because of the potential 

for risk due to possible failure of the instruments preventing RCIC 

initiations. 

The RCIC Steam Supply Line Pressure - Low signals are initiated from 

two transmitters that are connected to the system steam line. Two 

channels of RCIC Steam Supply Line Pressure - Low Functions are 

available and are required to be OPERABLE to ensure that no single 

instrument failure can preclude the isolation function. 

The Allowable Value is selected to be high enough to prevent damage to 

the system's turbines. 

This Function isolates the Group 4 valves. 

3.d. RCIC Turbine Exhaust Diaphragm Pressure - High

High turbine exhaust diaphragm pressure indicates that the pressure may 

be too high to continue operation of the associated system's turbine. That 

is, one of two exhaust diaphragms has ruptured and pressure is reaching 

turbine casing pressure limits. This isolation is for equipment protection 

and is not assumed in any transient or accident analysis in the FSAR. 

These instruments are included in the TS because of the potential for risk 

due to possible failure of the instruments preventing RCIC initiations 

(Ref. 3). 

The RCIC Turbine Exhaust Diaphragm Pressure - High signals are 

initiated from four transmitters that are connected to the area between the 

rupture diaphragms on each system's turbine exhaust line. Four 

channels of RCIC Turbine Exhaust Diaphragm Pressure - High Functions 

are available and are required to be OPERABLE to ensure that no single 

instrument failure can preclude the isolation function. 

The Allowable Values are high enough to prevent damage to the system's 

turbines. 

This Function isolates the Group 4 valves. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-14 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3.e, 3.f, 3.j, 3.k. Ambient and Differential Temperature - High

Ambient and Differential Temperatures are provided to detect a leak from 

the associated system steam piping. The isolation occurs when a very 

small leak has occurred and is diverse to the high flow instrumentation. If 

the small leak is allowed to continue without isolation, offsite dose limits 

may be reached. These Functions are not assumed in any FSAR 

transient or accident analysis, since bounding analyses are performed for 

large breaks such as recirculation or MSL breaks. 

Ambient and Differential Temperature - High signals are initiated from 

thermocouples that are appropriately located to protect the system that is 

being monitored. Two instruments monitor each area. Six channels for 

RHR and RCIC Ambient Temperature - High Function are available and 

are required to be OPERABLE to ensure that no single instrument failure 

can preclude the isolation function. There are two for the RCIC room and 

four for the RHR area. 

There are 12 thermocouples (four for the RCIC room and eight for the 

RHR area) that provide input to the Area Ventilation Differential 

Temperature - High Function. The output of these thermocouples is used 

to determine the differential temperature. Each channel consists of a 

differential temperature instrument that receives inputs from 

thermocouples that are located in the inlet and outlet of the area cooling 

system for a total of six (two for the RCIC room and four for the RHR 

area) available channels. 

The Allowable Values are set low enough to detect a leak equivalent to 

25 gpm. 

This Function isolates the Group 4 valves. 

3.g, 3.h. Main Steam Line Tunnel Ambient and Differential Temperature -

High

Ambient and Differential Temperature - High is provided to detect a leak 

in the RCPB and provides diversity to the high flow instrumentation. The 

isolation occurs when a very small leak has occurred. If the small leak is 

allowed to continue without isolation, offsite limits may be reached. 

However, credit for these instruments is not taken in any transient or 

accident analysis in the FSAR, since bounding analyses are performed 

for large breaks such as MSLBs. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-15 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Ambient temperature signals are initiated from thermocouples located in 

the area being monitored. Two channels of Main Steam Tunnel 

Temperature - High Function are available and are required to be 

OPERABLE to ensure that no single instrument failure can preclude the 

isolation function. Each Function has one temperature element. 

Four thermocouples provide input to the Main Steam Tunnel Differential 

Temperature - High Function. The output of these thermocouples is used 

to determine the differential temperature. Each channel consists of a 

differential temperature instrument that receives inputs from 

thermocouples that are located in the inlet and outlet of the area cooling 

system for a total of two available channels. 

The Allowable Values are chosen to detect a leak equivalent to 25 gpm. 

This Function isolates the Group 4 valves. 

3.i. Main Steam Line Tunnel Temperature Timer

The Main Steam Line Tunnel Temperature Timer is provided to allow all 

the other systems that may be leaking in the main steam tunnel (as 

indicated by the high temperature) to be isolated before RCIC is 

automatically isolated. This ensures maximum RCIC System operation 

by preventing isolations due to leaks in other systems. This Function is 

not assumed in any FSAR transient or accident analysis; however, 

maximizing RCIC availability is an important function. 

Two channels for RCIC Main Steam Line Tunnel Timer Function are 

available and are required to be OPERABLE to ensure that no single 

instrument failure can preclude the isolation function. 

The Allowable Values are based on maximizing the availability of the 

RCIC System; that is, providing sufficient time to isolate all other potential 

leakage sources in the main steam tunnel before RCIC is isolated. 

This Function isolates the Group 4 valves. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-16 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3.l. RCIC/RHR High Steam Line Flow - High

RCIC/RHR high steam line flow is provided to detect a break of the 

common steam line of RCIC and RHR (steam condensing mode) and 

initiates closure of the isolation valves for both systems. If the steam 

were allowed to continue flowing out of the break, the reactor would 

depressurize and the core could uncover. Therefore, the isolation is 

initiated at high flow to prevent or minimize core damage. Specific credit 

for this Function is not assumed in any FSAR accident or transient 

analysis since the bounding analysis is performed for large breaks such 

as recirculation and MSL breaks. However, these instruments prevent 

the RCIC/RHR steam line break from becoming bounding. 

The RCIC/RHR steam line flow signals are initiated from two transmitters 

that are connected to the steam line. Two channels with one channel in 

each trip system are available and required to be OPERABLE to ensure 

that no single instrument failure can preclude the isolation function. The 

Allowable Value is selected to ensure that the trip occurs to prevent fuel 

damage and maintains the MSLB as the boundary event. 

This Function actuates the Group 4 valves. 

3.m. Drywell Pressure – High

High drywell pressure can indicate a break in the RCPB. The RCIC 

isolation of the turbine exhaust is provided to prevent communication with 

the drywell when high drywell pressure exists. A potential leakage path 

exists via the turbine exhaust. The isolation is delayed until the system 

becomes unavailable for injection (i.e., low steam line pressure). The 

isolation of the RCIC turbine exhaust by Drywell Pressure - High is 

indirectly assumed in the FSAR accident analysis because the turbine 

exhaust leakage path is not assumed to contribute to offsite doses. 

High drywell pressure signals are initiated from pressure transmitters that 

sense the pressure in the drywell. Two channels of RCIC Drywell 

Pressure - High Function are available and are required to be 

OPERABLE to ensure that no single instrument failure can preclude the 

isolation function. 

The Allowable Value was selected to be the same as the ECCS Drywell 

Pressure - High Allowable Value (LCO 3.3.5.1), since this is indicative of 

a LOCA inside primary containment. 

This Function isolates the Group 9 valves. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-17 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3.n. Manual Initiation

The Manual Initiation push button channels introduce signals into the 

RCIC System isolation logic that are redundant to the automatic 

protective instrumentation and provide manual isolation capability. There 

is no specific FSAR safety analysis that takes credit for this Function. It is 

retained for overall redundancy and diversity of the isolation function as 

required by the NRC in the plant licensing basis. 

There are four push buttons for RCIC, two manual initiation push buttons 

per trip system. There is no Allowable Value for this Function since the 

channels are mechanically actuated based solely on the position of the 

push buttons. 

Four channels of RCIC Manual Initiation are available and are required to 

be OPERABLE. 

4. Reactor Water Cleanup System Isolation

4.a. Differential Flow - High

The high differential flow signal is provided to detect a break in the RWCU 

System. This will detect leaks in the RWCU System when area or 

differential temperature would not provide detection (i.e., a cold leg 

break). Should the reactor coolant continue to flow out of the break, 

offsite dose limits may be exceeded. Therefore, isolation of the RWCU 

System is initiated when high differential flow is sensed to prevent 

exceeding offsite doses. A time delay is provided to prevent spurious 

trips during most RWCU operational transients. This Function is not 

assumed in any FSAR transient or accident analysis, since bounding 

analyses are performed for large breaks such as MSLBs. 

The high differential flow signals are initiated from two transmitters that 

are connected to the inlet (from the reactor vessel) and four transmitters 

from the outlets (to condenser and feedwater) of the RWCU System. The 

outputs of the transmitters are compared (in two different summers) and 

the outputs are sent to two high flow trip units. If the difference between 

the inlet and outlet flow is too large, each trip unit generates an isolation 

signal. Two channels of Differential Flow - High Function are available 

and are required to be OPERABLE to ensure that no single instrument 

failure can preclude the isolation function. 

The Reactor Water Cleanup Differential Flow - High Allowable Value 

ensures that the break of the RWCU piping is detected. 

This Function isolates the Group 8 valves. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-18 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

4.b. Differential Flow – Timer

The Differential Flow - Timer is provided to avoid RWCU System 

isolations due to operational transients (such as pump starts and mode 

changes). During these transients the inlet and return flows become 

unbalanced for short time periods and Differential Flow - High will be 

sensed without an RWCU System break being present. Credit for this 

Function is not assumed in the FSAR accident or transient analysis, since 

bounding analyses are performed for large breaks such as MSLBs. 

The Differential Flow Timer Allowable Value is selected to ensure that the 

MSLB outside containment remains the limiting break for FSAR analysis 

for offsite dose calculations. 

Two channels for Differential Flow - Timer Function are available and are 

required to be OPERABLE to ensure that no single instrument failure can 

preclude the isolation function. 

4.c, 4.d, 4.e, 4.f, 4.g, 4.h. Ambient and Differential Temperature - High

Ambient and Differential Temperature - High is provided to detect a leak 

from the RWCU System. The isolation occurs even when very small 

leaks have occurred and is diverse to the high differential flow 

instrumentation for the hot portions of the RWCU System. If the small 

leak continues without isolation, offsite dose limits may be reached. 

Credit for these instruments is not taken in any transient or accident 

analysis in the FSAR, since bounding analyses are performed for large 

breaks such as MSLBs. 

Ambient and differential temperature signals are initiated from 

temperature elements that are located in the room that is being 

monitored. There are eight thermocouples that provide input to the Area 

Temperature - High Function (two per area). Eight channels are required 

to be OPERABLE to ensure that no single instrument failure can preclude 

the isolation function. 

There are 16 thermocouples that provide input to the Differential 

Temperature - High Function. The output of these thermocouples is used 

to determine the differential temperature. Each channel consists of a 

differential temperature instrument that receives inputs from 

thermocouples that are located in the inlet and outlet of the area cooling 

system for a total of eight available channels (two per area). Eight 

channels are required to be OPERABLE to ensure that no single 

instrument failure can preclude the isolation function. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-19 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Ambient and Differential Temperature - High Allowable Values are 

set low enough to detect a leak equivalent to 25 gpm. 

These Functions isolate the Group 8 valves. 

4.i, 4.j. Main Steam Line Tunnel Ambient and Differential Temperature -

High

Ambient and Differential Temperature - High is provided to detect a leak 

in the RCPB and provides diversity to the high flow instrumentation. The 

isolation occurs when a very small leak has occurred. If the small leak is 

allowed to continue without isolation, offsite dose limits may be reached. 

However, credit for these instruments is not taken in any transient or 

accident analysis, since bounding analyses are performed for large 

breaks such as MSLBs. 

Ambient temperature signals are initiated from thermocouples located in 

the area being monitored. Two channels of Main Steam Tunnel 

Temperature - High Function are available and are required to be 

OPERABLE to ensure that no single instrument failure can preclude the 

isolation function. Each Function has one temperature element. 

There are four thermocouples that provide input to the Differential 

Temperature - High Function. The output of these thermocouples is used 

to determine the differential temperature. Each channel consists of a 

differential temperature instrument that receives inputs from 

thermocouples that are located in the inlet and outlet of the area cooling 

system for a total of two available channels. 

The Allowable Values are chosen to detect a leak equivalent to 25 gpm. 

This Function isolates the Group 8 valves. 

4.k. Reactor Vessel Water Level - Low Low, Level 2

Low RPV water level indicates the capability to cool the fuel may be 

threatened. Should RPV water level decrease too far, fuel damage could 

result. Therefore, isolation of some reactor vessel interfaces occurs to 

isolate the potential sources of a break. The isolation of the RWCU 

System on Level 2 supports actions to ensure that fuel peak cladding 

temperature remains below the limits of 10 CFR 50.46. The Reactor 

Vessel Water Level - Low Low, Level 2 Function associated with RWCU 

isolation is not directly assumed in any transient or accident analysis, 

since bounding analyses are performed for large breaks such as MSLBs. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-20 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Reactor Vessel Water Level - Low Low, Level 2 signals are initiated from 

level transmitters that sense the difference between the pressure due to a 

constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. Four channels of Reactor 

Vessel Water Level - Low Low, Level 2 Function are available and are 

required to be OPERABLE to ensure that no single instrument failure can 

preclude the isolation function. 

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was 

chosen to be the same as the ECCS Reactor Vessel Water Level - Low 

Low, Level 2 Allowable Value (LCO 3.3.5.1), since the capability to cool 

the fuel may be threatened. 

This Function isolates the Group 8 valves. 

4.l. SLC System Initiation

The isolation of the RWCU System is required when the SLC System has 

been initiated to prevent dilution and removal of the boron solution by the 

RWCU System (Ref. 4). SLC System initiation signals are initiated from 

the two SLC pump start signals. 

There is no Allowable Value associated with this Function since the 

channels are mechanically actuated based solely on the position of the 

SLC System initiation switch. 

Two channels (one from each pump) of SLC System Initiation Function 

are available and are required to be OPERABLE only in MODES 1 and 2, 

since these are the only MODES where the reactor can be critical, and 

these MODES are consistent with the Applicability for the SLC System 

(LCO 3.1.7). 

4.m. Manual Initiation

The Manual Initiation push button channels introduce signals into the 

RWCU System isolation logic that are redundant to the automatic 

protective instrumentation and provide manual isolation capability. There 

is no specific FSAR safety analysis that takes credit for this Function. It is 

retained for overall redundancy and diversity of the isolation function as 

required by the NRC in plant licensing basis. 

There are four push buttons for the logic, two manual initiation push 

buttons per trip system. There is no Allowable Value for this Function, 

since the channels are mechanically actuated based solely on the 

position of the push buttons. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-21 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Four channels of the Manual Initiation Function are available and are 

required to be OPERABLE in MODES 1, 2, and 3 since these are the 

MODES in which the RWCU System Isolation automatic Functions are 

required to be OPERABLE. 

5. Shutdown Cooling System Isolation

5.a, 5.b. Ambient and Differential Temperature - High

Ambient and Differential Temperature - High is provided to detect a leak 

from the associated system steam piping. The isolation occurs when a 

very small leak has occurred and is diverse to the high flow 

instrumentation. If the small leak is allowed to continue without isolation, 

offsite dose limits may be reached. These Functions are not assumed in 

any FSAR transient or accident analysis, since bounding analyses are 

performed for large breaks such as MSLBs. 

Ambient and Differential Temperature - High signals are initiated from 

thermocouples that are appropriately located to protect the system that is 

being monitored. Two instruments monitor each area. Four channels for 

RHR Ambient and Differential Temperature - High Function are available 

and are required to be OPERABLE to ensure that no single instrument 

failure can preclude the isolation function. 

Eight thermocouples provide input to the Area Ventilation Differential 

Temperature - High Function. The output of these thermocouples is used 

to determine the differential temperature. Each channel consists of a 

differential temperature instrument that receives inputs from 

thermocouples that are located in the inlet and outlet of the area cooling 

system for a total of four available channels. 

The Allowable Values are set low enough to detect a leak equivalent to 

25 gpm. 

This Function isolates the Group 3 valves. 

5.c. Reactor Vessel Water Level - Low, Level 3

Low RPV water level indicates the capability to cool the fuel may be 

threatened. Should RPV water level decrease too far, fuel damage could 

result. Therefore, isolation of some reactor vessel interfaces occurs to 

begin isolating the potential sources of a break. The Reactor Vessel 

Water Level - Low, Level 3 Function associated with RHR Shutdown 

Cooling System isolation is not directly assumed in any transient or 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-22 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

accident analysis, since bounding analyses are performed for large 

breaks such as MSLBs. The RHR Shutdown Cooling System isolation on 

Level 3 supports actions to ensure that the RPV water level does not drop 

below the top of the active fuel during a vessel draindown event caused 

by a leak (e.g., pipe break or inadvertent valve opening) in the RHR 

Shutdown Cooling System. 

Reactor Vessel Water Level - Low, Level 3 signals are initiated from level 

transmitters that sense the difference between the pressure due to a 

constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. Four channels (two 

channels per trip system) of the Reactor Vessel Water Level - Low, 

Level 3 Function are available and are required to be OPERABLE to 

ensure that no single instrument failure can preclude the isolation 

function. As noted (footnote (c) to Table 3.3.6.1-1), only two channels of 

the Reactor Vessel Water Level - Low, Level 3 Function are required to 

be OPERABLE in MODES 4 and 5 (both channels must input into the 

same trip system) provided the RHR Shutdown Cooling System integrity 

is maintained. System integrity is maintained provided the piping is intact 

and no maintenance is being performed that has the potential for draining 

the reactor vessel through the system. 

The Reactor Vessel Water Level - Low, Level 3 Allowable Value was 

chosen to be the same as the RPS Reactor Vessel Water Level - Low, 

Level 3 Allowable Value (LCO 3.3.1.1) since the capability to cool the fuel 

may be threatened. 

The Reactor Vessel Water Level - Low, Level 3 Function is only required 

to be OPERABLE in MODES 3, 4, and 5 to prevent this potential flow 

path from lowering reactor vessel level to the top of the fuel. In MODES 1 

and 2, other isolations (e.g., Reactor Steam Dome Pressure - High) and 

administrative controls ensure that this flow path remains isolated to 

prevent unexpected loss of inventory via this flow path. 

This Function isolates the Group 3 valves. 

5.d. Reactor Steam Dome Pressure – High

The Shutdown Cooling System Reactor Steam Dome Pressure - High 

Function is provided to isolate the shutdown cooling portion of the RHR 

System. This interlock is provided only for equipment protection to 

prevent an intersystem LOCA scenario and credit for the interlock is not 

assumed in the accident or transient analysis in the FSAR. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-23 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Reactor Steam Dome - High pressure signals are initiated from four 

transmitters. Four channels of Reactor Steam Dome Pressure - High 

Function are available and are required to be OPERABLE to ensure that 

no single instrument failure can preclude the isolation function. The 

Allowable Value was chosen to be low enough to protect the system 

equipment from overpressurization. 

This Function isolates the Group 3 valves. 

5.e. Drywell Pressure - High

High drywell pressure can indicate a break in the RCPB. The isolation of 

some of the PCIVs on high drywell pressure supports actions to ensure 

that offsite dose limits of 10 CFR 100 are not exceeded. The Drywell 

Pressure - High Function associated with isolation of the RHR Shutdown 

Cooling System is not modeled in any FSAR accident or transient 

analysis because other leakage paths (e.g., MSIVs) are more limiting. 

High drywell pressure signals are initiated from pressure transmitters that 

sense the pressure in the drywell. Four channels of Drywell Pressure - 

High Function are available and are required to be OPERABLE to ensure 

that no single instrument failure can preclude the isolation function. 

The Allowable Value was selected to be the same as the ECCS Drywell 

Pressure - High Allowable Value (LCO 3.3.5.1), since this may be 

indicative of a LOCA inside primary containment. 

This Function isolates the Group 3 valves. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

The ACTIONS are modified by two NOTES. Note 1 allows penetration 

flow path(s) to be unisolated intermittently under administrative controls. 

These controls consist of stationing a dedicated operator at the controls 

of the valve, who is in continuous communication with the control room. 

In this way, the penetration can be rapidly isolated when a need for 

primary containment isolation is indicated. Note 2 has been provided to 

modify the ACTIONS related to primary containment isolation 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-24 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

instrumentation channels. Section 1.3, Completion Times, specifies that 

once a Condition has been entered, subsequent divisions, subsystems, 

components, or variables expressed in the Condition discovered to be 

inoperable or not within limits will not result in separate entry into the 

Condition. Section 1.3 also specifies that Required Actions of the 

Condition continue to apply for each additional failure, with Completion 

Times based on initial entry into the Condition. However, the Required 

Actions for inoperable primary containment isolation instrumentation 

channels provide appropriate compensatory measures for separate 

inoperable channels. As such, a Note has been provided that allows 

separate Condition entry for each inoperable primary containment 

isolation instrumentation channel. 

A.1

Because of the diversity of sensors available to provide isolation signals 

and the redundancy of the isolation design, an allowable out of service 

time of 12 hours or 24 hours, depending on the Function, has been 

shown to be acceptable (Refs. 5 and 6) to permit restoration of any 

inoperable channel to OPERABLE status. This out of service time is only 

acceptable provided the associated Function is still maintaining isolation 

capability (refer to Required Action B.1 Bases). If the inoperable channel 

cannot be restored to OPERABLE status within the allowable out of 

service time, the channel must be placed in the tripped condition per 

Required Action A.1. Placing the inoperable channel in trip would 

conservatively compensate for the inoperability, restore capability to 

accommodate a single failure, and allow operation to continue with no 

further restrictions. Alternately, if it is not desired to place the channel in 

trip (e.g., as in the case where placing the inoperable channel in trip 

would result in an isolation), Condition C must be entered and its 

Required Action taken. 

B.1

Required Action B.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within the same Function 

result in redundant automatic isolation capability being lost for the 

associated penetration flow path(s). The MSL isolation Functions are 

considered to be maintaining isolation capability when sufficient channels 

are OPERABLE or in trip such that both trip systems will generate a trip 

signal from the given Function on a valid signal. The other isolation 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-25 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Functions are considered to be maintaining isolation capability when 

sufficient channels are OPERABLE or in trip such that one trip system will 

generate a trip signal from the given Function on a valid signal. This 

ensures that one of the two PCIVs in the associated penetration flow path 

can receive an isolation signal from the given Function. For 

Functions 1.a, 1.b, 1.d, 1.e, and 1.f, this would require both trip systems 

to have one channel OPERABLE or in trip. For Function 1.c, this would 

require both trip systems to have one channel, associated with each MSL, 

OPERABLE or in trip. For Functions 2.a, 2.b, 2.c, 2.d, 2.e, 2.f, 2.g, 3.d, 

4.k, 5.c, 5.d, and 5.e, this would require one trip system to have two 

channels, each OPERABLE or in trip. For Functions 3.a, 3.b, 3.c, 3.e, 3.f, 

3.g, 3.h, 3.i, 3.l, 3.m, 4.a, 4.b, 4.c, 4.d, 4.g, 4.h, 4.i, 4.j, and 4.l, this would 

require one trip system to have one channel OPERABLE or in trip. For 

Functions 3.j, 3.k, 4.e, 4.f, 5.a, and 5.b, each Function consists of 

channels that monitor several different locations. Therefore, this would 

require one channel per location to be OPERABLE or in trip (the channels 

are not required to be in the same trip system). The Condition does not 

include the Manual Initiation Functions (Functions 1.g, 2.h, 3.n, and 4.m), 

since they are not assumed in any accident or transient analysis. Thus, a 

total loss of manual initiation capability for 24 hours (as allowed by 

Required Action A.1) is allowed. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. The Completion Time is 

acceptable because it minimizes risk while allowing time for restoration or 

tripping of channels. 

C.1

Required Action C.1 directs entry into the appropriate Condition 

referenced in Table 3.3.6.1-1. The applicable Condition specified in 

Table 3.3.6.1-1 is Function and MODE or other specified condition 

dependent and may change as the Required Action of a previous 

Condition is completed. Each time an inoperable channel has not met 

any Required Action of Condition A or B and the associated Completion 

Time has expired, Condition C will be entered for that channel and 

provides for transfer to the appropriate subsequent Condition. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-26 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1, D.2.1, and D.2.2

If the channel is not restored to OPERABLE status or placed in trip within 

the allowed Completion Time, the plant must be placed in a MODE or 

other specified condition in which the LCO does not apply. This is done 

by placing the plant in at least MODE 3 within 12 hours and in MODE 4 

within 36 hours (Required Actions D.2.1 and D.2.2). Alternately, the 

associated MSLs may be isolated (Required Action D.1), and if allowed 

(i.e., plant safety analysis allows operation with an MSL isolated), plant 

operation with the MSL isolated may continue. Isolating the affected MSL 

accomplishes the safety function of the inoperable channel. The 

Completion Times are reasonable, based on operating experience, to 

reach the required plant conditions from full power conditions in an 

orderly manner and without challenging plant systems. 

E.1

If the channel is not restored to OPERABLE status or placed in trip within 

the allowed Completion Time, the plant must be placed in a MODE or 

other specified condition in which the LCO does not apply. This is done 

by placing the plant in at least MODE 2 within 6 hours. 

The allowed Completion Time of 6 hours is reasonable, based on 

operating experience, to reach MODE 2 from full power conditions in an 

orderly manner and without challenging plant systems. 

F.1

If the channel is not restored to OPERABLE status or placed in trip within 

the allowed Completion Time, plant operation may continue if the affected 

penetration flow path(s) is isolated. Isolating the affected penetration flow 

path(s) accomplishes the safety function of the inoperable channels. 

For some of the Ambient and Differential Temperature Functions, the 

affected penetration flow path(s) may be considered isolated by isolating 

only that portion of the system in the associated room monitored by the 

inoperable channel. That is, if the RWCU pump room A ambient channel 

is inoperable, the A pump room area can be isolated while allowing 

continued RWCU operation utilizing the B RWCU pump. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-27 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Alternatively, if it is not desired to isolate the affected penetration flow 

path(s) (e.g., as in the case where isolating the penetration flow path(s) 

could result in a reactor scram), Condition H must be entered and its 

Required Actions taken. 

The Completion Time is acceptable because it minimizes risk while 

allowing sufficient time for plant operations personnel to isolate the 

affected penetration flow path(s). 

G.1

If the channel is not restored to OPERABLE status or placed in trip within 

the allowed Completion Time, plant operations may continue if the 

affected penetration flow path(s) is isolated. Isolating the affected 

penetration flow path(s) accomplishes the safety function of the 

inoperable channels. The 24 hour Completion Time is acceptable due to 

the fact that these Functions (Manual Initiation) are not assumed in any 

accident or transient analysis in the FSAR. Alternately, if it is not desired 

to isolate the affected penetration flow path(s) (e.g., as in the case where 

isolating the penetration flow path(s) could result in a reactor scram), 

Condition H must be entered and its Required Actions taken. 

H.1 and H.2

If the channel is not restored to OPERABLE status or placed in trip, or 

any Required Action of Condition F or G is not met and the associated 

Completion Time has expired, the plant must be placed in a MODE or 

other specified condition in which the LCO does not apply. This is done 

by placing the plant in at least MODE 3 within 12 hours and in MODE 4 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

I.1 and I.2

If the channel is not restored to OPERABLE status within the allowed 

Completion Time, the associated SLC subsystem(s) is declared 

inoperable or the RWCU System is isolated. Since this Function is 

required to ensure that the SLC System performs its intended function, 

sufficient remedial measures are provided by declaring the associated 

SLC subsystem inoperable or isolating the RWCU System. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-28 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The Completion Time of 1 hour is acceptable because it minimizes risk 

while allowing sufficient time for personnel to isolate the RWCU System. 

J.1 and J.2

If the channel is not restored to OPERABLE status or placed in trip within 

the allowed Completion Time, the associated penetration flow path should 

be closed. However, if the shutdown cooling function is needed to 

provide core cooling, these Required Actions allow the penetration flow 

path to remain unisolated provided action is immediately initiated to 

restore the channel to OPERABLE status or to isolate the RHR Shutdown 

Cooling System (i.e., provide alternate decay heat removal capabilities so 

the penetration flow path can be isolated). ACTIONS must continue until 

the channel is restored to OPERABLE status or the RHR Shutdown 

Cooling System is isolated. 

K.1, K.2.1, and K.2.2

If the channel is not restored to OPERABLE status or placed in trip within 

the allowed Completion Time, the associated penetration flow path(s) 

should be isolated (Required Action K.1). Isolating the affected 

penetration flow path(s) accomplishes the safety function of the 

inoperable instrumentation. Alternately, the plant must be placed in a 

condition in which the LCO does not apply. If applicable, movement of 

[recently] irradiated fuel assemblies must be immediately suspended. 

Suspension of these activities shall not preclude completion of movement 

of a component to a safe condition. Also, if applicable, action must be 

immediately initiated to suspend OPDRVs to minimize the probability of a 

vessel draindown and subsequent potential for fission production release. 

Actions must continue until OPDRVs are suspended. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

As noted at the beginning of the SRs, the SRs for each Primary 

Containment Isolation Instrumentation Function are found in the SRs 

column of Table 3.3.6.1-1. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-29 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Surveillances are also modified by a Note to indicate that when a 

channel is placed in an inoperable status solely for performance of 

required Surveillances, entry into associated Conditions and Required 

Actions may be delayed for up to 6 hours provided the associated 

Function maintains trip capability. Upon completion of the Surveillance, 

or expiration of the 6 hour allowance, the channel must be returned to 

OPERABLE status or the applicable Condition entered and Required 

Actions taken. This Note is based on the reliability analysis (Refs. 5 

and 6) assumption of the average time required to perform channel 

surveillance. That analysis demonstrated that the 6 hour testing 

allowance does not significantly reduce the probability that the PCIVs will 

isolate the penetration flow path(s) when necessary. 

SR 3.3.6.1.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. 

Agreement criteria are determined by the plant staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency is based on operating experience that demonstrates 

channel failure is rare. 

The CHANNEL CHECK supplements less formal, but more frequent, 

checks of channels during normal operational use of the displays 

associated with the channels required by the LCO. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-30 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.6.1.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. 

The Frequency is based on reliability analysis described in References 5 

and 6. 

SR 3.3.6.1.3

The calibration of trip units consists of a test to provide a check of the 

actual trip setpoints. The channel must be declared inoperable if the trip 

setting is discovered to be less conservative than the Allowable Value 

specified in Table 3.3.6.1-1. If the trip setting is discovered to be less 

conservative than accounted for in the appropriate setpoint methodology, 

but is not beyond the Allowable Value, the channel performance is still 

within the requirements of the plant safety analysis. Under these 

conditions, the setpoint must be readjusted to be equal to or more 

conservative than accounted for in the appropriate setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

References 5 and 6. 

SR 3.3.6.1.4 and SR 3.3.6.1.5

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. This test verifies the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-31 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Frequency of SR 3.3.6.1.4 is based on the assumption of a 92 day 

calibration interval in the determination of equipment drift in the setpoint 

analysis. The Frequency of SR 3.3.6.1.5 is based on the assumption of 

an 18 month calibration interval in the determination of the magnitude of 

equipment drift in the setpoint analysis. 

SR 3.3.6.1.6

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required isolation logic for a specific channel. The 

system functional testing performed on PCIVs in LCO 3.6.1.3 overlaps 

this Surveillance to provide complete testing of the assumed safety 

function. The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

SR 3.3.6.1.7

This SR ensures that the individual channel response times are less than 

or equal to the maximum values assumed in the accident analysis. 

Testing is performed only on channels where the assumed response time 

does not correspond to the diesel generator (DG) start time. For 

channels assumed to respond within the DG start time, sufficient margin 

exists in the [10] second start time when compared to the typical channel 

response time (milliseconds) so as to assure adequate response without 

a specific measurement test. The instrument response times must be 

added to the PCIV closure times to obtain the ISOLATION SYSTEM 

RESPONSE TIME. ISOLATION SYSTEM RESPONSE TIME acceptance 

criteria are included in Reference 7. 

ISOLATION SYSTEM RESPONSE TIME may be verified by actual 

response time measurements in any series of sequential, overlapping, or 

total channel measurements. 

[-----------------------------------REVIEWER’S NOTE----------------------------------

The following Bases are applicable for plants adopting NEDO-32291-A 

and/or Supplement 1. 

-------------------------------------------------------------------------------------------------- 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-32 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

However, the sensors for Functions 1.a, 1.b, and 1.c are allowed to be 

excluded from specific ISOLATION SYSTEM RESPONSE TIME 

measurement if the conditions of Reference 8 are satisfied. If these 

conditions are satisfied, sensor response time may be allocated based on 

either assumed design sensor response time or the manufacturer's stated 

design response time. When the requirements of Reference 8 are not 

satisfied, sensor response time must be measured. Furthermore, 

measurement of the instrument loops response time for Functions 1.a, 

1.b, and 1.c is not required if the conditions of Reference 9 are satisfied. 

For all other Functions, the measurement of instrument loop response 

times may be excluded if the conditions of Reference 8 are satisfied.]

A Note to the Surveillance states that the radiation detectors may be 

excluded from ISOLATION SYSTEM RESPONSE TIME testing. This 

Note is necessary because of the difficulty of generating an appropriate 

detector input signal and because the principles of detector operation 

virtually ensure an instantaneous response time. Response time for 

radiation detection channels shall be measured from detector output or 

the input of the first electronic component in the channel. 

ISOLATION SYSTEM RESPONSE TIME tests are conducted on an 

18 month STAGGERED TEST BASIS. The 18 month test Frequency is 

consistent with the typical industry refueling cycle and is based upon plant 

operating experience that shows that random failures of instrumentation 

components causing serious response time degradation, but not channel 

failure, are infrequent. 

REFERENCES 1. FSAR, Section [6.3]. 

 2. FSAR, Chapter [15]. 

 3. NEDO-31466, "Technical Specification Screening Criteria Application 

and Risk Assessment," November 1987. 

 4. FSAR, Section [9.3.5]. 

 5. NEDC-31677-P-A, "Technical Specification Improvement Analysis for 

BWR Isolation Actuation Instrumentation," June 1989. 

 6. NEDC-30851-P-A, Supplement 2, "Technical Specifications 

Improvement Analysis for BWR Isolation Instrumentation Common to 

RPS and ECCS Instrumentation," March 1989. 
Primary Containment Isolation Instrumentation 

B 3.3.6.1 

BWR/6 STS B 3.3.6.1-33 Rev. 3.0, 03/31/04 

BASES 

REFERENCES (continued) 

 7. FSAR, Section [7.3]. 

 [8. NEDO-32291-A, "System Analyses for the Elimination of Selected 

Response Time Testing Requirements," October 1995. 

 9. NEDO-32291-A, Supplement 1, "System Analyses for the Elimination 

of Selected Response Time Testing Requirements," October 1999.] 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.6.2 Secondary Containment Isolation Instrumentation 

BASES 

BACKGROUND The secondary containment isolation instrumentation automatically 

initiates closure of appropriate secondary containment isolation valves 

(SCIVs) and starts the Standby Gas Treatment (SGT) System. The 

function of these systems, in combination with other accident mitigation 

systems, is to limit fission product release during and following postulated 

Design Basis Accidents (DBAs) (Ref. 1), such that offsite radiation 

exposures are maintained within the requirements of 10 CFR 100 that are 

part of the NRC staff approved licensing basis. Secondary containment 

isolation and establishment of vacuum with the SGT System within the 

assumed time limits ensures that fission products that leak from primary 

containment following a DBA, or are released outside primary 

containment or during certain operations when primary containment is not 

required to be OPERABLE are maintained within applicable limits. 

The isolation instrumentation includes the sensors, relays, and switches 

that are necessary to cause initiation of secondary containment isolation. 

Most channels include electronic equipment (e.g., trip units) that 

compares measured input signals with pre-established setpoints. When 

the setpoint is exceeded, the channel output relay actuates, which then 

outputs a secondary containment isolation signal to the isolation logic. 

Functional diversity is provided by monitoring a wide range of 

independent parameters. The input parameters to the isolation logic are 

(a) reactor vessel water level, (b) drywell pressure, (c) fuel handling area 

ventilation exhaust, and (d) fuel handling area pool sweep exhaust 

radiation. Redundant sensor input signals from each parameter are 

provided for initiation of isolation parameters. In addition, manual 

initiation of the logic is provided. 

For all Secondary Containment Isolation instrumentation Functions, both 

channels in a trip system are required to trip the associated trip system. 

In addition to the isolation function, the SGT subsystems are initiated. 

There are two SGT subsystems with one subsystem being initiated by 

each trip system. Typically, automatically isolated secondary 

containment penetrations are isolated by two isolation valves. One trip 

system initiates isolation of each valve so that operation of either trip 

system isolates the penetrations. 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The isolation signals generated by the secondary containment isolation 

SAFETY instrumentation are implicitly assumed in the safety analyses of 

ANALYSES, LCO, References 1 and 2 to initiate closure of valves and start the SGT 

and APPLICABILITY System to limit offsite doses. 

Refer to LCO 3.6.4.2, "Secondary Containment Isolation Valves (SCIVs)," 

and LCO 3.6.4.3, "Standby Gas Treatment (SGT) System," Applicable 

Safety Analyses Bases for more detail of the safety analyses. 

The secondary containment isolation instrumentation satisfies Criterion 3 

of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained 

for other reasons and are described below in the individual Functions 

discussion. 

The OPERABILITY of the secondary containment isolation 

instrumentation is dependent upon the OPERABILITY of the individual 

instrumentation channel Functions. Each Function must have the 

required number of OPERABLE channels with their setpoints set within 

the specified Allowable Values, as shown in Table 3.3.6.2-1. The actual 

setpoint is calibrated consistent with applicable setpoint methodology 

assumptions. A channel is inoperable if its actual trip setpoint is not 

within its required Allowable Value. Each channel must also respond 

within its assumed response time, where appropriate. 

Allowable Values are specified for each Function specified in the Table. 

Nominal trip setpoints are specified in setpoint calculations. The nominal 

setpoints are selected to ensure that the setpoints do not exceed the 

Allowable Values between CHANNEL CALIBRATIONS. Operation with a 

trip setpoint less conservative than the nominal trip setpoint, but within its 

Allowable Value, is acceptable. 

Trip setpoints are those predetermined values of output at which an 

action should take place. The setpoints are compared to the actual 

process parameter (e.g., reactor vessel water level), and when the 

measured output value of the process parameter exceeds the setpoint, 

the associated device (e.g., trip unit) changes state. The analytic limits 

are derived from the limiting values of the process parameters obtained 

from the safety analysis. The Allowable Values are derived from the 

analytic limits, corrected for calibration, process, and some of the 

instrument errors. The trip setpoints are then determined accounting for 

the remaining instrument errors (e.g., drift). The trip setpoints derived in 

this manner provide adequate protection because instrumentation 

uncertainties, process effects, calibration tolerances, instrument drift, and 

severe environment errors (for channels that must function in harsh 

environments as defined by 10 CFR 50.49) are accounted for. 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

In general, the individual Functions are required to be OPERABLE in the 

MODES or other specified conditions when SCIVs and the SGT System 

are required. 

The specific Applicable Safety Analyses, LCO, and Applicability 

discussions are listed below on a Function by Function basis. 

1. Reactor Vessel Water Level - Low Low, Level 2

Low reactor pressure vessel (RPV) water level indicates that the 

capability to cool the fuel may be threatened. Should RPV water level 

decrease too far, fuel damage could result. An isolation of the secondary 

containment and actuation of the SGT System are initiated in order to 

minimize the potential of an offsite dose release. The Reactor Vessel 

Water Level - Low Low, Level 2 Function is one of the Functions 

assumed to be OPERABLE and capable of providing isolation and 

initiation signals. The isolation and initiation of systems on Reactor 

Vessel Water Level - Low Low, Level 2 support actions to ensure that any 

offsite releases are within the limits calculated in the safety analysis. 

Reactor Vessel Water Level - Low Low, Level 2 signals are initiated from 

level transmitters that sense the difference between the pressure due to a 

constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. Four channels of Reactor 

Vessel Water Level - Low Low, Level 2 Function are available and are 

required to be OPERABLE to ensure that no single instrument failure can 

preclude the isolation function. 

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was 

chosen to be the same as the High Pressure Core Spray (HPCS)/Reactor 

Core Isolation Cooling (RCIC) Reactor Vessel Water Level - Low Low, 

Level 2 Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling System 

(ECCS) Instrumentation," and LCO 3.3.5.2, "Reactor Core Isolation 

Cooling (RCIC) System Actuation"), since this could indicate the 

capability to cool the fuel is being threatened. 

The Reactor Vessel Water Level - Low Low, Level 2 Function is required 

to be OPERABLE in MODES 1, 2, and 3 where considerable energy 

exists in the Reactor Coolant System (RCS); thus, there is a probability of 

pipe breaks resulting in significant releases of radioactive steam and gas. 

In MODES 4 and 5, the probability and consequences of these events are 

low due to the RCS pressure and temperature limitations of these 

MODES; thus, this Function is not required. In addition, the Function is 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

also required to be OPERABLE during operations with a potential for 

draining the reactor vessel (OPDRVs) because the capability of isolating 

potential sources of leakage must be provided to ensure that offsite dose 

limits are not exceeded if core damage occurs. 

2. Drywell Pressure - High

High drywell pressure can indicate a break in the reactor coolant pressure 

boundary (RCPB). An isolation of the secondary containment and 

actuation of the SGT System are initiated in order to minimize the 

potential of an offsite dose release. The isolation of high drywell pressure 

supports actions to ensure that any offsite releases are within the limits 

calculated in the safety analysis. However, the Drywell Pressure - High 

Function associated with isolation is not assumed in any FSAR accident 

or transient analysis. It is retained for the overall redundancy and 

diversity of the secondary containment isolation instrumentation as 

required by the NRC approved licensing basis. 

High drywell pressure signals are initiated from pressure transmitters that 

sense the pressure in the drywell. Four channels of Drywell - High 

Function are available and are required to be OPERABLE to ensure that 

no single instrument failure can preclude the isolation function. 

The Allowable Value was chosen to be the same as the ECCS Drywell 

Pressure - High Function Allowable Value (LCO 3.3.5.1) since this is 

indicative of a loss of coolant accident. 

The Drywell Pressure - High Function is required to be OPERABLE in 

MODES 1, 2, and 3 where considerable energy exists in the RCS; thus, 

there is a probability of pipe breaks resulting in significant releases of 

radioactive steam and gas. This Function is not required in MODES 4 

and 5 because the probability and consequences of these events are low 

due to the RCS pressure and temperature limitations of these MODES. 

3, 4. Fuel Handling Area Ventilation and Pool Sweep Exhaust Radiation -

High High

High secondary containment exhaust radiation is an indication of possible 

gross failure of the fuel cladding. The release may have originated from 

the primary containment due to a break in the RCPB or the refueling floor 

due to a fuel handling accident. When Exhaust Radiation - High High is 

detected, secondary containment isolation and actuation of the SGT 

System are initiated to limit the release of fission products as assumed in 

the FSAR safety analyses (Ref. 1). 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The Exhaust Radiation - High High signals are initiated from radiation 

detectors that are located on the ventilation exhaust piping coming from 

the fuel handling area and the fuel handling area pool sweep, 

respectively. The signal from each detector is input to an individual 

monitor whose trip outputs are assigned to an isolation channel. Four 

channels of Fuel Handling Area Ventilation Exhaust Radiation - High High 

Function and four channels of Fuel Handling Area Pool Sweep Exhaust 

Radiation - High High Function are available and are required to be 

OPERABLE to ensure that no single instrument failure can preclude the 

isolation function. 

The Allowable Values are chosen to promptly detect gross failure of the 

fuel cladding. 

The Exhaust Radiation - High High Functions are required to be 

OPERABLE in MODES 1, 2, and 3 where considerable energy exists; 

thus, there is a probability of pipe breaks resulting in significant releases 

of radioactive steam and gas. In MODES 4 and 5, the probability and 

consequences of these events are low due to the RCS pressure and 

temperature limitations of these MODES; thus, these Functions are not 

required. In addition, the Functions are required to be OPERABLE during 

OPDRVs and movement of [recently] irradiated fuel assemblies in the 

primary or secondary containment because the capability of detecting 

radiation releases due to fuel failures (due to fuel uncovery or dropped 

fuel assemblies) must be provided to ensure that offsite dose limits are 

not exceeded. [Due to radioactive decay, this Function is only required to 

isolate secondary containment during fuel handling accidents involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [x] days).] 

5. Manual Initiation

The Manual Initiation push button channels introduce signals into the 

secondary containment isolation logic that are redundant to the automatic 

protective instrumentation channels, and provide manual isolation 

capability. There is no specific FSAR safety analysis that takes credit for 

this Function. It is retained for the overall redundancy and diversity of the 

secondary containment isolation instrumentation as required by the NRC 

approved licensing basis. 

There are four push buttons for the logic, two manual initiation push 

buttons per trip system. There is no Allowable Value for this Function 

since the channels are mechanically actuated based solely on the 

position of the push buttons. 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-6 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Four channels of the Manual Initiation Function are available and are 

required to be OPERABLE in MODES 1, 2, and 3 and during OPDRVs 

and movement of [recently] irradiated fuel assemblies in the secondary 

containment, since these are the MODES and other specified conditions 

in which the Secondary Containment Isolation automatic Functions are 

required to be OPERABLE. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

A Note has been provided to modify the ACTIONS related to secondary 

containment isolation instrumentation channels. Section 1.3, Completion 

Times, specifies that once a Condition has been entered, subsequent 

divisions, subsystems, components, or variables expressed in the 

Condition discovered to be inoperable or not within limits will not result in 

separate entry into the Condition. Section 1.3 also specifies that 

Required Actions of the Condition continue to apply for each additional 

failure, with Completion Times based on initial entry into the Condition. 

However, the Required Actions for inoperable secondary containment 

isolation instrumentation channels provide appropriate compensatory 

measures for separate inoperable channels. As such, a Note has been 

provided that allows separate Condition entry for each inoperable 

secondary containment isolation instrumentation channel. 

A.1

Because of the diversity of sensors available to provide isolation signals 

and the redundancy of the isolation design, an allowable out of service 

time of 12 hours or 24 hours, depending on the Function, has been 

shown to be acceptable (Refs. 3 and 4) to permit restoration of any 

inoperable channel to OPERABLE status. This out of service time is only 

acceptable provided the associated Function is still maintaining isolation 

capability (refer to Required Action B.1 Bases). If the inoperable channel 

cannot be restored to OPERABLE status within the allowable out of 

service time, the channel must be placed in the tripped condition per 

Required Action A.1. Placing the inoperable channel in trip would 

conservatively compensate for the inoperability, restore capability to 

accommodate a single failure, and allow operation to continue. 

Alternately, if it is not desired to place the channel in trip (e.g., as in the 

case where placing the inoperable channel in trip would result in an 

isolation), Condition C must be entered and its Required Actions taken. 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1

Required Action B.1 is intended to ensure that appropriate actions are 

taken if multiple, inoperable, untripped channels within the same Function 

result in a complete loss of automatic isolation capability for the 

associated penetration flow path(s) or a complete loss of automatic 

initiation capability for the SGT System. A Function is considered to be 

maintaining secondary containment isolation capability when sufficient 

channels are OPERABLE or in trip, such that one trip system will 

generate a trip signal from the given Function on a valid signal. This 

ensures that one of the two SCIVs in the associated penetration flow path 

and one SGT subsystem can be initiated on an isolation signal from the 

given Function. For the Functions with two two-out-of-two logic trip 

systems (Functions 1, 2, 3, and 4), this would require one trip system to 

have two channels, each OPERABLE or in trip. The Condition does not 

include the Manual Initiation Function (Function 5), since it is not 

assumed in any accident or transient analysis. Thus, a total loss of 

manual initiation capability for 24 hours (as allowed by Required 

Action A.1) is allowed. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. The 1 hour Completion Time is 

acceptable because it minimizes risk while allowing time for restoration or 

tripping of channels. 

C.1.1, C.1.2, C.2.1, and C.2.2

If any Required Action and associated Completion Time of Condition A 

or B are not met, the ability to isolate the secondary containment and start 

the SGT System cannot be ensured. Therefore, further actions must be 

performed to ensure the ability to maintain the secondary containment 

function. Isolating the associated valves and starting the associated SGT 

subsystem (Required Actions C.1.1 and C.2.1) performs the intended 

function of the instrumentation and allows operations to continue. 

Alternatively, declaring the associated SCIVs or SGT subsystem 

inoperable (Required Actions C.1.2 and C.2.2) is also acceptable since 

the Required Actions of the respective LCOs (LCO 3.6.4.2 and 

LCO 3.6.4.3) provide appropriate actions for the inoperable components. 

One hour is sufficient for plant operations personnel to establish required 

plant conditions or to declare the associated components inoperable 

without challenging plant systems. 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

As noted at the beginning of the SRs, the SRs for each Secondary 

Containment Isolation instrumentation Function are located in the SRs 

column of Table 3.3.6.2-1. 

The Surveillances are also modified by a Note to indicate that when a 

channel is placed in an inoperable status solely for performance of 

required Surveillances, entry into associated Conditions and Required 

Actions may be delayed for up to 6 hours, provided the associated 

Function maintains secondary containment isolation capability. Upon 

completion of the Surveillance, or expiration of the 6 hour allowance, the 

channel must be returned to OPERABLE status or the applicable 

Condition entered and Required Action(s) taken. 

This Note is based on the reliability analysis (Refs. 3 and 4) assumption 

of the average time required to perform channel surveillance. That 

analysis demonstrated that the 6 hour testing allowance does not 

significantly reduce the probability that the SCIVs will isolate the 

associated penetration flow paths and the SGT System will initiate when 

necessary. 

SR 3.3.6.2.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the indicated parameter for one instrument 

channel to a similar parameter on other channels. It is based on the 

assumption that instrument channels monitoring the same parameter 

should read approximately the same value. Significant deviations 

between the instrument channels could be an indication of excessive 

instrument drift in one of the channels or something even more serious. 

A CHANNEL CHECK will detect gross channel failure; thus, it is key to 

verifying the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 

Agreement criteria are determined by the plant staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Frequency is based on operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channels during normal operational use of 

the displays associated with the channels required by the LCO. 

SR 3.3.6.2.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. 

The Frequency of 92 days is based upon the reliability analysis of 

References 3 and 4. 

SR 3.3.6.2.3

Calibration of trip units provides a check of the actual trip setpoints. The 

channel must be declared inoperable if the trip setting is discovered to be 

less conservative than the Allowable Value specified in Table 3.3.6.2-1. If 

the trip setting is discovered to be less conservative than accounted for in 

the appropriate setpoint methodology, but is not beyond the Allowable 

Value, performance is still within the requirements of the plant safety 

analysis. Under these conditions, the setpoint must be readjusted to be 

equal to or more conservative than accounted for in the appropriate 

setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

References 3 and 4. 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.6.2.4

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. This test verifies the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 

The Frequency is based upon the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.6.2.5

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required isolation logic for a specific channel. The 

system functional testing, performed on SCIVs and the SGT System in 

LCO 3.6.4.2 and LCO 3.6.4.3, respectively, overlaps this Surveillance to 

provide complete testing of the assumed safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

SR 3.3.6.2.6

This SR ensures that the individual channel response times are less than 

or equal to the maximum values assumed in the accident analysis. 

Testing is performed only on channels where the assumed response time 

does not correspond to the diesel generator (DG) start time. For 

channels assumed to respond within the DG start time, sufficient margin 

exists in the [10] second start time when compared to the typical channel 

response time (milliseconds) so as to assure adequate response without 

a specific measurement test. The instrument response times must be 

added to the SCIV closure times to obtain the ISOLATION SYSTEM 

RESPONSE TIME. ISOLATION SYSTEM RESPONSE TIME acceptance 

criteria are included in Reference 5. 
Secondary Containment Isolation Instrumentation 

B 3.3.6.2 

BWR/6 STS B 3.3.6.2-11 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

ISOLATION SYSTEM RESPONSE TIME may be verified by actual 

response time measurements in any series of sequential, overlapping, or 

total channel measurements. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

[The following Bases are applicable for plants adopting NEDO-32291-A. 

-------------------------------------------------------------------------------------------------- 

However, the measurement of instrument loop response times may be 

excluded if the conditions of Reference 6 are satisfied.]

A Note to the Surveillance states that the radiation detectors may be 

excluded from ISOLATION SYSTEM RESPONSE TIME testing. This 

Note is necessary because of the difficulty of generating an appropriate 

detector input signal and because the principles of detector operation 

virtually ensure an instantaneous response time. Response time for 

radiation detector channels shall be measured from detector output or the 

input of the first electronic component in the channel. 

ISOLATION SYSTEM RESPONSE TIME tests are conducted on an 

18 month STAGGERED TEST BASIS. The 18 month Frequency is 

consistent with the typical industry refueling cycle and is based upon plant 

operating experience, which shows that random failures of 

instrumentation components causing serious response time degradation, 

but not channel failure, are infrequent occurrences. 

REFERENCES 1. FSAR, Section [6.3]. 

 2. FSAR, Chapter [15]. 

 3. NEDC-31677-P-A, "Technical Specification Improvement Analysis for 

BWR Isolation Actuation Instrumentation," July 1990. 

 4. NEDC-30851-P-A Supplement 2, "Technical Specifications 

Improvement Analysis for BWR Isolation Instrumentations Common 

to RPS and ECCS Instrumentation," March 1989. 

 5. FSAR, Section [7.3]. 

 [6. NEDO-32291-A, "System Analyses for the Elimination of Selected 

Response Time Testing Requirements," October 1995.] 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.6.3 Residual Heat Removal (RHR) Containment Spray System 

 Instrumentation 

BASES 

BACKGROUND The RHR Containment Spray System is an operating mode of the RHR 

System that is initiated to condense steam in the containment 

atmosphere. This ensures that containment pressure is maintained within 

its limits following a loss of coolant accident (LOCA). The RHR 

Containment Spray System can be initiated either automatically or 

manually. 

The RHR Containment Spray System is automatically initiated by Reactor 

Vessel Water Level - Low Low Low, Level 1, Drywell Pressure - High, and 

Containment Pressure - High signals. Most channels include electronic 

equipment (e.g., trip units) that compares measured input signals with 

pre-established setpoints. When the setpoint is exceeded, the channel 

output relay actuates, which then outputs a signal to the trip logic. The 

channels provide inputs to two trip systems; one trip system initiates one 

containment spray subsystem while the second trip system initiates the 

other containment spray subsystem (Ref. 1). For a trip system to initiate 

the associated subsystem, it must receive one signal from each of the 

following inputs: Drywell Pressure - High, Containment Pressure - High, 

and a System Timer. The Drywell Pressure - High and Containment 

Pressure - High Functions each have two channels, which are arranged 

in a one-out-of-two logic to provide the necessary signal. The System 

Timer is initiated by a one-out-of-two taken twice logic consisting of two 

channels each of the Reactor Vessel Water Level - Low Low Low, Level 1 

and Drywell Pressure - High Functions. When the System Timer has 

timed out, the trip system receives the System Timer signal. 

Manual initiation of the system is accomplished with the use of manual 

initiation push buttons. The system can be manually initiated using the 

manual initiation push buttons only if a Drywell Pressure - High signal is 

present. There is no time delay when using the manual initiation push 

buttons. 

APPLICABLE Operation of the RHR Containment Spray System is required to maintain 

SAFETY containment pressure within design limits after a LCO, and LOCA. 

ANALYSES, LCO, Safety analyses in Reference 2 implicitly assume that sufficient 

and APPLICABILITY instrumentation and controls, described below, are available to initiate the 

RHR Containment Spray System. 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The RHR Containment Spray System instrumentation satisfies Criterion 3 

of 10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained 

for other reasons and are described below in the individual Functions 

discussion. 

The OPERABILITY of the RHR Containment Spray System 

instrumentation is dependent on the OPERABILITY of the individual 

instrumentation channel Functions specified in Table 3.3.6.3-1. Each 

Function must have the required number of OPERABLE channels with 

their setpoints within the specified Allowable Values. A channel is 

inoperable if its actual trip setpoint is not within its required Allowable 

Value, where appropriate. The actual setpoint is calibrated consistent 

with applicable setpoint methodology assumptions. 

Allowable Values are specified for each Function in the Table. Nominal 

trip setpoints are specified in the setpoint calculations. The nominal 

setpoints are selected to ensure the setpoints do not exceed the 

Allowable Value between CHANNEL CALIBRATIONS. Operation with a 

trip setpoint less conservative than the nominal trip setpoint, but within its 

Allowable Value, is acceptable. 

Trip setpoints are those predetermined values of output at which an 

action should take place. The setpoints are compared to the actual 

process parameter (e.g., reactor vessel water level), and when the 

measured output value of the process parameter exceeds the setpoint, 

the associated device (e.g., trip unit) changes state. The analytic limits 

are derived from the limiting values of the process parameters obtained 

from the safety analysis. The Allowable Values are derived from the 

analytic limits, corrected for calibration, process, and some of the 

instrument errors. The trip setpoints are then determined accounting for 

the remaining instrument errors (e.g., drift). The trip setpoints derived in 

this manner provide adequate protection because instrumentation 

uncertainties, process effects, calibration tolerances, instrument drift, and 

severe environment errors (for channels that must function in harsh 

environments, as defined by 10 CFR 50.49) are accounted for. These 

uncertainties are described in the setpoint methodology. 

The RHR Containment Spray System instrumentation is required to be 

OPERABLE in MODES 1, 2, and 3, when considerable energy exists in 

the Reactor Coolant System and a Design Basis Accident (DBA) could 

cause pressurization of the primary containment. In MODES 4 and 5, the 

reactor is shut down, and any LOCA would not cause pressurization of 

the drywell or containment. 

The specific Applicable Safety Analyses and LCO discussions are listed 

below on a Function by Function basis. 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

1. Drywell Pressure - High

High pressure in the drywell could indicate a break in the reactor coolant 

pressure boundary (RCPB). The RHR Containment Spray System 

mitigates the consequences of steam leaking from the drywell directly into 

containment airspace, bypassing the suppression pool. 

Four Drywell Pressure - High transmitters (two per trip system) are 

available and are required to be OPERABLE and capable of automatically 

initiating the RHR Containment Spray System. This ensures that no 

single instrument failure can preclude the RHR containment spray 

function. The Drywell Pressure - High Allowable Value is chosen to be 

the same as the Emergency Core Cooling Systems (ECCS) Drywell 

Pressure - High Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling 

Systems (ECCS) Instrumentation") since this could be indicative of a 

LOCA. 

2. Containment Pressure - High

High pressure in the containment could indicate a break in the RCPB. 

The RHR Containment Spray System mitigates the consequences of 

steam leaking from the drywell directly into the containment airspace, 

bypassing the suppression pool. 

Four Containment Pressure - High transmitters are available, but only two 

Containment Pressure - High transmitters (one per trip system) are 

required to be OPERABLE and capable of automatically initiating the 

RHR Containment Spray System. This ensures that no single instrument 

failure can preclude the RHR containment spray function. 

The Containment Pressure - High Allowable Value is chosen to ensure 

the primary containment design pressure is not exceeded. 

3. Reactor Vessel Water Level - Low Low Low, Level 1

Low reactor pressure vessel (RPV) water level indicates that a break of 

the RCPB may have occurred and the capability to maintain the primary 

containment pressure within design limits may be threatened. The RHR 

Containment Spray System mitigates the consequences of the steam 

leaking from the drywell directly into the containment airspace, bypassing 

the suppression pool. 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Reactor vessel water level signals are initiated from four level transmitters 

that sense the difference between the pressure due to a constant column 

of water (reference leg) and the pressure due to the actual water level 

(variable leg) in the vessel. Four channels of Reactor Vessel Water Level 

- Low Low Low, Level 1 (two per trip system) are available and are 

required to be OPERABLE to ensure that no single instrument failure can 

preclude the RHR containment spray function. 

The Reactor Vessel Water Level - Low Low Low, Level 1 Allowable Value 

is chosen to be the same as the ECCS Reactor Vessel Water Level - Low 

Low Low, Level 1 Allowable Value (LCO 3.3.5.1) since this could be 

indicative of a LOCA. 

4. System A and System B Timers

The purpose of these timers is to delay automatic initiation of the RHR 

Containment Spray System for approximately 10 minutes after low 

pressure coolant injection (LPCI) initiation to give the LPCI System time 

to fulfill its ECCS function in response to a LOCA. The time delay is 

needed since the RHR Containment Spray System utilizes the same 

pumps as the LPCI subsystem (RHR pumps). 

There are two timers, one for each subsystem, designated System A 

Timer and System B Timer. Since each subsystem of the RHR 

Containment Spray System has a timer, a single failure of a timer will 

cause the failure of only one RHR containment spray subsystem. The 

other subsystem will still be available to perform the RHR containment 

spray cooling function. The Allowable Value for the time delay is chosen 

to be long enough to allow the LPCI System to fulfill its function, but short 

enough to prevent containment pressure from exceeding the design limit. 

5. Manual Initiation

The Manual Initiation Function introduces signals into the RHR 

containment spray logic and is redundant to all automatic protective 

instrumentation except Drywell Pressure - High. There is no specific 

FSAR analysis that takes credit for this Function. It is retained for overall 

redundancy and diversity of the initiation Function as required by the NRC 

approved licensing basis. Each trip system has a manual push button, for 

a total of two push buttons, both of which are required to be OPERABLE. 

There is no Allowable Value for this Function since the channels are 

mechanically actuated based solely on the position of the push buttons. 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

A Note has been provided to modify the ACTIONS related to RHR 

Containment Spray System instrumentation channels. Section 1.3, 

Completion Times, specifies that once a Condition has been entered, 

subsequent divisions, subsystems, components, or variables expressed 

in the Condition discovered to be inoperable or not within limits will not 

result in separate entry into the Condition. Section 1.3 also specifies that 

Required Actions of the Condition continue to apply for each additional 

failure, with Completion Times based on initial entry into the Condition. 

However, the Required Actions for inoperable RHR Containment Spray 

System instrumentation channels provide appropriate compensatory 

measures for separate inoperable channels. As such, a Note has been 

provided that allows separate Condition entry for each inoperable RHR 

Containment Spray System instrumentation channel. 

A.1

Required Action A.1 directs entry into the appropriate Condition 

referenced in Table 3.3.6.3-1. The applicable Condition specified in the 

Table is Function dependent. Each time a channel is discovered 

inoperable, Condition A is entered for that channel and provides for 

transfer to the appropriate subsequent Condition. 

B.1 and B.2

Required Action B.1 is intended to ensure appropriate actions are taken if 

multiple, inoperable, untripped channels within the same Function result 

in a complete loss of automatic initiation capability for the RHR 

Containment Spray System. Automatic initiation capability is lost if one 

Function 1 channel in both trip systems is inoperable and untripped, or 

one Function 3 channel in both trip systems is inoperable and untripped. 

In this situation (loss of automatic initiation capability), the 24 hour 

allowance of Required Action B.2 is not appropriate and the RHR 

Containment Spray System, made inoperable by RHR Containment 

Spray System instrumentation, must be declared inoperable within 1 hour 

after discovery of loss of RHR Containment Spray System initiation 

capability for both trip systems. 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action B.1, the Completion 

Time only begins upon discovery that the RHR Containment Spray 

System cannot be automatically initiated due to inoperable, untripped 

channels within the same Function, as described in the paragraph above. 

The 1 hour Completion Time from discovery of loss of initiation capability 

is acceptable because it minimizes risk while allowing time for restoration 

or tripping of channels. 

Because of the redundancy of sensors available to provide initiation 

signals, an allowable out of service time of 24 hours has been shown to 

be acceptable (Ref. 3) to permit restoration of any inoperable channel to 

OPERABLE status. If the inoperable channel cannot be restored to 

OPERABLE status within the allowable out of service time, the channel 

must be placed in the tripped condition, per Required Action B.2. Placing 

the inoperable channel in trip would conservatively compensate for the 

inoperability, restore the capability to accommodate a single failure, and 

allow operation to continue. Alternately, if it is not desired to place the 

channel in trip (e.g., as in the case where placing the inoperable channel 

in trip would result in an initiation), Condition D must be entered and its 

Required Action taken. 

C.1 and C.2

Required Action C.1 is intended to ensure appropriate actions are taken if 

multiple, inoperable, untripped channels within the same Function result 

in automatic initiation capability being lost for the RHR Containment 

Spray System. Automatic initiation capability is lost if two Function 2 

channels or two Function 4 channels are inoperable. In this situation 

(loss of automatic initiation capability), the 24 hour allowance of Required 

Action C.2 is not appropriate and the associated RHR Containment Spray 

System must be declared inoperable within 1 hour after discovery of loss 

of RHR Containment Spray System initiation capability for both trip 

systems. As noted, Required Action C.1 is only applicable for 

Functions 2 and 4. The Required Action is not applicable to Function 5 

(which also requires entry into this Condition if a channel in this Function 

is inoperable) since it is the Manual Initiation Function and is not assumed 

in any FSAR accident or transient analysis. Thus, a total loss of manual 

initiation capability for 24 hours (as allowed by Required Action C.2) is 

allowed. 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action C.1, the Completion 

Time only begins upon discovery that the RHR Containment Spray 

System cannot be automatically initiated due to two inoperable channels 

within the same Function. The 1 hour Completion Time from discovery of 

loss of initiation capability is acceptable because it minimizes risk while 

allowing time for restoration of channels. 

Because of the redundancy of sensors available to provide initiation 

signals, an allowable out of service time of 24 hours has been shown to 

be acceptable (Ref. 3) to permit restoration of any inoperable channel to 

OPERABLE status. If the inoperable channel cannot be restored to 

OPERABLE status within the allowable out of service time, Condition D 

must be entered and its Required Action taken. The Required Actions do 

not allow placing the channel in trip since this action could either cause 

the initiation or it would not necessarily result in a safe state for the 

channel in all events. 

D.1

With any Required Action and associated Completion Time not met, the 

associated RHR containment spray subsystem may be incapable of 

performing the intended function and the RHR containment spray 

subsystem associated with inoperable untripped channels must be 

declared inoperable immediately. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

As noted at the beginning of the SRs, the SRs for each RHR Containment 

Spray System Function are located in the SRs column of Table 3.3.6.3-1. 

The Surveillances are also modified by a Note to indicate that when a 

channel is placed in an inoperable status solely for performance of 

required Surveillances, entry into associated Conditions and Required 

Actions may be delayed for up to 6 hours, provided the associated 

Function maintains RHR containment spray initiation capability. Upon 

completion of the Surveillance, or expiration of the 6 hour allowance, the 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

channel must be returned to OPERABLE status or the applicable 

Condition entered and Required Actions taken. This Note is based on the 

reliability analysis (Ref. 3) assumption of the average time required to 

perform channel surveillance. That analysis demonstrated that the 6 hour 

testing allowance does not significantly reduce the probability that the 

RHR containment spray will initiate when necessary. 

SR 3.3.6.3.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. 

Agreement criteria are determined by the plant staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency is based upon operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channels during normal operational use of 

the displays associated with the channels required by the LCO. 

SR 3.3.6.3.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. 

The Frequency of 92 days is based upon the reliability analysis of 

Reference 3. 

SR 3.3.6.3.3

The calibration of trip units provides a check of the actual trip setpoints. 

The channel must be declared inoperable if the trip setting is discovered 

to be less conservative than the Allowable Value specified in 

Table 3.3.6.3-1. If the trip setting is discovered to be less conservative 

than accounted for in the appropriate setpoint methodology, but is not 

beyond the Allowable Value, the channel performance is still within the 

requirements of the plant safety analysis. Under these conditions, the 

setpoint must be readjusted to be equal to or more conservative than 

accounted for in the appropriate setpoint methodology. 

The Frequency of 92 days is based upon the reliability analysis of 

Reference 3. 

SR 3.3.6.3.4 and SR 3.3.6.3.5

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies that the channel responds to the 

measured parameter within the necessary range and accuracy. 

CHANNEL CALIBRATION leaves the channel adjusted to account for 

instrument drifts between successive calibrations consistent with the plant 

specific setpoint methodology. 

The Frequency of SR 3.3.6.3.4 is based on the assumption of a 92 day 

calibration interval in the determination of the magnitude of equipment 

drift in the setpoint analysis. 

The Frequency of SR 3.3.6.3.5 is based on the assumption of an 

18 month calibration interval in the determination of the magnitude of 

equipment drift in the setpoint analysis. 
RHR Containment Spray System Instrumentation 

B 3.3.6.3 

BWR/6 STS B 3.3.6.3-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.6.3.6

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required initiation logic for a specific channel. The 

system functional testing performed in LCO 3.6.1.7, "Residual Heat 

Removal (RHR) Containment Spray," overlaps this Surveillance to 

provide complete testing of the assumed safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

REFERENCES 1. FSAR, Section [ ], Figure [ ]. 

 2. FSAR, Section [6.2.1.1.5]. 

 3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals 

and Allowed Out-of-Service Times for Selected Instrumentation 

Technical Specifications," February 1991. 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.6.4 Suppression Pool Makeup (SPMU) System Instrumentation 

BASES 

BACKGROUND The SPMU System provides water from the upper containment pool to 

the suppression pool, by gravity flow, after a loss of coolant accident 

(LOCA) to ensure that primary containment temperature and pressure 

design limits are met. The SPMU System is automatically initiated by 

signals generated by Reactor Vessel Water Level - Low Low, Level 2; 

Reactor Vessel Water Level - Low Low Low, Level 1; Drywell Pressure - 

High; and Suppression Pool Water Level - Low Low channels. The 

channels include electronic equipment (e.g., trip units) that compares 

measured input signals with pre-established setpoints. When the setpoint 

is exceeded, the channel output relay actuates, which then outputs a 

signal to the trip logic. The channels provide inputs to two trip systems; 

one trip system initiates one SPMU subsystem while the second trip 

system initiates the other SPMU subsystem (Ref. 1). Two separate 

initiation logics are provided for each trip system. 

One initiation logic for a trip system will initiate the associated subsystem 

if a LOCA signal coincident with a Suppression Pool Water Level - Low 

Low signal is received. The LOCA signal is received from the associated 

division of low pressure Emergency Core Cooling Systems (ECCS) 

initiation signal (i.e., two channels of Reactor Vessel Water Level - Low 

Low Low, Level 1 and two channels of Drywell Pressure - High are 

arranged in a one-out-of-two taken twice logic). Two channels of 

Suppression Pool Water Level - Low Low are arranged in a one-out-oftwo logic, which generates the Suppression Pool Water Level - Low Low 

signal. The associated low pressure ECCS division's Manual Initiation 

push button (one per division) also supplies a signal, which manually 

performs the same function as the automatic LOCA signal (i.e., ECCS 

Manual Initiation coincident with a Suppression Pool Water Level - Low 

Low will initiate the trip system). Two SPMU Manual Initiation push 

buttons are also provided (arranged in a one-out-of-two logic), which 

manually perform the same function as the automatic Suppression Pool 

Water Level - Low Low signal. 

The second initiation logic for a trip system will initiate after a time delay 

of approximately 30 minutes when Drywell Pressure - High (a different 

Function from the Drywell Pressure - High Function described above) and 

Reactor Vessel Water Level - Low Low, Level 2 signals are received. 

Two channels of each of these two variables are arranged in a one-outof-two taken twice logic. Once actuated, this logic starts the timer, and 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

once the timer times out, the trip system initiates the associated SPMU 

subsystem. Two manual initiation push buttons (the same push buttons 

as the primary and secondary containment isolation manual initiation 

push buttons), arranged in a two-out-of-two logic, are also provided, 

which perform the same function as the two variables (i.e., the manual 

initiation push buttons will start the timer to initiate an associated SPMU 

subsystem). 

APPLICABLE The SPMU System is relied upon to dump upper containment pool water 

SAFETY to the suppression pool to maintain drywell horizontal vent coverage and 

ANALYSES, LCO, an adequate suppression poolheat sink volume to ensure that the 

and APPLICABILITY primary containment internal pressure and temperature stay within design 

limits (Ref. 2). 

The SPMU System instrumentation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). Certain instrumentation Functions are retained for 

other reasons and are described in the individual Functions discussion. 

The OPERABILITY of the SPMU System instrumentation is dependent on 

the OPERABILITY of the individual instrumentation channel Functions 

specified in Table 3.3.6.4-1. Each Function must have the required 

number of OPERABLE channels with their setpoints within the specified 

Allowable Value, where appropriate. A channel is inoperable if its actual 

trip setpoint is not within its required Allowable Value. The actual setpoint 

is calibrated consistent with applicable setpoint methodology 

assumptions. 

Allowable Values are specified for each Function in the Table. Nominal 

trip setpoints are specified in the setpoint calculations. The nominal 

setpoints are selected to ensure the setpoints do not exceed the 

Allowable Values between CHANNEL CALIBRATIONS. Operation with a 

trip setpoint less conservative than the nominal setpoint, but within the 

Allowable Value, is acceptable. 

Trip setpoints are those predetermined values of output at which an 

action should take place. The setpoints are compared to the actual 

process parameter (e.g., reactor vessel water level), and when the 

measured output value of the process parameter exceeds the setpoint, 

the associated device (e.g., trip unit) changes state. The analytic limits 

are derived from the limiting values of the process parameters obtained 

from the safety analysis. The Allowable Values are derived from the 

analytic limits, corrected for calibration, process, and some of the 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

instrument errors. The trip setpoints are then determined accounting for 

the remaining instrument errors (e.g., drift). The trip setpoints derived in 

this manner provide adequate protection because instrumentation 

uncertainties, process effects, calibration tolerances, instrument drift, and 

severe environment errors (for channels that must function in harsh 

environments as defined by 10 CFR 50.49) are accounted for. 

The SPMU System instrumentation is required to be OPERABLE in 

MODES 1, 2, and 3 where considerable energy exists in the Reactor 

Coolant System and a DBA could cause pressurization and heatup of the 

primary containment. In MODES 4 and 5, the reactor is shut down; 

therefore, any LOCA would not cause pressurization of the drywell, and 

the SPMU System would not be needed to maintain suppression pool 

water level. Furthermore, in MODES 4 and 5, the SPMU System is not 

required since there is insufficient energy to heat up the suppression pool 

in the event of a LOCA. 

The specific Applicable Safety Analyses and LCO discussions are listed 

below on a Function by Function basis. 

1. Drywell Pressure - High

High pressure in the drywell could indicate a break in the reactor coolant 

pressure boundary (RCPB). The Drywell Pressure - High is one of the 

Functions required to be OPERABLE and capable of initiating the SPMU 

System during the postulated accident. This protection is required to 

ensure primary containment temperature and pressure design limits are 

not exceeded during a LOCA. Accident analysis assumes that the 

suppression pool vents remain covered during a LOCA. Therefore, this 

signal is used to dump water from the upper containment pool into the 

suppression pool as assumed in the large break LOCA analysis. 

High drywell pressure signals are initiated from pressure transmitters that 

sense the pressure at four different locations in the drywell. Four 

channels of Drywell Pressure - High Function (two channels per trip 

system) are available and are required to be OPERABLE to ensure that 

no single instrument failure can preclude the SPMU System function. 

The Allowable Value is chosen to be the same as the ECCS Drywell 

Pressure - High Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling 

Systems (ECCS) Instrumentation"), since this could be indicative of a 

LOCA. 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

2. Reactor Vessel Water Level - Low Low Low, Level 1

Low reactor pressure vessel (RPV) water level indicates that a LOCA 

may have occurred and the capability to maintain the primary 

containment temperature and pressure and suppression pool level design 

limits may be threatened. Accident analysis assumes that the 

suppression pool vents remain covered during a LOCA. Therefore, this 

signal is used to dump water from the upper containment pool into the 

suppression pool as assumed in the large break LOCA analysis. 

Reactor vessel water level signals are initiated from four level transmitters 

that sense the difference between the pressure due to a constant column 

of water (reference leg) and the pressure due to the actual water level 

(variable leg) in the vessel. Four channels of reactor vessel water level 

(two channels per trip system) are available and are required to be 

OPERABLE to ensure that no single instrument failure can preclude the 

SPMU System function. The Reactor Vessel Water Level - Low Low 

Low, Level 1 Allowable Value is chosen to be the same as the ECCS 

Reactor Vessel Water Level - Low Low Low, Level 1 Allowable Value 

(LCO 3.3.5.1), since this could be indicative of a LOCA. 

3. Suppression Pool Water Level - Low Low

The Suppression Pool Water Level - Low Low signal provides assurance 

that the water level in the suppression pool will not drop below that 

required to keep the suppression pool vents covered for all LOCA break 

sizes. Accident analyses assume that the suppression pool vents remain 

covered during a LOCA. Therefore, the signal indicating low suppression 

pool water level is used to dump water from the upper containment pool 

into the suppression pool as assumed in the large break LOCA analysis. 

Suppression pool water level signals are from four transmitters that sense 

pool level at four different locations (two per trip system). However, only 

two of the four Suppression Pool Water Level - Low Low channels (one 

per trip system) are required to be OPERABLE to ensure that no single 

instrument failure can preclude the SPMU System function due to the 

redundancy of the Function. 

The Allowable Value is set high enough to ensure coverage of the 

suppression pool vents. 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

4. Drywell Pressure - High

High pressure in the drywell could indicate a break in the RCPB. The 

Drywell Pressure - High is one of the Functions required to be 

OPERABLE and capable of initiating the SPMU System during the 

postulated accident. This protection is required to ensure primary 

containment temperature and pressure design limits are not exceeded 

during a small break LOCA. 

High drywell pressure signals are initiated from pressure transmitters that 

sense the pressure at four different locations in the drywell. Four 

channels of Drywell Pressure - High Function (two channels per trip 

system) are available and are required to be OPERABLE to ensure that 

no single instrument failure can preclude the SPMU System function. 

The Allowable Value is chosen to be the same as the RPS Drywell 

Pressure - High Allowable Value (LCO 3.3.1.1, "Reactor Protection 

System (RPS) Instrumentation"), since this could be indicative of a LOCA. 

5. Reactor Vessel Water Level - Low Low, Level 2

Low RPV water level indicates that a LOCA may have occurred and that 

the capability to maintain the primary containment temperature and 

pressure and suppression pool design limits during a small break LOCA 

may be threatened. 

Reactor vessel water level signals are initiated from four level transmitters 

that sense the difference between the pressure due to a constant column 

of water (reference leg) and the pressure due to the actual water level 

(variable leg) in the vessel. Four channels of Reactor Vessel Water Level 

- Low Low, Level 2 (two per trip system) are available and are required to 

be OPERABLE to ensure that no single instrument failure can preclude 

the SPMU System function. The Allowable Value is chosen to be the 

same as the HPCS Reactor Vessel Water Level - Low Low, Level 2 

Allowable Value (LCO 3.3.5.1), since this could be indicative of a LOCA. 

6. Timer

The SPMU System valves open on a Drywell Pressure - High and/or 

Reactor Vessel Water Level - Low Low, Level 2 signal after about a 

30 minute timer delay, where the timer itself is started by these signals. 

The minimum suppression pool volume, without an upper pool dump, is 

adequate to meet all heat sink requirements for 30 minutes during a small 

break LOCA. 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-6 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

There are two SPMU System timers (one per trip system). Two timers 

are available and are required to be OPERABLE to ensure that no single 

timer failure can preclude the SPMU System function. The Allowable 

Value is chosen to be short enough to ensure that the suppression pool 

will serve as an adequate heat sink during a small break LOCA. 

7. Manual Initiation

The SPMU System Manual Initiation push button channels produce 

signals to provide manual initiation capabilities that are redundant to the 

automatic protective instrumentation. The Manual Initiation Function is 

not assumed in any transient or accident analysis in the FSAR. However, 

the Function is retained for overall redundancy and diversity of the SPMU 

System as required by the NRC in the approved licensing basis. 

Four manual initiation push buttons (two per trip system) are available 

and required to be OPERABLE to ensure that no single instrument failure 

can preclude the SPMU System function. There is no Allowable Value for 

this Function since the channels are mechanically actuated based solely 

on the position of the push buttons. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

A Note has been provided to modify the ACTIONS related to SPMU 

System instrumentation channels. Section 1.3, Completion Times, 

specifies that once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition 

discovered to be inoperable or not within limits will not result in separate 

entry into the Condition. Section 1.3 also specifies that Required Actions 

of the Condition continue to apply for each additional failure, with 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for inoperable SPMU System instrumentation channels 

provide appropriate compensatory measures for separate inoperable 

channels. As such, a Note has been provided that allows separate 

Condition entry for each inoperable SPMU System instrumentation 

channel. 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

Required Action A.1 directs entry into the appropriate Condition 

referenced in Table 3.3.6.4-1. The applicable Condition specified in the 

Table is Function dependent. Each time a channel is discovered 

inoperable, Condition A is entered for that channel and provides for 

transfer to the appropriate subsequent Condition. 

B.1 and B.2

Required Action B.1 is intended to ensure appropriate actions are taken if 

multiple, inoperable, untripped channels within the same Function result 

in a complete loss of automatic initiation capability for the SPMU System. 

In this case, automatic initiation capability is lost if (a) one Function 1 

channel in both trip systems is inoperable and untripped, (b) one 

Function 2 channel in both trip systems is inoperable and untripped, 

(c) one Function 4 channel in both trip systems is inoperable and 

untripped, or (d) one Function 5 channel in both trip systems is inoperable 

and untripped. In this situation (loss of automatic initiation capability), the 

24 hour allowance of Required Action B.2 is not appropriate and the 

SPMU System must be declared inoperable within 1 hour after discovery 

of loss of SPMU initiation capability for both trip systems. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action B.1, the Completion 

Time only begins upon discovery that the SPMU System cannot be 

automatically initiated due to inoperable, untripped channels within the 

same Function as described in the paragraph above. The 1 hour 

Completion Time from discovery of loss of initiation capability is 

acceptable because it minimizes risk while allowing time for restoration or 

tripping of channels. 

Because of the redundancy of sensors available to provide initiation 

signals, an allowable out of service time of 24 hours has been shown to 

be acceptable (Ref. 3) to permit restoration of any inoperable channel to 

OPERABLE status. If the inoperable channel cannot be restored to 

OPERABLE status within the allowable out of service time, the channel 

must be placed in the tripped condition per Required Action B.2. Placing 

the inoperable channel in trip would conservatively compensate for the 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

inoperability, restore capability to accommodate a single failure, and allow 

operation to continue. Alternately, if it is not desired to place the channel 

in trip (e.g., as in the case where placing the inoperable channel in trip 

would result in an initiation), Condition D must be entered and its 

Required Action taken. 

C.1 and C.2

Required Action C.1 is intended to ensure appropriate actions are taken if 

multiple, inoperable, untripped channels within the same Function result 

in a complete loss of automatic initiation capability for the SPMU System. 

In this case, automatic initiation capability is lost if two Function 3 

channels or two Function 6 channels are inoperable. In this situation 

(loss of automatic initiation capability), the 24 hour allowance of Required 

Action C.2 is not appropriate and the SPMU System must be declared 

inoperable within 1 hour after discovery of loss of SPMU initiation 

capability for both trip systems. As noted, Required Action C.1 is only 

applicable for Functions 3 and 6. Required Action C.1 is not applicable to 

Function 7 (which also requires entry into this Condition if a channel in 

this Function is inoperable), since it is the Manual Initiation Function and 

is not assumed in any FSAR accident or transient analysis. Thus, a total 

loss of manual initiation capability for 24 hours (as allowed by Required 

Action C.2) is allowed. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." For Required Action C.1, the Completion 

Time only begins upon discovery that the SPMU System cannot be 

automatically initiated due to two inoperable channels within the same 

Function. The 1 hour Completion Time from discovery of loss of initiation 

capability is acceptable because it minimizes risk while allowing time for 

restoration of channels. 

Because of the redundancy of sensors available to provide initiation 

signals, an allowable out of service time of 24 hours has been shown to 

be acceptable (Ref. 3) to permit restoration of any inoperable channel to 

OPERABLE status. If the inoperable channel cannot be restored to 

OPERABLE status within the allowable out of service time, Condition D 

must be entered and its Required Action taken. The Required Actions do 

not allow placing the channel in trip since this action could either cause 

the initiation or it would not necessarily result in a safe state for the 

channel in all events. 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-9 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1

With any Required Action and associated Completion Time not met, the 

associated SPMU subsystem may be incapable of performing the 

intended function and the SPMU subsystem associated with inoperable, 

untripped channels must be declared inoperable immediately. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

As noted at the beginning of the SRs, the SRs for each SPMU System 

Function are located in the SRs column of Table 3.3.6.4-1. 

The Surveillances are also modified by a Note to indicate that when a 

channel is placed in an inoperable status solely for performance of 

required Surveillances, entry into associated Conditions and Required 

Actions may be delayed for up to 6 hours, provided the associated 

Function maintains suppression pool makeup capability. Upon 

completion of the Surveillance, or expiration of the 6 hour allowance, the 

channel must be returned to OPERABLE status or the applicable 

Condition entered and Required Actions taken. This Note is based on the 

reliability analysis (Ref. 3) assumption of the average time required to 

perform channel surveillance. That analysis demonstrated that the 6 hour 

testing allowance does not significantly reduce the probability that the 

SPMU will initiate when necessary. 

SR 3.3.6.4.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Agreement criteria are determined by the plant staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency is based upon operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channels during normal operational use of 

the displays associated with the required channels of the LCO. 

SR 3.3.6.4.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 3. 

SR 3.3.6.4.3

The calibration of trip units provides a check of the actual trip setpoints. 

The channel must be declared inoperable if the trip setting is discovered 

to be less conservative than the Allowable Value specified in 

Table 3.3.6.4-1. If the trip setting is discovered to be less conservative 

than accounted for in the appropriate setpoint methodology but is not 

beyond the Allowable Value, the channel performance is still within the 

requirements of the plant safety analysis. Under these conditions, the 

setpoint must be readjusted to be equal to or more conservative than 

accounted for in the appropriate setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 3. 
SPMU System Instrumentation 

B 3.3.6.4 

BWR/6 STS B 3.3.6.4-11 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.6.4.4 and SR 3.3.6.4.5

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies that the channel responds to the 

measured parameter within the necessary range and accuracy. 

CHANNEL CALIBRATION leaves the channel adjusted to account for 

instrument drifts between successive calibrations consistent with the plant 

specific setpoint methodology. 

The Frequency of SR 3.3.6.4.4 is based on the assumption of a 92 day 

calibration interval in the determination of the magnitude of equipment 

drift in the setpoint analysis. 

The Frequency of SR 3.3.6.4.5 is based on the assumption of an 

18 month calibration interval in the determination of the magnitude of 

equipment drift in the setpoint analysis. 

SR 3.3.6.4.6

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required initiation logic for a specific channel. The 

system functional testing performed in LCO 3.6.2.4, "Suppression Pool 

Makeup (SPMU) System," overlaps this Surveillance to provide complete 

testing of the assumed safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

REFERENCES 1. FSAR, Figure [ ]. 

 2. FSAR, Section [6.2.7.3]. 

 3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals 

and Allowed Out-of-Service Times for Selected Instrumentation 

Technical Specifications," February 1991. 
Relief and LLS Instrumentation 

B 3.3.6.5 

BWR/6 STS B 3.3.6.5-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.6.5 Relief and Low-Low Set (LLS) Instrumentation 

BASES 

BACKGROUND The safety/relief valves (S/RVs) prevent overpressurization of the nuclear 

steam system. Instrumentation is provided to support two modes of S/RV 

operation - the relief function (all valves) and the LLS function (selected 

valves). Refer to LCO 3.4.4, "Safety/Relief Valves (S/RVs)," and 

LCO 3.6.1.6, "Low-Low Set (LLS) Safety/Relief Valves (S/RVs)," for 

Applicability Bases for additional information of these modes of S/RV 

operation. 

The relief function of the S/RVs prevents overpressurization of the 

nuclear steam system. The LLS function of the S/RVs is designed to 

mitigate the effects of postulated thrust loads on the S/RV discharge lines 

by preventing subsequent actuations with an elevated water leg in the 

S/RV discharge line. It also mitigates the effects of postulated pressure 

loads on the containment by preventing multiple actuations in rapid 

succession of the S/RVs subsequent to their initial actuation. 

Upon any S/RV actuation, the LLS logic assigns preset opening and 

reclosing setpoints to six preselected S/RVs. These setpoints are 

selected to override the normal relief setpoints such that the LLS S/RVs 

will stay open longer, thus releasing more steam (energy) to the 

suppression pool; hence more energy (and time) is required for 

repressurization and subsequent S/RV openings. The LLS logic 

increases the time between (or prevents) subsequent actuations to allow 

the high water leg created from the initial S/RV opening to return to (or fall 

below) its normal water level, thus reducing thrust loads from subsequent 

actuations to within their design limits. In addition, the LLS is designed to 

limit S/RV subsequent actuations to one valve, so that containment loads 

will also be reduced. 

The relief instrumentation consists of two trip systems, with each trip 

system actuating one solenoid for each S/RV. There are two solenoids 

per S/RV, and each solenoid can open its respective S/RV. The relief 

mode (S/RVs and associated trip systems) is divided into three setpoint 

groups (the low with one S/RV, the medium with 10 S/RVs, and the high 

with nine S/RVs). The S/RV relief function is actuated by transmitters that 

monitor reactor steam dome pressure. The reactor steam dome pressure 

transmitters send signals to trip units whose outputs are arranged in a 

two-out-of-two logic for each trip system in each of three separate 
Relief and LLS Instrumentation 

B 3.3.6.5 

BWR/6 STS B 3.3.6.5-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

setpoint groups (e.g., the medium group of 10 S/RVs opens when at least 

one of the associated trip systems trips at its assigned setpoint). Once an 

S/RV has been opened, it will reclose when reactor steam dome pressure 

decreases below the opening pressure setpoint. This logic arrangement 

ensures that no single instrument failure can preclude the S/RV relief 

function. 

The LLS logic consists of two trip systems similar to the S/RV relief 

function. Either trip system can actuate the LLS S/RVs by energizing the 

associated solenoids on the S/RV pilot valves. Each LLS trip system is 

enabled and sealed in upon initial S/RV actuation from the existing 

reactor steam dome pressure sensors of any of the normal relief setpoint 

groups. The reactor steam dome pressure channels used to arm LLS are 

arranged in a one-out-of-three taken twice logic. The reactor steam dome 

pressure channels that control the opening and closing of the LLS S/RVs 

are arranged in either a one-out-of-one or a two-out-of-two logic 

depending on which LLS S/RV group is being controlled. This logic 

arrangement ensures that no single instrument failure can preclude the 

LLS S/RV function. The channels include electronic equipment (e.g., trip 

units) that compares measured input signals with pre-established 

setpoints. When the setpoint is exceeded, the channel output relay 

actuates, which then outputs a LLS or relief initiation signal, as applicable, 

to the initiation logic. 

APPLICABLE The relief and LLS instrumentation are designed to prevent 

SAFETY overpressurization of the nuclear steam system and to ensure that the 

ANALYSES containment loads remain within the primary containment design basis 

(Ref. 1). 

Relief and LLS instrumentation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The LCO requires OPERABILITY of sufficient relief and LLS 

instrumentation channels to provide adequate assurance of successfully 

accomplishing the relief and LLS function, assuming any single 

instrumentation channel failure within the LLS logic. Therefore, two trip 

systems are required to be OPERABLE. The OPERABILITY of each trip 

system is dependent upon the OPERABILITY of the reactor steam dome 

pressure channels associated with required relief and LLS S/RVs. Each 

required channel shall have its setpoint within the specified Allowable 

Value. A channel is inoperable if its actual trip setpoint is not within its 

required Allowable Value. The actual setpoint is calibrated consistent 

with applicable setpoint methodology assumptions. 
Relief and LLS Instrumentation 

B 3.3.6.5 

BWR/6 STS B 3.3.6.5-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Allowable Values are specified for each channel in SR 3.3.6.5.3. Nominal 

trip setpoints are specified in the setpoint calculations. The nominal 

setpoints are selected to ensure that the setpoints do not exceed the 

Allowable Value between CHANNEL CALIBRATIONS. Operation with a 

trip setpoint less conservative than the nominal trip setpoint, but within its 

Allowable Value, is acceptable. 

Trip setpoints are those predetermined values of output at which an 

action should take place. The setpoints are compared to the actual 

process parameter (e.g., reactor vessel pressure), and when the 

measured output value of the process parameter exceeds the setpoint, 

the associated device (e.g., trip unit) changes state. The analytic limits 

are derived from the limiting values of the process parameters obtained 

from the safety analysis. The Allowable Values are derived from the 

analytic limits, corrected for calibration, process, and some of the 

instrument errors. The trip setpoints are then determined, accounting for 

the remaining instrument errors (e.g., drift). The trip setpoints derived in 

this manner provide adequate protection because instrumentation 

uncertainties, process effects, calibration tolerances, instrument drift, and 

severe environment errors (for channels that must function in harsh 

environments as defined by 10 CFR 50.49) are accounted for. 

For relief, the actuating Allowable Values are based on the transient 

event of main steam isolation valve (MSIV) closure with an indirect scram 

(i.e., neutron flux). This analysis is described in Reference 2. For LLS, 

the actuating and reclosing Allowable Values are based on the transient 

event of MSIV closure with a direct scram (i.e., MSIV position switches). 

This analysis is described in Reference 1. 

APPLICABILITY The relief and LLS instrumentation is required to be OPERABLE in 

MODES 1, 2, and 3, since considerable energy exists in the nuclear 

steam system and the S/RVs may be needed to provide pressure relief. 

If the S/RVs are needed, then the relief and LLS functions are required to 

ensure that the primary containment design basis is maintained. In 

MODES 4 and 5, the reactor pressure is low enough that the 

overpressure limit cannot be approached by assumed operational 

transients or accidents. Thus, pressure relief, associated relief, and LLS 

instrumentation are not required. 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use the times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 
Relief and LLS Instrumentation 

B 3.3.6.5 

BWR/6 STS B 3.3.6.5-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

Because the failure of any reactor steam dome pressure instrument 

channels [providing relief S/RV opening and LLS opening and closing 

pressure setpoints] in one trip system will not prevent the associated 

S/RV from performing its relief and LLS function, 7 days is allowed to 

restore a trip system to OPERABLE status. In this condition, the 

remaining OPERABLE trip system is adequate to perform the relief and 

LLS initiation function. However, the overall reliability is reduced because 

a single failure in the OPERABLE trip system could result in a loss of 

relief or LLS function. 

The 7 day Completion Time is considered appropriate for the relief and 

LLS function because of the redundancy of sensors available to provide 

initiation signals and the redundancy of the relief and LLS design. In 

addition, the probability of multiple relief or LLS instrumentation channel 

failures, which renders the remaining trip system inoperable, occurring 

together with an event requiring the relief or LLS function during the 7 day 

Completion Time is very low. 

B.1 and B.2

If the inoperable trip system is not restored to OPERABLE status within 

7 days, per Condition A, or if two trip systems are inoperable, then the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

12 hours and to MODE 4 within 36 hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

The Surveillances are modified by a Note to indicate that when a channel 

is placed in an inoperable status solely for performance of required 

Surveillances, entry into associated Conditions and Required Actions may 

be delayed for up to 6 hours, provided the associated Function maintains 

relief or LLS initiation capability, as applicable. Upon completion of the 
Relief and LLS Instrumentation 

B 3.3.6.5 

BWR/6 STS B 3.3.6.5-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Surveillance, or expiration of the 6 hour allowance, the channel must be 

returned to OPERABLE status or the applicable Condition entered and 

Required Actions taken. This Note is based on the reliability analysis 

(Ref. 3) assumption of the average time required to perform channel 

surveillance. That analysis demonstrated the 6 hour testing allowance 

does not significantly reduce the probability that the relief and LLS valves 

will initiate when necessary. 

SR 3.3.6.5.1

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. Any setpoint adjustment shall be consistent with 

the assumptions of the current plant specific setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 3. 

SR 3.3.6.5.2

The calibration of trip units provides a check of the actual trip setpoints. 

The channel must be declared inoperable if the trip setting is discovered 

to be less conservative than the Allowable Value specified in 

SR 3.3.6.5.3. If the trip setting is discovered to be less conservative than 

accounted for in the appropriate setpoint methodology but is not beyond 

the Allowable Value, the channel performance is still within the 

requirements of the plant safety analysis. Under these conditions, the 

setpoint must be readjusted to be equal to or more conservative than 

accounted for in the appropriate setpoint methodology. 

The Frequency of 92 days is based on the reliability analysis of 

Reference 3. 
Relief and LLS Instrumentation 

B 3.3.6.5 

BWR/6 STS B 3.3.6.5-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.6.5.3

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 

The Frequency is based upon the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.6.5.4

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required actuation logic for a specific channel. The 

system functional testing performed for S/RVs in LCO 3.4.4 and 

LCO 3.6.1.6 overlaps this Surveillance to provide complete testing of the 

assumed safety function. The 18 month Frequency is based on the need 

to perform this Surveillance under the conditions that apply during a plant 

outage and the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. Operating experience has 

shown these components usually pass the Surveillance when performed 

at the 18 month Frequency. 

REFERENCES 1. FSAR, Section [5.2.2]. 

 2. FSAR, Appendix 5A. 

 3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals 

and Allowed Out-of-Service Times for Selected Instrumentation 

Technical Specifications," February 1991. 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.7.1 Control Room Fresh Air (CRFA) System Instrumentation 

BASES 

BACKGROUND The CRFA System is designed to provide a radiologically controlled 

environment to ensure the habitability of the control room for the safety of 

control room operators under all plant conditions. Two independent 

CRFA subsystems are each capable of fulfilling the stated safety function. 

The instrumentation and controls for the CRFA System automatically 

initiate action to isolate or pressurize the main control room (MCR) to 

minimize the consequences of radioactive material in the control room 

environment. 

In the event of a loss of coolant accident (LOCA) signal (Reactor Vessel 

Water Level - Low Low, Level 2 or Drywell Pressure - High) or Control 

Room Ventilation Radiation Monitor signal, the CRFA System is 

automatically started in the isolation mode. The MCR air is then 

recirculated through the charcoal filter, and sufficient outside air is drawn 

in through the normal intake to keep the MCR slightly pressurized with 

respect to the turbine building. 

The CRFA System instrumentation has two trip systems: one trip system 

initiates one CRFA subsystem, while the second trip system initiates the 

other CRFA subsystem (Ref. 1). Each trip system receives input from the 

Functions listed above. The Functions are arranged as follows for each 

trip system. The Reactor Vessel Water Level - Low Low, Level 2 and 

Drywell Pressure - High are arranged together in a one-out-of-two taken 

twice logic. The Control Room Ventilation Radiation Monitors are 

arranged in a two-out-of-two logic. The channels include electronic 

equipment (e.g., trip units) that compares measured input signals with 

pre-established setpoints. When the setpoint is exceeded, the channel 

output relay actuates, which then outputs a CRFA System initiation signal 

to the initiation logic. 

APPLICABLE The ability of the CRFA System to maintain the habitability of the MCR is 

SAFETY explicitly assumed for certain accidents as discussed in the FSAR safety 

ANALYSES, LCO, analyses (Refs. 2 and 3). CRFA System operation ensures that the 

and APPLICABILITY radiation exposure of control room personnel, through the duration of any 

one of the postulated accidents, does not exceed the limits set by 

GDC 19 of 10 CFR 50, Appendix A. 

CRFA System instrumentation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The OPERABILITY of the CRFA System instrumentation is dependent 

upon the OPERABILITY of the individual instrumentation channel 

Functions specified in Table 3.3.7.1-1. Each Function must have a 

required number of OPERABLE channels, with their setpoints within the 

specified Allowable Values, where appropriate. A channel is inoperable if 

its actual trip setpoint is not within its required Allowable Value. The 

actual setpoint is calibrated consistent with applicable setpoint 

methodology assumptions. 

Allowable Values are specified for each CRFA System Function specified 

in the Table. Nominal trip setpoints are specified in the setpoint 

calculations. These nominal setpoints are selected to ensure that the 

setpoints do not exceed the Allowable Value between successive 

CHANNEL CALIBRATIONS. Operation with a trip setpoint that is less 

conservative than the nominal trip setpoint, but within its Allowable Value, 

is acceptable. 

Trip setpoints are those predetermined values of output at which an 

action should take place. The setpoints are compared to the actual 

process parameter (e.g., reactor vessel water level), and when the 

measured output value of the process parameter exceeds the setpoint, 

the associated device (e.g., trip unit) changes state. The analytic limits 

are derived from the limiting values of the process parameters obtained 

from the safety analysis. The Allowable Values are derived from the 

analytic limits, corrected for calibration, process, and some of the 

instrument errors. The trip setpoints are then determined, accounting for 

the remaining instrument errors (e.g., drift). The trip setpoints derived in 

this manner provide adequate protection because instrumentation 

uncertainties, process effects, calibration tolerances, instrument drift, and 

severe environment errors (for channels that must function in harsh 

environments as defined by 10 CFR 50.49) are accounted for. 

The specific Applicable Safety Analyses, LCO, and Applicability 

discussions are listed below on a Function by Function basis. 

1. Reactor Vessel Water Level - Low Low, Level 2

Low reactor pressure vessel (RPV) water level indicates that the 

capability to cool the fuel may be threatened. A low reactor vessel water 

level could indicate a LOCA, and will automatically initiate the CRFA 

System, since this could be a precursor to a potential radiation release 

and subsequent radiation exposure to control room personnel. 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Reactor Vessel Water Level - Low Low, Level 2 signals are initiated from 

four level transmitters that sense the difference between the pressure due 

to a constant column of water (reference leg) and the pressure due to the 

actual water level (variable leg) in the vessel. Four channels of Reactor 

Vessel Water Level - Low Low, Level 2 Function are available (two 

channels per trip system) and are required to be OPERABLE to ensure 

that no single instrument failure can preclude CRFA System initiation. 

The Allowable Value for the Reactor Vessel Water Level - Low Low, 

Level 2 is chosen to be the same as the Secondary Containment Isolation 

Reactor Vessel Water Level - Low Low, Level 2 Allowable Value 

(LCO 3.3.6.2). 

The Reactor Vessel Water Level - Low Low, Level 2 Function is required 

to be OPERABLE in MODES 1, 2, and 3, and during operations with a 

potential for draining the reactor vessel (OPDRVs), to ensure that the 

control room personnel are protected. In MODES 4 and 5, at times other 

than during OPDRVs, the probability of a vessel draindown event 

releasing radioactive material into the environment, or of a LOCA, is 

minimal. Therefore this Function is not required. In addition, the Control 

Room Ventilation Radiation Monitor Function provides adequate 

protection. 

2. Drywell Pressure - High

High pressure in the drywell could indicate a break in the reactor coolant 

pressure boundary (RCPB). A high drywell pressure signal could indicate 

a LOCA and will automatically initiate the CRFA System, since this could 

be a precursor to a potential radiation release and subsequent radiation 

exposure to control room personnel. 

Drywell Pressure - High signals are initiated from four pressure 

transmitters that sense drywell pressure. Four channels of Drywell 

Pressure - High Function are available (two channels per trip system) and 

are required to be OPERABLE to ensure that no single instrument failure 

can preclude CRFA System initiation. 

The Drywell Pressure - High Allowable Value was chosen to be the same 

as the Secondary Containment Isolation Drywell Pressure - High 

Allowable Value (LCO 3.3.6.2). 

The Drywell Pressure - High Function is required to be OPERABLE in 

MODES 1, 2, and 3 to ensure that control room personnel are protected 

during a LOCA. In MODES 4 and 5, the Drywell Pressure - High Function 

is not required since there is insufficient energy in the reactor to 

pressurize the drywell to the Drywell Pressure - High setpoint. 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

3. Control Room Ventilation Radiation Monitors

The Control Room Ventilation Radiation Monitors measure radiation 

levels exterior to the inlet ducting of the MCR. A high radiation level may 

pose a threat to MCR personnel; thus, a detector indicating this condition 

automatically signals initiation of the CRFA System. 

The Control Room Ventilation Radiation Monitors Function consists of 

four independent monitors. Four channels of Control Room Ventilation 

Radiation Monitors are available and are required to be OPERABLE to 

ensure that no single instrument failure can preclude CRFA System 

initiation. The Allowable Value was selected to ensure protection of the 

control room personnel. 

The Control Room Ventilation Radiation Monitors Function is required to 

be OPERABLE in MODES 1, 2, and 3, and during OPDRVs and 

movement of [recently] irradiated fuel in the secondary containment to 

ensure that control room personnel are protected during a LOCA, fuel 

handling event [involving handling recently irradiated fuel], or a vessel 

draindown event. During MODES 4 and 5, when these specified 

conditions are not in progress (e.g., OPDRVs), the probability of a LOCA 

is low; thus, the Function is not required. [Also due to radioactive decay, 

this Function is only required to initiate the CRFA System during fuel 

handling accidents involving handling recently irradiated fuel (i.e., fuel that 

has occupied part of a critical reactor core within the previous [x] days).] 

ACTIONS -----------------------------------REVIEWER’S NOTE----------------------------------- 

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use these times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report. 

-------------------------------------------------------------------------------------------------- 

A Note has been provided to modify the ACTIONS related to CRFA 

System instrumentation channels. Section 1.3, Completion Times, 

specifies that once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition 

discovered to be inoperable or not within limits will not result in separate 

entry into the Condition. Section 1.3 also specifies that Required Actions 

of the Condition continue to apply for each additional failure, with 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for inoperable CRFA System instrumentation channels 

provide appropriate compensatory measures for separate inoperable 

channels. As such, a Note has been provided that allows separate 

Condition entry for each inoperable CRFA System instrumentation 

channel. 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

Required Action A.1 directs entry into the appropriate Condition 

referenced in Table 3.3.7.1-1. The applicable Condition specified in the 

Table is Function dependent. Each time an inoperable channel is 

discovered, Condition A is entered for that channel and provides for 

transfer to the appropriate subsequent Condition. 

B.1 and B.2

Because of the diversity of sensors available to provide initiation signals 

and the redundancy of the CRFA System design, an allowable out of 

service time of 24 hours has 25-been shown to be acceptable (Refs. 4 

and 5) to permit restoration of any inoperable channel to OPERABLE 

status. However, this out of service time is only acceptable provided the 

associated Function is still maintaining CRFA System initiation capability. 

A Function is considered to be maintaining CRFA System initiation 

capability when sufficient channels are OPERABLE or in trip, such that 

one trip system will generate an initiation signal from the given Function 

on a valid signal. This would require one trip system to have two 

channels, each OPERABLE or in trip. In this situation (loss of CRFA 

System initiation capability), the 24 hour allowance of Required Action B.2 

is not appropriate. If the Function is not maintaining CRFA System 

initiation capability, the CRFA System must be declared inoperable within 

1 hour of discovery of loss of CRFA System initiation capability in both trip 

systems. If the inoperable channel cannot be restored to OPERABLE 

status within the allowable out of service time, the channel must be 

placed in the tripped condition per Required Action B.2. Placing the 

inoperable channel in trip would conservatively compensate for the 

inoperability, restore capability to accommodate a single failure, and allow 

operation to continue. Alternately, if it is not desired to place the channel 

in trip (e.g., as in the case where placing the inoperable channel in trip 

would result in an initiation), Condition E must be entered and its 

Required Actions taken. 

C.1 and C.2

Because of the diversity of sensors available to provide initiation signals 

and the redundancy of the CRFA System design, an allowable out of 

service time of 12 hours has been shown to be acceptable (Refs. 4 and 6) 

to permit restoration of any inoperable channel to OPERABLE status. 

However, this out of service time is only acceptable provided the 

associated Function is still maintaining CRFA System initiation 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

capability. A Function is considered to be maintaining CRFA System 

initiation capability when sufficient channels are OPERABLE or in trip, 

such that one trip system will generate an initiation signal from the given 

Function on a valid signal. This would require one trip system to have 

two channels, each OPERABLE or in trip. In this situation (loss of CRFA 

System initiation capability), the 12 hour allowance of Required 

Action C.2 is not appropriate. If the Function is not maintaining CRFA 

System initiation capability, the CRFA System must be declared 

inoperable within 1 hour of discovery of loss of CRFA System initiation 

capability in both trip systems. If the inoperable channel cannot be 

restored to OPERABLE status within the allowable out of service time, the 

channel must be placed in the tripped condition, per Required Action C.2. 

Placing the inoperable channel in trip would conservatively compensate 

for the inoperability, restore capability to accommodate a single failure, 

and allow operation to continue. Alternately, if it is not desired to place 

the channel in trip (e.g., as in the case where placing the inoperable 

channel in trip would result in an initiation), Condition E must be entered 

and its Required Actions taken. 

D.1 and D.2

Because of the diversity of sensors available to provide initiation signals 

and the redundancy of the CRFA System design, an allowable out of 

service time of 6 hours is provided to permit restoration of any inoperable 

channel to OPERABLE status. However, this out of service time is only 

acceptable provided the associated Function is still maintaining CRFA 

System initiation capability. A Function is considered to be maintaining 

CRFA System initiation capability when sufficient channels are 

OPERABLE or in trip, such that one trip system will generate an initiation 

signal from the given Function on a valid signal. This would require one 

trip system to have two channels, each OPERABLE or in trip. In this 

situation (loss of CRFA System initiation capability), the 6 hour allowance 

of Required Action D.2 is not appropriate. If the Function is not 

maintaining CRFA System initiation capability, the CRFA System must be 

declared inoperable within 1 hour of discovery of loss of CRFA System 

initiation capability in both trip systems. If the inoperable channel cannot 

be restored to OPERABLE status within the allowable out of service time, 

the channel must be placed in the tripped condition, per Required 

Action D.2. Placing the inoperable channel in trip performs the intended 

function of the channel (starts the associated CRFA subsystem in the 

isolation mode). Alternately, if it is not desired to place the channel in trip 

(e.g., as in the case where it is not desired to start the subsystem), 

Condition E must be entered and its Required Actions taken. 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The 6 hour Completion Time is based on the consideration that this 

Function provides the primary signal to start the CRFA System, thus 

ensuring that the design basis of the CRFA System is met. 

E.1 and E.2

With any Required Action and associated Completion Time not met, the 

associated CRFA subsystem must be placed in the isolation mode of 

operation (Required Action D.1) to ensure that control room personnel will 

be protected in the event of a Design Basis Accident. The method used 

to place the CRFA subsystem in operation must provide for automatically 

reinitiating the subsystem upon restoration of power following a loss of 

power to the CRFA subsystem(s). As noted, if the toxic gas protection 

instrumentation is concurrently inoperable, then the CRFA subsystem 

shall be placed in the toxic gas mode instead of the isolation mode. This 

provides proper protection of the control room personnel if both toxic gas 

instrumentation (not required by Technical Specifications) and radiation 

instrumentation are concurrently inoperable. Alternately, if it is not 

desired to start the subsystem, the CRFA subsystem associated with 

inoperable, untripped channels must be declared inoperable within 

1 hour. 

The 1 hour Completion Time is intended to allow the operator time to 

place the CRFA subsystem in operation. The 1 hour Completion Time is 

acceptable because it minimizes risk while allowing time for restoration or 

tripping of channels, or for placing the associated CRFA subsystem in 

operation. 

SURVEILLANCE -----------------------------------REVIEWER’S NOTE----------------------------------- 

REQUIREMENTS Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these Frequencies, the licensee must justify the 

Frequencies as required by the staff SER for the topical report. 

-------------------------------------------------------------------------------------------------- 

As noted at the beginning of the SRs, the SRs for each CRFA System 

Instrumentation Function are located in the SRs column of 

Table 3.3.7.1-1. 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Surveillances are also modified by a Note to indicate that when a 

channel is placed in an inoperable status solely for performance of 

required Surveillances, entry into associated Conditions and Required 

Actions may be delayed for up to 6 hours, provided the associated 

Function maintains CRFA System initiation capability. Upon completion 

of the surveillance, or expiration of the 6 hour allowance, the channel 

must be returned to OPERABLE status or the applicable Condition 

entered and Required Actions taken. This Note is based on the reliability 

analysis (Refs. 4, 5, and 6) assumption of the average time required to 

perform channel surveillance. That analysis demonstrated that the 6 hour 

testing allowance does not significantly reduce the probability that the 

CRFA System will initiate when necessary. 

SR 3.3.7.1.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the indicated parameter for one instrument 

channel to a similar parameter on other channels. It is based on the 

assumption that instrument channels monitoring the same parameter 

should read approximately the same value. Significant deviations 

between the instrument channels could be an indication of excessive 

instrument drift in one of the channels or something even more serious. 

A CHANNEL CHECK will detect gross channel failure; thus, it is key to 

verifying the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION. 

Agreement criteria are determined by the plant staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency is based upon operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channel status during normal operational 

use of the displays associated with channels required by the LCO. 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.7.1.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. Any setpoint adjustment shall be consistent with 

the assumptions of the current plant specific setpoint methodology. 

The Frequency of 92 days is based on the reliability analyses of 

References 4, 5, and 6. 

SR 3.3.7.1.3

The calibration of trip units provides a check of the actual trip setpoints. 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. The channel must be 

declared inoperable if the trip setting is discovered to be less conservative 

than the Allowable Value. If the trip setting is discovered to be less 

conservative than accounted for in the appropriate setpoint methodology, 

but is not beyond the Allowable Value, the channel performance is still 

within the requirements of the plant safety analysis. Under these 

conditions, the setpoint must be readjusted to be equal to or more 

conservative than accounted for in the appropriate setpoint methodology. 

The Frequency of 92 days is based on the reliability analyses of 

References 4, 5, and 6. 

SR 3.3.7.1.4

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 
CRFA System Instrumentation 

B 3.3.7.1 

BWR/6 STS B 3.3.7.1-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Frequency is based on the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.7.1.5

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required initiation logic for a specific channel. The 

system functional testing performed in LCO 3.7.3, "Control Room Fresh 

Air (CRFA) System," overlaps this Surveillance to provide complete 

testing of the assumed safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

REFERENCES 1. FSAR, Figure [ ]. 

 2. FSAR, Section [6.4]. 

 3. FSAR, Chapter [15]. 

 4. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals 

and Allowed Out-of-Service Times for Selected Instrumentation 

Technical Specifications," February 1991. 

 5. NEDC-31677P-A, "Technical Specification Improvement Analysis for 

BWR Isolation Actuation Instrumentation," July 1990. 

 6. NEDC-30851P-A, Supplement 2, "Technical Specification 

Improvement Analysis for BWR Isolation Instrumentation Common to 

RPS and ECCS Instrumentation," March 1989. 
LOP Instrumentation 

B 3.3.8.1 

BWR/6 STS B 3.3.8.1-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.8.1 Loss of Power (LOP) Instrumentation 

BASES 

BACKGROUND Successful operation of the required safety functions of the Emergency 

Core Cooling Systems (ECCS) is dependent upon the availability of 

adequate power sources for energizing the various components such as 

pump motors, motor operated valves, and the associated control 

components. The LOP instrumentation monitors the 4.16 kV emergency 

buses. Offsite power is the preferred source of power for the 4.16 kV 

emergency buses. If the monitors determine that insufficient power is 

available, the buses are disconnected from the offsite power sources and 

connected to the onsite diesel generator (DG) power sources. 

Each 4.16 kV emergency bus has its own independent LOP 

instrumentation and associated trip logic. The voltage for the Division 1, 

2, and 3 buses is monitored at two levels, which can be considered as 

two different undervoltage functions: loss of voltage and degraded 

voltage. 

The LOP instrumentation comprises three Functions for Divisions 1 

and 2, and two Functions for Division 3, which represent different voltage 

levels that cause various bus transfers and disconnects. Each Function 

is monitored by four undervoltage relays for each emergency bus whose 

outputs are arranged in a one-out-of-two taken twice logic configuration 

(Ref. 1). The channels include electronic equipment (e.g., trip units) that 

compares measured input signals with pre-established setpoints. When 

the setpoint is exceeded, the channel output relay actuates, which then 

outputs a LOP trip signal to the trip logic. 

APPLICABLE The LOP instrumentation is required for the Engineered Safety Features 

SAFETY to function in any accident with a loss of offsite power. The required 

ANALYSES, LCO, channels of LOP instrumentation ensure that the ECCS and other 

and APPLICABILITY assumed systems powered from the DGs provide plant protection in the 

event of any of the analyzed accidents in References 2, 3, and 4 in which 

a loss of offsite power is assumed. The initiation of the DGs on loss of 

offsite power, and subsequent initiation of the ECCS, ensure that the fuel 

peak cladding temperature remains below the limits of 10 CFR 50.46. 

Accident analyses credit the loading of the DG based on the loss of offsite 

power during a loss of coolant accident (LOCA). The diesel starting and 

loading times have been included in the delay time associated with each 

safety system component requiring DG supplied power following a loss of 

offsite power. 
LOP Instrumentation 

B 3.3.8.1 

BWR/6 STS B 3.3.8.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

The LOP instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

The OPERABILITY of the LOP instrumentation is dependent upon the 

OPERABILITY of the individual instrumentation channel Functions 

specified in Table 3.3.8.1-1. Each Function must have a required number 

of OPERABLE channels per 4.16 kV emergency bus, with their setpoints 

within the specified Allowable Values. A channel is inoperable if its actual 

trip setpoint is not within its required Allowable Value. The actual setpoint 

is calibrated consistent with applicable setpoint methodology 

assumptions. 

The Allowable Values are specified for each Function in the Table. 

Nominal trip setpoints are specified in the setpoint calculations. The 

nominal setpoints are selected to ensure that the setpoint does not 

exceed the Allowable Value between CHANNEL CALIBRATIONS. 

Operation with a trip setpoint less conservative than the nominal trip 

setpoint, but within the Allowable Value, is acceptable. Trip setpoints are 

those predetermined values of output at which an action should take 

place. The setpoints are compared to the actual process parameter (e.g., 

degraded voltage), and when the measured output value of the process 

parameter exceeds the setpoint, the associated device (e.g., trip unit) 

changes state. The analytic limits are derived from the limiting values of 

the process parameters obtained from the safety analysis. The Allowable 

Values are derived from the analytic limits, corrected for calibration, 

process, and some of the instrument errors. The trip setpoints are then 

determined accounting for the remaining instrument errors (e.g., drift). 

The trip setpoints derived in this manner provide adequate protection 

because instrumentation uncertainties, process effects, calibration 

tolerances, instrument drift, and severe environment errors (for channels 

that must function in harsh environments as defined by 10 CFR 50.49) 

are accounted for. 

The specific Applicable Safety Analyses, LCO, and Applicability 

discussions are listed below on a Function by Function basis. 

4.16 kV Emergency Bus Undervoltage

1.a, 1.b, 2.a, 2.b. 4.16 kV Emergency Bus Undervoltage (Loss of 

Voltage)

Loss of voltage on a 4.16 kV emergency bus indicates that offsite power 

may be completely lost to the respective emergency bus and is unable to 

supply sufficient power for proper operation of the applicable equipment. 

Therefore, the power supply to the bus is transferred from offsite power to 

DG power when the voltage on the bus drops below the Loss of Voltage 
LOP Instrumentation 

B 3.3.8.1 

BWR/6 STS B 3.3.8.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 

Function Allowable Values (loss of voltage with a short time delay). This 

ensures that adequate power will be available to the required equipment. 

The Bus Undervoltage Allowable Values are low enough to prevent 

inadvertent power supply transfer, but high enough to ensure power is 

available to the required equipment. The Time Delay Allowable Values 

are long enough to provide time for the offsite power supply to recover to 

normal voltages, but short enough to ensure that power is available to the 

required equipment. 

Four channels of 4.16 kV Emergency Bus Undervoltage (Loss of Voltage) 

Function per associated emergency bus are only required to be 

OPERABLE when the associated DG is required to be OPERABLE to 

ensure that no single instrument failure can preclude the DG function. 

(Four channels input to each of the three DGs.) Refer to LCO 3.8.1, "AC 

Sources - Operating," and LCO 3.8.2, "AC Sources - Shutdown," for 

Applicability Bases for the DGs. 

1.c, 1.d, 2.c, 2.d, 2.e. 4.16 kV Emergency Bus Undervoltage (Degraded 

Voltage)

A reduced voltage condition on a 4.16 kV emergency bus indicates that 

while offsite power may not be completely lost to the respective 

emergency bus, power may be insufficient for starting large motors 

without risking damage to the motors that could disable the ECCS 

function. Therefore, power supply to the bus is transferred from offsite 

power to onsite DG power when the voltage on the bus drops below the 

Degraded Voltage Function Allowable Values (degraded voltage with a 

time delay). This ensures that adequate power will be available to the 

required equipment. 

The Bus Undervoltage Allowable Values are low enough to prevent 

inadvertent power supply transfer, but high enough to ensure that 

sufficient power is available to the required equipment. The Time Delay 

Allowable Values are long enough to provide time for the offsite power 

supply to recover to normal voltages, but short enough to ensure that 

sufficient power is available to the required equipment. 

Four channels of 4.16 kV Emergency Bus Undervoltage (Degraded 

Voltage) Function per associated emergency bus are only required to be 

OPERABLE when the associated DG is required to be OPERABLE to 

ensure that no single instrument failure can preclude the DG function. 

(Four channels input to each of the three DGs.) Refer to LCO 3.8.1 and 

LCO 3.8.2 for Applicability Bases for the DGs. 
LOP Instrumentation 

B 3.3.8.1 

BWR/6 STS B 3.3.8.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A Note has been provided to modify the ACTIONS related to LOP 

instrumentation channels. Section 1.3, Completion Times, specifies that 

once a Condition has been entered, subsequent divisions, subsystems, 

components, or variables expressed in the Condition discovered to be 

inoperable or not within limits will not result in separate entry into the 

Condition. Section 1.3 also specifies that Required Actions of the 

Condition continue to apply for each additional failure, with Completion 

Times based on initial entry into the Condition. However, the Required 

Actions for inoperable LOP instrumentation channels provide appropriate 

compensatory measures for separate inoperable channels. As such, a 

Note has been provided that allows separate Condition entry for each 

inoperable LOP instrumentation channel. 

A.1

With one or more channels of a Function inoperable, the Function may 

not be capable of performing the intended function. Therefore, only 

1 hour is allowed to restore the inoperable channel to OPERABLE status. 

If the inoperable channel cannot be restored to OPERABLE status within 

the allowable out of service time, the channel must be placed in the 

tripped condition per Required Action A.1. Placing the inoperable 

channel in trip would conservatively compensate for the inoperability, 

restore capability to accommodate a single failure, and allow operation to 

continue. Alternately, if it is not desired to place the channel in trip (e.g., 

as in the case where placing the channel in trip would result in a DG 

initiation), Condition B must be entered and its Required Action taken. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. The 1 hour Completion Time is 

acceptable because it minimizes risk while allowing time for restoration or 

tripping of channels. 

B.1

If any Required Action and associated Completion Time is not met, the 

associated Function may not be capable of performing the intended 

function. Therefore, the associated DG(s) are declared inoperable 

immediately. This requires entry into applicable Conditions and Required 

Actions of LCO 3.8.1 and LCO 3.8.2, which provide appropriate actions 

for the inoperable DG(s). 
LOP Instrumentation 

B 3.3.8.1 

BWR/6 STS B 3.3.8.1-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each LOP 

REQUIREMENTS Instrumentation Function are located in the SRs column of 

Table 3.3.8.1-1. 

The Surveillances are modified by a Note to indicate that when a channel 

is placed in an inoperable status solely for performance of required 

Surveillances, entry into associated Conditions and Required Actions may 

be delayed for up to 2 hours provided the associated Function maintains 

DG initiation capability. Upon completion of the Surveillance, or 

expiration of the 2 hour allowance, the channel must be returned to 

OPERABLE status or the applicable Condition entered and Required 

Actions taken. 

SR 3.3.8.1.1

Performance of the CHANNEL CHECK once every 12 hours ensures that 

a gross failure of instrumentation has not occurred. A CHANNEL CHECK 

is normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. 

Agreement criteria are determined by the plant staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the instrument has drifted outside its limit. 

The Frequency is based on operating experience that demonstrates 

channel failure is rare. The CHANNEL CHECK supplements less formal, 

but more frequent, checks of channels during normal operational use of 

the displays associated with the required channels of the LCO. 

SR 3.3.8.1.2

A CHANNEL FUNCTIONAL TEST is performed on each required channel 

to ensure that the entire channel will perform the intended function. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable CHANNEL FUNCTIONAL 

TEST of a relay. This is acceptable because all of the other required 
LOP Instrumentation 

B 3.3.8.1 

BWR/6 STS B 3.3.8.1-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. Any setpoint adjustment shall be consistent with 

the assumptions of the current plant specific setpoint methodology. 

The Frequency of 31 days is based on plant operating experience with 

regard to channel OPERABILITY and drift that demonstrates that failure 

of more than one channel of a given Function in any 31 day interval is 

rare. 

SR 3.3.8.1.3

A CHANNEL CALIBRATION is a complete check of the instrument loop 

and the sensor. This test verifies the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 

Any setpoint adjustment shall be consistent with the assumptions of the 

current plant specific setpoint methodology. 

The Frequency is based on the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.8.1.4

The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the 

OPERABILITY of the required actuation logic for a specific channel. The 

system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps 

this Surveillance to provide complete testing of the assumed safety 

functions. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 
LOP Instrumentation 

B 3.3.8.1 

BWR/6 STS B 3.3.8.1-7 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Figure [ ]. 

 2. FSAR, Section [5.2]. 

 3. FSAR, Section [6.3]. 

 4. FSAR, Chapter [15]. 
RPS Electric Power Monitoring 

B 3.3.8.2 

BWR/6 STS B 3.3.8.2-1 Rev. 3.0, 03/31/04 

B 3.3 INSTRUMENTATION 

B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring 

BASES 

BACKGROUND The RPS Electric Power Monitoring System is provided to isolate the RPS 

bus from the motor generator (MG) set or an alternate power supply in 

the event of overvoltage, undervoltage, or underfrequency. This system 

protects the loads connected to the RPS bus against unacceptable 

voltage and frequency conditions (Ref. 1) and forms an important part of 

the primary success path for the essential safety circuits. Some of the 

essential equipment powered from the RPS buses includes the RPS 

logic, scram solenoids, and various valve isolation logic. 

The RPS Electric Power Monitoring assembly will detect any abnormal 

high or low voltage or low frequency condition in the outputs of the two 

MG sets or the alternate power supply and will de-energize its respective 

RPS bus, thereby causing all safety functions normally powered by this 

bus to de-energize. 

In the event of failure of an RPS Electric Power Monitoring System (e.g., 

both inseries electric power monitoring assemblies), the RPS loads may 

experience significant effects from the unregulated power supply. 

Deviation from the nominal conditions can potentially cause damage to 

the scram solenoids and other Class 1E devices. 

In the event of a low voltage condition, for an extended period of time, the 

scram solenoids can chatter and potentially lose their pneumatic control 

capability, resulting in a loss of primary scram action. 

In the event of an overvoltage condition, the RPS logic relays and scram 

solenoids, as well as the main steam isolation valve solenoids, may 

experience a voltage higher than their design voltage. If the overvoltage 

condition persists for an extended time period, it may cause equipment 

degradation and the loss of plant safety function. 

Two redundant Class 1E circuit breakers are connected in series between 

each RPS bus and its MG set, and between each RPS bus and its 

alternate power supply. Each of these circuit breakers has an associated 

independent set of Class 1E overvoltage, undervoltage, and 

underfrequency sensing logic. Together, a circuit breaker and its sensing 

logic constitute an electric power monitoring assembly. If the output of 

the MG set exceeds the predetermined limits of overvoltage, 

undervoltage, or underfrequency, a trip coil driven by this logic circuitry 

opens the circuit breaker, which removes the associated power supply 

from service. 
RPS Electric Power Monitoring 

B 3.3.8.2 

BWR/6 STS B 3.3.8.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE RPS electric power monitoring is necessary to meet the assumptions of 

SAFETY the safety analyses by ensuring that the equipment powered from the 

ANALYSES RPS buses can perform its intended function. RPS electric power 

monitoring provides protection to the RPS and other systems that receive 

power from the RPS buses, by disconnecting the RPS from the power 

supply under specified conditions that could damage the RPS bus 

powered equipment. 

RPS electric power monitoring satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The OPERABILITY of each RPS electric power monitoring assembly is 

dependent upon the OPERABILITY of the overvoltage, undervoltage, and 

underfrequency logic, as well as the OPERABILITY of the associated 

circuit breaker. Two electric power monitoring assemblies are required to 

be OPERABLE for each inservice power supply. This provides redundant 

protection against any abnormal voltage or frequency conditions to 

ensure that no single RPS electric power monitoring assembly failure can 

preclude the function of RPS bus powered components. Each inservice 

electric power monitoring assembly's trip logic setpoints are required to 

be within the specific Allowable Value. The actual setpoint is calibrated 

consistent with applicable setpoint methodology assumptions. 

Allowable Values are specified for each RPS electric power monitoring 

assembly trip logic (refer to SR 3.3.8.2.2). Nominal trip setpoints are 

specified in the setpoint calculations. The nominal setpoints are selected 

to ensure that the setpoints do not exceed the Allowable Value between 

CHANNEL CALIBRATIONS. Operation with a trip setpoint less 

conservative than the nominal trip setpoint, but within its Allowable Value, 

is acceptable. A channel is inoperable if its actual trip setpoint is not 

within its required Allowable Value. Trip setpoints are those 

predetermined values of output at which an action should take place. The 

setpoints are compared to the actual process parameter (e.g., 

overvoltage), and when the measured output value of the process 

parameter exceeds the setpoint, the associated device (e.g., trip unit) 

changes state. The analytic limits are derived from the limiting values of 

the process parameters obtained from the safety analysis. The Allowable 

Values are derived from the analytic limits, corrected for calibration, 

process, and some of the instrument errors. The trip setpoints are then 

determined, accounting for the remaining instrument errors (e.g., drift). 

The trip setpoints derived in this manner provide adequate protection 

because instrumentation uncertainties, process effects, calibration 

tolerances, instrument drift, and severe environment errors (for channels 

that must function in harsh environments as defined by 10 CFR 50.49) 

are accounted for. 
RPS Electric Power Monitoring 

B 3.3.8.2 

BWR/6 STS B 3.3.8.2-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The Allowable Values for the instrument settings are based on the RPS 

providing ≥ 57 Hz, 120 V ± 10% (to all equipment), and 115 V ± 10 V (to 

scram and MSIV solenoids). The most limiting voltage requirement and 

associated line losses determine the settings of the electric power 

monitoring instrument channels. The settings are calculated based on 

the loads on the buses and RPS MG set or alternate power supply being 

120 VAC and 60 Hz. 

APPLICABILITY The operation of the RPS electric power monitoring assemblies is 

essential to disconnect the RPS bus powered components from the MG 

set or alternate power supply during abnormal voltage or frequency 

conditions. Since the degradation of a nonclass 1E source supplying 

power to the RPS bus can occur as a result of any random single failure, 

the OPERABILITY of the RPS electric power monitoring assemblies is 

required when the RPS bus powered components are required to be 

OPERABLE. This results in the RPS Electric Power Monitoring System 

OPERABILITY being required in MODES 1, 2, and 3, and MODES 4 

and 5 with any control rod withdrawn from a core cell containing one or 

more fuel assemblies or with both residual heat removal (RHR) shutdown 

cooling isolation valves open. 

ACTIONS A.1

If one RPS electric power monitoring assembly for an inservice power 

supply (MG set or alternate) is inoperable, or one RPS electric power 

monitoring assembly on each inservice power supply is inoperable, the 

OPERABLE assembly will still provide protection to the RPS bus powered 

components under degraded voltage or frequency conditions. However, 

the reliability and redundancy of the RPS Electric Power Monitoring 

System are reduced and only a limited time (72 hours) is allowed to 

restore the inoperable assembly(s) to OPERABLE status. If the 

inoperable assembly(s) cannot be restored to OPERABLE status, the 

associated power supply must be removed from service (Required 

Action A.1). This places the RPS bus in a safe condition. An alternate 

power supply with OPERABLE power monitoring assemblies may then be 

used to power the RPS bus. 

The 72 hour Completion Time takes into account the remaining 

OPERABLE electric power monitoring assembly and the low probability of 

an event requiring RPS Electric Power Monitoring protection occurring 

during this period. It allows time for plant operations personnel to take 

corrective actions or to place the plant in the required condition in an 

orderly manner and without challenging plant systems. 
RPS Electric Power Monitoring 

B 3.3.8.2 

BWR/6 STS B 3.3.8.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Alternatively, if it is not desired to remove the power supply(s) from 

service (e.g., as in the case where removing the power supply(s) from 

service would result in a scram or isolation), Condition C or D, as 

applicable, must be entered and its Required Actions taken. 

B.1

If both power monitoring assemblies for an inservice power supply (MG 

set or alternate) are inoperable, or both power monitoring assemblies in 

each inservice power supply are inoperable, the system protective 

function is lost. In this condition, 1 hour is allowed to restore one 

assembly to OPERABLE status for each inservice power supply. If one 

inoperable assembly for each inservice power supply cannot be restored 

to OPERABLE status, the associated power supplies must be removed 

from service within 1 hour (Required Action B.1). An alternate power 

supply with OPERABLE assemblies may then be used to power one RPS 

bus. The 1 hour Completion Time is sufficient for the plant operations 

personnel to take corrective actions and is acceptable because it 

minimizes risk while allowing time for restoration or removal from service 

of the electric power monitoring assemblies. 

Alternately, if it is not desired to remove the power supply(s) from service 

(e.g., as in the case where removing the power supply(s) from service 

would result in a scram or isolation), Condition C or D, as applicable, 

must be entered and its Required Actions taken. 

C.1 and C.2

If any Required Action and associated Completion Time of Condition A 

or B are not met in MODE 1, 2, or 3, a plant shutdown must be 

performed. This places the plant in a condition where minimal equipment, 

powered through the inoperable RPS electric power monitoring 

assembly(s), is required and ensures that the safety function of the RPS 

(e.g., scram of control rods) is not required. The plant shutdown is 

accomplished by placing the plant in MODE 3 within 12 hours and in 

MODE 4 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required plant conditions 

from full power conditions in an orderly manner and without challenging 

plant systems. 
RPS Electric Power Monitoring 

B 3.3.8.2 

BWR/6 STS B 3.3.8.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1, D.2.1, and D.2.2

If any Required Action and associated Completion Time of Condition A or 

B are not met in MODE 4 or 5, with any control rod withdrawn from a core 

cell containing one or more fuel assemblies or with both RHR shutdown 

cooling valves open, the operator must immediately initiate action to fully 

insert all insertable control rods in core cells containing one or more fuel 

assemblies (Required Action D.1). This Required Action results in the 

least reactive condition for the reactor core and ensures that the safety 

function of the RPS (e.g., scram of control rods) is not required. 

In addition, action must be immediately initiated to either restore one 

electric power monitoring assembly to OPERABLE status for the inservice 

power source supplying the required instrumentation powered from the 

RPS bus (Required Action D.2.1) or to isolate the RHR Shutdown Cooling 

System (Required Action D.2.2). Required Action D.2.1 is provided 

because the RHR Shutdown Cooling System may be needed to provide 

core cooling. All actions must continue until the applicable Required 

Actions are completed. 

SURVEILLANCE SR 3.3.8.2.1

REQUIREMENTS 

A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, 

undervoltage, and underfrequency channel to ensure that the entire 

channel will perform the intended function. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. 

This is acceptable because all of the other required contacts of the relay 

are verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. Any setpoint adjustment shall be consistent with the 

assumptions of the current plant specific setpoint methodology. 

As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only 

required to be performed while the plant is in a condition in which the loss 

of the RPS bus will not jeopardize steady state power operation (the 

design of the system is such that the power source must be removed 

from service to conduct the Surveillance). The 24 hours is intended to 

indicate an outage of sufficient duration to allow for scheduling and proper 

performance of the Surveillance. The 184 day Frequency and the Note in 

the Surveillance are based on guidance provided in Generic Letter 91-09 

(Ref. 2). 
RPS Electric Power Monitoring 

B 3.3.8.2 

BWR/6 STS B 3.3.8.2-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.3.8.2.2

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. This test verifies that the channel responds to the measured 

parameter within the necessary range and accuracy. CHANNEL 

CALIBRATION leaves the channel adjusted to account for instrument 

drifts between successive calibrations consistent with the plant specific 

setpoint methodology. 

The Frequency is based upon the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis. 

SR 3.3.8.2.3

Performance of a system functional test demonstrates a required system 

actuation (simulated or actual) signal. The logic of the system will 

automatically trip open the associated power monitoring assembly circuit 

breaker. Only one signal per power monitoring assembly is required to 

be tested. This Surveillance overlaps with the CHANNEL CALIBRATION 

to provide complete testing of the safety function. The system functional 

test of the Class 1E circuit breakers is included as part of this test to 

provide complete testing of the safety function. If the breakers are 

incapable of operating, the associated electric power monitoring 

assembly would be inoperable. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

18 month Frequency. 

REFERENCES 1. FSAR, Section [8.3.1.1.5]. 

 2. NRC Generic Letter 91-09, "Modification of Surveillance Interval for 

the Electric Protective Assemblies in Power Supplies for the Reactor 

Protection System." 
Recirculation Loops Operating 

B 3.4.1 

BWR/6 STS B 3.4.1-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.1 Recirculation Loops Operating 

BASES 

BACKGROUND The Reactor Coolant Recirculation System is designed to provide a 

forced coolant flow through the core to remove heat from the fuel. The 

forced coolant flow removes more heat from the fuel than would be 

possible with just natural circulation. The forced flow, therefore, allows 

operation at significantly higher power than would otherwise be possible. 

The recirculation system also controls reactivity over a wide span of 

reactor power by varying the recirculation flow rate to control the void 

content of the moderator. The Reactor Coolant Recirculation System 

consists of two recirculation pump loops external to the reactor vessel. 

These loops provide the piping path for the driving flow of water to the 

reactor vessel jet pumps. Each external loop contains a two speed motor 

driven recirculation pump, a flow control valve, associated piping, jet 

pumps, valves, and instrumentation. The recirculation loops are part of 

the reactor coolant pressure boundary and are located inside the drywell 

structure. The jet pumps are reactor vessel internals. 

The recirculated coolant consists of saturated water from the steam 

separators and dryers that has been subcooled by incoming feedwater. 

This water passes down the annulus between the reactor vessel wall and 

the core shroud. A portion of the coolant flows from the vessel, through 

the two external recirculation loops, and becomes the driving flow for the 

jet pumps. Each of the two external recirculation loops discharges high 

pressure flow into an external manifold, from which individual recirculation 

inlet lines are routed to the jet pump risers within the reactor vessel. The 

remaining portion of the coolant mixture in the annulus becomes the 

suction flow for the jet pumps. This flow enters the jet pump at suction 

inlets and is accelerated by the driving flow. The drive flow and suction 

flow are mixed in the jet pump throat section. The total flow then passes 

through the jet pump diffuser section into the area below the core (lower 

plenum), gaining sufficient head in the process to drive the required flow 

upward through the core. 

The subcooled water enters the bottom of the fuel channels and contacts 

the fuel cladding, where heat is transferred to the coolant. As it rises, the 

coolant begins to boil, creating steam voids within the fuel channel that 

continue until the coolant exits the core. Because of reduced moderation, 

the steam voiding introduces negative reactivity that must be 

compensated for to maintain or to increase reactor power. The 
Recirculation Loops Operating 

B 3.4.1 

BWR/6 STS B 3.4.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

recirculation flow control allows operators to increase recirculation flow 

and sweep some of the voids from the fuel channel, overcoming the 

negative reactivity void effect. Thus, the reason for having variable 

recirculation flow is to compensate for reactivity effects of boiling over a 

wide range of power generation (i.e., 55 to 100% RTP) without having to 

move control rods and disturb desirable flux patterns. 

Each recirculation loop is manually started from the control room. The 

recirculation flow control valves provide regulation of individual 

recirculation loop drive flows. The flow in each loop can be manually or 

automatically controlled. 

APPLICABLE The operation of the Reactor Coolant Recirculation System is an initial 

SAFETY condition assumed in the design basis loss of coolant accident (LOCA) 

ANALYSES (Ref. 1). During a LOCA caused by a recirculation loop pipe break, the 

intact loop is assumed to provide coolant flow during the first few seconds 

of the accident. The initial core flow decrease is rapid because the 

recirculation pump in the broken loop ceases to pump reactor coolant to 

the vessel almost immediately. The pump in the intact loop coasts down 

relatively slowly. This pump coastdown governs the core flow response 

for the next several seconds until the jet pump suction is uncovered 

(Ref. 1). The analyses assume that both loops are operating at the same 

flow prior to the accident. However, the LOCA analysis was reviewed for 

the case with a flow mismatch between the two loops, with the pipe break 

assumed to be in the loop with the higher flow. While the flow coastdown 

and core response are potentially more severe in this assumed case 

(since the intact loop starts at a lower flow rate and the core response is 

the same as if both loops were operating at a lower flow rate), a small 

mismatch has been determined to be acceptable based on engineering 

judgement. 

The recirculation system is also assumed to have sufficient flow 

coastdown characteristics to maintain fuel thermal margins during 

abnormal operational transients (Ref. 2), which are analyzed in 

Chapter 15 of the FSAR. 

A plant specific LOCA analysis has been performed assuming only one 

operating recirculation loop. This analysis has demonstrated that, in the 

event of a LOCA caused by a pipe break in the operating recirculation 

loop, the Emergency Core Cooling System response will provide 

adequate core cooling, provided the APLHGR requirements are modified 

accordingly (Ref. 3). 
Recirculation Loops Operating 

B 3.4.1 

BWR/6 STS B 3.4.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The transient analyses of Chapter 15 of the FSAR have also been 

performed for single recirculation loop operation (Ref. 3) and demonstrate 

sufficient flow coastdown characteristics to maintain fuel thermal margins 

during the abnormal operational transients analyzed provided the MCPR 

requirements are modified. During single recirculation loop operation, 

modification to the Reactor Protection System average power range 

monitor (APRM) instrument setpoints is also required to account for the 

different relationships between recirculation drive flow and reactor core 

flow. The APLHGR and MCPR setpoints for single loop operation are 

specified in the COLR. The APRM flow biased simulated thermal power 

setpoint is in LCO 3.3.1.1, "Reactor Protection System (RPS) 

Instrumentation." 

Recirculation loops operating satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO Two recirculation loops are required to be in operation with their flows 

matched within the limits specified in SR 3.4.1.1 to ensure that during a 

LOCA caused by a break of the piping of one recirculation loop the 

assumptions of the LOCA analysis are satisfied. With the limits specified 

in SR 3.4.1.1 not met, the recirculation loop with the lower flow must be 

considered not in operation. With only one recirculation loop in operation, 

modifications to the required APLHGR limits (LCO 3.2.1, "AVERAGE 

PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), MCPR limits 

(LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), and APRM 

Flow Biased Simulated Thermal Power - High setpoint (LCO 3.3.1.1) may 

be applied to allow continued operation consistent with the assumptions 

of Reference 3. 

APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Coolant 

Recirculation System are necessary since there is considerable energy in 

the reactor core and the limiting design basis transients and accidents are 

assumed to occur. 

In MODES 3, 4, and 5, the consequences of an accident are reduced and 

the coastdown characteristics of the recirculation loops are not important. 

ACTIONS A.1

With the requirements of the LCO not met, the recirculation loops must be 

restored to operation with matched flows within 24 hours. A recirculation 

loop is considered not in operation when the pump in that loop is idle or 

when the mismatch between total jet pump flows of the two loops is 

greater than required limits. The loop with the lower flow must be 
Recirculation Loops Operating 

B 3.4.1 

BWR/6 STS B 3.4.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

considered not in operation. Should a LOCA occur with one recirculation 

loop not in operation, the core flow coastdown and resultant core 

response may not be bounded by the LOCA analyses. Therefore, only a 

limited time is allowed to restore the inoperable loop to operating status. 

Alternatively, if the single loop requirements of the LCO are applied to 

operating limits and RPS setpoints, operation with only one recirculation 

loop would satisfy the requirements of the LCO and the initial conditions 

of the accident sequence. 

The 24 hour Completion Time is based on the low probability of an 

accident occurring during this time period, on a reasonable time to 

complete the Required Action, and on frequent core monitoring by 

operators allowing abrupt changes in core flow conditions to be quickly 

detected. 

This Required Action does not require tripping the recirculation pump in 

the lowest flow loop when the mismatch between total jet pump flows of 

the two loops is greater than the required limits. However, in cases 

where large flow mismatches occur, low flow or reverse flow can occur in 

the low flow loop jet pumps, causing vibration of the jet pumps. If zero or 

reverse flow is detected, the condition should be alleviated by changing 

flow control valve position to re-establish forward flow or by tripping the 

pump. 

B.1

With no recirculation loops in operation, or the Required Action and 

associated Completion Time of Condition A not met, the unit is required to 

be brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to MODE 3 within 12 hours. In this 

condition, the recirculation loops are not required to be operating because 

of the reduced severity of DBAs and minimal dependence on the 

recirculation loop coastdown characteristics. The allowed Completion 

Time of 12 hours is reasonable, based on operating experience, to reach 

MODE 3 from full power conditions in an orderly manner and without 

challenging plant systems. 

SURVEILLANCE SR 3.4.1.1

REQUIREMENTS 

This SR ensures the recirculation loop flows are within the allowable limits 

for mismatch. At low core flow (i.e., < [70]% of rated core flow), the 

MCPR requirements provide larger margins to the fuel cladding integrity 

Safety Limit such that the potential adverse effect of early boiling 
Recirculation Loops Operating 

B 3.4.1 

BWR/6 STS B 3.4.1-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

transition during a LOCA is reduced. A larger flow mismatch can 

therefore be allowed when core flow is < [70]% of rated core flow. The 

recirculation loop jet pump flow, as used in this Surveillance, is the 

summation of the flows from all of the jet pumps associated with a single 

recirculation loop. 

The mismatch is measured in terms of percent of rated core flow. If the 

flow mismatch exceeds the specified limits, the loop with the lower flow is 

considered inoperable. This SR is not required when both loops are not 

in operation since the mismatch limits are meaningless during single loop 

or natural circulation operation. The Surveillance must be performed 

within 24 hours after both loops are in operation. The 24 hour Frequency 

is consistent with the Frequency for jet pump OPERABILITY verification 

and has been shown by operating experience to be adequate to detect off 

normal jet pump loop flows in a timely manner. 

REFERENCES 1. FSAR, Section [6.3.3.4]. 

 2. FSAR, Section [5.5.1.4]. 

 [3. Plant specific analysis for single loop operation. ] 
FCVs 

B 3.4.2 

BWR/6 STS B 3.4.2-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.2 Flow Control Valves (FCVs) 

BASES 

BACKGROUND The Reactor Coolant Recirculation System is described in the 

Background section of the Bases for LCO 3.4.1, "Recirculation Loops 

Operating," which discusses the operating characteristics of the system 

and how this affects the design basis transient and accident analyses. 

The jet pumps and the FCVs are part of the Reactor Coolant 

Recirculation System. The jet pumps are described in the Bases for 

LCO 3.4.3, "Jet Pumps." 

The Recirculation Flow Control System consists of the electronic and 

hydraulic components necessary for the positioning of the two 

hydraulically actuated FCVs. The recirculation loop flow rate can be 

rapidly changed within the expected flow range, in response to rapid 

changes in system demand. Limits on the system response are required 

to minimize the impact on core flow response during certain accidents 

and transients. Solid state control logic will generate an FCV "motion 

inhibit" signal in response to any one of several hydraulic power unit or 

analog control circuit failure signals. The "motion inhibit" signal causes 

hydraulic power unit shutdown and hydraulic isolation such that the FCVs 

fail "as is." 

APPLICABLE The FCV stroke rate is limited to ≤ 11% per second in the opening and 

SAFETY closing directions on a control signal failure of maximum demand. This 

ANALYSES stroke rate is an assumption of the analysis of the recirculation flow 

control failures on decreasing and increasing flow (Refs. 1 and 2). The 

closure of a recirculation FCV concurrent with a loss of coolant accident 

(LOCA) has been analyzed and found to be acceptable for a maximum 

closure rate of 11% of strokes per second (Ref. 3). 

Flow control valves satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO An FCV in each operating recirculation loop must be OPERABLE to 

ensure that the assumptions of the design basis transient and accident 

analyses are satisfied. 

APPLICABILITY In MODES 1 and 2, the FCVs are required to be OPERABLE, since 

during these conditions there is considerable energy in the reactor core, 

and the limiting design basis transients and accidents are assumed to 

occur. In MODES 3, 4, and 5, the consequences of a transient or 

accident are reduced and OPERABILITY of the flow control valves is not 

important. 
FCVs 

B 3.4.2 

BWR/6 STS B 3.4.2-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A Note has been provided to modify the ACTIONS related to FCVs. 

Section 1.3, Completion Times, specifies once a Condition has been 

entered, subsequent divisions, subsystems, components or variables 

expressed in the Condition, discovered to be inoperable or not within 

limits, will not result in separate entry into the Condition. Section 1.3 also 

specifies Required Actions of the Condition continue to apply for each 

additional failure, with Completion Times based on initial entry into the 

Condition. However, the Required Actions for inoperable FCVs provide 

appropriate compensatory measures for separate inoperable FCVs. As 

such, a Note has been provided that allows separate Condition entry for 

each inoperable FCV. 

A.1

With one or two required FCVs inoperable, the assumptions of the design 

basis transient and accident analyses may not be met and the inoperable 

FCV must be returned to OPERABLE status or hydraulically locked within 

4 hours. 

Opening an FCV faster than the limit could result in a more severe flow 

runout transient, resulting in violation of the Safety Limit MCPR. Closing 

an FCV faster than the limit assumed in the LOCA analysis (Refs. 1 

and 2) could affect the recirculation flow coastdown, resulting in higher 

peak clad temperatures. Therefore, if an FCV is inoperable due to stroke 

times faster than the limits, deactivating the valve will essentially lock the 

valve in position, which will prohibit the FCV from adversely affecting the 

DBA and transient analyses. Continued operation is allowed in this 

Condition. 

The 4 hour Completion Time is a reasonable time period to complete the 

Required Action, while limiting the time of operation with an inoperable 

FCV. 

B.1

If the FCVs are not deactivated ("locked up") within the associated 

Completion Time, the unit must be brought to a MODE in which the LCO 

does not apply. To achieve this status, the unit must be brought to at 

least MODE 3 within 12 hours. This brings the unit to a condition where 

the flow coastdown characteristics of the recirculation loop are not 

important. The allowed Completion Time of 12 hours is reasonable, 

based on operating experience, to reach MODE 3 from full power 

conditions in an orderly manner and without challenging unit systems. 
FCVs 

B 3.4.2 

BWR/6 STS B 3.4.2-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.2.1

REQUIREMENTS 

Hydraulic power unit pilot operated isolation valves located between the 

servo valves and the common "open" and "close" lines are required to 

close in the event of a loss of hydraulic pressure. When closed, these 

valves inhibit FCV motion by blocking hydraulic pressure from the servo 

valve to the common open and close lines as well as to the alternate 

subloop. This Surveillance verifies FCV lockup on a loss of hydraulic 

pressure. 

The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the SR when performed at the [18] month 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint. 

SR 3.4.2.2

This SR ensures the overall average rate of FCV movement at all 

positions is maintained within the analyzed limits. 

The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the SR when performed at the [18] month 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint. 

REFERENCES 1. FSAR, Section [15.3.2]. 

 2. FSAR, Section [15.4.5]. 

 [ 3. Plant specific Safety Evaluation Report. ] 
Jet Pumps 

B 3.4.3 

BWR/6 STS B 3.4.3-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.3 Jet Pumps 

BASES 

BACKGROUND The Reactor Coolant Recirculation System is described in the 

Background section of the Bases for LCO 3.4.1, "Recirculation Loops 

Operating," which discusses the operating characteristics of the system 

and how these characteristics affect the Design Basis Accident (DBA) 

analyses. 

The jet pumps are part of the Reactor Coolant Recirculation System and 

are designed to provide forced circulation through the core to remove 

heat from the fuel. The jet pumps are located in the annular region 

between the core shroud and the vessel inner wall. Because the jet 

pump suction elevation is at two thirds core height, the vessel can be 

reflooded and coolant level maintained at two thirds core height even with 

the complete break of the recirculation loop pipe that is located below the 

jet pump suction elevation. 

Each reactor coolant recirculation loop contains 12 jet pumps. 

Recirculated coolant passes down the annulus between the reactor 

vessel wall and the core shroud. A portion of the coolant flows from the 

vessel, through the two external recirculation loops, and becomes the 

driving flow for the jet pumps. Each of the two external recirculation loops 

discharges high pressure flow into an external manifold from which 

individual recirculation inlet lines are routed to the jet pump risers within 

the reactor vessel. The remaining portion of the coolant mixture in the 

annulus becomes the suction flow for the jet pumps. This flow enters the 

jet pump at suction inlets and is accelerated by the drive flow. The drive 

flow and suction flow are mixed in the jet pump throat section. The total 

flow then passes through the jet pump diffuser section into the area below 

the core (lower plenum), gaining sufficient head in the process to drive 

the required flow upward through the core. 

APPLICABLE Jet pump OPERABILITY is an explicit assumption in the design basis loss 

SAFETY of coolant accident (LOCA) analysis evaluated in Reference 1. 

ANALYSES 

The capability of reflooding the core to two-thirds core height is 

dependent upon the structural integrity of the jet pumps. If the structural 

system, including the beam holding a jet pump in place, fails, jet pump 

displacement and performance degradation could occur, resulting in an 

increased flow area through the jet pump and a lower core flooding 

elevation. This could adversely affect the water level in the core during 

the reflood phase of a LOCA as well as the assumed blowdown flow 

during a LOCA. 

Jet pumps satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
Jet Pumps 

B 3.4.3 

BWR/6 STS B 3.4.3-2 Rev. 3.0, 03/31/04 

BASES 

LCO The structural failure of any of the jet pumps could cause significant 

degradation in the ability of the jet pumps to allow reflooding to two thirds 

core height during a LOCA. OPERABILITY of all jet pumps is required to 

ensure that operation of the Reactor Coolant Recirculation System will be 

consistent with the assumptions used in the licensing basis analysis 

(Ref. 1). 

APPLICABILITY In MODES 1 and 2, the jet pumps are required to be OPERABLE since 

there is a large amount of energy in the reactor core and since the limiting 

DBAs are assumed to occur in these MODES. This is consistent with the 

requirements for operation of the Reactor Coolant Recirculation System 

(LCO 3.4.1). 

In MODES 3, 4, and 5, the Reactor Coolant Recirculation System is not 

required to be in operation, and when not in operation sufficient flow is not 

available to evaluate jet pump OPERABILITY. 

ACTIONS A.1

An inoperable jet pump can increase the blowdown area and reduce the 

capability of reflooding during a design basis LOCA. If one or more of the 

jet pumps are inoperable, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to MODE 3 within 12 hours. The allowed Completion Time of 

12 hours is reasonable, based on operating experience, to reach MODE 3 

from full power conditions in an orderly manner and without challenging 

plant systems. 

SURVEILLANCE SR 3.4.3.1

REQUIREMENTS 

This SR is designed to detect significant degradation in jet pump 

performance that precedes jet pump failure (Ref. 2). This SR is required 

to be performed only when the loop has forced recirculation flow since 

surveillance checks and measurements can only be performed during jet 

pump operation. The jet pump failure of concern is a complete mixer 

displacement due to jet pump beam failure. Jet pump plugging is also of 

concern since it adds flow resistance to the recirculation loop. Significant 

degradation is indicated if the specified criteria confirm unacceptable 

deviations from established patterns or relationships. The allowable 

deviations from the established patterns have been developed based on 

the variations experienced at plants during normal operation and with jet 

pump assembly failures (Refs. 2 and 3). Since refueling activities (fuel 

assembly replacement or shuffle, as well as any modifications to fuel 

support orifice size or core plate bypass flow) can affect the relationship 

between core flow, jet pump flow, and recirculation loop flow, these 
Jet Pumps 

B 3.4.3 

BWR/6 STS B 3.4.3-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

relationships may need to be re-established each cycle. Similarly, initial 

entry into extended single loop operation may also require establishment 

of these relationships. During the initial weeks of operation under such 

conditions, while baselining new "established patterns", engineering 

judgement of the daily surveillance results is used to detect significant 

abnormalities which could indicate a jet pump failure. 

The recirculation flow control valve (FCV) operating characteristics (loop 

flow versus FCV position) are determined by the flow resistance from the 

loop suction through the jet pump nozzles. A change in the relationship 

indicates a flow restriction, loss in pump hydraulic performance, leak, or 

new flow path between the recirculation pump discharge and jet pump 

nozzle. For this criterion, the loop flow versus FCV position relationship 

must be verified. 

Total core flow can be determined from measurements of the recirculation 

loop drive flows. Once this relationship has been established, increased 

or reduced total core flow for the same recirculation loop drive flow may 

be an indication of failures in one or several jet pumps. 

Individual jet pumps in a recirculation loop typically do not have the same 

flow. The unequal flow is due to the drive flow manifold, which does not 

distribute flow equally to all risers. The flow (or jet pump diffuser to lower 

plenum differential pressure) pattern or relationship of one jet pump to the 

loop average is repeatable. An appreciable change in this relationship is 

an indication that increased (or reduced) resistance has occurred in one 

of the jet pumps. This may be indicated by an increase in the relative 

flow for a jet pump that has experienced beam cracks. 

The deviations from normal are considered indicative of a potential 

problem in the recirculation drive flow or jet pump system (Ref. 2). 

Normal flow ranges and established jet pump flow and differential 

pressure patterns are established by plotting historical data as discussed 

in Reference 2. 

The 24 hour Frequency has been shown by operating experience to be 

adequate to verify jet pump OPERABILITY and is consistent with the 

Frequency for recirculation loop OPERABILITY verification. 

This SR is modified by two Notes. Note 1 allows this Surveillance not to 

be performed until 4 hours after the associated recirculation loop is in 

operation, since these checks can only be performed during jet pump 

operation. The 4 hours is an acceptable time to establish conditions 

appropriate for data collection and evaluation. 
Jet Pumps 

B 3.4.3 

BWR/6 STS B 3.4.3-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Note 2 allows this SR not to be performed when THERMAL POWER is 

≤ 25% RTP. During low flow conditions, jet pump noise approaches the 

threshold response of the associated flow instrumentation and precludes 

the collection of repeatable and meaningful data. 

REFERENCES 1. FSAR, Section [6.3]. 

 2. GE Service Information Letter No. 330, June 9, 1990. 

 3. NUREG/CR-3052, November 1984. 
S/RVs 

B 3.4.4 

BWR/6 STS B 3.4.4-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.4 Safety/Relief Valves (S/RVs) 

BASES 

BACKGROUND The American Society of Mechanical Engineers (ASME) Boiler and 

Pressure Vessel Code (Ref. 1) requires the Reactor Pressure Vessel be 

protected from overpressure during upset conditions by self actuated 

safety valves. As part of the nuclear pressure relief system, the size and 

number of safety/relief valves (S/RVs) are selected such that peak 

pressure in the nuclear system will not exceed the ASME Code limits for 

the reactor coolant pressure boundary (RCPB). 

The S/RVs are located on the main steam lines between the reactor 

vessel and the first isolation valve within the drywell. Each S/RV 

discharges steam through a discharge line to a point below the minimum 

water level in the suppression pool. 

The S/RVs can actuate by either of two modes: the safety mode or the 

relief mode. In the safety mode (or spring mode of operation), the direct 

action of the steam pressure in the main steam lines will act against a 

spring loaded disk that will pop open when the valve inlet pressure 

exceeds the spring force. In the relief mode (or power actuated mode of 

operation), a pneumatic piston or cylinder and mechanical linkage 

assembly are used to open the valve by overcoming the spring force, 

even with the valve inlet pressure equal to 0 psig. The pneumatic 

operator is arranged so that its malfunction will not prevent the valve disk 

from lifting if steam inlet pressure reaches the spring lift set pressures. In 

the relief mode, valves may be opened manually or automatically at the 

selected preset pressure. Six of the S/RVs providing the relief function 

also provide the low-low set relief function specified in LCO 3.6.1.6, "LowLow Set (LLS) Valves." Eight of the S/RVs that provide the relief function 

are part of the Automatic Depressurization System specified in 

LCO 3.5.1, "ECCS - Operating." The instrumentation associated with the 

relief valve function and low-low set relief function is discussed in the 

Bases for LCO 3.3.6.5, "Relief and Low-Low Set (LLS) Instrumentation," 

and instrumentation for the ADS function is discussed in LCO 3.3.5.1, 

"Emergency Core Cooling Systems (ECCS) Instrumentation." 

APPLICABLE The overpressure protection system must accommodate the most severe 

SAFETY pressure transient. Evaluations have determined that the most severe 

ANALYSES transient is the closure of all main steam isolation valves (MSIVs) 

followed by reactor scram on high neutron flux (i.e., failure of the direct 

scram associated with MSIV position) (Ref. 2). For the purpose of the 
S/RVs 

B 3.4.4 

BWR/6 STS B 3.4.4-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

analyses, [six] of the S/RVs are assumed to operate in the relief mode, 

and seven in the safety mode. The analysis results demonstrate that the 

design S/RV capacity is capable of maintaining reactor pressure below 

the ASME Code limit of 110% of vessel design pressure (110% x 

1250 psig = 1375 psig). This LCO helps to ensure that the acceptance 

limit of 1375 psig is met during the design basis event. 

From an overpressure standpoint, the design basis events are bounded 

by the MSIV closure with flux scram event described above. Reference 3 

discusses additional events that are expected to actuate the S/RVs. 

S/RVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The safety function of seven S/RVs is required to be OPERABLE in the 

safety mode, and an additional seven S/RVs (other than the seven S/RVs 

that satisfy the safety function) must be OPERABLE in the relief mode. 

The requirements of this LCO are applicable only to the capability of the 

S/RVs to mechanically open to relieve excess pressure. In Reference 2, 

an evaluation was performed to establish the parametric relationship 

between the peak vessel pressure and the number of OPERABLE S/RVs. 

The results show that with a minimum of seven S/RVs in the safety mode 

and six S/RVs in the relief mode OPERABLE, the ASME Code limit of 

1375 psig is not exceeded. 

The S/RV setpoints are established to ensure the ASME Code limit on 

peak reactor pressure is satisfied. The ASME Code specifications require 

the lowest safety valve be set at or below vessel design pressure 

(1250 psig) and the highest safety valve be set so the total accumulated 

pressure does not exceed 110% of the design pressure for conditions. 

The transient evaluations in Reference 3 are based on these setpoints, 

but also include the additional uncertainties of ± 1% of the nominal 

setpoint to account for potential setpoint drift to provide an added degree 

of conservatism. 

Operation with fewer valves OPERABLE than specified, or with setpoints 

outside the ASME limits, could result in a more severe reactor response 

to a transient than predicted, possibly resulting in the ASME Code limit on 

reactor pressure being exceeded. 
S/RVs 

B 3.4.4 

BWR/6 STS B 3.4.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1, 2, and 3, the specified number of S/RVs must be 

OPERABLE since there may be considerable energy in the reactor core 

and the limiting design basis transients are assumed to occur. The 

S/RVs may be required to provide pressure relief to discharge energy 

from the core until such time that the Residual Heat Removal (RHR) 

System is capable of dissipating the heat. 

In MODE 4, decay heat is low enough for the RHR System to provide 

adequate cooling, and reactor pressure is low enough that the 

overpressure limit is unlikely to be approached by assumed operational 

transients or accidents. In MODE 5, the reactor vessel head is unbolted 

or removed and the reactor is at atmospheric pressure. The S/RV 

function is not needed during these conditions. 

ACTIONS A.1

With the safety function of one [required] S/RV inoperable, the remaining 

OPERABLE S/RVs are capable of providing the necessary overpressure 

protection. Because of additional design margin, the ASME Code limits 

for the RCPB can also be satisfied with two S/RVs inoperable. However, 

the overall reliability of the pressure relief system is reduced because 

additional failures in the remaining OPERABLE S/RVs could result in 

failure to adequately relieve pressure during a limiting event. For this 

reason, continued operation is permitted for a limited time only. 

The 14 day Completion Time to restore the inoperable required S/RVs to 

OPERABLE status is based on the relief capability of the remaining 

S/RVs, the low probability of an event requiring S/RV actuation, and a 

reasonable time to complete the Required Action. 

B.1 and B.2

With less than the minimum number of required S/RVs OPERABLE, a 

transient may result in the violation of the ASME Code limit on reactor 

pressure. [If the inoperable required S/RV cannot be restored to 

OPERABLE status within the associated Completion Time of Required 

Action A.1] or if [two] or more [required] S/RVs are inoperable, the plant 

must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

12 hours and to MODE 4 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required 

plant conditions from full power conditions in an orderly manner and 

without challenging plant systems. 
S/RVs 

B 3.4.4 

BWR/6 STS B 3.4.4-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.4.1

REQUIREMENTS 

This Surveillance demonstrates that the [required] S/RVs will open at the 

pressures assumed in the safety analysis of Reference 2. The 

demonstration of the S/RV safety function lift settings must be performed 

during shutdown, since this is a bench test[, and in accordance with the 

Inservice Testing Program]. The lift setting pressure shall correspond to 

ambient conditions of the valves at nominal operating temperatures and 

pressures. The S/RV setpoint is ± [3]% for OPERABILITY; however, the 

valves are reset to ± 1% during the Surveillance to allow for drift. [A Note 

is provided to allow up to [two] of the required [11] S/RVs to be physically 

replaced with S/RVs with lower setpoints. This provides operational 

flexibility which maintains the assumptions in the over-pressure analysis.] 

The [18 month] Frequency was selected because this Surveillance must 

be performed during shutdown conditions and is based on the time 

between refuelings. 

SR 3.4.4.2

The [required] relief function S/RVs are required to actuate automatically 

upon receipt of specific initiation signals. A system functional test is 

performed to verify the mechanical portions of the automatic relief 

function operate as designed when initiated either by an actual or 

simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in 

SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety 

function. 

The [18 month] Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the SR when performed at the [18 month] 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint. 

This SR is modified by a Note that excludes valve actuation. This 

prevents an RPV pressure blowdown. 
S/RVs 

B 3.4.4 

BWR/6 STS B 3.4.4-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.4.4.3

A manual actuation of each [required] S/RV is performed to verify that, 

mechanically, the valve is functioning properly and no blockage exists in 

the valve discharge line. This can be demonstrated by the response of 

the turbine control valves or bypass valves, by a change in the measured 

steam flow, or any other method suitable to verify steam flow. Adequate 

reactor steam dome pressure must be available to perform this test to 

avoid damaging the valve. Also, adequate steam flow must be passing 

through the main turbine or turbine bypass valves to continue to control 

reactor pressure when the S/RVs divert steam flow upon opening. 

Sufficient time is therefore allowed after the required pressure and flow 

are achieved to perform this test. Adequate pressure at which this test is 

to be performed is 950 psig (the pressure recommended by the valve 

manufacturer). Adequate steam flow is represented by [at least 1.25 

turbine bypass valves open, or total steam flow ≥ 106

 lb/hr]. Plant startup 

is allowed prior to performing this test because valve OPERABILITY and 

the setpoints for overpressure protection are verified, per ASME 

requirements, prior to valve installation. Therefore, this SR is modified by 

a Note that states the Surveillance is not required to be performed until 

12 hours after reactor steam pressure and flow are adequate to perform 

the test. The 12 hours allowed for manual actuation after the required 

pressure is reached is sufficient to achieve stable conditions for testing 

and provides a reasonable time to complete the SR. If the valve fails to 

actuate due only to the failure of the solenoid but is capable of opening on 

overpressure, the safety function of the S/RV is considered OPERABLE. 

The [18] month on a STAGGERED TEST BASIS Frequency ensures that 

each solenoid for each S/RV is alternately tested. The 18 month 

Frequency was developed based on the S/RV tests required by the 

ASME Boiler and Pressure Vessel Code, Section XI (Ref. 1). Operating 

experience has shown that these components usually pass the 

Surveillance when performed at the 18 month Frequency. Therefore, the 

Frequency was concluded to be acceptable from a reliability standpoint. 

REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section III. 

 2. FSAR, Section [5.2.5.5.3]. 

 3. FSAR, Section [15]. 
RCS Operational LEAKAGE 

B 3.4.5 

BWR/6 STS B 3.4.5-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.5 RCS Operational LEAKAGE 

BASES 

BACKGROUND The RCS includes systems and components that contain or transport the 

coolant to or from the reactor core. The pressure containing components 

of the RCS and the portions of connecting systems out to and including 

the isolation valves define the reactor coolant pressure boundary (RCPB). 

The joints of the RCPB components are welded or bolted. 

During plant life, the joint and valve interfaces can produce varying 

amounts of reactor coolant LEAKAGE, through either normal operational 

wear or mechanical deterioration. Limits on RCS operational LEAKAGE 

are required to ensure appropriate action is taken before the integrity of 

the RCPB is impaired. This LCO specifies the types and limits of 

LEAKAGE. 

This protects the RCS pressure boundary described in 10 CFR 50.2, 

10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, 

and 3). 

The safety significance of leaks from the RCPB varies widely depending 

on the source, rate, and duration. Therefore, detection of LEAKAGE in 

the drywell is necessary. Methods for quickly separating the identified 

LEAKAGE from the unidentified LEAKAGE are necessary to provide the 

operators quantitative information to permit them to take corrective action 

should a leak occur detrimental to the safety of the facility or the public. 

A limited amount of leakage inside the drywell is expected from auxiliary 

systems that cannot be made 100% leaktight. Leakage from these 

systems should be detected and isolated from the drywell atmosphere, if 

possible, so as not to mask RCS operational LEAKAGE detection. 

This LCO deals with protection of the RCPB from degradation and the 

core from inadequate cooling, in addition to preventing the accident 

analyses radiation release assumptions from being exceeded. The 

consequences of violating this LCO include the possibility of a loss of 

coolant accident. 
RCS Operational LEAKAGE 

B 3.4.5 

BWR/6 STS B 3.4.5-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The allowable RCS operational LEAKAGE limits are based on the 

SAFETY predicted and experimentally observed behavior of pipe cracks. The 

ANALYSES normally expected background LEAKAGE due to equipment design and 

the detection capability of the instrumentation for determining system 

LEAKAGE were also considered. The evidence from experiments 

suggests, for LEAKAGE even greater than the specified unidentified 

LEAKAGE limits, the probability is small that the imperfection or crack 

associated with such LEAKAGE would grow rapidly. 

The unidentified LEAKAGE flow limit allows time for corrective action 

before the RCPB could be significantly compromised. The 5 gpm limit is 

a small fraction of the calculated flow from a critical crack in the primary 

system piping. Crack behavior from experimental programs (Refs. 4 

and 5) shows leak rates of hundreds of gallons per minute will precede 

crack instability (Ref. 6). 

The low limit on increase in unidentified LEAKAGE assumes a failure 

mechanism of intergranular stress corrosion cracking (IGSCC) that 

produces tight cracks. This flow increase limit is capable of providing an 

early warning of such deterioration. 

No applicable safety analysis assumes the total LEAKAGE limit. The 

total LEAKAGE limit considers RCS inventory makeup capability and 

drywell floor sump capacity. 

RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO RCS operational LEAKAGE shall be limited to: 

a. Pressure Boundary LEAKAGE

No pressure boundary LEAKAGE is allowed, being indicative of 

material degradation. LEAKAGE of this type is unacceptable as the 

leak itself could cause further deterioration, resulting in higher 

LEAKAGE. Violation of this LCO could result in continued 

degradation of the RCPB. LEAKAGE past seals and gaskets is not 

pressure boundary LEAKAGE. 

b. Unidentified LEAKAGE

Five gpm of unidentified LEAKAGE is allowed as a reasonable 

minimum detectable amount that the drywell air monitoring, drywell 

sump level monitoring, and drywell air cooler condensate flow rate 

monitoring equipment can detect within a reasonable time period. 

Violation of this LCO could result in continued degradation of the 

RCPB. 
RCS Operational LEAKAGE 

B 3.4.5 

BWR/6 STS B 3.4.5-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

c. Total LEAKAGE

The total LEAKAGE limit is based on a reasonable minimum 

detectable amount. The limit also accounts for LEAKAGE from 

known sources (identified LEAKAGE). Violation of this LCO indicates 

an unexpected amount of LEAKAGE and, therefore, could indicate 

new or additional degradation in an RCPB component or system. 

d. Unidentified LEAKAGE Increase

An unidentified LEAKAGE increase of > 2 gpm within the previous 

4 hour period indicates a potential flaw in the RCPB and must be 

quickly evaluated to determine the source and extent of the 

LEAKAGE. The increase is measured relative to the steady state 

value; temporary changes in LEAKAGE rate as a result of transient 

conditions (e.g., startup) are not considered. As such, the 2 gpm 

increase limit is only applicable in MODE 1 when operating pressures 

and temperatures are established. Violation of this LCO could result 

in continued degradation of the RCPB. 

APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCO applies 

because the potential for RCPB LEAKAGE is greatest when the reactor is 

pressurized. 

In MODES 4 and 5, RCS operational LEAKAGE limits are not required 

since the reactor is not pressurized and stresses in the RCPB materials 

and potential for LEAKAGE are reduced. 

ACTIONS A.1

With RCS unidentified or total LEAKAGE greater than the limits, actions 

must be taken to reduce the leak. Because the LEAKAGE limits are 

conservatively below the LEAKAGE that would constitute a critical crack 

size, 4 hours is allowed to reduce the LEAKAGE rates before the reactor 

must be shut down. If an unidentified LEAKAGE has been identified and 

quantified, it may be reclassified and considered as identified LEAKAGE. 

However, the total LEAKAGE limit would remain unchanged. 
RCS Operational LEAKAGE 

B 3.4.5 

BWR/6 STS B 3.4.5-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

An unidentified LEAKAGE increase of > 2 gpm within a 4 hour period is 

an indication of a potential flaw in the RCPB and must be quickly 

evaluated. Although the increase does not necessarily violate the 

absolute unidentified LEAKAGE limit, certain susceptible components 

must be determined not to be the source of the LEAKAGE increase within 

the required Completion Time. For an unidentified LEAKAGE increase 

greater than required limits, an alternative to reducing LEAKAGE increase 

to within limits (i.e., reducing the leakage rate such that the current rate is 

less than the "2 gpm increase in the previous [4] hours" limit; either by 

isolating the source or other possible methods) is to evaluate RCS 

type 304 and type 316 austenitic stainless steel piping that is subject to 

high stress or that contains relatively stagnant or intermittent flow fluids 

and determine it is not the source of the increased LEAKAGE. This type 

of piping is very susceptible to IGSCC. 

The 4 hour Completion Time is needed to properly reduce the LEAKAGE 

increase or verify the source before the reactor must be shut down. 

C.1 and C.2

If any Required Action and associated Completion Time of Condition A 

or B is not met or if pressure boundary LEAKAGE exists, the plant must 

be brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to MODE 3 within 12 hours and to 

MODE 4 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required plant conditions 

from full power conditions in an orderly manner and without challenging 

plant systems. 

SURVEILLANCE SR 3.4.5.1

REQUIREMENTS 

The RCS LEAKAGE is monitored by a variety of instruments designed to 

provide alarms when LEAKAGE is indicated and to quantify the various 

types of LEAKAGE. Leakage detection instrumentation is discussed in 

more detail in the Bases for LCO 3.4.7, "RCS Leakage Detection 

Instrumentation." Sump level and flow rate are typically monitored to 

determine actual LEAKAGE rates. However, any method may be used to 

quantify LEAKAGE within the guidelines of Reference 7. In conjunction 

with alarms and other administrative controls, an 8 hour Frequency for 

this Surveillance is appropriate for identifying changes in LEAKAGE and 

for tracking required trends (Ref. 8). 
RCS Operational LEAKAGE 

B 3.4.5 

BWR/6 STS B 3.4.5-5 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 50.2. 

 2. 10 CFR 50.55a(c). 

 3. 10 CFR 50, Appendix A, GDC 55. 

 4. GEAP-5620, April 1968. 

 5. NUREG-76/067, October 1975. 

 6. FSAR, Section [5.2.5.5.3]. 

 7. Regulatory Guide 1.45. 

 8. Generic Letter 88-01, Supplement 1. 
RCS PIV Leakage 

B 3.4.6 

BWR/6 STS B 3.4.6-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.6 RCS Pressure Isolation Valve (PIV) Leakage 

BASES 

BACKGROUND RCS PIVs are defined as any two normally closed valves in series within 

the reactor coolant pressure boundary (RCPB). The function of RCS 

PIVs is to separate the high pressure RCS from an attached low pressure 

system. This protects the RCS pressure boundary described in 

10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A 

(Refs. 1, 2, and 3). PIVs are designed to meet the requirements of 

Reference 4. During their lives, these valves can produce varying 

amounts of reactor coolant leakage through either normal operational 

wear or mechanical deterioration. 

The RCS PIV LCO allows RCS high pressure operation when leakage 

through these valves exists in amounts that do not compromise safety. 

The PIV leakage limit applies to each individual valve. Leakage through 

these valves is not included in any allowable LEAKAGE specified in 

LCO 3.4.5, "RCS Operational LEAKAGE." 

Although this specification provides a limit on allowable PIV leakage rate, 

its main purpose is to prevent overpressure failure of the low pressure 

portions of connecting systems. The leakage limit is an indication that the 

PIVs between the RCS and the connecting systems are degraded or 

degrading. PIV leakage could lead to overpressure of the low pressure 

piping or components. Failure consequences could be a loss of coolant 

accident (LOCA) outside of containment, an unanalyzed accident which 

could degrade the ability for low pressure injection. 

A study (Ref. 5) evaluated various PIV configurations to determine the 

probability of intersystem LOCAs. This study concluded that periodic 

leakage testing of the PIVs can substantially reduce intersystem LOCA 

probability. 

PIVs are provided to isolate the RCS from the following typically 

connected systems: 

a. Residual Heat Removal (RHR) System, 

b. Low Pressure Core Spray System, 

c. High Pressure Core Spray System, and 

d. Reactor Core Isolation Cooling System. 

The PIVs are listed in Reference 6. 
RCS PIV Leakage 

B 3.4.6 

BWR/6 STS B 3.4.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE Reference 5 evaluated various PIV configurations, leakage testing of the 

SAFETY valves, and operational changes to determine the effect on the 

ANALYSES probability of intersystem LOCAs. This study concluded that periodic 

leakage testing of the PIVs can substantially reduce the probability of an 

intersystem LOCA. 

PIV leakage is not considered in any Design Basis Accident analyses. 

This Specification provides for monitoring the condition of the RCPB to 

detect PIV degradation that has the potential to cause a LOCA outside of 

containment. RCS PIV leakage satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO RCS PIV leakage is leakage into closed systems connected to the RCS. 

Isolation valve leakage is usually on the order of drops per minute. 

Leakage that increases significantly suggests that something is 

operationally wrong and corrective action must be taken. Violation of this 

LCO could result in continued degradation of a PIV, which could lead to 

overpressurization of a low pressure system and the loss of the integrity 

of a fission product barrier. 

The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with 

a maximum limit of 5 gpm (Ref. 4). 

Reference 7 permits leakage testing at a lower pressure differential than 

between the specified maximum RCS pressure and the normal pressure 

of the connected system during RCS operation (the maximum pressure 

differential). The observed rate may be adjusted to the maximum 

pressure differential by assuming leakage is directly proportional to the 

pressure differential to the one-half power. 

APPLICABILITY In MODES 1, 2, and 3, this LCO applies because the PIV leakage 

potential is greatest when the RCS is pressurized. In MODE 3, valves in 

the RHR flowpath are not required to meet the requirements of this LCO 

when in, or during transition to or from, the RHR shutdown cooling mode 

of operation. 

In MODES 4 and 5, leakage limits are not provided because the lower 

reactor coolant pressure results in a reduced potential for leakage and for 

a LOCA outside the containment. Accordingly, the potential for the 

consequences of reactor coolant leakage is far lower during these 

MODES. 
RCS PIV Leakage 

B 3.4.6 

BWR/6 STS B 3.4.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS The ACTIONS are modified by two Notes. Note 1 has been provided to 

modify the ACTIONS related to RCS PIV flow paths. Section 1.3, 

Completion Times, specifies once a Condition has been entered, 

subsequent divisions, subsystems, components or variables expressed in 

the Condition, discovered to be inoperable or not within limits, will not 

result in separate entry into the Condition. Section 1.3 also specifies 

Required Actions of the Condition continue to apply for each additional 

failure, with Completion Times based on initial entry into the Condition. 

However, the Required Actions for the Condition of RCS PIV leakage 

limits exceeded provide appropriate compensatory measures for separate 

affected RCS PIV flow paths. As such, a Note has been provided that 

allows separate Condition entry for each affected RCS PIV flow path. 

Note 2 requires an evaluation of affected systems if a PIV is inoperable. 

The leakage may have affected system OPERABILITY, or isolation of a 

leaking flow path with an alternate valve may have degraded the ability of 

the interconnected system to perform its safety function. As a result, the 

applicable Conditions and Required Actions for systems made inoperable 

by PIVs must be entered. This ensures appropriate remedial actions are 

taken, if necessary, for the affected systems. 

A.1 and A.2

If leakage from one or more RCS PIVs is not within limit, the flow path 

must be isolated by at least one closed manual, deactivated, automatic, 

or check valve within 4 hours. Required Action A.1 and Required 

Action A.2 are modified by a Note stating that the valves used for isolation 

must meet the same leakage requirements as the PIVs and must be on 

the RCPB [or the high pressure portion of the system.] 

Four hours provides time to reduce leakage in excess of the allowable 

limit and to isolate the flow path if leakage cannot be reduced while 

corrective actions to reseat the leaking PIVs are taken. The 4 hours 

allows time for these actions and restricts the time of operation with 

leaking valves. 

Required Action A.2 specifies that the double isolation barrier of two 

valves be restored by closing another valve qualified for isolation or 

restoring one leaking PIV. The 72 hour Completion Time after exceeding 

the limit considers the time required to complete the Required Action, the 

low probability of a second valve failing during this time period, and the 

low probability of a pressure boundary rupture of the low pressure ECCS 

piping when overpressurized to reactor pressure (Ref. 7). 
RCS PIV Leakage 

B 3.4.6 

BWR/6 STS B 3.4.6-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

If leakage cannot be reduced or the system isolated, the plant must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to MODE 3 within 12 hours and to 

MODE 4 within 36 hours. This action may reduce the leakage and also 

reduces the potential for a LOCA outside the containment. The 

Completion Times are reasonable, based on operating experience, to 

achieve the required plant conditions from full power conditions in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.4.6.1

REQUIREMENTS 

Performance of leakage testing on each RCS PIV is required to verify that 

leakage is below the specified limit and to identify each leaking valve. 

The leakage limit of 0.5 gpm per inch of nominal valve diameter up to 

5 gpm maximum applies to each valve. Leakage testing requires a stable 

pressure condition. For the two PIVs in series, the leakage requirement 

applies to each valve individually and not to the combined leakage across 

both valves. If the PIVs are not individually leakage tested, one valve 

may have failed completely and not be detected if the other valve in 

series meets the leakage requirement. In this situation, the protection 

provided by redundant valves would be lost. 

The 18 month Frequency required by the Inservice Testing Program is 

within the ASME Code, Section XI, Frequency requirement and is based 

on the need to perform this Surveillance under the conditions that apply 

during an outage and the potential for an unplanned transient if the 

Surveillance were performed with the reactor at power. 

Therefore, this SR is modified by a Note that states the leakage 

Surveillance is not required to be performed in MODE 3. Entry into 

MODE 3 is permitted for leakage testing at high differential pressures with 

stable conditions not possible in the lower MODES. 

REFERENCES 1. 10 CFR 50.2. 

 2. 10 CFR 50.55a(c). 

 3. 10 CFR 50, Appendix A, GDC 55. 

 4. ASME, Boiler and Pressure Vessel Code, Section XI. 
RCS PIV Leakage 

B 3.4.6 

BWR/6 STS B 3.4.6-5 Rev. 3.0, 03/31/04 

BASES 

REFERENCES (continued) 

 5. NUREG-0677, May 1980. 

 6. FSAR, Section [ ]. 

 7. NEDC-31339, November 1986. 
RCS Leakage Detection Instrumentation 

B 3.4.7 

BWR/6 STS B 3.4.7-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.7 RCS Leakage Detection Instrumentation 

BASES 

BACKGROUND GDC 30 of 10 CFR 50, Appendix A (Ref. 1), requires means for detecting 

and, to the extent practical, identifying the location of the source of RCS 

LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable 

methods for selecting leakage detection systems. 

Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) 

are required so that appropriate action can be taken before the integrity of 

the RCPB is impaired (Ref. 2). Leakage detection systems for the RCS 

are provided to alert the operators when leakage rates above normal 

background levels are detected and also to supply quantitative 

measurement of rates. The Bases for LCO 3.4.5, "RCS Operational 

LEAKAGE," discuss the limits on RCS LEAKAGE rates. 

Systems for separating the LEAKAGE of an identified source from an 

unidentified source are necessary to provide prompt and quantitative 

information to the operators to permit them to take immediate corrective 

action. 

LEAKAGE from the RCPB inside the drywell is detected by at least one of 

two or three independently monitored variables, such as sump level 

changes and drywell gaseous and particulate radioactivity levels. The 

primary means of quantifying LEAKAGE in the drywell is the drywell floor 

drain sump monitoring system. 

The drywell floor drain sump monitoring system monitors the LEAKAGE 

collected in the floor drain sump. This unidentified LEAKAGE consists of 

LEAKAGE from control rod drives, valve flanges or packings, floor drains, 

the Closed Cooling Water System, and drywell air cooling unit 

condensate drains, and any LEAKAGE not collected in the drywell 

equipment drain sump. The drywell floor drain sump has transmitters that 

supply level indications in the main control room. 

The floor drain sump level indicators have switches that start and stop the 

sump pumps when required. A timer starts each time the sump is 

pumped down to the low level setpoint. If the sump fills to the high level 

setpoint before the timer ends, an alarm sounds in the control room, 

indicating a LEAKAGE rate into the sump in excess of a preset limit. A 

second timer starts when the sump pumps start on high level. Should this 

timer run out before the sump level reaches the low level setpoint, an 

alarm is sounded in the control room indicating a LEAKAGE rate into the 

sump in excess of a preset limit. A flow indicator in the discharge line of 

the drywell floor drain sump pumps provides flow indication in the control 

room. 
RCS Leakage Detection Instrumentation 

B 3.4.7 

BWR/6 STS B 3.4.7-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The drywell air monitoring systems continuously monitor the drywell 

atmosphere for airborne particulate and gaseous radioactivity. A sudden 

increase of radioactivity, which may be attributed to RCPB steam or 

reactor water LEAKAGE, is annunciated in the control room. The drywell 

atmosphere particulate and gaseous radioactivity monitoring systems are 

not capable of quantifying leakage rates, but are sensitive enough to 

indicate increased LEAKAGE rates of 1 gpm within 1 hour. Larger 

changes in LEAKAGE rates are detected in proportionally shorter times 

(Ref. 3). 

[ Condensate from four of the six drywell coolers is routed to the drywell 

floor drain sump and is monitored by a flow transmitter that provides 

indication and alarms in the control room. This drywell air cooler 

condensate flow rate monitoring system serves as an added indicator, but 

not quantifier, of RCS unidentified LEAKAGE. ] 

APPLICABLE A threat of significant compromise to the RCPB exists if the barrier 

SAFETY contains a crack that is large enough to propagate rapidly. LEAKAGE 

ANALYSES rate limits are set low enough to detect the LEAKAGE emitted from a 

single crack in the RCPB (Refs. 4 and 5). Each of the leakage detection 

systems inside the drywell is designed with the capability of detecting 

LEAKAGE less than the established LEAKAGE rate limits and providing 

appropriate alarm of excess LEAKAGE in the control room. 

A control room alarm allows the operators to evaluate the significance of 

the indicated LEAKAGE and, if necessary, shut down the reactor for 

further investigation and corrective action. The allowed LEAKAGE rates 

are well below the rates predicted for critical crack sizes (Ref. 6). 

Therefore, these actions provide adequate response before a significant 

break in the RCPB can occur. 

RCS leakage detection instrumentation satisfies Criterion 1 of 

10 CFR 50.36(c)(2)(ii). 

LCO The drywell floor drain sump monitoring system is required to quantify the 

unidentified LEAKAGE from the RCS. Thus, for the system to be 

considered OPERABLE, either the flow monitoring or the sump level 

monitoring portion of the system must be OPERABLE. The other 

monitoring systems provide early alarms to the operators so closer 

examination of other detection systems will be made to determine the 

extent of any corrective action that may be required. With the leakage 

detection systems inoperable, monitoring for LEAKAGE in the RCPB is 

degraded. 
RCS Leakage Detection Instrumentation 

B 3.4.7 

BWR/6 STS B 3.4.7-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1, 2, and 3, leakage detection systems are required to be 

OPERABLE to support LCO 3.4.5. This Applicability is consistent with 

that for LCO 3.4.5. 

ACTIONS A.1

With the drywell floor drain sump monitoring system inoperable, no other 

form of sampling can provide the equivalent information to quantify 

leakage. However, the drywell atmospheric activity monitor [and the 

drywell air cooler condensate flow rate monitor] will provide indications of 

changes in leakage. 

With the drywell floor drain sump monitoring system inoperable, but with 

RCS unidentified and total LEAKAGE being determined every 8 hours 

(SR 3.4.5.1), operation may continue for 30 days. The 30 day 

Completion Time of Required Action A.1 is acceptable, based on 

operating experience, considering the multiple forms of leakage detection 

that are still available. 

B.1 and B.2

With both gaseous and particulate drywell atmospheric monitoring 

channels inoperable, grab samples of the drywell atmosphere shall be 

taken and analyzed to provide periodic leakage information. [Provided a 

sample is obtained and analyzed every 12 hours, the plant may be 

operated for up to 30 days to allow restoration of at least one of the 

required monitors.] [Provided a sample is obtained and analyzed every 

12 hours, the plant may continue operation since at least one other form 

of drywell leakage detection (i.e., air cooler condensate flow rate monitor) 

is available.] 

The 12 hour interval provides periodic information that is adequate to 

detect LEAKAGE. The 30 day Completion Time for restoration 

recognizes that at least one other form of leakage detection is available. 
RCS Leakage Detection Instrumentation 

B 3.4.7 

BWR/6 STS B 3.4.7-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ C.1

With the required drywell air cooler condensate flow rate monitoring 

system inoperable, SR 3.4.7.1 is performed every 8 hours to provide 

periodic information of activity in the drywell at a more frequent interval 

than the routine Frequency of SR 3.4.7.1. The 8 hour interval provides 

periodic information that is adequate to detect LEAKAGE and recognizes 

that other forms of leakage detection are available. However, this 

Required Action is modified by a Note that allows this action to be not 

applicable if the required drywell atmospheric monitoring system is 

inoperable. Consistent with SR 3.0.1, Surveillances are not required to 

be performed on inoperable equipment. ]

[ D.1 and D.2

With both the gaseous and particulate drywell atmospheric monitor 

channels and the drywell air cooler condensate flow rate monitor 

inoperable, the only means of detecting LEAKAGE is the drywell floor 

drain sump monitor. This Condition does not provide the required diverse 

means of leakage detection. The Required Action is to restore either of 

the inoperable monitors to OPERABLE status within 30 days to regain the 

intended leakage detection diversity. The 30 day Completion Time 

ensures that the plant will not be operated in a degraded configuration for 

a lengthy time period.] 

E.1 and E.2

If any Required Action of Condition A, B, [C, or D] cannot be met within 

the associated Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 12 hours and to MODE 4 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions in an orderly 

manner and without challenging plant systems. 

F.1

With all required monitors inoperable, no required automatic means of 

monitoring LEAKAGE are available, and immediate plant shutdown in 

accordance with LCO 3.0.3 is required. 
RCS Leakage Detection Instrumentation 

B 3.4.7 

BWR/6 STS B 3.4.7-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.7.1

REQUIREMENTS 

This SR requires the performance of a CHANNEL CHECK of the required 

drywell atmospheric monitoring system. The check gives reasonable 

confidence that the channel is operating properly. The Frequency of 

12 hours is based on instrument reliability and is reasonable for detecting 

off normal conditions. 

SR 3.4.7.2

This SR requires the performance of a CHANNEL FUNCTIONAL TEST of 

the required RCS leakage detection instrumentation. The test ensures 

that the monitors can perform their function in the desired manner. The 

test also verifies the alarm setpoint and relative accuracy of the 

instrument string. A successful test of the required contact(s) of a 

channel relay may be performed by the verification of the change of state 

of a single contact of the relay. This clarifies what is an acceptable 

CHANNEL FUNCTIONAL TEST of a relay. This is acceptable because 

all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The Frequency of 

31 days considers instrument reliability, and operating experience has 

shown it proper for detecting degradation. 

SR 3.4.7.3

This SR requires the performance of a CHANNEL CALIBRATION of the 

required RCS leakage detection instrumentation channels. The 

calibration verifies the accuracy of the instrument string, including the 

instruments located inside the drywell. The Frequency of [18] months is a 

typical refueling cycle and considers channel reliability. Operating 

experience has proven this Frequency is acceptable. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30. 

 2. Regulatory Guide 1.45, May 1973. 

 3. FSAR, Section [5.2.5.2]. 

 4. GEAP-5620, April 1968. 

 5. NUREG-75/067, October 1975. 

 6. FSAR, Section [5.2.5.5.3]. 
RCS Specific Activity 

B 3.4.8 

BWR/6 STS B 3.4.8-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.8 RCS Specific Activity 

BASES 

BACKGROUND During circulation, the reactor coolant acquires radioactive materials due 

to release of fission products from fuel leaks into the coolant and 

activation of corrosion products in the reactor coolant. These radioactive 

materials in the coolant can plate out in the RCS, and, at times, an 

accumulation will break away to spike the normal level of radioactivity. 

The release of coolant during a Design Basis Accident (DBA) could send 

radioactive materials into the environment. 

Limits on the maximum allowable level of radioactivity in the reactor 

coolant are established to ensure, in the event of a release of any 

radioactive material to the environment during a DBA, radiation doses are 

maintained within the limits of 10 CFR 100 (Ref. 1). 

This LCO contains iodine specific activity limits. The iodine isotopic 

activities per gram of reactor coolant are expressed in terms of a DOSE 

EQUIVALENT I-131. The allowable levels are intended to limit the 2 hour 

radiation dose to an individual at the site boundary to a small fraction of 

the 10 CFR 100 limit. 

APPLICABLE Analytical methods and assumptions involving radioactive material in the 

SAFETY primary coolant are presented in the FSAR (Ref. 2). The specific activity 

ANALYSES in the reactor coolant (the source term) is an initial condition for 

evaluation of the consequences of an accident due to a main steam line 

break (MSLB) outside containment. No fuel damage is postulated in the 

MSLB accident, and the release of radioactive material to the 

environment is assumed to end when the main steam isolation valves 

(MSIVs) close completely. 

This MSLB release forms the basis for determining offsite doses (Ref. 2). 

The limits on the specific activity of the primary coolant ensure that the 

2 hour thyroid and whole body doses at the site boundary, resulting from 

an MSLB outside containment during steady state operation, will not 

exceed 10% of the dose guidelines of 10 CFR 100. 

The limits on specific activity are values from a parametric evaluation of 

typical site locations. These limits are conservative because the 

evaluation considered more restrictive parameters than for a specific site, 

such as the location of the site boundary and the meteorological 

conditions of the site. 

RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
RCS Specific Activity 

B 3.4.8 

BWR/6 STS B 3.4.8-2 Rev. 3.0, 03/31/04 

BASES 

LCO The specific iodine activity is limited to ≤ [0.2] μCi/gm DOSE 

EQUIVALENT I-131. This limit ensures the source term assumed in the 

safety analysis for the MSLB is not exceeded, so any release of 

radioactivity to the environment during an MSLB is less than a small 

fraction of the 10 CFR 100 limits. 

APPLICABILITY In MODE 1, and MODES 2 and 3 with any main steam line not isolated, 

limits on the primary coolant radioactivity are applicable since there is an 

escape path for release of radioactive material from the primary coolant to 

the environment in the event of an MSLB outside of primary containment. 

In MODES 2 and 3 with the main steam lines isolated, such limits do not 

apply since an escape path does not exist. In MODES 4 and 5, no limits 

are required since the reactor is not pressurized and the potential for 

leakage is reduced. 

ACTIONS A.1 and A.2

When the reactor coolant specific activity exceeds the LCO DOSE 

EQUIVALENT I-131 limit, but is ≤ 4.0 μCi/gm, samples must be analyzed 

for DOSE EQUIVALENT I-131 at least once every 4 hours. In addition, 

the specific activity must be restored to the LCO limit within 48 hours. 

The Completion Time of once every 4 hours is based on the time needed 

to take and analyze a sample. The 48 hour Completion Time to restore 

the activity level provides a reasonable time for temporary coolant activity 

increases (iodine spikes or crud bursts) to be cleaned up with the normal 

processing systems. 

A Note permits the use of the provisions of LCO 3.0.4.c. This allowance 

permits entry into the applicable MODE(S) while relying on the ACTIONS. 

This allowance is acceptable due to the significant conservatism 

incorporated into the specific activity limit, the low probability of an event 

which is limiting due to exceeding this limit, and the ability to restore 

transient specific activity excursions while the plant remains at, or 

proceeds to power operation. 

B.1, B.2.1, B.2.2.1, and B.2.2.2

If the DOSE EQUIVALENT I-131 cannot be restored to ≤ [0.2] μCi/gm 

within 48 hours, or if at any time it is > [4.0] μCi/gm, it must be determined 

at least every 4 hours and all the main steam lines must be isolated within 

12 hours. Isolating the main steam lines precludes the possibility of 

releasing radioactive material to the environment in an amount that is 

more than a small fraction of the requirements of 10 CFR 100 during a 

postulated MSLB accident. 
RCS Specific Activity 

B 3.4.8 

BWR/6 STS B 3.4.8-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Alternately, the plant can be brought to MODE 3 within 12 hours and to 

MODE 4 within 36 hours. This option is provided for those instances 

when isolation of main steam lines is not desired (e.g., due to the decay 

heat loads). In MODE 4, the requirements of the LCO are no longer 

applicable. 

The Completion Time of once every 4 hours is the time needed to take 

and analyze a sample. The 12 hour Completion Time is reasonable, 

based on operating experience, to isolate the main steam lines in an 

orderly manner and without challenging plant systems. Also, the allowed 

Completion Times for Required Actions B.2.2.1 and B.2.2.2 for bringing 

the plant to MODES 3 and 4 are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.4.8.1

REQUIREMENTS 

This Surveillance is performed to ensure iodine remains within limit during 

normal operation. The 7 day Frequency is adequate to trend changes in 

the iodine activity level. 

This SR is modified by a Note that requires this Surveillance to be 

performed only in MODE 1 because the level of fission products 

generated in other MODES is much less. 

REFERENCES 1. 10 CFR 100.11, 1973. 

 2. FSAR, Section [15.1.40]. 
RHR Shutdown Cooling System - Hot Shutdown 

B 3.4.9 

BWR/6 STS B 3.4.9-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling System - Hot Shutdown 

BASES 

BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the 

decay of fission products and increases the temperature of the reactor 

coolant. This decay heat must be removed to reduce the temperature of 

the reactor coolant to ≤ 200°F. This decay heat removal is in preparation 

for performing refueling or maintenance operations, or for keeping the 

reactor in the Hot Shutdown condition. 

The two redundant, manually controlled shutdown cooling subsystems of 

the RHR System provide decay heat removal. Each loop consists of a 

motor driven pump, two heat exchangers in series, and associated piping 

and valves. Both loops have a common suction from the same 

recirculation loop. Each pump discharges the reactor coolant, after 

circulation through the respective heat exchanger, to the reactor via 

separate feedwater lines or to the reactor via the LPCI injection path. The 

RHR heat exchangers transfer heat to the Standby Service Water System 

(LCO 3.7.1, "[Standby Service Water (SSW)] System and [Ultimate Heat 

Sink (UHS)]"). 

APPLICABLE Decay heat removal by the RHR System in the shutdown cooling mode is 

SAFETY not required for mitigation of any event or accident evaluated in the 

ANALYSES safety analyses. Decay heat removal is, however, an important safety 

function that must be accomplished or core damage could result. The 

RHR Shutdown Cooling System satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii). 

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, 

and, when no recirculation pump is in operation, one shutdown cooling 

subsystem must be in operation. An OPERABLE RHR shutdown cooling 

subsystem consists of one OPERABLE RHR pump, two heat exchangers 

in series, and the associated piping and valves. Each shutdown cooling 

subsystem is considered OPERABLE if it can be manually aligned 

(remote or local) in the shutdown cooling mode for removal of decay heat. 

In MODE 3, one RHR shutdown cooling subsystem can provide the 

required cooling, but two subsystems are required to be OPERABLE to 

provide redundancy. Operation of one subsystem can maintain or reduce 

the reactor coolant temperature as required. However, to ensure 

adequate core flow to allow for accurate average reactor coolant 

temperature monitoring, nearly continuous operation is required. 
RHR Shutdown Cooling System - Hot Shutdown 

B 3.4.9 

BWR/6 STS B 3.4.9-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Note 1 permits both RHR shutdown cooling subsystems and recirculation 

pumps to be removed from operation for a period of 2 hours in an 8 hour 

period. Note 2 allows one RHR shutdown cooling subsystem to be 

inoperable for up to 2 hours for performance of surveillance tests. These 

tests may be on the affected RHR System or on some other plant system 

or component that necessitates placing the RHR System in an inoperable 

status during the performance. This is permitted because the core heat 

generation can be low enough and the heatup rate slow enough to allow 

some changes to the RHR subsystems or other operations requiring RHR 

flow interruption and loss of redundancy. 

APPLICABILITY In MODE 3 with reactor steam dome pressure below the RHR cut in 

permissive pressure (i.e., the actual pressure at which the interlock 

resets) the RHR Shutdown Cooling System may be operated in the 

shutdown cooling mode to remove decay heat to reduce or maintain 

coolant temperature. Otherwise, a recirculation pump is required to be in 

operation. 

In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure 

greater than or equal to the RHR cut in permissive pressure, this LCO is 

not applicable. Operation of the RHR System in the shutdown cooling 

mode is not allowed above this pressure because the RCS pressure may 

exceed the design pressure of the shutdown cooling piping. Decay heat 

removal at reactor pressures greater than or equal to the RHR cut in 

permissive pressure is typically accomplished by condensing the steam in 

the main condenser. Additionally, in MODE 2 below this pressure, the 

OPERABILITY requirements for the Emergency Core Cooling Systems 

(ECCS) (LCO 3.5.1, "ECCS - Operating") do not allow placing the RHR 

shutdown cooling subsystem into operation. 

The requirements for decay heat removal in MODES 4 and 5 are 

discussed in LCO 3.4.10, "Residual Heat Removal (RHR) Shutdown 

Cooling System - Cold Shutdown," LCO 3.9.8, "Residual Heat Removal 

(RHR) - High Water Level," and LCO 3.9.9, "Residual Heat Removal 

(RHR) - Low Water Level." 

ACTIONS A Note has been provided to modify the ACTIONS related to RHR 

shutdown cooling subsystems. Section 1.3, Completion Times, specifies 

once a Condition has been entered, subsequent divisions, subsystems, 

components or variables expressed in the Condition, discovered to be 

inoperable or not within limits, will not result in separate entry into the 

Condition. Section 1.3 also specifies Required Actions of the Condition 
RHR Shutdown Cooling System - Hot Shutdown 

B 3.4.9 

BWR/6 STS B 3.4.9-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

continue to apply for each additional failure, with Completion Times based 

on initial entry into the Condition. However, the Required Actions for 

inoperable shutdown cooling subsystems provide appropriate 

compensatory measures for separate inoperable shutdown cooling 

subsystems. As such, a Note has been provided that allows separate 

Condition entry for each inoperable RHR shutdown cooling subsystem. 

A.1, A.2, and A.3

With one required RHR shutdown cooling subsystem inoperable for 

decay heat removal, except as permitted by LCO Note 2, the inoperable 

subsystem must be restored to OPERABLE status without delay. In this 

condition, the remaining OPERABLE subsystem can provide the 

necessary decay heat removal. The overall reliability is reduced, 

however, because a single failure in the OPERABLE subsystem could 

result in reduced RHR shutdown cooling capability. Therefore an 

alternate method of decay heat removal must be provided. 

With both RHR shutdown cooling subsystems inoperable, an alternate 

method of decay heat removal must be provided in addition to that 

provided for the initial RHR shutdown cooling subsystem inoperability. 

This re-establishes backup decay heat removal capabilities, similar to the 

requirements of the LCO. The 1 hour Completion Time is based on the 

decay heat removal function and the probability of a loss of the available 

decay heat removal capabilities. 

The required cooling capacity of the alternate method should be ensured 

by verifying (by calculation or demonstration) its capability to maintain or 

reduce temperature. Decay heat removal by ambient losses can be 

considered as, or contributing to, the alternate method capability. 

Alternate methods that can be used include (but are not limited to) the 

Spent Fuel Pool Cooling System or the Reactor Water Cleanup System. 

However, due to the potentially reduced reliability of the alternate 

methods of decay heat removal, it is also required to reduce the reactor 

coolant temperature to the point where MODE 4 is entered. 
RHR Shutdown Cooling System - Hot Shutdown 

B 3.4.9 

BWR/6 STS B 3.4.9-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1, B.2, and B.3

With no RHR shutdown cooling subsystem and no recirculation pump in 

operation, except as is permitted by LCO Note 1, reactor coolant 

circulation by the RHR shutdown cooling subsystem or one recirculation 

pump must be restored without delay. 

Until RHR or recirculation pump operation is re-established, an alternate 

method of reactor coolant circulation must be placed into service. This 

will provide the necessary circulation for monitoring coolant temperature. 

The 1 hour Completion Time is based on the coolant circulation function 

and is modified such that the 1 hour is applicable separately for each 

occurrence involving a loss of coolant circulation. Furthermore, 

verification of the functioning of the alternate method must be reconfirmed 

every 12 hours thereafter. This will provide assurance of continued 

temperature monitoring capability. 

During the period when the reactor coolant is being circulated by an 

alternate method (other than by the required RHR shutdown cooling 

subsystem or recirculation pump), the reactor coolant temperature and 

pressure must be periodically monitored to ensure proper function of the 

alternate method. The once per hour Completion Time is deemed 

appropriate. 

SURVEILLANCE SR 3.4.9.1

REQUIREMENTS 

This Surveillance verifies that one RHR shutdown cooling subsystem or 

recirculation pump is in operation and circulating reactor coolant. The 

required flow rate is determined by the flow rate necessary to provide 

sufficient decay heat removal capability. The Frequency of 12 hours is 

sufficient in view of other visual and audible indications available to the 

operator for monitoring the RHR subsystem in the control room. 

This Surveillance is modified by a Note allowing sufficient time to align the 

RHR System for shutdown cooling operation after clearing the pressure 

interlock that isolates the system, or for placing a recirculation pump in 

operation. The Note takes exception to the requirements of the 

Surveillance being met (i.e., forced coolant circulation is not required for 

this initial 2 hour period), which also allows entry into the Applicability of 

this Specification in accordance with SR 3.0.4 since the Surveillance will 

not be "not met" at the time of entry into the Applicability. 

REFERENCES None. 
RHR Shutdown Cooling System - Cold Shutdown 

B 3.4.10 

BWR/6 STS B 3.4.10-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown 

BASES 

BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the 

decay of fission products and increases the temperature of the reactor 

coolant. This decay heat must be removed to maintain the temperature 

of the reactor coolant at ≤ 200°F. This decay heat removal is in 

preparation for performing refueling or maintenance operations, or for 

keeping the reactor in the Cold Shutdown condition. 

The two redundant, manually controlled shutdown cooling subsystems of 

the RHR System provide decay heat removal. Each loop consists of a 

motor driven pump, two heat exchangers in series, and associated piping 

and valves. Both loops have a common suction from the same 

recirculation loop. Each pump discharges the reactor coolant, after 

circulation through the respective heat exchanger, to the reactor via 

separate feedwater lines or to the reactor via the LPCI injection path. The 

RHR heat exchangers transfer heat to the Standby Service Water 

System. 

APPLICABLE Decay heat removal by the RHR System in the shutdown cooling mode is 

SAFETY not required for mitigation of any event or accident evaluated in the 

ANALYSES safety analyses. Decay heat removal is, however, an important safety 

function that must be accomplished or core damage could result. The 

RHR Shutdown Cooling System satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii). 

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, 

and, when no recirculation pump is in operation, one RHR shutdown 

cooling subsystem must be in operation. An OPERABLE RHR shutdown 

cooling subsystem consists of one OPERABLE RHR pump, two heat 

exchangers in series, and the associated piping and valves. Each 

shutdown cooling subsystem is considered OPERABLE if it can be 

manually aligned (remote or local) in the shutdown cooling mode for 

removal of decay heat. In MODE 4, one RHR shutdown cooling 

subsystem can provide the required cooling, but two subsystems are 

required to be OPERABLE to provide redundancy. Operation of one 

subsystem can maintain and reduce the reactor coolant temperature as 

required. However, to ensure adequate core flow to allow for accurate 

average reactor coolant temperature monitoring, nearly continuous 

operation is required. 
RHR Shutdown Cooling System - Cold Shutdown 

B 3.4.10 

BWR/6 STS B 3.4.10-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Note 1 permits both RHR shutdown cooling subsystems and recirculation 

pumps to be removed from operation for a period of 2 hours in an 8 hour 

period. Note 2 allows one RHR shutdown cooling subsystem to be 

inoperable for up to 2 hours for performance of surveillance tests. These 

tests may be on the affected RHR System or on some other plant system 

or component that necessitates placing the RHR System in an inoperable 

status during the performance. This is permitted because the core heat 

generation can be low enough and the heatup rate slow enough to allow 

some changes to the RHR subsystems or other operations requiring RHR 

flow interruption and loss of redundancy. 

APPLICABILITY In MODE 4, the RHR System may be operated in the shutdown cooling 

mode to remove decay heat to maintain coolant temperature below 

200°F. Otherwise, a recirculation pump is required to be in operation. 

In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure 

greater than or equal to the RHR cut in permissive pressure, this LCO is 

not applicable. Operation of the RHR System in the shutdown cooling 

mode is not allowed above this pressure because the RCS pressure may 

exceed the design pressure of the shutdown cooling piping. Decay heat 

removal at reactor pressures greater than or equal to the RHR cut in 

permissive pressure is typically accomplished by condensing the steam in 

the main condenser. Additionally, in MODE 2 below this pressure, the 

OPERABILITY requirements for the Emergency Core Cooling Systems 

(ECCS) (LCO 3.5.1, "ECCS - Operating") do not allow placing the RHR 

shutdown cooling subsystem into operation. 

The requirements for decay heat removal in MODE 3 below the cut in 

permissive pressure and in MODE 5 are discussed in LCO 3.4.9, 

"Residual Heat Removal (RHR) Shutdown Cooling System - Hot 

Shutdown," LCO 3.9.8, "Residual Heat Removal (RHR) - High Water 

Level," and LCO 3.9.9, "Residual Heat Removal (RHR) - Low Water 

Level." 

ACTIONS A Note has been provided to modify the ACTIONS related to RHR 

shutdown cooling subsystems. Section 1.3, Completion Times, specifies 

once a Condition has been entered, subsequent divisions, subsystems, 

components or variables expressed in the Condition, discovered to be 

inoperable or not within limits, will not result in separate entry into the 

Condition. Section 1.3 also specifies Required Actions of the Condition 

continue to apply for each additional failure, with Completion Times based 

on initial entry into the Condition. However, the Required Actions for 

inoperable shutdown cooling subsystems provided appropriate 

compensatory measures for separate inoperable shutdown cooling 

subsystems. As such, a Note has been provided that allows separate 

Condition entry for each inoperable RHR shutdown cooling subsystem. 
RHR Shutdown Cooling System - Cold Shutdown 

B 3.4.10 

BWR/6 STS B 3.4.10-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

With one of the two required RHR shutdown cooling subsystems 

inoperable except as permitted by LCO Note 2, the remaining subsystem 

is capable of providing the required decay heat removal. However, the 

overall reliability is reduced. Therefore, an alternate method of decay 

heat removal must be provided. With both RHR shutdown cooling 

subsystems inoperable, an alternate method of decay heat removal must 

be provided in addition to that provided for the initial RHR shutdown 

cooling subsystem inoperability. This re-establishes backup decay heat 

removal capabilities, similar to the requirements of the LCO. The 1 hour 

Completion Time is based on the decay heat removal function and the 

probability of a loss of the available decay heat removal capabilities. 

Furthermore, verification of the functional availability of these alternate 

method(s) must be reconfirmed every 24 hours thereafter. This will 

provide assurance of continued heat removal capability. 

The required cooling capacity of the alternate method should be ensured 

by verifying (by calculation or demonstration) its capability to maintain or 

reduce temperature. Decay heat removal by ambient losses can be 

considered as, or contributing to the alternate method capability. 

Alternate methods that can be used include (but are not limited to) the 

Spent Fuel Pool Cooling System or the Reactor Water Cleanup System. 

B.1 and B.2

With no RHR shutdown cooling subsystem and no recirculation pump in 

operation, except as is permitted by LCO Note 1, and until RHR or 

recirculation pump operation is re-established, an alternate method of 

reactor coolant circulation must be placed into service. This will provide 

the necessary circulation for monitoring coolant temperature. The 1 hour 

Completion Time is based on the coolant circulation function and is 

modified such that the 1 hour is applicable separately for each occurrence 

involving a loss of coolant circulation. Furthermore, verification of the 

functioning of the alternate method must be reconfirmed every 12 hours 

thereafter. This will provide assurance of continued temperature 

monitoring capability. 

During the period when the reactor coolant is being circulated by an 

alternate method (other than by the required RHR shutdown cooling 

system or recirculation pump), the reactor coolant temperature and 

pressure must be periodically monitored to ensure proper function of the 

alternate method. The once per hour Completion Time is deemed 

appropriate. 
RHR Shutdown Cooling System - Cold Shutdown 

B 3.4.10 

BWR/6 STS B 3.4.10-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.4.10.1

REQUIREMENTS 

This Surveillance verifies that one RHR shutdown cooling subsystem or 

recirculation pump is in operation and circulating reactor coolant. The 

required flow rate is determined by the flow rate necessary to provide 

sufficient decay heat removal capability. The Frequency of 12 hours is 

sufficient in view of other visual and audible indications available to the 

operator for monitoring the RHR subsystem in the control room. 

REFERENCES None. 
RCS P/T Limits 

B 3.4.11 

BWR/6 STS B 3.4.11-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.11 RCS Pressure and Temperature (P/T) Limits 

BASES 

BACKGROUND All components of the RCS are designed to withstand effects of cyclic 

loads due to system pressure and temperature changes. These loads 

are introduced by startup (heatup) and shutdown (cooldown) operations, 

power transients, and reactor trips. This LCO limits the pressure and 

temperature changes during RCS heatup and cooldown, within the design 

assumptions and the stress limits for cyclic operation. 

The PTLR contains P/T limit curves for heatup, cooldown, and inservice 

leak and hydrostatic testing, and data for the maximum rate of change of 

reactor coolant temperature. The heatup curve provides limits for both 

heatup and criticality. 

Each P/T limit curve defines an acceptable region for normal operation. 

The usual use of the curves is operational guidance during heatup or 

cooldown maneuvering, when pressure and temperature indications are 

monitored and compared to the applicable curve to determine that 

operation is within the allowable region. 

The LCO establishes operating limits that provide a margin to brittle 

failure of the reactor vessel and piping of the reactor coolant pressure 

boundary (RCPB). The vessel is the component most subject to brittle 

failure. Therefore, the LCO limits apply mainly to the vessel. 

10 CFR 50, Appendix G (Ref. 1), requires the establishment of P/T limits 

for material fracture toughness requirements of the RCPB materials. 

Reference 1 requires an adequate margin to brittle failure during normal 

operation, anticipated operational occurrences, and system hydrostatic 

tests. It mandates the use of the American Society of Mechanical 

Engineers (ASME) Code, Section III, Appendix G (Ref. 2). 

The actual shift in the RTNDT of the vessel material will be established 

periodically by removing and evaluating the irradiated reactor vessel 

material specimens, in accordance with ASTM E 185 (Ref. 3) and 

10 CFR 50, Appendix H (Ref. 4). The operating P/T limit curves will be 

adjusted, as necessary, based on the evaluation findings and the 

recommendations of Reference 5. 
RCS P/T Limits 

B 3.4.11 

BWR/6 STS B 3.4.11-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The P/T limit curves are composite curves established by superimposing 

limits derived from stress analyses of those portions of the reactor vessel 

and head that are the most restrictive. At any specific pressure, 

temperature, and temperature rate of change, one location within the 

reactor vessel will dictate the most restrictive limit. Across the span of the 

P/T limit curves, different locations are more restrictive, and, thus, the 

curves are composites of the most restrictive regions. 

The heatup curve represents a different set of restrictions than the 

cooldown curve because the directions of the thermal gradients through 

the vessel wall are reversed. The thermal gradient reversal alters the 

location of the tensile stress between the outer and inner walls. 

The criticality limits include the Reference 1 requirement that they be at 

least 40°F above the heatup curve or the cooldown curve and not lower 

than the minimum permissible temperature for the inservice leak and 

hydrostatic testing. 

The consequence of violating the LCO limits is that the RCS has been 

operated under conditions that can result in brittle failure of the RCPB, 

possibly leading to a nonisolable leak or loss of coolant accident. In the 

event these limits are exceeded, an evaluation must be performed to 

determine the effect on the structural integrity of the RCPB components. 

The ASME Code, Section XI, Appendix E (Ref. 6), provides a 

recommended methodology for evaluating an operating event that causes 

an excursion outside the limits. 

APPLICABLE The P/T limits are not derived from Design Basis Accident (DBA) 

SAFETY analyses. They are prescribed during normal operation to avoid 

ANALYSES encountering pressure, temperature, and temperature rate of change 

conditions that might cause undetected flaws to propagate and cause 

nonductile failure of the RCPB, a condition that is unanalyzed. 

Reference 7 establishes the methodology for determining the P/T limits. 

Since the P/T limits are not derived from any DBA, there are no 

acceptance limits related to the P/T limits. Rather, the P/T limits are 

acceptance limits themselves since they preclude operation in an 

unanalyzed condition. 

RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO The elements of this LCO are: 

a. RCS pressure, temperature, and heatup or cooldown rate are within 

the limits specified in the PTLR, during RCS heatup, cooldown, and 

inservice leak and hydrostatic testing, 
RCS P/T Limits 

B 3.4.11 

BWR/6 STS B 3.4.11-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

b. The temperature difference between the reactor vessel bottom head 

coolant and the reactor pressure vessel (RPV) coolant is within the 

limit of the PTLR during recirculation pump startup, and during 

increases in THERMAL POWER or loop flow while operating at low 

THERMAL POWER or loop flow, 

c. The temperature difference between the reactor coolant in the 

respective recirculation loop and in the reactor vessel meets the limit 

of the PTLR during recirculation pump startup, and during increases 

in THERMAL POWER or loop flow while operating at low THERMAL 

POWER or loop flow, 

d. RCS pressure and temperature are within the criticality limits 

specified in the PTLR, prior to achieving criticality, and 

e. The reactor vessel flange and the head flange temperatures are 

within the limits of the PTLR when tensioning the reactor vessel head 

bolting studs. 

These limits define allowable operating regions and permit a large 

number of operating cycles while also providing a wide margin to 

nonductile failure. 

The rate of change of temperature limits control the thermal gradient 

through the vessel wall and are used as inputs for calculating the heatup, 

cooldown, and inservice leak and hydrostatic testing P/T limit curves. 

Thus, the LCO for the rate of change of temperature restricts stresses 

caused by thermal gradients and also ensures the validity of the P/T limit 

curves. 

Violation of the limits places the reactor vessel outside of the bounds of 

the stress analyses and can increase stresses in other RCS components. 

The consequences depend on several factors, as follows: 

a. The severity of the departure from the allowable operating pressure 

temperature regime or the severity of the rate of change of 

temperature, 

b. The length of time the limits were violated (longer violations allow the 

temperature gradient in the thick vessel walls to become more 

pronounced), and 

c. The existences, sizes, and orientations of flaws in the vessel 

material. 
RCS P/T Limits 

B 3.4.11 

BWR/6 STS B 3.4.11-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The potential for violating a P/T limit exists at all times. For example, P/T 

limit violations could result from ambient temperature conditions that 

result in the reactor vessel metal temperature being less than the 

minimum allowed temperature for boltup. Therefore, this LCO is 

applicable even when fuel is not loaded in the core. 

ACTIONS A.1 and A.2

Operation outside the P/T limits while in MODE 1, 2, or 3 must be 

corrected so that the RCPB is returned to a condition that has been 

verified by stress analyses. 

The 30 minute Completion Time reflects the urgency of restoring the 

parameters to within the analyzed range. Most violations will not be 

severe, and the activity can be accomplished in this time in a controlled 

manner. 

Besides restoring operation within limits, an evaluation is required to 

determine if RCS operation can continue. The evaluation must verify the 

RCPB integrity remains acceptable and must be completed if continued 

operation is desired. Several methods may be used, including 

comparison with pre-analyzed transients in the stress analyses, new 

analyses, or inspection of the components. 

ASME Code, Section XI, Appendix E (Ref. 6), may be used to support the 

evaluation. However, its use is restricted to evaluation of the vessel 

beltline. 

The 72 hour Completion Time is reasonable to accomplish the evaluation 

of a mild violation. More severe violations may require special, event 

specific stress analyses or inspections. A favorable evaluation must be 

completed if continued operation is desired. 

Condition A is modified by a Note requiring Required Action A.2 be 

completed whenever the Condition is entered. The Note emphasizes the 

need to perform the evaluation of the effects of the excursion outside the 

allowable limits. Restoration alone per Required Action A.1 is insufficient 

because higher than analyzed stresses may have occurred and may have 

affected the RCPB integrity. 
RCS P/T Limits 

B 3.4.11 

BWR/6 STS B 3.4.11-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

If a Required Action and associated Completion Time of Condition A are 

not met, the plant must be brought to a lower MODE because either the 

RCS remained in an unacceptable P/T region for an extended period of 

increased stress, or a sufficiently severe event caused entry into an 

unacceptable region. Either possibility indicates a need for more careful 

examination of the event, best accomplished with the RCS at reduced 

pressure and temperature. With the reduced pressure and temperature 

conditions, the possibility of propagation of undetected flaws is 

decreased. 

Pressure and temperature are reduced by bringing the plant to at least 

MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required plant conditions from full power conditions in an 

orderly manner and without challenging plant systems. 

C.1 and C.2

Operation outside the P/T limits in other than MODES 1, 2, and 3 

(including defueled conditions) must be corrected so that the RCPB is 

returned to a condition that has been verified by stress analyses. The 

Required Action must be initiated without delay and continued until the 

limits are restored. 

Besides restoring the P/T limit parameters to within limits, an evaluation is 

required to determine if RCS operation is allowed. This evaluation must 

verify that the RCPB integrity is acceptable and must be completed 

before approaching criticality or heating up to > 200°F. Several methods 

may be used, including comparison with pre-analyzed transients, new 

analyses, or inspection of the components. ASME Section XI, 

Appendix E (Ref. 6), may be used to support the evaluation; however, its 

use is restricted to evaluation of the beltline. 

SURVEILLANCE SR 3.4.11.1

REQUIREMENTS 

Verification that operation is within PTLR limits is required every 

30 minutes when RCS pressure and temperature conditions are 

undergoing planned changes. This Frequency is considered reasonable 

in view of the control room indication available to monitor RCS status. 

Also, since temperature rate of change limits are specified in hourly 

increments, 30 minutes permits assessment and correction of minor 

deviations. 
RCS P/T Limits 

B 3.4.11 

BWR/6 STS B 3.4.11-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Surveillance for heatup, cooldown, or inservice leakage and hydrostatic 

testing may be discontinued when the criteria given in the relevant plant 

procedure for ending the activity are satisfied. 

This SR has been modified by a Note that requires this Surveillance to be 

performed only during system heatup and cooldown operations and 

inservice leakage and hydrostatic testing. 

SR 3.4.11.2

A separate limit is used when the reactor is approaching criticality. 

Consequently, the RCS pressure and temperature must be verified within 

the appropriate limits before withdrawing control rods that will make the 

reactor critical. 

Performing the Surveillance within 15 minutes before control rod 

withdrawal for the purpose of achieving criticality provides adequate 

assurance that the limits will not be exceeded between the time of the 

Surveillance and the time of the control rod withdrawal. 

SR 3.4.11.3, SR 3.4.11.4, [SR 3.4.11.5, and SR 3.4.11.6]

Differential temperatures within the applicable PTLR limits ensure that 

thermal stresses resulting from the startup of an idle recirculation pump 

will not exceed design allowances. [In addition, compliance with these 

limits ensures that the assumptions of the analysis for the startup of an 

idle recirculation loop (Ref. 8) are satisfied.] 

[ Performing the Surveillance within 15 minutes before starting the idle 

recirculation pump provides adequate assurance that the limits will not be 

exceeded between the time of the Surveillance and the time of the idle 

pump start. ]

[ Limiting differential temperatures within the applicable limits during a 

THERMAL POWER increase or recirculation flow increase in single loop 

operation, while THERMAL POWER ≤ 30% RTP or operating loop flow 

≤ 50% of rated loop flow, ensure that resulting thermal stresses will not 

exceed design allowances. 
RCS P/T Limits 

B 3.4.11 

BWR/6 STS B 3.4.11-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Performing the Surveillance within 15 minutes before starting the idle 

recirculation pump, THERMAL POWER increase during single loop 

operation, or recirculation flow increase during single loop operation, 

provides adequate assurance that the limits will not be exceeded between 

the time of the Surveillance and the time of the idle pump start, power 

increase, or flow increase. ]

An acceptable means of demonstrating compliance with the temperature 

differential requirement in SR 3.4.11.4 [and SR 3.4.11.6] is to compare 

the temperatures of the operating recirculation loop and the idle loop. 

[SR 3.4.11.3 has] These SRs have been modified by [a Note] [Notes] 

that require[s] the Surveillance to be met only in [MODES 1, 2, 3, and 4 

with reactor steam dome pressure ≥ 25 psig]. In MODE 5, the overall 

stress on limiting components is lower; therefore, ∆T limits are not 

required [for SRs 3.4.11.3 and 3.4.11.4 in MODE 5. In MODES 3, 4, and 

5, THERMAL POWER increases are not possible, and recirculation flow 

increases will not result in additional stresses. Therefore, ∆T limits are 

only required for SRs 3.4.11.5 and 3.4.11.6 in MODES 1 and 2]. The 

[Note][Notes] also state that the SR is only required to be met during the 

event of concern (e.g., pump startup, power increase or flow increase) 

since this is when the stresses occur.

SR 3.4.11.7, SR 3.4.11.8, and SR 3.4.11.9

Limits on the reactor vessel flange and head flange temperatures are 

generally bounded by the other P/T limits during system heatup and 

cooldown. However, operations approaching MODE 4 from MODE 5 and 

in MODE 4 with RCS temperature less than or equal to certain specified 

values require assurance that these temperatures meet the LCO limits. 

The flange temperatures must be verified to be above the limits 

30 minutes before and while tensioning the vessel head bolting studs to 

ensure that once the head is tensioned the limits are satisfied. When in 

MODE 4 with RCS temperature ≤ 80°F, 30 minute checks of the flange 

temperatures are required because of the reduced margin to the limits. 

When in MODE 4 with RCS temperature ≤ 100°F, monitoring of the flange 

temperature is required every 12 hours to ensure the temperatures are 

within the limits specified in the PTLR. 
RCS P/T Limits 

B 3.4.11 

BWR/6 STS B 3.4.11-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The 30 minute Frequency reflects the urgency of maintaining the 

temperatures within limits, and also limits the time that the temperature 

limits could be exceeded. The 12 hour Frequency is reasonable based 

on the rate of temperature change possible at these temperatures. 

REFERENCES 1. 10 CFR 50, Appendix G. 

 2. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G. 

 3. ASTM E 185-82, July 1982. 

 4. 10 CFR 50, Appendix H. 

 5. Regulatory Guide 1.99, Revision 2, May 1988. 

 6. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E. 

 7. NEDO-21778-A, December 1978. 

 [ 8. FSAR, Section [15.1.26]. ] 
Reactor Steam Dome Pressure 

B 3.4.12 

BWR/6 STS B 3.4.12-1 Rev. 3.0, 03/31/04 

B 3.4 REACTOR COOLANT SYSTEM (RCS) 

B 3.4.12 Reactor Steam Dome Pressure 

BASES 

BACKGROUND The reactor steam dome pressure is an assumed initial condition of 

Design Basis Accidents (DBAs) and transients and is also an assumed 

value in the determination of compliance with reactor pressure vessel 

overpressure protection criteria. 

APPLICABLE The reactor steam dome pressure of ≤ [1045] psig is an initial condition of 

SAFETY the vessel overpressure protection analysis of Reference 1. This 

ANALYSES analysis assumes an initial maximum reactor steam dome pressure and 

evaluates the response of the pressure relief system, primarily the 

safety/relief valves, during the limiting pressurization transient. The 

determination of compliance with the overpressure criteria is dependent 

on the initial reactor steam dome pressure; therefore, the limit on this 

pressure ensures that the assumptions of the overpressure protection 

analysis are conserved. Reference 2 also assumes an initial reactor 

steam dome pressure for the analysis of DBAs and transients used to 

determine the limits for fuel cladding integrity MCPR (see Bases for 

LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1% 

cladding plastic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR 

LINEAR HEAT GENERATION RATE (APLHGR)"). 

Reactor steam dome pressure satisfies the requirements of Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO The specified reactor steam dome pressure limit of ≤ [1045] psig ensures 

the plant is operated within the assumptions of the transient analyses. 

Operation above the limit may result in a transient response more severe 

than analyzed. 

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be 

less than or equal to the limit. In these MODES, the reactor may be 

generating significant steam, and the DBAs and transients are bounding. 

In MODES 3, 4, and 5, the limit is not applicable because the reactor is 

shut down. In these MODES, the reactor pressure is well below the 

required limit, and no anticipated events will challenge the overpressure 

limits. 
Reactor Steam Dome Pressure 

B 3.4.12 

BWR/6 STS B 3.4.12-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With the reactor steam dome pressure greater than the limit, prompt 

action should be taken to reduce pressure to below the limit and return 

the reactor to operation within the bounds of the analyses. The 15 minute 

Completion Time is reasonable considering the importance of maintaining 

the pressure within limits. This Completion Time also ensures that the 

probability of an accident while pressure is greater than the limit is 

minimal. If the operator is unable to restore the reactor steam dome 

pressure to below the limit, then the reactor should be brought to MODE 3 

to be within the assumptions of the transient analyses. 

B.1

If the reactor steam dome pressure cannot be restored to within the limit 

within the associated Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 12 hours. The allowed 

Completion Time of 12 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power conditions in an orderly 

manner and without challenging plant systems. 

SURVEILLANCE SR 3.4.12.1

REQUIREMENTS 

Verification that reactor steam dome pressure is ≤ [1045] psig ensures 

that the initial conditions of the DBAs and transients are met. Operating 

experience has shown the 12 hour Frequency to be sufficient for 

identifying trends and verifying operation within safety analyses 

assumptions. 

REFERENCES 1. FSAR, Section [5.2.2.2.4]. 

 2. FSAR, Section [15]. 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-1 Rev. 3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE 

 ISOLATION COOLING SYSTEM (RCIC) 

B 3.5.1 ECCS - Operating 

BASES 

BACKGROUND The ECCS is designed, in conjunction with the primary and secondary 

containment, to limit the release of radioactive materials to the 

environment following a loss of coolant accident (LOCA). The ECCS 

uses two independent methods (flooding and spraying) to cool the core 

during a LOCA. The ECCS network is composed of the High Pressure 

Core Spray (HPCS) System, the Low Pressure Core Spray (LPCS) 

System, and the low pressure coolant injection (LPCI) mode of the 

Residual Heat Removal (RHR) System. The ECCS also consists of the 

Automatic Depressurization System (ADS). The suppression pool 

provides the required source of water for the ECCS. Although no credit is 

taken in the safety analyses for the condensate storage tank (CST), it is 

capable of providing a source of water for the HPCS System. 

On receipt of an initiation signal, ECCS pumps automatically start; 

simultaneously the system aligns, and the pumps inject water, taken 

either from the CST or suppression pool, into the Reactor Coolant System 

(RCS) as RCS pressure is overcome by the discharge pressure of the 

ECCS pumps. Although the system is initiated, ADS action is delayed, 

allowing the operator to interrupt the timed sequence if the system is not 

needed. The HPCS pump discharge pressure almost immediately 

exceeds that of the RCS, and the pump injects coolant into the spray 

sparger above the core. If the break is small, HPCS will maintain coolant 

inventory, as well as vessel level, while the RCS is still pressurized. If 

HPCS fails, it is backed up by ADS in combination with LPCI and LPCS. 

In this event, the ADS timed sequence would be allowed to time out and 

open the selected safety/relief valves (S/RVs), depressurizing the RCS 

and allowing the LPCI and LPCS to overcome RCS pressure and inject 

coolant into the vessel. If the break is large, RCS pressure initially drops 

rapidly, and the LPCI and LPCS systems cool the core. 

Water from the break returns to the suppression pool where it is used 

again and again. Water in the suppression pool is circulated through a 

heat exchanger cooled by the Standby Service Water (SWS) System. 

Depending on the location and size of the break, portions of the ECCS 

may be ineffective; however, the overall design is effective in cooling the 

core regardless of the size or location of the piping break. Although no 

credit is taken in the safety analysis for the RCIC System, it performs a 

similar function as HPCS but has reduced makeup capability. 

Nevertheless, it will maintain inventory and cool the core, while the RCS 

is still pressurized, following a reactor pressure vessel (RPV) isolation. 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

All ECCS subsystems are designed to ensure that no single active 

component failure will prevent automatic initiation and successful 

operation of the minimum required ECCS subsystems. 

The LPCS System (Ref. 1) consists of a motor driven pump, a spray 

sparger above the core, piping, and valves to transfer water from the 

suppression pool to the sparger. The LPCS System is designed to 

provide cooling to the reactor core when the reactor pressure is low. 

Upon receipt of an initiation signal, the LPCS pump is automatically 

started when AC power is available. When the RPV pressure drops 

sufficiently, LPCS flow to the RPV begins. A full flow test line is provided 

to route water from and to the suppression pool to allow testing of the 

LPCS System without spraying water into the RPV. 

LPCI is an independent operating mode of the RHR System. There are 

three LPCI subsystems. Each LPCI subsystem (Ref. 2) consists of a 

motor driven pump, piping, and valves to transfer water from the 

suppression pool to the core. Each LPCI subsystem has its own suction 

and discharge piping and separate vessel nozzle that connects with the 

core shroud through internal piping. The LPCI subsystems are designed 

to provide core cooling at low RPV pressure. Upon receipt of an initiation 

signal, each LPCI pump is automatically started (C pump immediately, 

when AC power is available, and A and B pumps approximately 

5.25 seconds after AC power is available). When the RPV pressure 

drops sufficiently, LPCI flow to the RPV begins. RHR System valves in 

the LPCI flow path are automatically positioned to ensure the proper flow 

path for water from the suppression pool to inject into the core. A 

discharge test line is provided to route water from and to the suppression 

pool to allow testing of each LPCI pump without injecting water into the 

RPV. 

The HPCS System (Ref. 3) consists of a single motor driven pump, a 

spray sparger above the core, and piping and valves to transfer water 

from the suction source to the sparger. Suction piping is provided from 

the CST and the suppression pool. Pump suction is normally aligned to 

the CST source to minimize injection of suppression pool water into the 

RPV. However, if the CST water supply is low or the suppression pool 

level is high, an automatic transfer to the suppression pool water source 

ensures a water supply for continuous operation of the HPCS System. 

The HPCS System is designed to provide core cooling over a wide range 

of RPV pressures (0 psid to 1177 psid, vessel to suction source). Upon 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

receipt of an initiation signal, the HPCS pump automatically starts (when 

AC power is available) and valves in the flow path begin to open. Since 

the HPCS System is designed to operate over the full range of expected 

RPV pressures, HPCS flow begins as soon as the necessary valves are 

open. A full flow test line is provided to route water from and to the CST 

to allow testing of the HPCS System during normal operation without 

spraying water into the RPV. 

The ECCS pumps are provided with minimum flow bypass lines, which 

discharge to the suppression pool. The valves in these lines 

automatically open to prevent pump damage due to overheating when 

other discharge line valves are closed or RPV pressure is greater than 

the LPCS or LPCI pump discharge pressures following system initiation. 

To ensure rapid delivery of water to the RPV and to minimize water 

hammer effects, the ECCS discharge line "keep fill" systems are designed 

to maintain all pump discharge lines filled with water. 

The ADS (Ref. 4) consists of 8 of the 20 S/RVs. It is designed to provide 

depressurization of the primary system during a small break LOCA if 

HPCS fails or is unable to maintain required water level in the RPV. ADS 

operation reduces the RPV pressure to within the operating pressure 

range of the low pressure ECCS subsystems (LPCS and LPCI), so that 

these subsystems can provide core cooling. Each ADS valve is supplied 

with pneumatic power from an air storage system, which consists of air 

accumulators and air receivers located in the drywell. 

APPLICABLE The ECCS performance is evaluated for the entire spectrum of break 

SAFETY sizes for a postulated LOCA. The accidents for which ECCS operation is 

ANALYSES required are presented in References 5, 6, and 7. The required analyses 

and assumptions are defined in 10 CFR 50 (Ref. 8), and the results of 

these analyses are described in Reference 9. 

This LCO helps to ensure that the following acceptance criteria for the 

ECCS, established by 10 CFR 50.46 (Ref. 10), will be met following a 

LOCA assuming the worst case single active component failure in the 

ECCS: 

a. Maximum fuel element cladding temperature is ≤ 2200°F, 

b. Maximum cladding oxidation is ≤ 0.17 times the total cladding 

thickness before oxidation, 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-4 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

c. Maximum hydrogen generation from zirconium water reaction is 

≤ 0.01 times the hypothetical amount that would be generated if all of 

the metal in the cladding surrounding the fuel, excluding the cladding 

surrounding the plenum volume, were to react, 

d. The core is maintained in a coolable geometry, and 

e. Adequate long term cooling capability is maintained. 

The limiting single failures are discussed in Reference 11. For a large 

break LOCA, failure of ECCS subsystems in Division 1 (LPCS and 

LPCI-A) or Division 2 (LPCI-B and LPCI-C) due to failure of its associated 

diesel generator is, in general, the most severe failure. For a small break 

LOCA, HPCS System failure is the most severe failure. One ADS valve 

failure is analyzed as a limiting single failure for events requiring ADS 

operation. The remaining OPERABLE ECCS subsystems provide the 

capability to adequately cool the core and prevent excessive fuel 

damage. 

The ECCS satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Each ECCS injection/spray subsystem and eight ADS valves are required 

to be OPERABLE. The ECCS injection/spray subsystems are defined as 

the three LPCI subsystems, the LPCS System, and the HPCS System. 

The low pressure ECCS injection/spray subsystems are defined as the 

LPCS System and the three LPCI subsystems. 

With less than the required number of ECCS subsystems OPERABLE 

during a limiting design basis LOCA concurrent with the worst case single 

failure, the limits specified in 10 CFR 50.46 (Ref. 10) could potentially be 

exceeded. All ECCS subsystems must therefore be OPERABLE to 

satisfy the single failure criterion required by 10 CFR 50.46 (Ref. 10). 

As noted, LPCI subsystems may be considered OPERABLE during 

alignment and operation for decay heat removal when below the actual 

RHR cut in permissive pressure in MODE 3, if capable of being manually 

realigned (remote or local) to the LPCI mode and not otherwise 

inoperable. Alignment and operation for decay heat removal includes 

when the required RHR pump is not operating or when the system is 

realigned from or to the RHR shutdown cooling mode. This allowance is 

necessary since the RHR System may be required to operate in the 

shutdown cooling mode to remove decay heat and sensible heat from the 

reactor. At these low pressures and decay heat levels, a reduced 

complement of ECCS subsystems should provide the required core 

cooling, thereby allowing operation of RHR shutdown cooling when 

necessary. 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-5 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY All ECCS subsystems are required to be OPERABLE during MODES 1, 

2, and 3 when there is considerable energy in the reactor core and core 

cooling would be required to prevent fuel damage in the event of a break 

in the primary system piping. In MODES 2 and 3, the ADS function is not 

required when pressure is ≤ 150 psig because the low pressure ECCS 

subsystems (LPCS and LPCI) are capable of providing flow into the RPV 

below this pressure. ECCS requirements for MODES 4 and 5 are 

specified in LCO 3.5.2, "ECCS - Shutdown." 

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCS 

subsystem. There is an increased risk associated with entering a MODE 

or other specified condition in the Applicability with an inoperable HPCS 

subsystem and the provisions of LCO 3.0.4.b, which allow entry into a 

MODE or other specified condition in the Applicability with the LCO not 

met after performance of a risk assessment addressing inoperable 

systems and components, should not be applied in this circumstance. 

 A.1

If any one low pressure ECCS injection/spray subsystem is inoperable, 

the inoperable subsystem must be restored to OPERABLE status within 

7 days. In this Condition, the remaining OPERABLE subsystems provide 

adequate core cooling during a LOCA. However, overall ECCS reliability 

is reduced because a single failure in one of the remaining OPERABLE 

subsystems concurrent with a LOCA may result in the ECCS not being 

able to perform its intended safety function. The 7 day Completion Time 

is based on a reliability study (Ref. 12) that evaluated the impact on 

ECCS availability by assuming that various components and subsystems 

were taken out of service. The results were used to calculate the average 

availability of ECCS equipment needed to mitigate the consequences of a 

LOCA as a function of allowed outage times (i.e., Completion Times). 

B.1 and B.2

If the HPCS System is inoperable, and the RCIC System is verified to be 

OPERABLE (when RCIC is required to be OPERABLE), the HPCS 

System must be restored to OPERABLE status within 14 days. In this 

Condition, adequate core cooling is ensured by the OPERABILITY of the 

redundant and diverse low pressure ECCS injection/spray subsystems in 

conjunction with the ADS. Also, the RCIC System will automatically 

provide makeup water at most reactor operating pressures. Verification 

of RCIC OPERABILITY immediately is therefore required when HPCS is 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

inoperable. This may be performed by an administrative check, by 

examining logs or other information to determine if RCIC is out of service 

for maintenance or other reasons. It is not necessary to perform the 

Surveillances needed to demonstrate the OPERABILITY of the RCIC 

System. However, if the OPERABILITY of the RCIC System cannot be 

verified and RCIC is required to be OPERABLE, Condition D must be 

immediately entered. If a single active component fails concurrent with a 

design basis LOCA, there is a potential, depending on the specific failure, 

that the minimum required ECCS equipment will not be available. A 

14 day Completion Time is based on the results of a reliability study 

(Ref. 12) and has been found to be acceptable through operating 

experience. 

C.1

With two ECCS injection subsystems inoperable or one ECCS injection 

and one ECCS spray subsystem inoperable, at least one ECCS 

injection/spray subsystem must be restored to OPERABLE status within 

72 hours. In this Condition, the remaining OPERABLE subsystems 

provide adequate core cooling during a LOCA. However, overall ECCS 

reliability is reduced in this Condition because a single failure in one of 

the remaining OPERABLE subsystems concurrent with a design basis 

LOCA may result in the ECCS not being able to perform its intended 

safety function. Since the ECCS availability is reduced relative to 

Condition A, a more restrictive Completion Time is imposed. The 72 hour 

Completion Time is based on a reliability study, as provided in 

Reference 12. 

D.1 and D.2

If any Required Action and associated Completion Time of Condition A, 

B, or C are not met, the plant must be brought to a MODE in which the 

LCO does not apply. To achieve this status, the plant must be brought to 

at least MODE 3 within 12 hours and to MODE 4 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems. 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1

The LCO requires eight ADS valves to be OPERABLE to provide the ADS 

function. Reference 13 contains the results of an analysis that evaluated 

the effect of one ADS valve being out of service. Per this analysis, 

operation of only seven ADS valves will provide the required 

depressurization. However, overall reliability of the ADS is reduced 

because a single failure in the OPERABLE ADS valves could result in a 

reduction in depressurization capability. Therefore, operation is only 

allowed for a limited time. The 14 day Completion Time is based on a 

reliability study (Ref. 12) and has been found to be acceptable through 

operating experience. 

F.1 and F.2

If any one low pressure ECCS injection/spray subsystem is inoperable in 

addition to one inoperable ADS valve, adequate core cooling is ensured 

by the OPERABILITY of HPCS and the remaining low pressure ECCS 

injection/spray subsystems. However, the overall ECCS reliability is 

reduced because a single active component failure concurrent with a 

design basis LOCA could result in the minimum required ECCS 

equipment not being available. Since both a high pressure (ADS) and 

low pressure subsystem are inoperable, a more restrictive Completion 

Time of 72 hours is required to restore either the low pressure ECCS 

injection/spray subsystem or the ADS valve to OPERABLE status. This 

Completion Time is based on a reliability study (Ref. 12) and has been 

found to be acceptable through operating experience. 

G.1 and G.2

If any Required Action and associated Completion Time of Condition E 

or F are not met or if two or more ADS valves are inoperable, the plant 

must be brought to a condition in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

12 hours and reactor steam dome pressure reduced to ≤ 150 psig within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

H.1

When multiple ECCS subsystems are inoperable, as stated in 

Condition H, the plant is in a condition outside of the accident analyses. 

Therefore, LCO 3.0.3 must be entered immediately. 

SURVEILLANCE SR 3.5.1.1

REQUIREMENTS 

The flow path piping has the potential to develop voids and pockets of 

entrained air. Maintaining the pump discharge lines of the HPCS System, 

LPCS System, and LPCI subsystems full of water ensures that the 

systems will perform properly, injecting their full capacity into the RCS 

upon demand. This will also prevent a water hammer following an ECCS 

initiation signal. One acceptable method of ensuring the lines are full is to 

vent at the high points. The 31 day Frequency is based on operating 

experience, on the procedural controls governing system operation, and 

on the gradual nature of void buildup in the ECCS piping. 

SR 3.5.1.2

Verifying the correct alignment for manual, power operated, and 

automatic valves in the ECCS flow paths provides assurance that the 

proper flow paths will exist for ECCS operation. This SR does not apply 

to valves that are locked, sealed, or otherwise secured in position since 

these valves were verified to be in the correct position prior to locking, 

sealing, or securing. A valve that receives an initiation signal is allowed 

to be in a nonaccident position provided the valve will automatically 

reposition in the proper stroke time. This SR does not require any testing 

or valve manipulation; rather, it involves verification that those valves 

potentially capable of being mispositioned are in the correct position. 

This SR does not apply to valves that cannot be inadvertently misaligned, 

such as check valves. 

The 31 day Frequency of this SR was derived from the Inservice Testing 

Program requirements for performing valve testing at least once every 

92 days. The Frequency of 31 days is further justified because the valves 

are operated under procedural control and because improper valve 

alignment would only affect a single subsystem. This Frequency has 

been shown to be acceptable through operating experience. 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.5.1.3

Verification every 31 days that ADS air receiver pressure is ≥ [150] psig 

assures adequate air pressure for reliable ADS operation. The 

accumulator on each ADS valve provides pneumatic pressure for valve 

actuation. The designed pneumatic supply pressure requirements for the 

accumulator are such that, following a failure of the pneumatic supply to 

the accumulator, at least two valve actuations can occur with the drywell 

at 70% of design pressure (Ref. 14). The ECCS safety analysis assumes 

only one actuation to achieve the depressurization required for operation 

of the low pressure ECCS. This minimum required pressure of [150] psig 

is provided by the ADS Instrument Air Supply System. The 31 day 

Frequency takes into consideration administrative control over operation 

of the Instrument Air Supply System and alarms for low air pressure. 

SR 3.5.1.4

The performance requirements of the ECCS pumps are determined 

through application of the 10 CFR 50, Appendix K, criteria (Ref. 8). This 

periodic Surveillance is performed (in accordance with the ASME Code, 

Section XI, requirements for the ECCS pumps) to verify that the ECCS 

pumps will develop the flow rates required by the respective analyses. 

The ECCS pump flow rates ensure that adequate core cooling is provided 

to satisfy the acceptance criteria of 10 CFR 50.46 (Ref. 10). 

The pump flow rates are verified against a system head that is equivalent 

to the RPV pressure expected during a LOCA. The total system pump 

outlet pressure is adequate to overcome the elevation head pressure 

between the pump suction and the vessel discharge, the piping friction 

losses, and RPV pressure present during LOCAs. These values may be 

established during pre-operational testing. A 92 day Frequency for this 

Surveillance is in accordance with the Inservice Testing Program 

requirements. 

SR 3.5.1.5

The ECCS subsystems are required to actuate automatically to perform 

their design functions. This Surveillance test verifies that, with a required 

system initiation signal (actual or simulated), the automatic initiation logic 

of HPCS, LPCS, and LPCI will cause the systems or subsystems to 

operate as designed, including actuation of the system throughout its 

emergency operating sequence, automatic pump startup, and actuation of 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

all automatic valves to their required positions. This Surveillance also 

ensures that the HPCS System will automatically restart on an RPV low 

water level (Level 2) signal received subsequent to an RPV high water 

level (Level 8) trip and that the suction is automatically transferred from 

the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL 

TEST performed in LCO 3.3.5.1 overlaps this Surveillance to provide 

complete testing of the assumed safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the SR when performed at the 18 month 

Frequency, which is based on the refueling cycle. Therefore, the 

Frequency was concluded to be acceptable from a reliability standpoint. 

This SR is modified by a Note that excludes vessel injection/spray during 

the Surveillance. Since all active components are testable and full flow 

can be demonstrated by recirculation through the test line, coolant 

injection into the RPV is not required during the Surveillance. 

SR 3.5.1.6

The ADS designated S/RVs are required to actuate automatically upon 

receipt of specific initiation signals. A system functional test is performed 

to demonstrate that the mechanical portions of the ADS function (i.e., 

solenoids) operate as designed when initiated either by an actual or 

simulated initiation signal, causing proper actuation of all the required 

components. SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST 

performed in LCO 3.3.5.1 overlap this Surveillance to provide complete 

testing of the assumed safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the SR when performed at the 18 month 

Frequency, which is based on the refueling cycle. Therefore, the 

Frequency was concluded to be acceptable from a reliability standpoint. 

This SR is modified by a Note that excludes valve actuation. This 

prevents an RPV pressure blowdown. 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-11 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.5.1.7

A manual actuation of each ADS valve is performed to verify that the 

valve and solenoids are functioning properly and that no blockage exists 

in the S/RV discharge lines. This is demonstrated by the response of the 

turbine control or bypass valve, by a change in the measured steam flow, 

or by any other method suitable to verify steam flow. Adequate reactor 

steam dome pressure must be available to perform this test to avoid 

damaging the valve. Also, adequate steam flow must be passing through 

the main turbine or turbine bypass valves to continue to control reactor 

pressure when the ADS valves divert steam flow upon opening. 

Sufficient time is therefore allowed, after the required pressure and flow 

are achieved, to perform this test. Adequate pressure at which this test is 

to be performed is [950] psig (the pressure recommended by the valve 

manufacturer). Adequate steam flow is represented by [at least 1.25 

turbine bypass valves open, or total steam flow ≥ 106

 lb/hr]. Reactor 

startup is allowed prior to performing this test because valve 

OPERABILITY and the setpoints for overpressure protection are verified, 

per ASME requirements, prior to valve installation. Therefore, this SR is 

modified by a Note that states the Surveillance is not required to be 

performed until 12 hours after reactor steam pressure and flow are 

adequate to perform the test. SR 3.5.1.6 and the LOGIC SYSTEM 

FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance 

to provide complete testing of the assumed safety function. 

The Frequency of 18 months on a STAGGERED TEST BASIS ensures 

that both solenoids for each ADS valve are alternately tested. The 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply just prior to or during a startup from a plant outage. 

Operating experience has shown that these components usually pass the 

SR when performed at the 18 month Frequency, which is based on the 

refueling cycle. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [6.3.2.2.3]. 

 2. FSAR, Section [6.3.2.2.4]. 

 3. FSAR, Section [6.3.2.2.1]. 

 4. FSAR, Section [6.3.2.2.2]. 

 5. FSAR, Section [15.2.8]. 
ECCS - Operating 

B 3.5.1 

BWR/6 STS B 3.5.1-12 Rev. 3.0, 03/31/04 

BASES 

REFERENCES (continued) 

 6. FSAR, Section [15.6.4]. 

 7. FSAR, Section [15.6.5]. 

 8. 10 CFR 50, Appendix K. 

 9. FSAR, Section [6.3.3]. 

 10. 10 CFR 50.46. 

 11. FSAR, Section [6.3.3.3]. 

 12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr. (NRC), 

"Recommended Interim Revisions to LCO's for ECCS Components," 

December 1, 1975. 

 13. FSAR, Section [6.3.3.7.8]. 

 14. FSAR, Section [7.3.1.1.1.4.2]. 
ECCS - Shutdown 

B 3.5.2 

BWR/6 STS B 3.5.2-1 Rev. 3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE 

 ISOLATION COOLING SYSTEM (RCIC) 

B 3.5.2 ECCS - Shutdown 

BASES 

BACKGROUND A description of the High Pressure Core Spray (HPCS) System, Low 

Pressure Core Spray (LPCS) System, and low pressure coolant injection 

(LPCI) mode of the Residual Heat Removal (RHR) System is provided in 

the Bases for LCO 3.5.1, "ECCS - Operating." 

APPLICABLE The ECCS performance is evaluated for the entire spectrum of break 

SAFETY sizes for a postulated loss of coolant accident (LOCA). The long term 

ANALYSES cooling analysis following a design basis LOCA (Ref. 1) demonstrates 

that only one low pressure ECCS injection/spray subsystem is required, 

post LOCA, to maintain adequate reactor vessel water level in the event 

of an inadvertent vessel draindown. It is reasonable to assume, based on 

engineering judgment, that while in MODES 4 and 5, one low pressure 

ECCS injection/spray subsystem can maintain adequate reactor vessel 

water level. To provide redundancy, a minimum of two low pressure 

ECCS injection/spray subsystems are required to be OPERABLE in 

MODES 4 and 5. 

The ECCS satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Two ECCS injection/spray subsystems are required to be OPERABLE. 

The ECCS injection/spray subsystems are defined as the three LPCI 

subsystems, the LPCS System, and the HPCS System. The LPCS 

System and each LPCI subsystem consist of one motor driven pump, 

piping, and valves to transfer water from the suppression pool to the RPV. 

The HPCS System consists of one motor driven pump, piping, and valves 

to transfer water from the suppression pool or condensate storage tank 

(CST) to the RPV. 

As noted, one LPCI subsystem (A or B) may be considered OPERABLE 

during alignment and operation for decay heat removal, if capable of 

being manually realigned (remote or local) to the LPCI mode and is not 

otherwise inoperable. Alignment and operation for decay heat removal 

includes when the required RHR pump is not operating or when the 

system is realigned from or to the RHR shutdown cooling mode. This 

allowance is necessary since the RHR System may be required to 

operate in the shutdown cooling mode to remove decay heat and sensible 

heat from the reactor. Because of low pressure and low temperature 

conditions in MODES 4 and 5, sufficient time will be available to manually 

align and initiate LPCI subsystem operation to provide core cooling prior 

to postulated fuel uncovery. 
ECCS - Shutdown 

B 3.5.2 

BWR/6 STS B 3.5.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY OPERABILITY of the ECCS injection/spray subsystems is required in 

MODES 4 and 5 to ensure adequate coolant inventory and sufficient heat 

removal capability for the irradiated fuel in the core in case of an 

inadvertent draindown of the vessel. Requirements for ECCS 

OPERABILITY during MODES 1, 2, and 3 are discussed in the 

Applicability section of the Bases for LCO 3.5.1. ECCS subsystems are 

not required to be OPERABLE during MODE 5 with the upper 

containment pool gate removed, and the water level maintained at ≥ 22 ft 

8 inches above the RPV flange. This provides sufficient coolant inventory 

to allow operator action to terminate the inventory loss prior to fuel 

uncovery in case of an inadvertent draindown. 

The Automatic Depressurization System is not required to be OPERABLE 

during MODES 4 and 5 because the RPV pressure is < 150 psig, and the 

LPCS, HPCS, and LPCI subsystems can provide core cooling without any 

depressurization of the primary system. 

ACTIONS A.1 and B.1

If any one required ECCS injection/spray subsystem is inoperable, the 

required inoperable ECCS injection/spray subsystem must be restored to 

OPERABLE status within 4 hours. In this Condition, the remaining 

OPERABLE subsystem can provide sufficient RPV flooding capability to 

recover from an inadvertent vessel draindown. However, overall system 

reliability is reduced because a single failure in the remaining OPERABLE 

subsystem concurrent with a vessel draindown could result in the ECCS 

not being able to perform its intended function. The 4 hour Completion 

Time for restoring the required ECCS injection/spray subsystem to 

OPERABLE status is based on engineering judgment that considered the 

availability of one subsystem and the low probability of a vessel 

draindown event. 

With the inoperable subsystem not restored to OPERABLE status within 

the required Completion Time, action must be initiated immediately to 

suspend operations with a potential for draining the reactor vessel 

(OPDRVs) to minimize the probability of a vessel draindown and the 

subsequent potential for fission product release. Actions must continue 

until OPDRVs are suspended. 
ECCS - Shutdown 

B 3.5.2 

BWR/6 STS B 3.5.2-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1, C.2, D.1, D.2, and D.3

If both of the required ECCS injection/spray subsystems are inoperable, 

all coolant inventory makeup capability may be unavailable. Therefore, 

actions must be initiated immediately to suspend OPDRVs in order to 

minimize the probability of a vessel draindown and the subsequent 

potential for fission product release. Actions must continue until OPDRVs 

are suspended. One ECCS injection/spray subsystem must also be 

restored to OPERABLE status within 4 hours. 

If at least one ECCS injection/spray subsystem is not restored to 

OPERABLE status within the 4 hour Completion Time, additional actions 

are required to minimize any potential fission product release to the 

environment. This includes ensuring secondary containment is 

OPERABLE; one standby gas treatment subsystem is OPERABLE; and 

secondary containment isolation capability (i.e., one isolation valve and 

associated instrumentation are OPERABLE or other acceptable 

administrative controls to assure isolation capability) in each secondary 

containment penetration flow path not isolated that is assumed to be 

isolated to mitigate radioactivity releases. This may be performed by an 

administrative check, by examining logs or other information, to determine 

if the components are out of service for maintenance or other reasons. It 

is not necessary to perform the Surveillances needed to demonstrate 

OPERABILITY of the components. If, however, any required component 

is inoperable, then it must be restored to OPERABLE status. In this case, 

the Surveillances may need to be performed to restore the component to 

OPERABLE status. Actions must continue until all required components 

are OPERABLE. 

The 4 hour Completion Time to restore at least one ECCS injection/spray 

subsystem to OPERABLE status ensures that prompt action will be taken 

to provide the required cooling capacity or to initiate actions to place the 

plant in a condition that minimizes any potential fission product release to 

the environment. 

SURVEILLANCE SR 3.5.2.1 and SR 3.5.2.2

REQUIREMENTS 

The minimum water level of [12.67 ft] required for the suppression pool is 

periodically verified to ensure that the suppression pool will provide 

adequate net positive suction head (NPSH) for the ECCS pumps, 

recirculation volume, and vortex prevention. With the suppression pool 

water level less than the required limit, all ECCS injection/spray 

subsystems are inoperable unless they are aligned to an OPERABLE 

CST. 
ECCS - Shutdown 

B 3.5.2 

BWR/6 STS B 3.5.2-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

When the suppression pool level is < [12.67 ft], the HPCS System is 

considered OPERABLE only if it can take suction from the CST and the 

CST water level is sufficient to provide the required NPSH for the HPCS 

pump. Therefore, a verification that either the suppression pool water 

level is ≥ [12.67 ft] or the HPCS System is aligned to take suction from 

the CST and the CST contains ≥ [170,000] gallons of water, equivalent to 

18 ft, ensures that the HPCS System can supply makeup water to the 

RPV. 

The 12 hour Frequency of these SRs was developed considering 

operating experience related to suppression pool and CST water level 

variations and instrument drift during the applicable MODES. 

Furthermore, the 12 hour Frequency is considered adequate in view of 

other indications in the control room, including alarms, to alert the 

operator to an abnormal suppression pool or CST water level condition. 

SR 3.5.2.3, SR 3.5.2.5, and SR 3.5.2.6

The Bases provided for SR 3.5.1.1, SR 3.5.1.4, and SR 3.5.1.5 are 

applicable to SR 3.5.2.3, SR 3.5.2.5, and SR 3.5.2.6, respectively. 

SR 3.5.2.4

Verifying the correct alignment for manual, power operated, and 

automatic valves in the ECCS flow paths provides assurance that the 

proper flow paths will exist for ECCS operation. This SR does not apply 

to valves that are locked, sealed, or otherwise secured in position since 

these valves were verified to be in the correct position prior to locking, 

sealing, or securing. A valve that receives an initiation signal is allowed 

to be in a nonaccident position provided the valve will automatically 

reposition in the proper stroke time. This SR does not require any testing 

or valve manipulation; rather, it involves verification that those valves 

capable of potentially being mispositioned are in the correct position. 

This SR does not apply to valves that cannot be inadvertently misaligned, 

such as check valves. The 31 day Frequency is appropriate because the 

valves are operated under procedural control and the probability of their 

being mispositioned during this time period is low. 

REFERENCES 1. FSAR, Section [6.3.3.4]. 
RCIC System 

B 3.5.3 

BWR/6 STS B 3.5.3-1 Rev. 3.0, 03/31/04 

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) AND REACTOR CORE 

 ISOLATION COOLING SYSTEM (RCIC) 

B 3.5.3 RCIC System 

BASES 

BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is 

included with the ECCS section because of their similar functions. 

The RCIC System is designed to operate either automatically or manually 

following reactor pressure vessel (RPV) isolation accompanied by a loss 

of coolant flow from the feedwater system to provide adequate core 

cooling and control of RPV water level. Under these conditions, the High 

Pressure Core Spray (HPCS) and RCIC systems perform similar 

functions. The RCIC System design requirements ensure that the criteria 

of Reference 1 are satisfied. 

The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, 

piping, and valves to provide steam to the turbine, as well as piping and 

valves to transfer water from the suction source to the core via the 

feedwater system line. Suction piping is provided from the condensate 

storage tank (CST) and the suppression pool. Pump suction is normally 

aligned to the CST to minimize injection of suppression pool water into 

the RPV. However, if the CST water supply is low, or the suppression 

pool level is high, an automatic transfer to the suppression pool water 

source ensures a water supply for continuous operation of the RCIC 

System. The steam supply to the turbine is piped from main steam line A, 

upstream of the inboard main steam line isolation valve. 

The RCIC System is designed to provide core cooling for a wide range of 

reactor pressures, [165] psig to [1155] psig. Upon receipt of an initiation 

signal, the RCIC turbine accelerates to a specified speed. As the RCIC 

flow increases, the turbine control valve is automatically adjusted to 

maintain design flow. Exhaust steam from the RCIC turbine is discharged 

to the suppression pool. A full flow test line is provided to route water 

from and to the CST to allow testing of the RCIC System during normal 

operation without injecting water into the RPV. 

The RCIC pump is provided with a minimum flow bypass line, which 

discharges to the suppression pool. The valve in this line automatically 

opens to prevent pump damage due to overheating when other discharge 

line valves are closed. To ensure rapid delivery of water to the RPV and 

to minimize water hammer effects, the RCIC System discharge line "keep 

fill" system is designed to maintain the pump discharge line filled with 

water. 
RCIC System 

B 3.5.3 

BWR/6 STS B 3.5.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The function of the RCIC System is to respond to transient events by 

SAFETY providing makeup coolant to the reactor. The RCIC System is not an 

ANALYSES Engineered Safety Feature System and no credit is taken in the safety 

analyses for RCIC System operation. The RCIC System satisfies 

Criterion 4 of 10 CFR 50.36(c)(2)(ii). 

LCO The OPERABILITY of the RCIC System provides adequate core cooling 

such that actuation of any of the ECCS subsystems is not required in the 

event of RPV isolation accompanied by a loss of feedwater flow. The 

RCIC System has sufficient capacity to maintain RPV inventory during an 

isolation event. 

APPLICABILITY The RCIC System is required to be OPERABLE in MODE 1, and 

MODES 2 and 3 with reactor steam dome pressure > 150 psig since 

RCIC is the primary non-ECCS water source for core cooling when the 

reactor is isolated and pressurized. In MODES 2 and 3 with reactor 

steam dome pressure ≤ 150 psig, and in MODES 4 and 5, RCIC is not 

required to be OPERABLE since the ECCS injection/spray subsystems 

can provide sufficient flow to the vessel. 

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC 

System. There is an increased risk associated with entering a MODE or 

other specified condition in the Applicability with an inoperable RCIC 

System and the provisions of LCO 3.0.4.b, which allow entry into a MODE 

or other specified condition in the Applicability with the LCO not met after 

performance of a risk assessment addressing inoperable systems and 

components, should not be applied in this circumstance. 

 A.1 and A.2

If the RCIC System is inoperable during MODE 1, or MODES 2 or 3 with 

reactor steam dome pressure > 150 psig, and the HPCS System is 

verified to be OPERABLE, the RCIC System must be restored to 

OPERABLE status within 14 days. In this Condition, loss of the RCIC 

System will not affect the overall plant capability to provide makeup 

inventory at high RPV pressure since the HPCS System is the only high 

pressure system assumed to function during a loss of coolant accident 

(LOCA). OPERABILITY of the HPCS is therefore verified immediately 

when the RCIC System is inoperable. This may be performed as an 

administrative check, by examining logs or other information, to determine 

if the HPCS is out of service for maintenance or other reasons. 

Verification does not require performing the Surveillances needed to 

demonstrate the OPERABILITY of the HPCS System. If the 

OPERABILITY of the HPCS System cannot be verified, however, 
RCIC System 

B 3.5.3 

BWR/6 STS B 3.5.3-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition B must be immediately entered. For transients and certain 

abnormal events with no LOCA, RCIC (as opposed to HPCS) is the 

preferred source of makeup coolant because of its relatively small 

capacity, which allows easier control of RPV water level. Therefore, a 

limited time is allowed to restore the inoperable RCIC to OPERABLE 

status. 

The 14 day Completion Time is based on a reliability study (Ref. 3) that 

evaluated the impact on ECCS availability, assuming that various 

components and subsystems were taken out of service. The results were 

used to calculate the average availability of ECCS equipment needed to 

mitigate the consequences of a LOCA as a function of allowed outage 

times (AOTs). Because of the similar functions of the HPCS and RCIC, 

the AOTs (i.e., Completion Times) determined for the HPCS are also 

applied to RCIC. 

B.1 and B.2

If the RCIC System cannot be restored to OPERABLE status within the 

associated Completion Time, or if the HPCS System is simultaneously 

inoperable, the plant must be brought to a condition in which the LCO 

does not apply. To achieve this status, the plant must be brought to at 

least MODE 3 within 12 hours and reactor steam dome pressure reduced 

to ≤ 150 psig within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

SURVEILLANCE SR 3.5.3.1

REQUIREMENTS 

The flow path piping has the potential to develop voids and pockets of 

entrained air. Maintaining the pump discharge line of the RCIC System 

full of water ensures that the system will perform properly, injecting its full 

capacity into the Reactor Coolant System upon demand. This will also 

prevent a water hammer following an initiation signal. One acceptable 

method of ensuring the line is full is to vent at the high points. The 31 day 

Frequency is based on the gradual nature of void buildup in the RCIC 

piping, the procedural controls governing system operation, and operating 

experience. 
RCIC System 

B 3.5.3 

BWR/6 STS B 3.5.3-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.5.3.2

Verifying the correct alignment for manual, power operated, and 

automatic valves in the RCIC flow path provides assurance that the 

proper flow path will exist for RCIC operation. This SR does not apply to 

valves that are locked, sealed, or otherwise secured in position since 

these were verified to be in the correct position prior to locking, sealing, or 

securing. A valve that receives an initiation signal is allowed to be in a 

nonaccident position provided the valve will automatically reposition in the 

proper stroke time. This SR does not require any testing or valve 

manipulation; rather, it involves verification that those valves capable of 

potentially being mispositioned are in the correct position. This SR does 

not apply to valves that cannot be inadvertently misaligned, such as 

check valves. For the RCIC System, this SR also includes the steam flow 

path for the turbine and the flow controller position. 

The 31 day Frequency of this SR was derived from the Inservice Testing 

Program requirements for performing valve testing at least every 92 days. 

The Frequency of 31 days is further justified because the valves are 

operated under procedural control and because improper valve position 

would affect only the RCIC System. This Frequency has been shown to 

be acceptable through operating experience. 

SR 3.5.3.3 and SR 3.5.3.4

The RCIC pump flow rates ensure that the system can maintain reactor 

coolant inventory during pressurized conditions with the RPV isolated. 

The flow tests for the RCIC System are performed at two different 

pressure ranges such that system capability to provide rated flow is 

tested both at the higher and lower operating ranges of the system. 

Additionally, adequate steam flow must be passing through the main 

turbine or turbine bypass valves to continue to control reactor pressure 

when the RCIC System diverts steam flow. Reactor steam pressure must 

be ≥ [920] psig to perform SR 3.5.3.3 and ≥ [150] psig to perform 

SR 3.5.3.4. Adequate steam flow is represented by [at least 1.25 turbine 

bypass valves open, or total steam flow ≥ 106

 lb/hr. Therefore, sufficient 

time is allowed after adequate pressure and flow are achieved to perform 

these SRs. Reactor startup is allowed prior to performing the low 

pressure Surveillance because the reactor pressure is low and the time to 

satisfactorily perform the Surveillance is short. The reactor pressure is 

allowed to be increased to normal operating pressure since it is assumed 
RCIC System 

B 3.5.3 

BWR/6 STS B 3.5.3-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

that the low pressure test has been satisfactorily completed and there is 

no indication or reason to believe that RCIC is inoperable. Therefore, 

these SRs are modified by Notes that state the Surveillances are not 

required to be performed until 12 hours after the reactor steam pressure 

and flow are adequate to perform the test. 

A 92 day Frequency for SR 3.5.3.3 is consistent with the Inservice 

Testing Program requirements. The 18 month Frequency for SR 3.5.3.4 

is based on the need to perform this Surveillance under the conditions 

that apply just prior to or during startup from a plant outage. Operating 

experience has shown that these components usually pass the SR when 

performed at the 18 month Frequency, which is based on the refueling 

cycle. Therefore, the Frequency was concluded to be acceptable from a 

reliability standpoint. 

SR 3.5.3.5

The RCIC System is required to actuate automatically to perform its 

design function. This Surveillance verifies that with a required system 

initiation signal (actual or simulated) the automatic initiation logic of RCIC 

will cause the system to operate as designed, including actuation of the 

system throughout its emergency operating sequence, automatic pump 

startup and actuation of all automatic valves to their required positions. 

This Surveillance test also ensures that the RCIC System will 

automatically restart on an RPV low water level (Level 2) signal received 

subsequent to an RPV high water level (Level 8) trip and that the suction 

is automatically transferred from the CST to the suppression pool. The 

LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.2 overlaps 

this Surveillance to provide complete testing of the assumed safety 

function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the SR when performed at the 18 month 

Frequency, which is based on the refueling cycle. Therefore, the 

Frequency was concluded to be acceptable from a reliability standpoint. 

This SR is modified by a Note that excludes vessel injection during the 

Surveillance. Since all active components are testable and full flow can 

be demonstrated by recirculation through the test line, coolant injection 

into the RPV is not required during the Surveillance. 
RCIC System 

B 3.5.3 

BWR/6 STS B 3.5.3-6 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 33. 

 2. FSAR, Section [5.4.6.2]. 

 3. Memorandum from R.L. Baer (NRC) to V. Stello, Jr. (NRC), 

"Recommended Interim Revisions to LCO's for ECCS Components," 

December 1, 1975. 
Primary Containment 

B 3.6.1.1 

BWR/6 STS B 3.6.1.1-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.1 Primary Containment 

BASES 

BACKGROUND The function of the primary containment is to isolate and contain fission 

products released from the Reactor Primary System following a design 

basis loss of coolant accident (LOCA) and to confine the postulated 

release of radioactive material to within limits. The primary containment 

consists of a steel lined, reinforced concrete vessel, which surrounds the 

Reactor Primary System and provides an essentially leak tight barrier 

against an uncontrolled release of radioactive material to the 

environment. Additionally, this structure provides shielding from the 

fission products that may be present in the primary containment 

atmosphere following accident conditions. 

The isolation devices for the penetrations in the primary containment 

boundary are a part of the primary containment leak tight barrier. To 

maintain this leak tight barrier: 

a. All penetrations required to be closed during accident conditions are 

either: 

1. Capable of being closed by an OPERABLE automatic 

containment isolation system or 

2. Closed by manual valves, blind flanges, or de-activated 

automatic valves secured in their closed positions, except as 

provided in LCO 3.6.1.3, "Primary Containment Isolation Valves 

(PCIVs)," 

b. Primary containment air locks are OPERABLE, except as provided in 

LCO 3.6.1.2, "Primary Containment Air Locks," 

c. All equipment hatches are closed, and 

[ d. The pressurized sealing mechanism associated with a penetration is 

OPERABLE, except as provided in LCO 3.6.1.[ ]. ] 

This Specification ensures that the performance of the primary 

containment, in the event of a Design Basis Accident (DBA), meets the 

assumptions used in the safety analyses of References 1 and 2. 

SR 3.6.1.1.1 leakage rate requirements are in conformance with 

10 CFR 50, Appendix J, Option [A][B] (Ref. 3), as modified by approved 

exemptions. 
Primary Containment 

B 3.6.1.1 

BWR/6 STS B 3.6.1.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The safety design basis for the primary containment is that it must 

SAFETY withstand the pressures and temperatures of the limiting DBA without 

ANALYSES exceeding the design leakage rate. 

The DBA that postulates the maximum release of radioactive material 

within primary containment is a LOCA. In the analysis of this accident, it 

is assumed that primary containment is OPERABLE such that release of 

fission products to the environment is controlled by the rate of primary 

containment leakage. 

Analytical methods and assumptions involving the primary containment 

are presented in References 1 and 2. The safety analyses assume a 

nonmechanistic fission product release following a DBA, which forms the 

basis for determination of offsite doses. The fission product release is, in 

turn, based on an assumed leakage rate from the primary containment. 

OPERABILITY of the primary containment ensures that the leakage rate 

assumed in the safety analyses is not exceeded. 

The maximum allowable leakage rate for the primary containment (La) is 

[0.437]% by weight of the containment and drywell air per 24 hours at the 

design basis LOCA maximum peak containment pressure (Pa) of 

([11.5] psig) (Ref. 4). 

Primary containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Primary containment OPERABILITY is maintained by limiting leakage to 

≤ 1.0 La, except prior to the first startup after performing a required 

Primary Containment Leakage Rate Testing Program leakage test. At 

this time the applicable leakage limits must be met. 

 Compliance with this LCO will ensure a primary containment 

configuration, including equipment hatches, that is structurally sound and 

that will limit leakage to those leakage rates assumed in the safety 

analysis. Individual leakage rates specified for the primary containment 

air locks are addressed in LCO 3.6.1.2. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, primary containment 

is not required to be OPERABLE in MODES 4 and 5 to prevent leakage 

of radioactive material from primary containment. 
Primary Containment 

B 3.6.1.1 

BWR/6 STS B 3.6.1.1-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

In the event that primary containment is inoperable, primary containment 

must be restored to OPERABLE status within 1 hour. The 1 hour 

Completion Time provides a period of time to correct the problem that is 

commensurate with the importance of maintaining primary containment 

OPERABILITY during MODES 1, 2, and 3. This time period also ensures 

that the probability of an accident (requiring primary containment 

OPERABILITY) occurring during periods where primary containment is 

inoperable is minimal. 

B.1 and B.2

If primary containment cannot be restored to OPERABLE status within 

the associated Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 12 hours and to MODE 4 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE SR 3.6.1.1.1

REQUIREMENTS 

Maintaining the primary containment OPERABLE requires compliance 

with the visual examinations and leakage rate test requirements of the 

Primary Containment Leakage Rate Testing Program. Failure to meet air 

lock leakage testing (SR 3.6.1.2.1 and SR 3.6.1.2.4), [secondary 

containment bypass leakage (SR 3.6.1.3.9),] resilient seal primary 

containment purge valve leakage testing (SR 3.6.1.3.6), or main steam 

isolation valve leakage (SR 3.6.1.3.10) does not necessarily result in a 

failure of this SR. The impact of the failure to meet these SRs must be 

evaluated against the Type A, B, and C acceptance criteria of the Primary 

Containment Leakage Rate Testing Program. As left leakage prior to the 

first startup after performing a required Primary Containment Leakage 

Rate Testing Program leakage test is required to be < 0.6 La for combined 

Type B and C leakage, and [< 0.75 La for Option A] [≤ 0.75 La for Option 

B] for overall Type A leakage. At all other times between required 

leakage rate tests, the acceptance criteria is based on an overall Type A 

leakage limit of ≤ 1.0 La. At ≤ 1.0 La the offsite dose consequences are 

bounded by the assumptions of the safety analysis. The Frequency is 

required by the Primary Containment Leakage Rate Testing Program. 
Primary Containment 

B 3.6.1.1 

BWR/6 STS B 3.6.1.1-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Regulatory Guide 1.163 and NEI 94-01 include acceptance criteria for asleft and as-found Type A leakage rates and combined Type B and C 

leakage rates, which may be reflected in the Bases. 

-------------------------------------------------------------------------------------------------- 

[ SR 3.6.1.1.2

The structural integrity of the primary containment is ensured by the 

successful completion of the Primary Containment Tendon Surveillance 

Program and by associated visual inspections of the steel liner and 

penetrations for evidence of deterioration or breach of integrity. This 

ensures that the structural integrity of the primary containment will be 

maintained in accordance with the provisions of the Primary Containment 

Tendon Surveillance Program. Testing and Frequency are consistent 

with the recommendations of Regulatory Guide 1.35 (Ref. 5).] 

REFERENCES 1. FSAR, Section [6.2]. 

 2. FSAR, Section [15.6.5]. 

 3. 10 CFR 50, Appendix J, Option [A][B]. 

 4. FSAR, Section [ ]. 

 5. Regulatory Guide 1.35, Revision [1]. 
Primary Containment Air Locks 

B 3.6.1.2 

BWR/6 STS B 3.6.1.2-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.2 Primary Containment Air Locks 

BASES 

BACKGROUND Two double door primary containment air locks have been built into the 

primary containment to provide personnel access to the primary 

containment and to provide primary containment isolation during the 

process of personnel entry and exit. The air locks are designed to 

withstand the same loads, temperatures, and peak design internal and 

external pressures as the primary containment (Ref. 1). As part of the 

primary containment, the air lock limits the release of radioactive material 

to the environment during normal unit operation and through a range of 

transients and accidents up to and including postulated Design Basis 

Accidents (DBAs). 

Each air lock door has been designed and tested to certify its ability to 

withstand pressure in excess of the maximum expected pressure 

following a DBA in primary containment. Each of the doors has inflatable 

seals that are maintained > [60] psig by the seal air flask and pneumatic 

system, which is maintained at a pressure ≥ [90] psig. Each door has two 

seals to ensure they are single failure proof in maintaining the leak tight 

boundary of primary containment. 

Each air lock is nominally a right circular cylinder, 10 ft 2 inches in 

diameter, with doors at each end that are interlocked to prevent 

simultaneous opening. The air locks are provided with limit switches on 

both doors in each air lock that provide control room indication of door 

position. [Additionally, control room indication is provided to alert the 

operator whenever an air lock interlock mechanism is defeated.] During 

periods when primary containment is not required to be OPERABLE, the 

air lock interlock mechanism may be disabled, allowing both doors of an 

air lock to remain open for extended periods when frequent primary 

containment entry is necessary. Under some conditions, as allowed by 

this LCO, the primary containment may be accessed through the air lock 

when the door interlock mechanism has failed, by manually performing 

the interlock function. 

The primary containment air locks form part of the primary containment 

pressure boundary. As such, air lock integrity and leak tightness are 

essential for maintaining primary containment leakage rate to within limits 

in the event of a DBA. Not maintaining air lock integrity or leak tightness 

may result in a leakage rate in excess of that assumed in the unit safety 

analysis. 
Primary Containment Air Locks 

B 3.6.1.2 

BWR/6 STS B 3.6.1.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The DBA that postulates the maximum release of radioactive material 

SAFETY within primary containment is a LOCA. In the analysis of this accident, it 

ANALYSES is assumed that primary containment is OPERABLE, such that release of 

fission products to the environment is controlled by the rate of primary 

containment leakage. The primary containment is designed with a 

maximum allowable leakage rate (La) of [0.437]% by weight of the 

containment and drywell air per 24 hours at the calculated maximum peak 

containment pressure (Pa) of [11.5] psig. This allowable leakage rate 

forms the basis for the acceptance criteria imposed on the SRs 

associated with the air locks. 

Primary containment air lock OPERABILITY is also required to minimize 

the amount of fission product gases that may escape primary 

containment through the air lock and contaminate and pressurize the 

secondary containment. 

Primary containment air locks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO As part of the primary containment pressure boundary, the air lock's 

safety function is related to control of containment leakage rates following 

a DBA. Thus, the air lock's structural integrity and leak tightness are 

essential to the successful mitigation of such an event. 

The primary containment air locks are required to be OPERABLE. For 

each air lock to be considered OPERABLE, the air lock interlock 

mechanism must be OPERABLE, the air lock must be in compliance with 

the Type B air lock leakage test, and both air lock doors must be 

OPERABLE. The interlock allows only one air lock door to be open at a 

time. This provision ensures that a gross breach of primary containment 

does not exist when primary containment is required to be OPERABLE. 

Closure of a single door in each air lock is sufficient to provide a leak tight 

barrier following postulated events. Nevertheless, both doors are kept 

closed when the air lock is not being used for normal entry into or exit 

from primary containment. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, the primary 

containment air lock is not required to be OPERABLE in MODES 4 and 5 

to prevent leakage of radioactive material from primary containment. 
Primary Containment Air Locks 

B 3.6.1.2 

BWR/6 STS B 3.6.1.2-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS The ACTIONS are modified by Note 1, which allows entry and exit to 

perform repairs of the affected air lock component. If the outer door is 

inoperable, then it may be easily accessed for most repairs. It is 

preferred that the air lock be accessed from inside primary containment 

by entering through the other OPERABLE air lock. However, if this is not 

practicable, or if repairs on either door must be performed from the barrel 

side of the door, then it is permissible to enter the air lock through the 

OPERABLE door, which means there is a short time during which the 

primary containment boundary is not intact (during access through the 

OPERABLE door). The ability to open the OPERABLE door, even if it 

means the primary containment boundary is temporarily not intact, is 

acceptable due to the low probability of an event that could pressurize the 

primary containment during the short time in which the OPERABLE door 

is expected to be open. After each entry and exit, the OPERABLE door 

must be immediately closed. 

Note 2 has been included to provide clarification that, for this LCO, 

separate Condition entry is allowed for each air lock. This is acceptable, 

since the Required Actions for each Condition provide appropriate 

compensatory actions for each inoperable air lock. Complying with the 

Required Actions may allow for continued operation, and a subsequent 

inoperable air lock is governed by subsequent Condition entry and 

application of associated Required Actions. 

The ACTIONS are modified by a third Note, which ensures appropriate 

remedial actions are taken when necessary. Pursuant to LCO 3.0.6, 

ACTIONS are not required even if primary containment is exceeding its 

leakage limit. Therefore, the Note is added to require ACTIONS for 

LCO 3.6.1.1, "Primary Containment," to be taken in this event. 

A.1, A.2, and A.3

With one primary containment air lock door inoperable in one or more 

primary containment air locks, the OPERABLE door must be verified 

closed (Required Action A.1) in each affected air lock. This ensures that 

a leak tight primary containment barrier is maintained by the use of an 

OPERABLE air lock door. This action must be completed within 1 hour. 

The 1 hour Completion Time is consistent with the ACTIONS of 

LCO 3.6.1.1, which requires that primary containment be restored to 

OPERABLE status within 1 hour. 
Primary Containment Air Locks 

B 3.6.1.2 

BWR/6 STS B 3.6.1.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

In addition, the affected air lock penetration must be isolated by locking 

closed the OPERABLE air lock door within the 24 hour Completion Time. 

The 24 hour Completion Time is considered reasonable for locking the 

OPERABLE air lock door, considering the OPERABLE door of the 

affected air lock is being maintained closed. 

Required Action A.3 ensures that the affected air lock with an inoperable 

door has been isolated by the use of a locked closed OPERABLE air lock 

door. This ensures that an acceptable primary containment leakage 

boundary is maintained. The Completion Time of once per 31 days is 

based on engineering judgment and is considered adequate in view of the 

low likelihood of a locked door being mispositioned and other 

administrative controls. 

Required Action A.3 is modified by a Note that applies to air lock doors 

located in high radiation areas and allows these doors to be verified 

locked closed by use of administrative controls. Allowing verification by 

administrative controls is considered acceptable, since access to these 

areas is typically restricted. Therefore, the probability of misalignment of 

the door, once it has been verified to be in the proper position, is small. 

The Required Actions have been modified by two Notes. Note 1 ensures 

that only the Required Actions and associated Completion Times of 

Condition C are required if both doors in the air lock are inoperable. With 

both doors in the air lock inoperable, an OPERABLE door is not available 

to be closed. Required Actions C.1 and C.2 are the appropriate remedial 

actions. The exception of Note 1 does not affect tracking the Completion 

Time from the initial entry into Condition A; only the requirement to 

comply with the Required Actions. Note 2 allows use of the air lock for 

entry and exit for 7 days under administrative controls if both air locks 

have an inoperable door. This 7 day restriction begins when the second 

air lock is discovered inoperable. 

Primary containment entry may be required to perform Technical 

Specifications (TS) Surveillances and Required Actions, as well as other 

activities on equipment inside primary containment that are required by 

TS or activities on equipment that support TS-required equipment. This 

Note is not intended to preclude performing other activities (i.e., non-TSrelated activities) if the primary containment was entered, using the 

inoperable air lock, to perform an allowed activity listed above. This 

allowance is acceptable due to the low probability of an event that could 

pressurize the primary containment during the short time that the 

OPERABLE door is expected to be open. 
Primary Containment Air Locks 

B 3.6.1.2 

BWR/6 STS B 3.6.1.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1, B.2, and B.3

With an air lock interlock mechanism inoperable in one or both primary 

containment air locks, the Required Actions and associated Completion 

Times are consistent with those specified in Condition A. 

The Required Actions have been modified by two Notes. Note 1 ensures 

that only the Required Actions and associated Completion Times of 

Condition C are required if both doors in one air lock are inoperable. With 

both doors in the air lock inoperable, an OPERABLE door is not available 

to be closed. Required Actions C.1 and C.2 are the appropriate remedial 

actions. Note 2 allows entry into and exit from the primary containment 

under the control of a dedicated individual stationed at the air lock to 

ensure that only one door is opened at a time (i.e., the individual performs 

the function of the interlock). 

Required Action B.3 is modified by a Note that applies to air lock doors 

located in high radiation areas and allows these doors to be verified 

locked closed by use of administrative controls. Allowing verification by 

administrative controls is considered acceptable, since access to these 

areas is typically restricted. Therefore, the probability of misalignment of 

the door, once it has been verified to be in the proper position, is small. 

C.1, C.2, and C.3

With one or more air locks inoperable for reasons other than those 

described in Condition A or B, Required Action C.1 requires action to be 

immediately initiated to evaluate containment overall leakage rates using 

current air lock leakage test results. An evaluation is acceptable since it 

is overly conservative to immediately declare the primary containment 

inoperable if both doors in an air lock have failed a seal test or if the 

overall air lock leakage is not within limits. In many instances (e.g., only 

one seal per door has failed) primary containment remains OPERABLE, 

yet only 1 hour (according to LCO 3.6.1.1) would be provided to restore 

the air lock door to OPERABLE status prior to requiring a plant shutdown. 

In addition, even with both doors failing the seal test, the overall 

containment leakage rate can still be within limits. 

Required Action C.2 requires that one door in the affected primary 

containment air locks must be verified closed. This Required Action must 

be completed within the 1 hour Completion Time. This specified time 

period is consistent with the ACTIONS of LCO 3.6.1.1, which require that 

primary containment be restored to OPERABLE status within 1 hour. 
Primary Containment Air Locks 

B 3.6.1.2 

BWR/6 STS B 3.6.1.2-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Additionally, the air lock must be restored to OPERABLE status within 

24 hours. The 24 hour Completion Time is reasonable for restoring an 

inoperable air lock to OPERABLE status considering that at least one 

door is maintained closed in each affected air lock. 

D.1 and D.2

If the inoperable primary containment air lock cannot be restored to 

OPERABLE status within the associated Completion Time, the plant must 

be brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 12 hours and 

to MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

SURVEILLANCE SR 3.6.1.2.1

REQUIREMENTS 

Maintaining primary containment air locks OPERABLE requires 

compliance with the leakage rate test requirements of the Primary 

Containment Leakage Rate Testing Program. This SR reflects the 

leakage rate testing requirements with regard to air lock leakage (Type B 

leakage tests). The acceptance criteria were established [during initial air 

lock and primary containment OPERABILITY testing]. The periodic 

testing requirements verify that the air lock leakage does not exceed the 

allowed fraction of the overall primary containment leakage rate. The 

Frequency is required by the Primary Containment Leakage Rate Testing 

Program. 

The SR has been modified by two Notes. Note 1 states that an 

inoperable air lock door does not invalidate the previous successful 

performance of the overall air lock leakage test. This is considered 

reasonable since either air lock door is capable of providing a fission 

product barrier in the event of a DBA. Note 2 has been added to this SR, 

requiring the results to be evaluated against the acceptance criteria which 

is applicable to SR 3.6.1.1.1. This ensures that air lock leakage is 

properly accounted for in determining the combined Type B and C 

primary containment leakage rate. 
Primary Containment Air Locks 

B 3.6.1.2 

BWR/6 STS B 3.6.1.2-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.6.1.2.2

The seal air flask pressure is verified to be at ≥ [90] psig every 7 days to 

ensure that the seal system remains viable. It must be checked because 

it could bleed down during or following access through the air lock, which 

occurs regularly. The 7 day Frequency has been shown to be acceptable 

through operating experience and is considered adequate in view of the 

other indications available to operations personnel that the seal air flask 

pressure is low. ]

SR 3.6.1.2.3

The air lock interlock mechanism is designed to prevent simultaneous 

opening of both doors in the air lock. Since both the inner and outer 

doors of an air lock are designed to withstand the maximum expected 

post accident primary containment pressure (Ref. 3), closure of either 

door will support primary containment OPERABILITY. Thus, the interlock 

feature supports primary containment OPERABILITY while the air lock is 

being used for personnel transit in and out of the containment. Periodic 

testing of this interlock demonstrates that the interlock will function as 

designed and that simultaneous inner and outer door opening will not 

inadvertently occur. Due to the purely mechanical nature of this interlock, 

and given that the interlock mechanism is not normally challenged when 

the primary containment air lock door is used for entry and exit 

(procedures require strict adherence to single door opening), this test is 

only required to be performed every 24 months. The 24 month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage, and the potential for loss of 

primary containment OPERABILITY if the Surveillance were performed 

with the reactor at power. The 24 month Frequency for the interlock is 

justified based on generic operating experience. The 24 month 

Frequency is based on engineering judgment and is considered adequate 

given that the interlock is not challenged during the use of the airlock. 
Primary Containment Air Locks 

B 3.6.1.2 

BWR/6 STS B 3.6.1.2-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.6.1.2.4

A seal pneumatic system test to ensure that pressure does not decay at a 

rate equivalent to > [2] psig for a period of [48] hours from an initial 

pressure of [90] psig is an effective leakage rate test to verify system 

performance. The [18] month Frequency is based on the need to perform 

this Surveillance under the conditions that apply during a plant outage 

and the potential for an unplanned transient if the Surveillance were 

performed with the reactor at power. Operating experience has shown 

these components usually pass the Surveillance when performed at the 

[18] month Frequency, which is based on the refueling cycle. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint. ] 

REFERENCES 1. FSAR, Section [3.8]. 

 2. 10 CFR 50, Appendix J, Option [A][B]. 

 3. FSAR, Table [6.2-13]. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.3 Primary Containment Isolation Valves (PCIVs) 

BASES 

BACKGROUND The function of the PCIVs, in combination with other accident mitigation 

systems, is to limit fission product release during and following postulated 

Design Basis Accidents (DBAs) to within limits. Primary containment 

isolation within the time limits specified for those PCIVs designed to close 

automatically ensures that the release of radioactive material to the 

environment will be consistent with the assumptions used in the analyses 

for a DBA. 

The OPERABILITY requirements for PCIVs help ensure that an adequate 

primary containment boundary is maintained during and after an accident 

by minimizing potential paths to the environment. Therefore, the 

OPERABILITY requirements provide assurance that the primary 

containment function assumed in the safety analysis will be maintained. 

These isolation devices consist of either passive devices or active 

(automatic) devices. Manual valves, de-activated automatic valves 

secured in their closed position (including check valves with flow through 

the valve secured), blind flanges, and closed systems are considered 

passive devices. Check valves, or other automatic valves designed to 

close without operator action following an accident, are considered active 

devices. Two barriers in series are provided for each penetration so that 

no single credible failure or malfunction of an active component can result 

in a loss of isolation or leakage that exceeds limits assumed in the safety 

analysis. One of these barriers may be a closed system. 

The [6] and [20] inch primary containment purge valves are PCIVs that 

are qualified for use during all operational conditions. The [6] and 

[20] inch primary containment purge valves are normally maintained 

closed in MODES 1, 2, and 3 to ensure leak tightness. The purge valves 

must be closed when not being used for pressure control, ALARA, or air 

quality considerations to ensure that the primary containment boundary 

assumed in the safety analysis will be maintained. 

APPLICABLE The PCIV LCO was derived from the assumptions related to minimizing 

SAFETY the loss of reactor coolant inventory, and establishing the primary 

ANALYSES containment boundary during major accidents. As part of the primary 

containment boundary, PCIV OPERABILITY supports leak tightness of 

primary containment. Therefore, the safety analysis of any event 

requiring isolation of primary containment is applicable to this LCO. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The DBAs that result in a release of radioactive material for which the 

consequences are mitigated by PCIVs are a loss of coolant accident 

(LOCA), a main steam line break (MSLB), and a fuel handling accident 

[involving handling recently irradiated fuel (i.e., fuel that has occupied part 

of a critical reactor core within the previous [X] days)] inside primary 

containment (Refs. 1 and 2). In the analysis for each of these accidents, 

it is assumed that PCIVs are either closed or function to close within the 

required isolation time following event initiation. This ensures that 

potential paths to the environment through PCIVs (including primary 

containment purge valves) are minimized. Of the events analyzed in 

Reference 1, the MSLB is the most limiting event due to radiological 

consequences. The closure time of the main steam isolation valves 

(MSIVs) is a significant variable from a radiological standpoint. The 

MSIVs are required to close within 3 to 5 seconds since the 5 second 

closure time is assumed in the analysis. The safety analyses assume 

that the purge valves are closed at event initiation. Likewise, it is 

assumed that the primary containment is isolated such that release of 

fission products to the environment is controlled. 

The DBA analysis assumes that within 60 seconds after the accident, 

isolation of the primary containment is complete and leakage terminated, 

except for the maximum allowable leakage, La. The primary containment 

isolation total response time of 60 seconds includes signal delay, diesel 

generator startup (for loss of offsite power), and PCIV stroke times. 

[ The single failure criterion required to be imposed in the conduct of unit 

safety analyses was considered in the original design of the primary 

containment purge valves. Two valves in series on each purge line 

provide assurance that both the supply and exhaust lines could be 

isolated even if a single failure occurred. ]

[ The purge valves may be unable to close in the environment following a 

LOCA. Therefore, each of the purge valves is required to remain sealed 

closed during MODES 1, 2, and 3. In this case, the single failure criterion 

remains applicable to the primary containment purge valve due to failure 

in the control circuit associated with each valve. Again, the primary 

containment purge valve design precludes a single failure from 

compromising the primary containment boundary as long as the system is 

operated in accordance with this LCO. ]

PCIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-3 Rev. 3.0, 03/31/04 

BASES 

LCO PCIVs form a part of the primary containment boundary. The PCIV safety 

function is related to minimizing the loss of reactor coolant inventory and 

establishing the primary containment boundary during a DBA. 

The power operated, automatic isolation valves are required to have 

isolation times within limits and actuate on an automatic isolation signal. 

Primary containment purge valves that are not qualified to close under 

accident conditions must be sealed closed [or blocked to prevent full 

opening] to be OPERABLE. The valves covered by this LCO are listed 

with their associated stroke times in the FSAR (Ref. 3). 

The normally closed PCIVs are considered OPERABLE when manual 

valves are closed or open in accordance with appropriate administrative 

controls, automatic valves are de-activated and secured in their closed 

position, blind flanges are in place, and closed systems are intact. These 

passive isolation valves and devices are those listed in Reference 3. 

Purge valves with resilient seals, secondary bypass valves, MSIVs, and 

hydrostatically tested valves must meet additional leakage rate 

requirements. Other PCIV leakage rates are addressed by LCO 3.6.1.1, 

"Primary Containment," as Type B or C testing. 

This LCO provides assurance that the PCIVs will perform their designed 

safety functions to minimize the loss of reactor coolant inventory and 

establish the primary containment boundary during accidents. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, most PCIVs are not 

required to be OPERABLE and the primary containment purge valves are 

not required to be sealed closed in MODES 4 and 5. Certain valves are 

required to be OPERABLE, however, to prevent inadvertent reactor 

vessel draindown and release of radioactive material during a postulated 

fuel handling accident [involving handling recently irradiated fuel (i.e., fuel 

that has occupied part of a critical reactor core within the previous [X] 

days)]. These valves are those whose associated instrumentation is 

required to be OPERABLE according to LCO 3.3.6.1, "Primary 

Containment Isolation Instrumentation." (This does not include the valves 

that isolate the associated instrumentation.) 

ACTIONS The ACTIONS are modified by a Note allowing penetration flow path(s) 

[except for the [ ] inch primary containment purge valve flow path(s)] to 

be unisolated intermittently under administrative controls. [The primary 

containment purge valve exception applies to primary containment purge 

valves that are not qualified to close under accident conditions.] These 

controls consist of stationing a dedicated operator at the controls of the 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

valve, who is in continuous communication with the control room. In this 

way, the penetration can be rapidly isolated when a need for primary 

containment isolation is indicated. Due to the size of the containment 

purge line penetration and the fact that those penetrations exhaust 

directly from the primary containment atmosphere to the environment, the 

penetration flow path containing these valves may not be opened under 

administrative controls. A single purge valve in a penetration flow path 

may be opened to effect repairs to an inoperable valve, as allowed by the 

exception to SR 3.6.1.3.1 and Note 2 to SR 3.6.1.3.2. 

A second Note has been added to provide clarification that, for the 

purpose of this LCO, separate Condition entry is allowed for each 

penetration flow path. This is acceptable, since the Required Actions for 

each Condition provide appropriate compensatory actions for each 

inoperable PCIV. Complying with the Required Actions may allow for 

continued operation, and subsequent inoperable PCIVs are governed by 

subsequent Condition entry and application of associated Required 

Actions. 

The ACTIONS are modified by Notes 3 and 4. Note 3 ensures 

appropriate remedial actions are taken, if necessary, if the affected 

system(s) are rendered inoperable by an inoperable PCIV (e.g., an 

Emergency Core Cooling System subsystem is inoperable due to a failed 

open test return valve). Note 4 ensures appropriate remedial actions are 

taken when the primary containment leakage limits are exceeded. 

Pursuant to LCO 3.0.6, these ACTIONS are not required even when the 

associated LCO is not met. Therefore, Notes 3 and 4 are added to 

require the proper actions are taken. 

A.1 and A.2

With one or more penetration flow paths with one PCIV inoperable, 

[except for secondary containment bypass leakage rate, MSIV leakage 

rate, purge valve leakage rate, or hydrostatically tested line leakage rate 

not within limits], the affected penetration flow path must be isolated. The 

method of isolation must include the use of at least one isolation barrier 

that cannot be adversely affected by a single active failure. Isolation 

barriers that meet this criterion are a closed and de-activated automatic 

valve, a closed manual valve, a blind flange, and a check valve with flow 

through the valve secured. For penetrations isolated in accordance with 

Required Action A.1, the device used to isolate the penetration should be 

the closest available one to the primary containment. The Required 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Action must be completed within the 4 hour Completion Time (8 hours for 

main steam lines). The specified time period of 4 hours is reasonable 

considering the time required to isolate the penetration and the relative 

importance of supporting primary containment OPERABILITY during 

MODES 1, 2, and 3. For main steam lines, an 8 hour Completion Time is 

allowed. The Completion Time of 8 hours for the main steam lines allows 

a period of time to restore the MSIVs to OPERABLE status given the fact 

that MSIV closure will result in isolation of the main steam line(s) and a 

potential for plant shutdown. 

For affected penetrations that have been isolated in accordance with 

Required Action A.1, the affected penetration flow path must be verified to 

be isolated on a periodic basis. This is necessary to ensure that primary 

containment penetrations required to be isolated following an accident, 

and no longer capable of being automatically isolated, will be in the 

isolation position should an event occur. This Required Action does not 

require any testing or device manipulation. Rather, it involves verification 

that those devices outside the primary containment, drywell, and steam 

tunnel and capable of being mispositioned are in the correct position. 

The Completion Time for this verification of "once per 31 days for isolation 

devices outside primary containment, drywell, and steam tunnel," is 

appropriate because the devices are operated under administrative 

controls and the probability of their misalignment is low. For devices 

inside the primary containment, drywell, or steam tunnel, the specified 

time period of "prior to entering MODE 2 or 3 from MODE 4, if not 

performed within the previous 92 days," is based on engineering 

judgment and is considered reasonable in view of the inaccessibility of 

the devices and the existence of other administrative controls ensuring 

that device misalignment is an unlikely possibility. 

Condition A is modified by a Note indicating that this Condition is only 

applicable to those penetration flow paths with two [or more] PCIVs. For 

penetration flow paths with one PCIV, Condition C provides appropriate 

Required Actions. 

Required Action A.2 is modified by two Notes. Note 1 applies to isolation 

devices located in high radiation areas and allows them to be verified by 

use of administrative means. Allowing verification by administrative 

means is considered acceptable, since access to these areas is typically 

restricted. Note 2 applies to isolation devices that are locked, sealed, or 

otherwise secured in position and allows these devices to be verified 

closed by use of administrative means. Allowing verification by 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. Therefore, the probability of 

misalignment of these devices, once they have been verified to be in the 

proper position, is low. 

B.1

With one or more penetration flow paths with two [or more] PCIVs 

inoperable, [except for secondary containment bypass leakage rate, 

MSIV leakage rate, purge valve leakage rate, or hydrostatically tested line 

leakage rate not within limit], either the inoperable PCIVs must be 

restored to OPERABLE status or the affected penetration flow path must 

be isolated within 1 hour. The method of isolation must include the use of 

at least one isolation barrier that cannot be adversely affected by a single 

active failure. 

Isolation barriers that meet this criterion are a closed and de-activated 

automatic valve, a closed manual valve, and a blind flange. The 1 hour 

Completion Time is consistent with the ACTIONS of LCO 3.6.1.1. 

Condition B is modified by a Note indicating this Condition is only 

applicable to penetration flow paths with two [or more] PCIVs. For 

penetration flow paths with one PCIV, Condition C provides the 

appropriate Required Actions. 

C.1 and C.2

When one or more penetration flow paths with one PCIV inoperable, 

[except for secondary containment bypass leakage rate, MSIV leakage 

rate, purge valve leakage rate, or hydrostatically tested line leakage rate 

not within limit], the inoperable valve must be restored to OPERABLE 

status or the affected penetration flow path must be isolated. The method 

of isolation must include the use of at least one isolation barrier that 

cannot be adversely affected by a single active failure. Isolation barriers 

that meet this criterion are a closed and de-activated automatic valve, a 

closed manual valve, and a blind flange. A check valve may not be used 

to isolate the affected penetration. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The [4] hour Completion Time is left as 4 hours consistent with the 

Completion Time of Required Action A.1 for most penetrations; or a plant 

specific evaluation is provided for NRC review for cases other than for 

closed system penetrations and EFCVs (which have been reviewed and 

approved for 72 hours). If all penetrations are accepted for 72 hours, the 

Completion Time is simplified to state 72 hours. 

-------------------------------------------------------------------------------------------------- 

The Completion Time of [4] hours is reasonable considering the time 

required to isolate the penetration and the relative importance of 

supporting primary containment OPERABILITY during MODES 1, 2, 

and 3. The 72 hour Completion Time is reasonable considering the 

relative stability of the closed system (hence, reliability) to act as a 

penetration isolation boundary and the relative importance of supporting 

primary containment OPERABILITY during MODES 1, 2, and 3. The 

closed system must meet the requirements of Ref. 5. In the event the 

affected penetration is isolated in accordance with Required Action C.1, 

the affected penetration flow path must be verified to be isolated on a 

periodic basis. This is necessary to ensure that primary containment 

penetrations required to be isolated following an accident are isolated. 

The Completion Time of once per 31 days for verifying that each affected 

penetration is isolated is appropriate because the valves are operated 

under administrative controls and the probability of their misalignment is 

low. 

Condition C is modified by a Note indicating this Condition is applicable 

only to those penetration flow paths with only one PCIV. For penetration 

flow paths with two PCIVs, Conditions A and B provide the appropriate 

Required Actions. This Note is necessary since this Condition is written 

specifically to address those penetrations with a single PCIV. 

Required Action C.2 is modified by two Notes. Note 1 applies to valves 

and blind flanges located in high radiation areas and allows them to be 

verified by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since access to these 

areas is typically restricted. Note 2 applies to isolation devices that are 

locked, sealed, or otherwise secured in position and allows these devices 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. Therefore, the probability of 

misalignment of these valves, once they have been verified to be in the 

proper position, is low. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ D.1

With the [secondary containment bypass leakage rate (SR 3.6.1.3.9),] 

MSIV leakage rate (SR 3.6.1.3.10), [purge valve leakage rate 

(SR 3.6.1.3.6),] [or] [hydrostatically tested line leakage rate 

(SR 3.6.1.3.11)], not within limit, the assumptions of the safety analysis 

are not met. Therefore, the leakage must be restored to within limit. 

Restoration can be accomplished by isolating the penetration that caused 

the limit to be exceeded by use of one closed and de-activated automatic 

valve, closed manual valve, or blind flange. When a penetration is 

isolated, the leakage rate for the isolation penetration is assumed to be 

the actual pathway leakage through the isolation device. If two isolation 

devices are used to isolate the penetration, the leakage rate is assumed 

to be the lesser actual pathway leakage of the two devices. The 4 hour 

Completion Time for hydrostatically tested line leakage [not on a closed 

system] and for secondary containment bypass leakage is reasonable 

considering the time required to restore the leakage by isolating the 

penetration and the relative importance of secondary containment bypass 

leakage to the overall containment function. For MSIV leakage, an 8 hour 

Completion Time is allowed. The Completion Time of 8 hours for MSIV 

leakage allows a period of time to restore the MSIVs to OPERABLE 

status given the fact that MSIV closure will result in isolation of the main 

steam line(s) and potential for plant shutdown. [The 24 hour Completion 

Time for purge valve leakage is acceptable considering the purge valves 

remain closed so that a gross breach of the containment does not exist.] 

[The 72 hour Completion Time for hydrostatically tested line leakage [on a 

closed system] is acceptable based on the available water seal expected 

to remain as a gaseous fission product boundary during the accident 

[, and, in many cases, an associated closed system]. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The bracketed options provided in ACTION D reflect options in plant 

design and options in adopting the associated leakage rate Surveillances. 

The options (both in ACTION D and ACTION E) for purge valve leakage, 

are based primarily on the design. If leakage rates can be measured 

separately for each purge valve, ACTION E is intended to apply. This 

would be required to be able to implement Required Action E.3. Should 

the design allow only for leak testing both purge valves simultaneously, 

then the Completion Time for ACTION D should include the "24 hours for 

purge valve leakage" and ACTION E should be eliminated. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-9 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Adopting Completion Times for secondary containment bypass and/or 

hydrostatically tested lines is based on whether the associated SRs are 

adopted. 

The additional bracketed options for whether the hydrostatically tested 

line is with or without a closed system is predicated on plant-specific 

design. If the design is such that there are not both types of 

hydrostatically tested lines (some with and some without closed systems), 

the specific 'closed system' wording can be removed and the appropriate 

4 or 72 hour Completion Time retained. In the event there are both types, 

the clarifying wording remains and the brackets are removed. ]

-------------------------------------------------------------------------------------------------- 

[ E.1, E.2, and E.3

In the event one or more containment purge valves are not within the 

purge valve leakage limits, purge valve leakage must be restored to 

within limits or the affected penetration must be isolated. The method of 

isolation must be by the use of at least one isolation barrier that cannot be 

adversely affected by a single active failure. Isolation barriers that meet 

this criterion are a [closed and de-activated automatic valve, closed 

manual valve, and blind flange]. If a purge valve with resilient seals is 

utilized to satisfy Required Action E.1 it must have been demonstrated to 

meet the leakage requirements of SR 3.6.1.3.6. The specified 

Completion Time is reasonable, considering that one containment purge 

valve remains closed so that a gross breach of containment does not 

exist. 

In accordance with Required Action E.2, this penetration flow path must 

be verified to be isolated on a periodic basis. The periodic verification is 

necessary to ensure that containment penetrations required to be isolated 

following an accident, which are no longer capable of being automatically 

isolated, will be in the isolation position should an event occur. This 

Required Action does not require any testing or valve manipulation. 

Rather, it involves verification that those isolation devices outside 

containment and potentially capable of being mispositioned are in the 

correct position. For the isolation devices inside containment, the time 

period specified as "prior to entering MODE 2 or 3 from MODE 4 if not 

performed within the previous 92 days" is based on engineering judgment 

and is considered reasonable in view of the inaccessibility of the isolation 

devices and other administrative controls that will ensure that isolation 

device misalignment is an unlikely possibility. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-10 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

For the containment purge valve with resilient seal that is isolated in 

accordance with Required Action E.1, SR 3.6.1.3.6 must be performed at 

least once every [ ] days. This provides assurance that degradation of 

the resilient seal is detected and confirms that the leakage rate of the 

containment purge valve does not increase during the time the 

penetration is isolated. The normal Frequency for SR 3.6.1.3.6 is 

184 days. Since more reliance is placed on a single valve while in this 

Condition, it is prudent to perform the SR more often. Therefore, a 

Frequency of once per [ ] days was chosen and has been shown 

acceptable based on operating experience. 

Required Action E.2 is modified by two Notes. Note 1 applies to isolation 

devices located in high radiation areas and allows these devices to be 

verified closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since access to these 

areas is typically restricted. Note 2 applies to isolation devices that are 

locked, sealed, or otherwise secured in position and allows these devices 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. ]

F.1 and F.2

If any Required Action and associated Completion Time cannot be met in 

MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO 

does not apply. To achieve this status, the plant must be brought to at 

least MODE 3 within 12 hours and to MODE 4 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems. 

[ G.1, H.1, and H.2

If any Required Action and associated Completion Time cannot be met, 

the plant must be placed in a condition in which the LCO does not apply. 

If applicable, movement of [recently] irradiated fuel assemblies must be 

immediately suspended. Suspension of these activities shall not preclude 

completion of movement of a component to a safe condition. Also, if 

applicable, action must be immediately initiated to suspend operations 

with a potential for draining the reactor vessel (OPDRVs) to minimize the 

probability of a vessel draindown and subsequent potential for fission 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-11 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

product release. Actions must continue until OPDRVs are suspended. If 

suspending the OPDRVs would result in closing the residual heat removal 

(RHR) shutdown cooling isolation valves, an alternative Required Action 

is provided to immediately initiate action to restore the valves to 

OPERABLE status. This allows RHR to remain in service while actions 

are being taken to restore the valve. ] 

SURVEILLANCE [ SR 3.6.1.3.1

REQUIREMENTS 

Each [ ] inch primary containment purge valve is required to be verified 

sealed closed at 31 day intervals. This SR is intended to apply to primary 

containment purge valves that are not fully qualified to open under 

accident conditions. This SR is designed to ensure that a gross breach of 

primary containment is not caused by an inadvertent or spurious opening 

of a primary containment purge valve. Detailed analysis of the purge 

valves failed to conclusively demonstrate their ability to close during a 

LOCA in time to limit offsite doses. Primary containment purge valves 

that are sealed closed must have motive power to the valve operator 

removed. This can be accomplished by de-energizing the source of 

electric power or removing the air supply to the valve operator. In this 

application, the term "sealed" has no connotation of leak tightness. The 

31 day Frequency is a result of an NRC initiative, Generic Issue B-24, 

(Ref. 6) related to primary containment purge valve use during unit 

operations. 

This SR allows a valve that is open under administrative controls to not 

meet the SR during the time the valve is open. Opening a purge valve 

under administrative controls is restricted to one valve in a penetration 

flow path at a given time (refer to discussion for Note 1 of the ACTIONS) 

in order to effect repairs to that valve. This allows one purge valve to be 

opened without resulting in a failure of the Surveillance and resultant 

entry into the ACTIONS for this purge valve, provided the stated 

restrictions are met. Condition E must be entered during this allowance, 

and the valve opened only as necessary for effecting repairs. Each purge 

valve in the penetration flow path may be alternately opened, provided 

one remains sealed closed, if necessary, to complete repairs on the 

penetration. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-12 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ The SR is modified by a Note stating that primary containment purge 

valves are only required to be sealed closed in MODES 1, 2, and 3. If a 

LOCA inside primary containment occurs in these MODES, the purge 

valves may not be capable of closing before the pressure pulse affects 

systems downstream of the purge valves or the release of radioactive 

material will exceed limits prior to the closing of the purge valves. At 

other times when the purge valves are required to be capable of closing 

(e.g., during movement of [recently] irradiated fuel assemblies), 

pressurization concerns are not present and the purge valves are allowed 

to be open. ] ]

[ SR 3.6.1.3.2

 This SR verifies that the [20] inch primary containment purge valves are 

closed as required or, if open, open for an allowable reason. If a purge 

valve is open in violation of this SR, the valve is considered inoperable. If 

the inoperable valve is not otherwise known to have excessive leakage 

when closed, it is not considered to have leakage outside of limits. 

 The SR is also modified by a Note (Note 1) stating that primary 

containment purge valves are only required to be closed in MODES 1, 2, 

and 3. If a LOCA inside primary containment occurs in these MODES, 

the purge valves may not be capable of closing before the pressure pulse 

affects systems downstream of the purge valves, or the release of 

radioactive material will exceed limits prior to the purge valves closing. At 

other times when the purge valves are required to be capable of closing 

(e.g., during movement of irradiated fuel assemblies) pressurization 

concerns are not present and the purge valves are allowed to be open. 

The SR is modified by a Note (Note 2) stating that the SR is not required 

to be met when the purge valves are open for the stated reasons. The 

Note states that these valves may be opened for pressure control, 

ALARA, or air quality considerations for personnel entry, or for 

Surveillances that require the valves to be open, provided the drywell 

[purge supply and exhaust] lines are isolated. These primary 

containment purge valves are capable of closing in the environment 

following a LOCA. Therefore, these valves are allowed to be open for 

limited periods of time. The 31 day Frequency is consistent with other 

primary containment purge valve requirements discussed in 

SR 3.6.1.3.1. ]
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-13 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.1.3.3

This SR verifies that each primary containment isolation manual valve 

and blind flange that is located outside primary containment, drywell, and 

steam tunnel, and not locked, sealed, or otherwise secured and is 

required to be closed during accident conditions, is closed. The SR helps 

to ensure that post accident leakage of radioactive fluids or gases outside 

of the primary containment boundary is within design limits. This SR 

does not require any testing or valve manipulation. Rather, it involves 

verification that those PCIVs outside primary containment, and capable of 

being mispositioned, are in the correct position. Since verification of 

valve position for PCIVs outside primary containment is relatively easy, 

the 31 day Frequency was chosen to provide added assurance that the 

PCIVs are in the correct positions. This SR does not apply to valves that 

are locked, sealed, or otherwise secured in the closed position, since 

these were verified to be in the correct position upon locking, sealing, or 

securing. 

Two Notes are added to this SR. The first Note applies to valves and 

blind flanges located in high radiation areas and allows them to be 

verified by use of administrative controls. Allowing verification by 

administrative controls is considered acceptable, since access to these 

areas is typically restricted during MODES 1, 2, and 3 for ALARA 

reasons. Therefore, the probability of misalignment of these PCIVs, once 

they have been verified to be in the proper position, is low. A second 

Note is included to clarify that PCIVs open under administrative controls 

are not required to meet the SR during the time the PCIVs are open. 

SR 3.6.1.3.4

This SR verifies that each primary containment manual isolation valve 

and blind flange located inside primary containment, drywell, or steam 

tunnel, and not locked, sealed, or otherwise secured and required to be 

closed during accident conditions, is closed. The SR helps to ensure that 

post accident leakage of radioactive fluids or gases outside the primary 

containment boundary is within design limits. For PCIVs inside primary 

containment, drywell, or steam tunnel the Frequency of "prior to entering 

MODE 2 or 3 from MODE 4, if not performed within the previous 

92 days," is appropriate since these PCIVs are operated under 

administrative controls and the probability of their misalignment is low. 

This SR does not apply to valves that are locked, sealed, or otherwise 

secured in the closed position, since these were verified to be in the 

correct position upon locking, sealing, or securing. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-14 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Two Notes are added to this SR. The first Note allows valves and blind 

flanges located in high radiation areas to be verified by use of 

administrative controls. Allowing verification by administrative controls is 

considered acceptable since access to these areas is typically restricted 

during MODES 1, 2, and 3. Therefore, the probability of misalignment of 

these PCIVs, once they have been verified to be in their proper position, 

is low. A second Note is included to clarify that PCIVs that are open 

under administrative controls are not required to meet the SR during the 

time that the PCIVs are open. 

SR 3.6.1.3.5

Verifying the isolation time of each power operated, automatic PCIV is 

within limits is required to demonstrate OPERABILITY. MSIVs may be 

excluded from this SR since MSIV full closure isolation time is 

demonstrated by SR 3.6.1.3.6. The isolation time test ensures that the 

valve will isolate in a time period less than or equal to that assumed in the 

safety analysis. The isolation time and Frequency of this SR are [in 

accordance with the Inservice Testing Program or 92 days]. 

[ SR 3.6.1.3.6

For primary containment purge valves with resilient seals, additional 

leakage rate testing beyond the test requirements of 10 CFR 50, 

Appendix J, Option [A][B] (Ref. 4), is required to ensure OPERABILITY. 

Operating experience has demonstrated that this type of seal has the 

potential to degrade in a shorter time period than do other seal types. 

Based on this observation, and the importance of maintaining this 

penetration leak tight (due to the direct path between primary containment 

and the environment), a Frequency of 184 days was established. 

Additionally, this SR must be performed within 92 days after opening the 

valve. The 92 day Frequency was chosen recognizing that cycling the 

valve could introduce additional seal degradation (beyond that which 

occurs to a valve that has not been opened). Thus, decreasing the 

interval (from 184 days) is a prudent measure after a valve has been 

opened. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-15 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The SR is modified by a Note stating that the primary containment purge 

valves are only required to meet leakage rate testing requirements in 

MODES 1, 2, and 3. If a LOCA inside primary containment occurs in 

these MODES, purge valve leakage must be minimized to ensure offsite 

radiological release is within limits. At other times when the purge valves 

are required to be capable of closing (e.g., during handling of [recently] 

irradiated fuel), pressurization concerns are not present and the purge 

valves are not required to meet any specific leakage criteria. ]

SR 3.6.1.3.7

Verifying that the full closure isolation time of each MSIV is within the 

specified limits is required to demonstrate OPERABILITY. The full 

closure isolation time test ensures that the MSIV will isolate in a time 

period that does not exceed the times assumed in the DBA analyses. 

The Frequency of this SR is [in accordance with the Inservice Testing 

Program or 18 months]. 

SR 3.6.1.3.8

Automatic PCIVs close on a primary containment isolation signal to 

prevent leakage of radioactive material from primary containment 

following a DBA. This SR ensures that each automatic PCIV will actuate 

to its isolation position on a primary containment isolation signal. The 

LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.6 overlaps this SR to 

provide complete testing of the safety function. The [18] month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power. Operating experience has shown that these components usually 

pass this Surveillance when performed at the [18] month Frequency. 

Therefore, the Frequency was concluded to be acceptable from a 

reliability standpoint. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-16 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.6.1.3.9

This SR ensures that the leakage rate of secondary containment bypass 

leakage paths is less than the specified leakage rate. This provides 

assurance that the assumptions in the radiological evaluations of 

Reference 2 are met. The leakage rate of each bypass leakage path is 

assumed to be the maximum pathway leakage (leakage through the 

worse of the two isolation valves) unless the penetration is isolated by 

use of one closed and de-activated automatic valve, closed manual valve, 

or blind flange. In this case, the leakage rate of the isolated bypass 

leakage path is assumed to be the actual pathway leakage through the 

isolation device. If both isolation valves in the penetration are closed, the 

actual leakage rate is the lesser leakage rate of the two valves. The 

Frequency is required by the Primary Containment Leakage Rate Testing 

Program. This SR simply imposes additional acceptance criteria. 

[ This SR is modified by a Note that states that these valves are only 

required to meet this leakage limit in MODES 1, 2, and 3. In the other 

conditions, the Reactor Coolant System is not pressurized and specific 

primary containment leakage limits are not required. ]

[ Bypass leakage is considered part of La. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Unless specifically exempted.] ]

-------------------------------------------------------------------------------------------------- 

SR 3.6.1.3.10

The analyses in References 1 and 2 are based on leakage that is less 

than the specified leakage rate. Leakage through all four MSIVs must be 

≤ [100] scfh when tested at Pt ([11.5] psig). A Note is added to this SR 

which states that these valves are only required to meet this leakage limit 

in MODES 1, 2, and 3. In the other conditions, the Reactor Coolant 

System is not pressurized and specific primary containment leakage limits 

are not required. This ensures that MSIV leakage is properly accounted 

for in determining the overall primary containment leakage rate. The 

Frequency is required by the Primary Containment Leakage Rate Testing 

Program. 
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-17 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.1.3.11

Surveillance of hydrostatically tested lines provides assurance that the 

calculation assumptions of References 1 and 2 are met. The acceptance 

criteria for the combined leakage of all hydrostatically tested lines is [1.0 

gpm times the total number of hydrostatically tested PCIVs] when tested 

at 1.1 Pa ([63.25] psig). The combined leakage rates must be 

demonstrated to be in accordance with the leakage test frequency 

required by the Primary Containment Leakage Rate Testing Program. 

[ This SR is modified by a Note that states that these valves are only 

required to meet the combined leakage rate in MODES 1, 2, and 3 since 

this is when the Reactor Coolant System is pressurized and primary 

containment is required. In some instances, the valves are required to be 

capable of automatically closing during MODES other than MODES 1, 2, 

and 3. However, specific leakage limits are not applicable in these other 

MODES or conditions. ]

[ SR 3.6.1.3.12

-----------------------------------REVIEWER’S NOTE----------------------------------- 

This SR is only required for those plants with purge valves with resilient 

seals allowed to be open during [MODE 1, 2, or 3] and having blocking 

devices on the valves that are not permanently installed. 

-------------------------------------------------------------------------------------------------- 

Verifying that each [ ] inch primary containment purge valve is blocked to 

restrict opening to ≤ [50%] is required to ensure that the valves can close 

under DBA conditions within the time limits assumed in the analyses of 

References 1 and 2. 

[ The SR is modified by a Note stating that this SR is only required to be 

met in MODES 1, 2, and 3. If a LOCA inside primary containment occurs 

in these MODES, the purge valves must close to maintain containment 

leakage within the values assumed in the accident analysis. At other 

times when purge valves are required to be capable of closing (e.g., 

during movement of [recently] irradiated fuel assemblies), pressurization 

concerns are not present, thus the purge valves can be fully open. The 

[18] month Frequency is appropriate because the blocking devices are 

typically removed only during a refueling outage. ] ]
PCIVs 

B 3.6.1.3 

BWR/6 STS B 3.6.1.3-18 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Chapter [15]. 

 2. FSAR, Section [6.2]. 

 3. FSAR, [Table 6.2-44]. 

 4. 10 CFR 50, Appendix J, Option [A][B]. 

 5. FSAR, Section 6.2.[ ]. 

 6. Generic Issue B-24. 
Primary Containment Pressure 

B 3.6.1.4 

BWR/6 STS B 3.6.1.4-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.4 Primary Containment Pressure 

BASES 

BACKGROUND The primary containment pressure is limited during normal operation to 

preserve the initial conditions assumed in the accident analyses for a 

Design Basis Accident (DBA) or loss of coolant accident (LOCA). 

The limits on primary containment [to secondary containment differential] 

pressure have been developed based on operating experience. The 

auxiliary building, which is part of the secondary containment, completely 

surrounds the lower portion of the primary containment. Therefore, the 

primary containment design external differential pressure, and 

consequently the Specification limit, are established relative to the 

auxiliary building pressure. The auxiliary building pressure is kept slightly 

negative relative to the atmospheric pressure to prevent leakage to the 

atmosphere. 

Transient events, which include inadvertent containment spray initiation, 

can reduce the primary containment pressure (Ref. 1). Without an 

appropriate limit on the negative containment pressure, the design limit 

for negative internal pressure of [-3.0] psid could be exceeded. 

Therefore, the Specification pressure limits of [-0.1 and 1.0 psid] were 

established (Ref. 2). 

The limitation on the primary [to secondary containment differential] 

pressure provides added assurance that the peak LOCA primary 

containment pressure does not exceed the design value of 15 psig 

(Ref. 1). 

APPLICABLE Primary containment performance for the DBA is evaluated for the entire 

SAFETY spectrum of break sizes for postulated LOCAs inside containment 

ANALYSES (Ref. 3). Among the inputs to the design basis analysis is the initial 

primary containment internal pressure. The primary containment [to 

secondary containment differential] pressure can affect the initial 

containment internal pressure. The initial pressure limitation 

requirements ensure that peak primary containment pressure for a DBA 

LOCA does not exceed the design value of 15 psig and that peak 

negative pressure for an inadvertent containment spray event does not 

exceed the design value of [-3.0] psid. 

Primary containment pressure satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 
Primary Containment Pressure 

B 3.6.1.4 

BWR/6 STS B 3.6.1.4-2 Rev. 3.0, 03/31/04 

BASES 

LCO A limitation on the primary [to secondary containment differential] 

pressure of [≥ -0.1 and ≤ 1.0 psid] is required to ensure that primary 

containment initial conditions are consistent with the initial safety 

analyses assumptions so that containment pressures remain within 

design values during a LOCA and the design value of containment 

negative pressure is not exceeded during an inadvertent operation of 

containment sprays. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could result in a release of radioactive 

material to primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, maintaining primary 

containment pressure within limits is not required in MODE 4 or 5. 

ACTIONS A.1

When primary [to secondary containment differential] pressure is not 

within the limits of the LCO, differential pressure must be restored to 

within limits within 1 hour. The Required Action is necessary to return 

operation to within the bounds of the primary containment analysis. The 

1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1.1, 

"Primary Containment," which requires that primary containment be 

restored to OPERABLE status within 1 hour. 

B.1 and B.2

If primary [to secondary containment differential] pressure cannot be 

restored to within limits within the required Completion Time, the plant 

must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

12 hours and to MODE 4 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required 

plant conditions from full power conditions in an orderly manner and 

without challenging plant systems. 

SURVEILLANCE SR 3.6.1.4.1

REQUIREMENTS 

Verifying that primary containment [to secondary containment differential] 

pressure is within limits ensures that operation remains within the limits 

assumed in the primary containment analysis. The 12 hour Frequency of 

this SR was developed based on operating experience related to trending 

primary containment pressure variations during the applicable MODES. 

Furthermore, the 12 hour Frequency is considered adequate in view of 

other indications available in the control room, including alarms, to alert 

the operator to an abnormal primary containment pressure condition. 
Primary Containment Pressure 

B 3.6.1.4 

BWR/6 STS B 3.6.1.4-3 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [6.2.1]. 

 2. FSAR, Section [6.2.1.1.4.2]. 

 3. FSAR, Section [6.2]. 
Primary Containment Air Temperature 

B 3.6.1.5 

BWR/6 STS B 3.6.1.5-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.5 Primary Containment Air Temperature 

BASES 

BACKGROUND Heat loads from the drywell, as well as piping and equipment in the 

primary containment, add energy to the primary containment airspace 

and raise airspace temperature. Coolers included in the unit design 

remove this energy and maintain an appropriate average temperature 

inside primary containment. The average airspace temperature affects 

the calculated response to postulated Design Basis Accidents (DBAs). 

This primary containment air temperature limit is an initial condition input 

for the Reference 1 safety analyses. 

APPLICABLE Primary containment performance for the DBA is evaluated for a entire 

SAFETY spectrum of break sizes for postulated loss of coolant accidents (LOCAs) 

ANALYSES inside containment (Ref. 1). Among the inputs to the design basis 

analysis is the initial primary containment average air temperature. 

Analyses assume an initial average primary containment air (and 

suppression pool) temperature of [95]°F. Maintaining the expected initial 

conditions ensures that safety analyses remain valid and ensures that the 

peak LOCA primary containment temperature does not exceed the 

maximum allowable temperature of 185°F (Ref. 1). Exceeding this design 

temperature may result in the degradation of the primary containment 

structure under accident loads. Equipment inside primary containment, 

and needed to mitigate the effects of a DBA, is designed to operate and 

be capable of operating under environmental conditions expected for the 

accident. 

Primary containment air temperature satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO During a DBA, with an initial primary containment average air temperature 

less than or equal to the LCO temperature limit, the accident temperature 

profile assures that the containment structural temperature is maintained 

below its design temperature and that required safety related equipment 

will continue to perform its function. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, maintaining primary 

containment average air temperature within the limit is not required in 

MODE 4 or 5. 
Primary Containment Air Temperature 

B 3.6.1.5 

BWR/6 STS B 3.6.1.5-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

When primary containment average air temperature is not within the limit 

of the LCO, it must be restored within 8 hours. This Required Action is 

necessary to return operation to within the bounds of the primary 

containment analysis. The 8 hour Completion Time is acceptable, 

considering the sensitivity of the analysis to variations in this parameter, 

and provides sufficient time to correct minor problems. 

B.1 and B.2

If the primary containment average air temperature cannot be restored to 

within limit within the required Completion Time, the plant must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 12 hours and 

to MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

SURVEILLANCE SR 3.6.1.5.1

REQUIREMENTS 

Verifying that the primary containment average air temperature is within 

the LCO limit ensures that operation remains within the limits assumed for 

the primary containment analyses. In order to determine the primary 

containment average air temperature, an arithmetic average is calculated, 

using measurements taken at locations within the primary containment 

selected to provide a representative sample of the overall primary 

containment atmosphere. 

The 24 hour Frequency of this SR is considered acceptable based on 

observed slow rates of temperature increase within primary containment 

as a result of environmental heat sources (due to large volume of the 

primary containment). Furthermore, the 24 hour Frequency is considered 

adequate in view of other indications available in the control room, 

including alarms, to alert the operator to an abnormal primary 

containment air temperature condition. 

REFERENCES 1. FSAR, Section [6.2]. 
LLS Valves 

B 3.6.1.6 

BWR/6 STS B 3.6.1.6-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.6 Low-Low Set (LLS) Valves 

BASES 

BACKGROUND The safety/relief valves (S/RVs) can actuate either in the relief mode, the 

safety mode, the Automatic Depressurization System mode, or the LLS 

mode. In the LLS mode (or power actuated mode of operation), a 

pneumatic diaphragm and stem assembly overcome the spring force and 

open the pilot valve. As in the safety mode, opening the pilot valve allows 

a differential pressure to develop across the main valve piston and thus 

opens the main valve. The main valve can stay open with valve inlet 

steam pressure as low as [0] psig. The pneumatic operator is arranged 

so that its malfunction will not prevent the valve disk from lifting if steam 

inlet pressure exceeds the safety mode pressure setpoints. 

[Six] of the S/RVs are equipped to provide the LLS function. The LLS 

logic causes the LLS valves to be opened at a lower pressure than the 

relief or safety mode pressure setpoints and stay open longer, such that 

reopening of more than one S/RV is prevented on subsequent actuations. 

Therefore, the LLS function prevents excessive short duration S/RV 

cycles with valve actuation at the relief setpoint. 

Each S/RV discharges steam through a discharge line and quencher to a 

location near the bottom of the suppression pool, which causes a load on 

the suppression pool wall. Actuation at lower reactor pressure results in a 

lower load. 

APPLICABLE The LLS relief mode functions to ensure that the containment design 

SAFETY basis of one S/RV operating on "subsequent actuations" is met (Ref. 1). 

ANALYSES In other words, multiple simultaneous openings of S/RVs (following the 

initial opening) and the corresponding higher loads, are avoided. The 

safety analysis demonstrates that the LLS functions to avoid the induced 

thrust loads on the S/RV discharge line resulting from "subsequent 

actuations" of the S/RV during Design Basis Accidents (DBAs). 

Furthermore, the LLS function justifies the primary containment analysis 

assumption that multiple simultaneous S/RV openings occur only on the 

initial actuation for DBAs. Even though [six] LLS S/RVs are specified, all 

[six] LLS S/RVs do not operate in any DBA analysis. 

LLS valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
LLS Valves 

B 3.6.1.6 

BWR/6 STS B 3.6.1.6-2 Rev. 3.0, 03/31/04 

BASES 

LCO [Six] LLS valves are required to be OPERABLE to satisfy the 

assumptions of the safety analysis (Ref. 2). The requirements of this 

LCO are applicable to the mechanical and electrical/pneumatic capability 

of the LLS valves to function for controlling the opening and closing of the 

S/RVs 

APPLICABILITY In MODES 1, 2, and 3, an event could cause pressurization of the reactor 

and opening of S/RVs. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations in these MODES. Therefore, maintaining the LLS 

valves OPERABLE is not required in MODE 4 or 5. 

ACTIONS A.1

With one LLS valve inoperable, the remaining OPERABLE LLS valves 

are adequate to perform the designed function. However, the overall 

reliability is reduced. The 14 day Completion Time takes into account the 

redundant capability afforded by the remaining LLS S/RVs and the low 

probability of an event in which the remaining LLS S/RV capability would 

be inadequate. 

B.1 and B.2

If two or more LLS valves are inoperable or if the inoperable LLS valve 

cannot be restored to OPERABLE status within the required Completion 

Time, the plant must be brought to a MODE in which the LCO does not 

apply. To achieve this status, the plant must be brought to at least 

MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required plant conditions from full power conditions in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.6.1.6.1

REQUIREMENTS 

A manual actuation of each LLS valve is performed to verify that the valve 

and solenoids are functioning properly and that no blockage exists in the 

valve discharge line. This can be demonstrated by the response of the 

turbine control or bypass valve, by a change in the measured steam flow, 

or by any other method that is suitable to verify steam flow. Adequate 

reactor steam dome pressure must be available to perform this test to 

avoid damaging the valve. Adequate pressure at which this test is to be 

performed is ≥ [950] psig (the pressure recommended by the valve 

manufacturer). Also, adequate steam flow must be passing through the 

main turbine or turbine bypass valves to continue to control reactor 

pressure when the ADS valves divert steam flow upon opening. 
LLS Valves 

B 3.6.1.6 

BWR/6 STS B 3.6.1.6-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Adequate steam flow is represented by [at least 1.25 turbine bypass 

valves open, or total steam flow ≥ 106 lb/hr]. The [18] month Frequency 

was developed based on the S/RV tests required by the ASME Boiler and 

Pressure Vessel Code, Section XI (Ref. 3). The Frequency of [18] 

months on a STAGGERED TEST BASIS ensures that each solenoid for 

each S/RV is alternately tested. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

Since steam pressure is required in order to perform the Surveillance, 

however, and steam may not be available during a unit outage, the 

Surveillance may be performed during the shutdown prior to or the startup 

following a unit outage. Unit startup is allowed prior to performing this 

test because valve OPERABILITY and the setpoints for overpressure 

protection are verified by Reference 3 prior to valve installation. After 

adequate reactor steam dome pressure and flow are reached, 12 hours 

are allowed to prepare for and perform the test. 

SR 3.6.1.6.2

The LLS designed S/RVs are required to actuate automatically upon 

receipt of specific initiation signals. A system functional test is performed 

to verify that the mechanical portions (i.e., solenoids) of the automatic 

LLS function operate as designed when initiated either by an actual or 

simulated automatic initiation signal. The LOGIC SYSTEM 

FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete 

testing of the safety function. 

The 18 month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown these 

components usually pass the Surveillance when performed at the 

18 month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

This SR is modified by a Note that excludes valve actuation. This 

prevents a reactor pressure vessel pressure blowdown. 
LLS Valves 

B 3.6.1.6 

BWR/6 STS B 3.6.1.6-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES [ 1. GESSAR-II, Appendix 3BA.8. ] 

 2. FSAR, Section [5.5.17]. 

 3. ASME, Boiler and Pressure Vessel Code, Section XI. 
RHR Containment Spray System 

B 3.6.1.7 

BWR/6 STS B 3.6.1.7-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.7 Residual Heat Removal (RHR) Containment Spray System 

BASES 

BACKGROUND The primary containment is designed with a suppression pool so that, in 

the event of a loss of coolant accident (LOCA), steam released from the 

primary system is channeled through the suppression pool water and 

condensed without producing significant pressurization of the primary 

containment. The primary containment is designed so that with the pool 

initially at the minimum water volume and the worst single failure of the 

primary containment heat removal systems, suppression pool energy 

absorption combined with subsequent operator controlled pool cooling will 

prevent the primary containment pressure from exceeding its design 

value. However, the primary containment must also withstand a 

postulated bypass leakage pathway that allows the passage of steam 

from the drywell directly into the primary containment airspace, bypassing 

the suppression pool. The primary containment also must withstand a 

low energy steam release into the primary containment airspace. The 

RHR Containment Spray System is designed to mitigate the effects of 

bypass leakage and low energy line breaks. 

There are two redundant, 100% capacity RHR containment spray 

subsystems. Each subsystem consists of a suction line from the 

suppression pool, an RHR pump, a heat exchanger, and three spray 

spargers inside the primary containment (outside of the drywell) above 

the refueling floor. Dispersion of the spray water is accomplished by 

350 nozzles in each subsystem. 

The RHR containment spray mode will be automatically initiated, if 

required, following a LOCA, or it may be manually initiated according to 

emergency procedures. 

APPLICABLE Reference 1 contains the results of analyses that predict the primary 

SAFETY containment pressure response for a LOCA with the maximum allowable 

ANALYSES bypass leakage area. 

The equivalent flow path area for bypass leakage has been specified to 

be [0.9] ft2

. The analysis demonstrates that with containment spray 

operation the primary containment pressure remains within design limits. 

The RHR Containment Spray System satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
RHR Containment Spray System 

B 3.6.1.7 

BWR/6 STS B 3.6.1.7-2 Rev. 3.0, 03/31/04 

BASES 

LCO In the event of a Design Basis Accident (DBA), a minimum of one RHR 

containment spray subsystem is required to mitigate potential bypass 

leakage paths and maintain the primary containment peak pressure 

below design limits. To ensure that these requirements are met, two 

RHR containment spray subsystems must be OPERABLE. Therefore, in 

the event of an accident, at least one subsystem is OPERABLE assuming 

the worst case single active failure. An RHR containment spray 

subsystem is OPERABLE when the pump, the heat exchanger, and 

associated piping, valves, instrumentation, and controls are OPERABLE. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause pressurization of primary 

containment. In MODES 4 and 5, the probability and consequences of 

these events are reduced due to the pressure and temperature limitations 

in these MODES. Therefore, maintaining RHR containment spray 

subsystems OPERABLE is not required in MODE 4 or 5. 

ACTIONS A.1

With one RHR containment spray subsystem inoperable, the inoperable 

subsystem must be restored to OPERABLE status within 7 days. In this 

Condition, the remaining OPERABLE RHR containment spray subsystem 

is adequate to perform the primary containment cooling function. 

However, the overall reliability is reduced because a single failure in the 

OPERABLE subsystem could result in reduced primary containment 

cooling capability. The 7 day Completion Time was chosen in light of the 

redundant RHR containment capabilities afforded by the OPERABLE 

subsystem and the low probability of a DBA occurring during this period. 

B.1

With two RHR containment spray subsystems inoperable, one subsystem 

must be restored to OPERABLE status within 8 hours. In this Condition, 

there is a substantial loss of the primary containment bypass leakage 

mitigation function. The 8 hour Completion Time is based on this loss of 

function and is considered acceptable due to the low probability of a DBA 

and because alternative methods to remove heat from primary 

containment are available. 
RHR Containment Spray System 

B 3.6.1.7 

BWR/6 STS B 3.6.1.7-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

If the inoperable RHR containment spray subsystem cannot be restored 

to OPERABLE status within the required Completion Time, the plant must 

be brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 12 hours and 

to MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

SURVEILLANCE SR 3.6.1.7.1

REQUIREMENTS 

Verifying the correct alignment for manual, power operated, and 

automatic valves in the RHR containment spray mode flow path provides 

assurance that the proper flow paths will exist for system operation. This 

SR does not apply to valves that are locked, sealed, or otherwise secured 

in position, since these were verified to be in the correct position prior to 

locking, sealing, or securing. This SR does not require any testing or 

valve manipulation; rather, it involves verification that those valves 

capable of being mispositioned are in the correct position. This SR does 

not apply to valves that cannot be inadvertently misaligned, such as 

check valves. 

The 31 day Frequency of this SR is justified because the valves are 

operated under procedural control and because improper valve position 

would affect only a single subsystem. This Frequency has been shown to 

be acceptable based on operating experience. 

A Note has been added to this SR that allows RHR containment spray 

subsystems to be considered OPERABLE during alignment to and 

operation in the RHR shutdown cooling mode when below [the RHR cut 

in permissive pressure in MODE 3], if capable of being manually 

realigned and not otherwise inoperable. At these low pressures and 

decay heat levels (the reactor is shut down in MODE 3), a reduced 

complement of subsystems can provide the required containment 

pressure mitigation function thereby allowing operation of an RHR 

shutdown cooling loop when necessary. 
RHR Containment Spray System 

B 3.6.1.7 

BWR/6 STS B 3.6.1.7-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.1.7.2

Verifying each RHR pump develops a flow rate ≥ [5650] gpm while 

operating in the suppression pool cooling mode with flow through the 

associated heat exchanger ensures that pump performance has not 

degraded during the cycle. It is tested in the pool cooling mode to 

demonstrate pump OPERABILITY without spraying down equipment in 

primary containment. Flow is a normal test of centrifugal pump 

performance required by the ASME Code, Section XI (Ref. 2). This test 

confirms one point on the pump design curve and is indicative of overall 

performance. Such inservice inspections confirm component 

OPERABILITY, trend performance, and detect incipient failures by 

indicating abnormal performance. [The Frequency of this SR is in 

accordance with the Inservice Testing Program or 92 days.] 

SR 3.6.1.7.3

This SR verifies that each RHR containment spray subsystem automatic 

valve actuates to its correct position upon receipt of an actual or 

simulated automatic actuation signal. Actual spray initiation is not 

required to meet this SR. The LOGIC SYSTEM FUNCTIONAL TEST in 

SR 3.3.6.3.6 overlaps this SR to provide complete testing of the safety 

function. The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

SR 3.6.1.7.4

This Surveillance is performed every 10 years to verify that the spray 

nozzles are not obstructed and that flow will be provided when required. 

The 10 year Frequency is adequate to detect degradation in performance 

due to the passive nozzle design and its normally dry state and has been 

shown to be acceptable through operating experience. 

REFERENCES 1. FSAR, Section [6.2.1.1.5]. 

 2. ASME, Boiler and Pressure Vessel Code, Section XI. 
PVLCS 

B 3.6.1.8 

BWR/6 STS B 3.6.1.8-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.8 Penetration Valve Leakage Control System (PVLCS) 

BASES 

BACKGROUND The PVLCS supplements the isolation function of primary containment 

isolation valves (PCIVs) in process lines that also penetrate the 

secondary containment. These penetrations are sealed by air from the 

PVLCS to prevent fission products leaking past the isolation valves and 

bypassing the secondary containment after a Design Basis Accident 

(DBA) loss of coolant accident (LOCA). 

The PVLCS consists of [two] independent, manually initiated subsystems, 

either of which is capable of preventing fission product leakage from the 

containment post LOCA. Each subsystem is comprised of an air 

compressor, an accumulator, an injection valve, and three injection 

headers with separate isolation valves. This system has additional 

headers, which serve the Main Steam Isolation Valve Leakage Control 

System and safety/relief valve (S/RV) actuator air accumulators. 

Each process line has two PCIVs and an additional manual isolation 

valve outside of the outboard PCIV. The two outboard valves are double 

disk gate valves. Each valve is provided sealing air from its electrically 

associated division of PVLCS to the area between the dual disk seats. 

The PVLCS is started manually. 

APPLICABLE The analyses described in Reference 1 provide the evaluation of offsite 

SAFETY dose consequences during accident conditions. During the first 

ANALYSES 25 minutes following an accident, the isolation valves on lines that 

penetrate primary containment and also penetrate secondary 

containment are assumed to leak fission products directly to the 

environment, without being processed by the Standby Gas Treatment 

System. The analyses take credit for manually initiating PVLCS after 

25 minutes and do not assume any further secondary containment 

bypass leakage. 

The PVLCS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO [Two] PVLCS subsystems must be OPERABLE such that in the event of 

an accident, at least one subsystem is OPERABLE assuming the worst 

case single active failure. A PVLCS subsystem is OPERABLE when all 

necessary components are available to supply each associated dual seat 

isolation valve with sufficient air pressure to preclude containment 

leakage when the containment atmosphere is at the maximum peak 

containment pressure, Pa. 
PVLCS 

B 3.6.1.8 

BWR/6 STS B 3.6.1.8-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, the PVLCS is not 

required to be OPERABLE in MODES 4 and 5 to prevent leakage of 

radioactive material from primary containment. 

ACTIONS A.1

With one PVLCS subsystem inoperable, the inoperable subsystem must 

be restored to OPERABLE status within 30 days. In this Condition, the 

remaining OPERABLE PVLCS subsystem is adequate to perform the 

leakage control function. The 30 day Completion Time is based on the 

low probability of the occurrence of a LOCA, the amount of time available 

after the event for operator action to prevent exceeding this limit, the low 

probability of failure of the OPERABLE PVLCS subsystem, and the 

availability of the PCIVs. 

B.1

With [two] PVLCS subsystems inoperable, at least one subsystem must 

be restored to OPERABLE status within 7 days. The 7 day Completion 

Time is based on the low probability of the occurrence of a DBA LOCA, 

the availability of 25 minutes for operator action, and the availability of the 

PCIVs. 

C.1 and C.2

If the inoperable PVLCS subsystem cannot be restored to OPERABLE 

status within the required Completion Time, the plant must be brought to 

a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 12 hours and to MODE 4 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 
PVLCS 

B 3.6.1.8 

BWR/6 STS B 3.6.1.8-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.6.1.8.1

REQUIREMENTS 

The minimum air supply necessary for PVLCS OPERABILITY varies with 

the system being supplied with compressed air from the PVLCS 

accumulators. Due to the support system function of PVLCS for S/RV 

actuator air, however, the specified minimum pressure of [101] psig is 

required, which provides sufficient air for [ ] S/RV actuations with the 

drywell pressure at 30 psig. This minimum air pressure alone is sufficient 

for PVLCS to support the OPERABILITY of these S/RV systems and is 

verified every 24 hours. The 24 hour Frequency is considered adequate 

in view of other indications available in the control room, such as alarms, 

to alert the operator to an abnormal PVLCS air pressure condition. 

SR 3.6.1.8.2

A simulated system operation is performed every [18] months to ensure 

that the PVLCS will function throughout its operating sequence. This 

includes correct automatic positioning of valves once the system is 

initiated manually. Proper functioning of the compressor and valves is 

verified by this Surveillance. The [18] month Frequency was developed 

considering it is prudent that many Surveillances be performed only 

during a plant outage. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [15.6.5]. 
MSIV LCS 

B 3.6.1.9 

BWR/6 STS B 3.6.1.9-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.1.9 Main Steam Isolation Valve (MSIV) Leakage Control System (LCS) 

BASES 

BACKGROUND The MSIV LCS supplements the isolation function of the MSIVs by 

processing the fission products that could leak through the closed MSIVs 

after a Design Basis Accident (DBA) loss of coolant accident (LOCA). 

The MSIV LCS consists of two independent subsystems: an inboard 

subsystem, which is connected between the inboard and outboard 

MSIVs; and an outboard subsystem, which is connected immediately 

downstream of the outboard MSIVs. Each subsystem is capable of 

processing leakage from MSIVs following a DBA LOCA. Each subsystem 

consists of blowers (four blowers for the inboard subsystem and two 

blowers for the outboard subsystem), valves, piping, and heaters (for the 

inboard subsystem only). The four electric heaters in the inboard 

subsystem are provided to boil off any condensate prior to the gas 

mixture passing through the flow limiter. 

Each subsystem operates in two process modes: depressurization and 

bleedoff. The depressurization process reduces the steam line pressure 

to within the operating capability of equipment used for the bleedoff 

mode. During bleedoff (long term leakage control), the blowers maintain 

a negative pressure in the main steam lines (Ref. 1). This ensures that 

leakage through the closed MSIVs is collected by the MSIV LCS. In both 

process modes, the effluent is discharged to the auxiliary building, which 

encloses a volume served by the Standby Gas Treatment (SGT) System. 

The MSIV LCS is manually initiated approximately 20 minutes following a 

DBA LOCA (Ref. 2). 

APPLICABLE The MSIV LCS mitigates the consequences of a DBA LOCA by ensuring 

SAFETY that fission products that may leak from the closed MSIVs are diverted to 

ANALYSES the auxiliary building and ultimately filtered by the SGT System. The 

analyses in Reference 3 provide the evaluation of offsite dose 

consequences. The operation of the MSIV LCS prevents a release of 

untreated leakage for this type of event. 

The MSIV LCS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO One MSIV LCS subsystem can provide the required processing of the 

MSIV leakage. To ensure that this capability is available, assuming worst 

case single failure, two MSIV LCS subsystems must be OPERABLE. 
MSIV LCS 

B 3.6.1.9 

BWR/6 STS B 3.6.1.9-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to 

primary containment. Therefore, MSIV LCS OPERABILITY is required 

during these MODES. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations in these MODES. Therefore, maintaining the 

MSIV LCS OPERABLE is not required in MODE 4 or 5 to ensure MSIV 

leakage is processed. 

ACTIONS A.1

With one MSIV LCS subsystem inoperable, the inoperable MSIV LCS 

subsystem must be restored to OPERABLE status within 30 days. In this 

Condition, the remaining OPERABLE MSIV LCS subsystem is adequate 

to perform the required leakage control function. However, the overall 

reliability is reduced because a single failure in the remaining subsystem 

could result in a total loss of MSIV leakage control function. The 30 day 

Completion Time is based on the redundant capability afforded by the 

remaining OPERABLE MSIV LCS subsystem and the low probability of a 

DBA LOCA occurring during this period. 

B.1

With two MSIV LCS subsystems inoperable, at least one subsystem must 

be restored to OPERABLE status within 7 days. The 7 day Completion 

Time is based on the low probability of the occurrence of a DBA LOCA. 

C.1 and C.2

If the MSIV LCS subsystem cannot be restored to OPERABLE status 

within the required Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 12 hours and to MODE 4 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE SR 3.6.1.9.1

REQUIREMENTS 

Each MSIV LCS blower is operated for ≥ [15] minutes to verify 

OPERABILITY. The 31 day Frequency was developed considering the 

known reliability of the LCS blower and controls, the two subsystem 

redundancy, and the low probability of a significant degradation of the 

MSIV LCS subsystem occurring between surveillances and has been 

shown to be acceptable through operating experience. 
MSIV LCS 

B 3.6.1.9 

BWR/6 STS B 3.6.1.9-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.1.9.2

The electrical continuity of each inboard MSIV LCS subsystem heater is 

verified by a resistance check, by verifying the rate of temperature 

increase meets specifications, or by verifying the current or wattage draw 

meets specifications. The 31 day Frequency is based on operating 

experience that has shown that these components usually pass this 

Surveillance when performed at this Frequency. 

SR 3.6.1.9.3

A system functional test is performed to ensure that the MSIV LCS will 

operate through its operating sequence. This includes verifying that the 

automatic positioning of the valves and the operation of each interlock 

and timer are correct, that the blowers start and develop the required flow 

rate and the necessary vacuum, and the upstream heaters meet current 

or wattage draw requirements (if not used to verify electrical continuity in 

SR 3.6.1.9.2). The 18 month Frequency is based on the need to perform 

this Surveillance under the conditions that apply during a plant outage 

and the potential for an unplanned transient if the Surveillance were 

performed with the reactor at power. Operating experience has shown 

that these components usually pass the Surveillance when performed at 

the [18] month Frequency. Therefore, the Frequency was concluded to 

be acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [6.7]. 

 2. Regulatory Guide 1.96, Revision [1]. 

 3. FSAR, Section [15.6.5]. 
Suppression Pool Average Temperature 

B 3.6.2.1 

BWR/6 STS B 3.6.2.1-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.2.1 Suppression Pool Average Temperature 

BASES 

BACKGROUND The suppression pool is a concentric open container of water with a 

stainless steel liner that is located at the bottom of the primary 

containment. The suppression pool is designed to absorb the decay heat 

and sensible heat released during a reactor blowdown from safety/relief 

valve discharges or from a loss of coolant accident (LOCA). The 

suppression pool must also condense steam from the Reactor Core 

Isolation Cooling System turbine exhaust and provides the main 

emergency water supply source for the reactor vessel. The amount of 

energy that the pool can absorb as it condenses steam is dependent 

upon the initial average suppression pool temperature. The lower the 

initial pool temperature, the more heat it can absorb without heating up 

excessively. Since it is an open pool, its temperature will affect both 

primary containment pressure and average air temperature. Using 

conservative inputs and methods, the maximum calculated primary 

containment pressure during and following a Design Basis Accident 

(DBA) must remain below the primary containment design pressure of 

[15] psig. In addition, the maximum primary containment average air 

temperature must remain < [185]°F. 

The technical concerns that lead to the development of suppression pool 

average temperature limits are as follows: 

a. Complete steam condensation - [the original limit for the end of a 

LOCA blowdown was 170°F, based on the Bodega Bay and 

Humboldt Bay Tests], 

b. Primary containment peak pressure and temperature - [the design 

pressure is [15] psig and design temperature is [185]°F], 

c. Condensation oscillation (CO) loads - [a maximum allowable initial 

temperature of [100]°F ensures that CO loads do not exceed the 

Mark III CO load definition], and 

d. Chugging load - [a maximum allowable initial temperature of [100]°F 

ensures that expected LOCA temperatures are within the range of 

Mark III tested conditions]. 
Suppression Pool Average Temperature 

B 3.6.2.1 

BWR/6 STS B 3.6.2.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The postulated DBA against which the primary containment performance 

SAFETY is evaluated is the entire spectrum of postulated pipe breaks within the 

ANALYSES primary containment. Inputs to the safety analyses include initial 

suppression pool water volume and suppression pool temperature 

(Reference 1 for LOCAs and Reference 2 for the suppression pool 

temperature analyses required by Reference 3). An initial pool 

temperature of [95]°F is assumed for the Reference 1 and 2 analyses. 

Reactor shutdown at a pool temperature of [110]°F and vessel 

depressurization at a pool temperature of [120]°F are assumed for the 

Reference 2 analyses. The limit of [105]°F, at which testing is terminated, 

is not used in the safety analyses because DBAs are assumed to not 

initiate during plant testing. 

Suppression pool average temperature satisfies Criteria 2 and 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO A limitation on the suppression pool average temperature is required to 

assure that the primary containment conditions assumed for the safety 

analyses are met. This limitation subsequently ensures that peak primary 

containment pressures and temperatures do not exceed maximum 

allowable values during a postulated DBA or any transient resulting in 

heatup of the suppression pool. The LCO requirements are as follows: 

a. Average temperature ≤ [95]°F [when any OPERABLE intermediate 

range monitor (IRM) channel is > [25/40] divisions of full scale on 

Range 7] [with THERMAL POWER > 1% RATED THERMAL 

POWER (RTP)], and no testing that adds heat to the suppression 

pool is being performed. This requirement ensures that licensing 

bases initial conditions are met. 

b. Average temperature ≤ [105]°F [when any OPERABLE IRM channel 

is > [25/40] divisions of full scale on Range 7] [with THERMAL 

POWER > 1% RTP] and testing that adds heat to the suppression 

pool is being performed. This requirement ensures that the plant has 

testing flexibility, and was selected to provide margin below the 

[110]°F limit at which reactor shutdown is required. When testing 

ends, temperature must be restored to ≤ [95]°F within 24 hours 

according to Required Action A.2. Therefore, the time period that the 

temperature is > [95]°F is short enough not to cause a significant 

increase in plant risk. 

c. Average temperature ≤ [110]°F [when all OPERABLE IRM channels 

are ≤ [25/40] divisions of full scale on Range 7] [with THERMAL 

POWER ≤ 1% RTP]. This requirement ensures that the plant will be 

shut down at > [110]°F. The pool is designed to absorb decay heat 

and sensible heat but could be heated beyond design limits by the 

steam generated if the reactor is not shut down. 
Suppression Pool Average Temperature 

B 3.6.2.1 

BWR/6 STS B 3.6.2.1-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

[Note that [25/40] divisions of full scale on IRM Range 7 is a convenient 

measure of when the reactor is producing power essentially equivalent to 

1% RTP]. At [this power level] [1% RTP], heat input is approximately 

equal to normal system heat losses. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant heatup of the 

suppression pool. In MODES 4 and 5, the probability and consequences 

of these events are reduced due to the pressure and temperature 

limitations in these MODES. Therefore, maintaining suppression pool 

average temperature within limits is not required in MODE 4 or 5. 

ACTIONS A.1 and A.2

With the suppression pool average temperature above the specified limit 

when not performing testing that adds heat to the suppression pool and 

when above the specified power indication, the initial conditions exceed 

the conditions assumed for the Reference 1 and 3 analyses. However, 

primary containment cooling capability still exists, and the primary 

containment pressure suppression function will occur at temperatures 

well above that assumed for safety analyses. Therefore, continued 

operation is allowed for a limited time. The 24 hour Completion Time is 

adequate to allow the suppression pool temperature to be restored to 

below the limit. Additionally, when pool temperature is > [95]°F, 

increased monitoring of the pool temperature is required to ensure it 

remains ≤ [110]°F. The once per hour Completion Time is adequate 

based on past experience, which has shown that suppression pool 

temperature increases relatively slowly except when testing that adds 

heat to the pool is being performed. Furthermore, the once per hour 

Completion Time is considered adequate in view of other indications in 

the control room, including alarms, to alert the operator to an abnormal 

suppression pool average temperature condition. 

B.1

If the suppression pool average temperature cannot be restored to within 

limits within the required Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, 

THERMAL POWER must be reduced to [≤ [25/40] divisions of full scale 

on Range 7 for all OPERABLE IRM channels] [≤ 1% RTP] within 

12 hours. The 12 hour Completion Time is reasonable, based on 

operating experience, to reduce reactor power from full power in an 

orderly manner and without challenging plant systems. 
Suppression Pool Average Temperature 

B 3.6.2.1 

BWR/6 STS B 3.6.2.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

Suppression pool average temperature is allowed to be > [95]°F [with any 

OPERABLE IRM channel > [25/40] divisions of full scale on Range 7] 

[with THERMAL POWER > 1% RTP] when testing that adds heat to the 

suppression pool is being performed. However, if temperature is 

> [105]°F, the testing must be immediately suspended to preserve the 

pool's heat absorption capability. With the testing suspended, 

Condition A is entered and the Required Actions and associated 

Completion Times are applicable. 

D.1 and D.2

Suppression pool average temperature > [110]°F requires that the reactor 

be shut down immediately. This is accomplished by placing the reactor 

mode switch in the shutdown position. Further cooldown to MODE 4 is 

required at normal cooldown rates (provided pool temperature remains 

≤ [120]°F). Additionally, when pool temperature is > [110]°F, increased 

monitoring of pool temperature is required to ensure that it remains 

≤ [120]°F. The once per 30 minute Completion Time is adequate, based 

on operating experience. Given the high pool temperature in this 

Condition, the monitoring Frequency is increased to twice that of 

Condition A. Furthermore, the 30 minute Completion Time is considered 

adequate in view of other indications available in the control room, 

including alarms, to alert the operator to an abnormal suppression pool 

average temperature condition. 

E.1 and E.2

If suppression pool average temperature cannot be maintained ≤ [120]°F, 

the plant must be brought to a MODE in which the LCO does not apply. 

To achieve this status, the reactor pressure must be reduced to 

< [200] psig within 12 hours and the plant must be brought to MODE 4 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner without challenging plant systems. 
Suppression Pool Average Temperature 

B 3.6.2.1 

BWR/6 STS B 3.6.2.1-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Continued addition of heat to the suppression pool with pool temperature 

> [120]°F could result in exceeding the design basis maximum allowable 

values for primary containment temperature or pressure. Furthermore, if 

a blowdown were to occur when temperature was > [120]°F, the 

maximum allowable bulk and local temperatures could be exceeded very 

quickly. 

SURVEILLANCE SR 3.6.2.1.1

REQUIREMENTS 

The suppression pool average temperature is regularly monitored to 

ensure that the required limits are satisfied. Average temperature is 

determined by taking an arithmetic average of the OPERABLE 

suppression pool water temperature channels. The 24 hour Frequency 

has been shown to be acceptable based on operating experience. When 

heat is being added to the suppression pool by testing, however, it is 

necessary to monitor suppression pool temperature more frequently. The 

5 minute Frequency during testing is justified by the rates at which testing 

will heat up the suppression pool, has been shown to be acceptable 

based on operating experience, and provides assurance that allowable 

pool temperatures are not exceeded. The Frequencies are further 

justified in view of other indications available in the control room, including 

alarms, to alert the operator to an abnormal suppression pool average 

temperature condition. 

REFERENCES 1. FSAR, Section [6.2]. 

 2. FSAR, Section [15.2]. 

 3. NUREG-0783. 
Suppression Pool Water Level 

B 3.6.2.2 

BWR/6 STS B 3.6.2.2-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.2.2 Suppression Pool Water Level 

BASES 

BACKGROUND The suppression pool is a concentric open container of water with a 

stainless steel liner, which is located at the bottom of the primary 

containment. The suppression pool is designed to absorb the decay heat 

and sensible heat released during a reactor blowdown from safety/relief 

valve (S/RV) discharges or from a loss of coolant accident (LOCA). The 

suppression pool must also condense steam from the Reactor Core 

Isolation Cooling (RCIC) System turbine exhaust and provides the main 

emergency water supply source for the reactor vessel. The suppression 

pool volume ranges between [135,291] ft3

 at the low water level limit of 

[18 ft 4.5 inches] and [138,701] ft3

 at the high water level limit of [18 ft 

9.75 inches]. 

If the suppression pool water level is too low, an insufficient amount of 

water would be available to adequately condense the steam from the 

S/RV quenchers, main vents, or RCIC turbine exhaust lines. Low 

suppression pool water level could also result in an inadequate 

emergency makeup water source to the Emergency Core Cooling 

System. The lower volume would also absorb less steam energy before 

heating up excessively. Therefore, a minimum suppression pool water 

level is specified. 

If the suppression pool water level is too high, it could result in excessive 

clearing loads from S/RV discharges and excessive pool swell loads 

resulting from a Design Basis Accident (DBA) LOCA. An inadvertent 

upper pool dump could also overflow the weir wall into the drywell. 

Therefore, a maximum pool water level is specified. This LCO specifies 

an acceptable range to prevent the suppression pool water level from 

being either too high or too low. 

APPLICABLE Initial suppression pool water level affects suppression pool temperature 

SAFETY response calculations, calculated drywell pressure during vent clearing 

ANALYSES for a DBA, calculated pool swell loads for a DBA LOCA, and calculated 

loads due to S/RV discharges. Suppression pool water level must be 

maintained within the limits specified so that the safety analysis of 

Reference 1 remains valid. 

Suppression pool water level satisfies Criteria 2 and 3 of 

10 CFR 50.36(c)(2)(ii). 
Suppression Pool Water Level 

B 3.6.2.2 

BWR/6 STS B 3.6.2.2-2 Rev. 3.0, 03/31/04 

BASES 

LCO A limit that suppression pool water level be ≥ [18 ft 4.5 inches] and ≤ [18 ft 

9.75 inches] is required to ensure that the primary containment conditions 

assumed for the safety analysis are met. Either the high or low water 

level limits were used in the safety analysis, depending upon which is 

conservative for a particular calculation. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant loads on the 

primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced because of the pressure and 

temperature limitations in these MODES. The requirements for 

maintaining suppression pool water level within limits in MODE 4 or 5 is 

addressed in LCO 3.5.2, "ECCS-Shutdown." 

ACTIONS A.1

With suppression pool water level outside the limits, the conditions 

assumed for the safety analysis are not met. If water level is below the 

minimum level, the pressure suppression function still exists as long as 

main vents are covered, RCIC turbine exhausts are covered, and S/RV 

quenchers are covered. If suppression pool water level is above the 

maximum level, protection against overpressurization still exists due to 

the margin in the peak containment pressure analysis or as long as the 

drywell sprays are OPERABLE. Prompt action to restore the suppression 

pool water level to within the normal range is prudent, however, to retain 

the margin to weir wall overflow from an inadvertent upper pool dump and 

reduce the risks of increased pool swell and dynamic loading. Therefore, 

continued operation for a limited time is allowed. The 2 hour Completion 

Time is sufficient to restore suppression pool water level to within 

specified limits. Also, it takes into account the low probability of an event 

impacting the suppression pool water level occurring during this interval. 

B.1 and B.2

If suppression pool water level cannot be restored to within limits within 

the required Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 12 hours and to MODE 4 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 
Suppression Pool Water Level 

B 3.6.2.2 

BWR/6 STS B 3.6.2.2-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.6.2.2.1

REQUIREMENTS 

Verification of the suppression pool water level is to ensure that the 

required limits are satisfied. The 24 hour Frequency of this SR was 

developed considering operating experience related to trending variations 

in suppression pool water level and water level instrument drift during the 

applicable MODES and to assessing the proximity to the specified LCO 

level limits. Furthermore, the 24 hour Frequency is considered adequate 

in view of other indications available in the control room, including alarms, 

to alert the operator to an abnormal suppression pool water level 

condition. 

REFERENCES 1. FSAR, Section [6.2]. 
RHR Suppression Pool Cooling 

B 3.6.2.3 

BWR/6 STS B 3.6.2.3-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.2.3 Residual Heat Removal (RHR) Suppression Pool Cooling 

BASES 

BACKGROUND Following a Design Basis Accident (DBA), the RHR Suppression Pool 

Cooling System removes heat from the suppression pool. The 

suppression pool is designed to absorb the sudden input of heat from the 

primary system. In the long term, the pool continues to absorb residual 

heat generated by fuel in the reactor core. Some means must be 

provided to remove heat from the suppression pool so that the 

temperature inside the primary containment remains within design limits. 

This function is provided by two redundant RHR suppression pool cooling 

subsystems. The purpose of this LCO is to ensure that both subsystems 

are OPERABLE in applicable MODES. 

Each RHR subsystem contains a pump and two heat exchangers in 

series and is manually initiated and independently controlled. The two 

RHR subsystems perform the suppression pool cooling function by 

circulating water from the suppression pool through the RHR heat 

exchangers and returning it to the suppression pool. RHR service water, 

circulating through the tube side of the heat exchangers, exchanges heat 

with the suppression pool water and discharges this heat to the external 

heat sink. 

The heat removal capability of one RHR subsystem is sufficient to meet 

the overall DBA pool cooling requirement to limit peak temperature to 

[185]°F for loss of coolant accidents (LOCAs) and transient events such 

as a turbine trip or a stuck open safety/relief valve (S/RV). S/RV leakage 

and Reactor Core Isolation Cooling System testing increase suppression 

pool temperature more slowly. The RHR Suppression Pool Cooling 

System is also used to lower the suppression pool water bulk temperature 

following such events. 

APPLICABLE Reference 1 contains the results of analyses used to predict primary 

SAFETY containment pressure and temperature following large and small break 

ANALYSES LOCAs. The intent of the analyses is to demonstrate that the heat 

removal capacity of the RHR Suppression Pool Cooling System is 

adequate to maintain the primary containment conditions within design 

limits. The suppression pool temperature is calculated to remain below 

the design limit. 

The RHR Suppression Pool Cooling System satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
RHR Suppression Pool Cooling 

B 3.6.2.3 

BWR/6 STS B 3.6.2.3-2 Rev. 3.0, 03/31/04 

BASES 

LCO During a DBA, a minimum of one RHR suppression pool cooling 

subsystem is required to maintain the primary containment peak pressure 

and temperature below the design limits (Ref. 1). To ensure that these 

requirements are met, two RHR suppression pool cooling subsystems 

must be OPERABLE with power from two safety related independent 

power supplies. Therefore, in the event of an accident, at least one 

subsystem is OPERABLE, assuming the worst case single active failure. 

An RHR suppression pool cooling subsystem is OPERABLE when the 

pump, two heat exchangers, and associated piping, valves, 

instrumentation, and controls are OPERABLE. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to primary containment and cause a heatup and pressurization of 

primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations in these MODES. Therefore, the RHR 

Suppression Pool Cooling System is not required to be OPERABLE in 

MODE 4 or 5. 

ACTIONS A.1

With one RHR suppression pool cooling subsystem inoperable, the 

inoperable subsystem must be restored to OPERABLE status within 

7 days. In this Condition, the remaining RHR suppression pool cooling 

subsystem is adequate to perform the primary containment cooling 

function. However, the overall reliability is reduced because a single 

failure in the OPERABLE subsystem could result in reduced primary 

containment cooling capability. The 7 day Completion Time is acceptable 

in light of the redundant RHR suppression pool cooling capabilities 

afforded by the OPERABLE subsystem and the low probability of a DBA 

occurring during this period. 

B.1

With two RHR suppression pool cooling subsystems inoperable, one 

subsystem must be restored to OPERABLE status within 8 hours. In this 

condition, there is a substantial loss of the primary containment pressure 

and temperature mitigation function. The 8 hour Completion Time is 

based on this loss of function and is considered acceptable due to the low 

probability of a DBA and the potential avoidance of a plant shutdown 

transient that could result in the need for the RHR suppression pool 

cooling subsystems to operate. 
RHR Suppression Pool Cooling 

B 3.6.2.3 

BWR/6 STS B 3.6.2.3-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

If the Required Action and required Completion Time cannot be met, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

12 hours and to MODE 4 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required 

plant conditions from full power conditions in an orderly manner and 

without challenging plant systems. 

SURVEILLANCE SR 3.6.2.3.1

REQUIREMENTS 

Verifying the correct alignment for manual, power operated, and 

automatic valves, in the RHR suppression pool cooling mode flow path 

provides assurance that the proper flow path exists for system operation. 

This SR does not apply to valves that are locked, sealed, or otherwise 

secured in position since these valves were verified to be in the correct 

position prior to being locked, sealed, or secured. A valve is also allowed 

to be in the nonaccident position, provided it can be aligned to the 

accident position within the time assumed in the accident analysis. This 

is acceptable, since the RHR suppression pool cooling mode is manually 

initiated. This SR does not require any testing or valve manipulation; 

rather, it involves verification that those valves capable of being 

mispositioned are in the correct position. This SR does not apply to 

valves that cannot be inadvertently misaligned, such as check valves. 

The Frequency of 31 days is justified because the valves are operated 

under procedural control, improper valve position would affect only a 

single subsystem, the probability of an event requiring initiation of the 

system is low, and the subsystem is a manually initiated system. This 

Frequency has been shown to be acceptable, based on operating 

experience. 

SR 3.6.2.3.2

Verifying each RHR pump develops a flow rate ≥ [7450] gpm, while 

operating in the suppression pool cooling mode with flow through the 

associated heat exchanger at least every 92 days, ensures that pump 

performance has not degraded during the cycle. Flow is a normal test of 

centrifugal pump performance required by ASME Section XI (Ref. 2). 

This test confirms one point on the pump design curve, and the results 

are indicative of overall performance. Such inservice inspections confirm 

component OPERABILITY, trend performance, and detect incipient 

failures by indicating abnormal performance. The Frequency of this SR is 

[in accordance with the Inservice Testing Program or 92 days].
RHR Suppression Pool Cooling 

B 3.6.2.3 

BWR/6 STS B 3.6.2.3-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [6.2]. 

 2. ASME, Boiler and Pressure Vessel Code, Section XI. 
SPMU System 

B 3.6.2.4 

BWR/6 STS B 3.6.2.4-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.2.4 Suppression Pool Makeup (SPMU) System 

BASES 

BACKGROUND The function of the SPMU System is to transfer water from the upper 

containment pool to the suppression pool after a loss of coolant accident 

(LOCA). For a LOCA, with Emergency Core Cooling System injection 

from the suppression pool, a large volume of water can be held up in the 

drywell behind the weir wall. This holdup can significantly lower 

suppression pool water level. The water transfer from the SPMU System 

ensures a post LOCA suppression pool vent coverage of ≥ 2 ft above the 

top of the top row vents so that long term steam condensation is 

maintained. The additional makeup water is used as part of the long term 

suppression pool heat sink. The post LOCA delayed transfer of this water 

to the suppression pool provides an initially low vent submergence, which 

results in lower drywell pressure loading and lower pool dynamic loading 

during a Design Basis Accident (DBA) LOCA as compared to higher vent 

submergence. The sizing of the residual heat removal heat exchanger 

takes credit for the additional SPMU System water mass in the calculation 

of the post LOCA peak containment pressure and suppression pool 

temperature. 

The required water dump volume from the upper containment pool is 

equal to the difference between the total post LOCA drawdown volume 

and the assumed volume loss from the suppression pool. The total 

drawdown volume is the volume of suppression pool water that can be 

entrapped outside of the suppression pool following a LOCA. The post 

LOCA entrapment volumes causing suppression pool level drawdown 

include: 

a. The free volume inside and below the top of the drywell weir wall, 

b. The added volume required to fill the reactor pressure vessel from a 

condition of normal power operation to a post accident complete fill of 

the vessel, including the top dome, 

c. The volume in the steam lines out to the inboard main steam isolation 

valve (MSIV) on three lines and out to the outboard MSIV on one 

line, and 

d. Allowances for primary containment spray holdup on equipment and 

structural surfaces. 
SPMU System 

B 3.6.2.4 

BWR/6 STS B 3.6.2.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The SPMU System consists of two redundant subsystems, each capable 

of dumping the makeup volume from the upper containment pool to the 

suppression pool by gravity flow. Each dump line includes two normally 

closed valves in series. The upper pool is dumped automatically on a 

suppression pool water level Low-Low signal (with a LOCA signal 

permissive) or on the basis of a timer following a LOCA signal alone to 

ensure that the makeup volume is available as part of the long term 

energy sink for small breaks that might not cause dump on a suppression 

pool water level Low-Low signal. A 30 minute timer was chosen, since 

the initial suppression pool mass is adequate for any sequence of vessel 

blowdown energy and decay heat up to at least 30 minutes. 

Although the minimum freeboard distance above the suppression pool 

high water level limit of LCO 3.6.2.2, "Suppression Pool Water Level," to 

the top of the weir wall is adequate to preclude flooding of the drywell, a 

LOCA permissive signal is used to prevent an erroneous suppression 

pool level signal from causing pool dump. In addition, the SPMU System 

mode switch may be keylocked in the "OFF" position to ensure that 

inadvertent dump will not occur. Inadvertent actuation of the SPMU 

System during MODE 4 or 5 could create a radiation hazard to plant 

personnel due to a loss of shield water from the upper pool if irradiated 

fuel were in an elevated position. 

APPLICABLE Analyses used to predict suppression pool temperature following large 

SAFETY and small break LOCAs, which are the applicable DBAs for the SPMU 

ANALYSES System, are contained in References 1 and 2. During these events, the 

SPMU System is relied upon to dump upper containment pool water to 

maintain drywell horizontal vent coverage and an adequate suppression 

pool heat sink volume to ensure that the primary containment internal 

pressure and temperature stay within design limits. The analysis 

assumes an SPMU System dump volume of [36,380] ft3

 at a temperature 

of [125]N

F. 

The SPMU System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO During a DBA, a minimum of one SPMU subsystem is required to 

maintain peak suppression pool water temperature below the design 

limits (Ref. 1). To ensure that these requirements are met, two SPMU 

subsystems must be OPERABLE with power from two independent safety 

related power supplies. Therefore, in the event of an accident, at least 

one subsystem is OPERABLE, assuming the worst case single active 
SPMU System 

B 3.6.2.4 

BWR/6 STS B 3.6.2.4-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

failure. The SPMU System is OPERABLE when the upper containment 

pool water temperature is ≤ [125]°F, the water level is ≥ [23 ft 3 inches], 

gates are in the stored condition, the piping is intact, and the system 

valves are OPERABLE. The above temperature and water level 

conditions correspond to an SPMU System available dump volume of 

≥ [36,380] ft3

. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause heatup and pressurization of 

the primary containment. In MODES 4 and 5, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations in these MODES. Therefore, maintaining the 

SPMU System OPERABLE is not required in MODE 4 or 5. 

ACTIONS A.1

When upper containment pool water level is < [23 ft 3 inches], the volume 

is inadequate to ensure that the suppression pool heat sink capability 

matches the safety analysis assumptions. A sufficient quantity of water is 

necessary to ensure long term energy sink capabilities of the suppression 

pool and maintain water coverage over the uppermost drywell vents. 

Loss of water volume has a relatively large impact on heat sink capability. 

Therefore, the upper containment pool water level must be restored to 

within limit within 4 hours. The 4 hour Completion Time is sufficient to 

provide makeup water to the upper containment pool to restore level 

within specified limit. Also, it takes into account the low probability of an 

event occurring that would require the SPMU System. 

B.1

When upper containment pool water temperature is > [125]°F, the heat 

absorption capacity is inadequate to ensure that the suppression pool 

heat sink capability matches the safety analysis assumptions. Increased 

temperature has a relatively smaller impact on heat sink capability. 

Therefore, the upper containment pool water temperature must be 

restored to within limit within 24 hours. The 24 hour Completion Time is 

sufficient to restore the upper containment pool to within the specified 

temperature limit. It also takes into account the low probability of an 

event occurring that would require the SPMU System. 
SPMU System 

B 3.6.2.4 

BWR/6 STS B 3.6.2.4-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

With one SPMU subsystem inoperable for reasons other than Condition A 

or B, the inoperable subsystem must be restored to OPERABLE status 

within 7 days. The 7 day Completion Time is acceptable in light of the 

redundant SPMU System capabilities afforded by the OPERABLE 

subsystem and the low probability of a DBA occurring during this period. 

D.1 and D.2

If any Required Action and required Completion Time cannot be met, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

12 hours and to MODE 4 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required 

plant conditions from full power conditions in an orderly manner and 

without challenging plant systems. 

SURVEILLANCE SR 3.6.2.4.1

REQUIREMENTS 

The upper containment pool water level is regularly monitored to ensure 

that the required limits are satisfied. The 24 hour Frequency of this SR 

was developed, considering operating experience related to upper 

containment pool water level variations and water level instrument drift 

during the applicable MODES and considering the low probability of a 

DBA occurring between surveillances. Furthermore, the 24 hour 

Frequency is considered adequate in view of other indications available in 

the control room, including alarms, to alert the operator to an abnormal 

upper containment pool water level condition. 

SR 3.6.2.4.2

The upper containment pool water temperature is regularly monitored to 

ensure that the required limit is satisfied. The 24 hour Frequency was 

developed, based on operating experience related to upper containment 

pool temperature variations during the applicable MODES. 
SPMU System 

B 3.6.2.4 

BWR/6 STS B 3.6.2.4-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.2.4.3

Verifying the correct alignment for manual, power operated, and 

automatic valves in the SPMU System flow path provides assurance that 

the proper flow paths will exist for system operation. This SR does not 

apply to valves that are locked, sealed, or otherwise secured in position, 

since these valves are verified to be in the correct position prior to being 

locked, sealed, or secured. This SR does not require any testing or valve 

manipulation. Rather, it involves verification that those valves capable of 

potentially being mispositioned are in the correct position. This SR does 

not apply to valves that cannot be inadvertently misaligned, such as 

check valves. 

The Frequency of 31 days is justified because the valves are operated 

under procedural control and because improper valve position would 

affect only a single subsystem. This Frequency has been shown to be 

acceptable through operating experience. 

[ SR 3.6.2.4.4

The upper containment pool has two gates used to separate the pool into 

distinct sections to facilitate fuel transfer and maintenance during 

refueling operations and two additional gates in the separator pool weir 

wall extension, which, when installed, limit personnel exposure and 

ensure adequate water submergence of the separator when the separator 

is stored in the pool. The SPMU System dump line penetrations are 

located in the steam separator storage section of the pool. To provide the 

required SPMU System dump volume to the suppression pool, the gates 

must be removed (or placed in their stored position) to allow 

communication between the various pool sections. The 31 day 

Frequency is appropriate because the gates are moved under procedural 

control and only the infrequent movement of these gates is required in 

MODES 1, 2, and 3. ]

SR 3.6.2.4.5

This SR requires a verification that each SPMU subsystem automatic 

valve actuates to its correct position on receipt of an actual or simulated 

automatic initiation signal. This includes verification of the correct 

automatic positioning of the valves and of the operation of each interlock 

and timer. As noted, actual makeup to the suppression pool may be 
SPMU System 

B 3.6.2.4 

BWR/6 STS B 3.6.2.4-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

excluded. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.4.6 

overlaps this SR to provide complete testing of the safety function. The 

[18] month Frequency is based on the need to perform this Surveillance 

under the conditions that apply during a plant outage and the potential for 

an unplanned transient if the Surveillance were performed with the 

reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [6.2]. 

 2. FSAR, Chapter [15]. 
Primary Containment and Drywell Hydrogen Ignitors 

B 3.6.3.1 

BWR/6 STS B 3.6.3.1-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.3.1 Primary Containment and Drywell Hydrogen Ignitors 

BASES 

BACKGROUND The primary containment and drywell hydrogen ignitors are a part of the 

combustible gas control required by 10 CFR 50.44 (Ref. 1) and GDC 41, 

"Containment Atmosphere Cleanup" (Ref. 2), to reduce the hydrogen 

concentration in the primary containment following a degraded core 

accident. The hydrogen ignitors ensure the combustion of hydrogen in a 

manner such that containment overpressure failure is prevented as a 

result of a postulated degraded core accident. 

10 CFR 50.44 (Ref. 1) requires boiling water reactor units with Mark III 

containments to install suitable hydrogen control systems. The hydrogen 

ignitors are installed to accommodate an amount of hydrogen equivalent 

to that generated from the reaction of 75% of the fuel cladding with water. 

This requirement was placed on reactor units with Mark III containments 

because they were not designed for inerting and because of their low 

design pressure. Calculations indicate that if hydrogen equivalent to that 

generated from the reaction of 75% of the fuel cladding with water were to 

collect in primary containment, the resulting hydrogen concentration 

would be far above the lower flammability limit such that, without the 

hydrogen ignitors, if the hydrogen were ignited from a random ignition 

source, the resulting hydrogen burn would seriously challenge the primary 

containment. 

The hydrogen ignitors are based on the concept of controlled ignition 

using thermal ignitors designed to be capable of functioning in a post 

accident environment, seismically supported and capable of actuation 

from the control room. Ignitors are distributed throughout the [32] regions 

of the drywell and primary containment in which hydrogen could be 

released or to which it could flow in significant quantities. The hydrogen 

ignitors are arranged in two independent divisions such that each 

containment region has two ignitors, one from each division, controlled 

and powered redundantly so that ignition would occur in each region even 

if one division failed to energize. 

When the hydrogen ignitors are energized they heat up to a surface 

temperature ≥ [1700]°F. At this temperature, they ignite the hydrogen gas 

that is present in the airspace in the vicinity of the ignitor. The hydrogen 

ignitors depend on the dispersed location of the ignitors so that local 

pockets of hydrogen at increased concentrations would burn before 

reaching a hydrogen concentration significantly higher than the lower 

flammability limit. Hydrogen ignition in the vicinity of the ignitors is 

assumed to occur when the local hydrogen concentration reaches 

[8.0] volume percent (v/o) and results in [85]% of the hydrogen present 

being consumed. 
Primary Containment and Drywell Hydrogen Ignitors 

B 3.6.3.1 

BWR/6 STS B 3.6.3.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The hydrogen ignitors cause hydrogen in containment to burn in a 

SAFETY controlled manner as it accumulates following a degraded core accident 

ANALYSES (Ref. 3). Burning occurs at the lower flammability concentration, where 

the resulting temperatures and pressures are relatively benign. Without 

the system, hydrogen could build up to higher concentrations that could 

result in a violent reaction if ignited by a random ignition source after such 

a buildup. 

The hydrogen ignitors are not included for mitigation of a Design Basis 

Accident (DBA) because an amount of hydrogen equivalent to that 

generated from the reaction of 75% of the fuel cladding with water is far in 

excess of the hydrogen calculated for the limiting DBA loss of coolant 

accident (LOCA). The hydrogen concentration resulting from a DBA can 

be maintained less than the flammability limit using the hydrogen 

recombiners. However, the hydrogen ignitors have been shown by 

probabilistic risk analysis to be a significant contributor to limiting the 

severity of accident sequences that are commonly found to dominate risk 

for units with Mark III containment. 

The hydrogen ignitors satisfy Criterion 4 of 10 CFR 50.36(c)(2)(ii). 

LCO Two divisions of primary containment and drywell hydrogen ignitors must 

be OPERABLE, each with more than 90% of the ignitors OPERABLE. 

This ensures operation of at least one ignitor division, with adequate 

coverage of the primary containment and drywell, in the event of a worst 

case single active failure. This will ensure that the hydrogen 

concentration remains near 4.0 v/o. 

APPLICABILITY In MODES 1 and 2, the hydrogen ignitor is required to control hydrogen 

concentration to near the flammability limit of 4.0 v/o following a degraded 

core event that would generate hydrogen in amounts equivalent to a 

metal water reaction of 75% of the core cladding. The control of 

hydrogen concentration prevents overpressurization of the primary 

containment. The event that could generate hydrogen in quantities 

sufficiently high enough to exceed the flammability limit is limited to 

MODES 1 and 2. 

In MODE 3, both the hydrogen production rate and the total hydrogen 

produced after a degraded core accident would be less than that 

calculated for the DBA LOCA. Also, because of the limited time in this 

MODE, the probability of an accident requiring the hydrogen ignitor is low. 

Therefore, the hydrogen ignitor is not required in MODE 3. 

In MODES 4 and 5, the probability and consequences of a degraded core 

accident are reduced due to the pressure and temperature limitations. 

Therefore, the hydrogen ignitors are not required to be OPERABLE in 

MODES 4 and 5 to control hydrogen. 
Primary Containment and Drywell Hydrogen Ignitors 

B 3.6.3.1 

BWR/6 STS B 3.6.3.1-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With one hydrogen ignitor division inoperable, the inoperable division 

must be restored to OPERABLE status within 30 days. In this Condition, 

the remaining OPERABLE hydrogen ignitor division is adequate to 

perform the hydrogen burn function. However, the overall reliability is 

reduced because a single failure in the OPERABLE subsystem could 

result in reduced hydrogen control capability. The 30 day Completion 

Time is based on the low probability of the occurrence of a degraded core 

event that would generate hydrogen in amounts equivalent to a metal 

water reaction of 75% of the core cladding, the amount of time available 

after the event for operator action to prevent hydrogen accumulation from 

exceeding the flammability limit, and the low probability of failure of the 

OPERABLE hydrogen ignitor division. 

B.1 and B.2

With two primary containment and drywell ignitor divisions inoperable, the 

ability to perform the hydrogen control function via alternate capabilities 

must be verified by administrative means within 1 hour. The 1 hour 

Completion Time allows a reasonable period of time to verify that a loss 

of hydrogen control function does not exist. The verification may be 

performed as an administrative check by examining logs or other 

information to determine the availability of the alternate hydrogen control 

capabilities. It does not mean to perform the Surveillances needed to 

demonstrate OPERABILITY of the alternate hydrogen control capabilities. 

If the ability to perform the hydrogen control function is maintained, 

continued operation is permitted with two ignitor divisions inoperable for 

up to 7 days. Seven days is a reasonable time to allow two ignitor 

divisions to be inoperable because the hydrogen control function is 

maintained and because of the low probability of the occurrence of a 

LOCA that would generate hydrogen in the amounts capable of 

exceeding the flammability limit. 

C.1

If any Required Action and required Completion Time cannot be met, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

12 hours. The allowed Completion Time of 12 hours is reasonable, 

based on operating experience, to reach MODE 3 from full power 

conditions in an orderly manner and without challenging plant systems. 
Primary Containment and Drywell Hydrogen Ignitors 

B 3.6.3.1 

BWR/6 STS B 3.6.3.1-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.6.3.1.1 and SR 3.6.3.1.2

REQUIREMENTS 

These SRs verify that there are no physical problems that could affect the 

ignitor operation. Since the ignitors are mechanically passive, they are 

not subject to mechanical failure. The only credible failures are loss of 

power or burnout. The verification that each required ignitor is energized 

is performed by circuit current versus voltage measurement. 

The Frequency of 184 days has been shown to be acceptable through 

operating experience because of the low failure occurrence, and provides 

assurance that hydrogen burn capability exists between the more 

rigorous 18 month Surveillances. Operating experience has shown these 

components usually pass the Surveillance when performed at a 184 day 

Frequency. Additionally, these surveillances must be performed every 

92 days if four or more ignitors in any division are inoperable. The 92 day 

Frequency was chosen, recognizing that the failure occurrence is higher 

than normal. Thus, decreasing the Frequency from 184 days to 92 days 

is a prudent measure, since only two more inoperable ignitors (for a total 

of six) will result in an inoperable ignitor division. SR 3.6.3.1.2 is modified 

by a Note that indicates that the Surveillance is not required to be 

performed until 92 days after four or more ignitors in the division are 

discovered to be inoperable. 

[ SR 3.6.3.1.3 and SR 3.6.3.1.4

These functional tests are performed every 18 months to verify system 

OPERABILITY. The current draw to develop a surface temperature of 

≥ 1700°F is verified for ignitors in inaccessible areas, e.g., in a high 

radiation area. Additionally, the surface temperature of each accessible 

ignitor is measured to be ≥ 1700°F to demonstrate that a temperature 

sufficient for ignition is achieved. The 18 month Frequency is based on 

the need to perform this Surveillance under the conditions that apply 

during a plant outage and the potential for an unplanned transient if the 

Surveillance were performed with the reactor at power. Operating 

experience has shown that these components usually pass the 

Surveillance when performed at the 18 month Frequency. Therefore, the 

Frequency was concluded to be acceptable from a reliability standpoint. ] 

REFERENCES 1. 10 CFR 50.44. 

 2. 10 CFR 50, Appendix A, GDC 41. 

 3. FSAR, Section [6.2.5]. 
 [Drywell Purge System] 

B 3.6.3.2 

BWR/6 STS B 3.6.3.2-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.3.2 [Drywell Purge System] 

BASES 

BACKGROUND The [Drywell Purge System] ensures a uniformly mixed post accident 

containment atmosphere, thereby minimizing the potential for local 

hydrogen burns due to a pocket of hydrogen above the flammable 

concentration. 

The [Drywell Purge System] is an Engineered Safety Feature and is 

designed to operate following a loss of coolant accident (LOCA) in post 

accident environments without loss of function. The system has two 

independent subsystems, each consisting of a compressor and 

associated valves, controls, and piping. Each subsystem is sized to 

pump [500] scfm. Each subsystem is powered from a separate 

emergency power supply. Since each subsystem can provide 100% of 

the mixing requirements, the system will provide its design function with a 

worst case single active failure. 

Following a LOCA, the drywell is immediately pressurized due to the 

release of steam into the drywell environment. This pressure is relieved 

by the lowering of the water level within the weir wall, clearing the drywell 

vents and allowing the mixture of steam and noncondensibles to flow into 

the primary containment through the suppression pool, removing much of 

the heat from the steam. The remaining steam in the drywell begins to 

condense as steam flow from the reactor pressure vessel ceases, the 

drywell pressure falls rapidly. Both drywell purge compressors start 

automatically 30 seconds after a LOCA signal is received from the 

Emergency Core Cooling System instrumentation, but only when drywell 

pressure has decreased to within approximately [0.087] psi above primary 

containment pressure. This ensures the blowdown from the drywell to the 

primary containment is complete. The drywell purge compressors force 

air from the primary containment into the drywell. Drywell pressure 

increases until the water level between the weir wall and the drywell is 

forced down to the first row of suppression pool vents forcing drywell 

atmosphere back into containment and mixing with containment 

atmosphere to dilute the hydrogen. 
 [Drywell Purge System] 

B 3.6.3.2 

BWR/6 STS B 3.6.3.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The [Drywell Purge System] provides the capability for reducing the 

SAFETY drywell hydrogen concentration to approximately the bulk average 

ANALYSES primary containment concentration following a Design Basis Accident 

(DBA). The limiting DBA relative to hydrogen generation is a LOCA. 

Hydrogen may accumulate in primary containment following a LOCA as a 

result of: 

a. A metal steam reaction between the zirconium fuel rod cladding and 

the reactor coolant and 

b. Radiolytic decomposition of water in the Reactor Coolant System and 

drywell sump. 

To evaluate the potential for hydrogen accumulation in primary 

containment following a LOCA, the hydrogen generation as a function of 

time following the initiation of the accident is calculated. Conservative 

assumptions recommended by Reference 1 are used to maximize the 

amount of hydrogen calculated. 

[ Based on a conservative assumption used to calculate the hydrogen 

concentration versus time after a LOCA, the hydrogen concentration in 

the primary containment would reach [3.5 v/o about 6 days] after the 

LOCA and [4.0 v/o about 2 days] later if no hydrogen mixing and 

recombiner were functioning (Ref. 2). ] 

The [Drywell Purge System] satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Two [drywell purge] subsystems must be OPERABLE to ensure operation 

of at least one primary containment [drywell purge] subsystem in the 

event of a worst case single active failure. Operation with at least one 

OPERABLE [drywell purge] subsystem provides the capability of 

controlling the hydrogen concentration in the drywell without exceeding 

the flammability limit. 

APPLICABILITY In MODES 1 and 2, the two [drywell purge] subsystems ensure the 

capability to prevent localized hydrogen concentrations above the 

flammability limit of 4.0 v/o in the drywell, assuming a worst case single 

active failure. 

In MODE 3, both the hydrogen production rate and the total hydrogen 

produced after a LOCA would be less than that calculated for the DBA 

LOCA. Also, because of the limited time in this MODE, the probability of 

an accident requiring the [Drywell Purge System] is low. Therefore, the 

[Drywell Purge System] is not required in MODE 3. 
 [Drywell Purge System] 

B 3.6.3.2 

BWR/6 STS B 3.6.3.2-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

In MODES 4 and 5, the probability and consequences of a LOCA are 

reduced due to the pressure and temperature limitations in these 

MODES. Therefore, the [Drywell Purge System] is not required in these 

MODES. 

ACTIONS A.1

With one [drywell purge] subsystem inoperable, the inoperable subsystem 

must be restored to OPERABLE status within 30 days. In this Condition, 

the remaining OPERABLE subsystem is adequate to perform the drywell 

purge function. However, the overall reliability is reduced because a 

single failure in the OPERABLE subsystem could result in reduced 

drywell purge capability. The 30 day Completion Time is based on the 

availability of the second subsystem, the low probability of a LOCA that 

would generate hydrogen in amounts capable of exceeding the 

flammability limit, and the amount of time available after the event for 

operator action to prevent hydrogen accumulation from exceeding this 

limit. 

B.1 and B.2

-----------------------------------REVIEWER’S NOTE----------------------------------- 

This Condition is only allowed for units with an alternate hydrogen control 

system acceptable to the technical staff. 

-------------------------------------------------------------------------------------------------- 

With two [drywell purge] subsystems inoperable, the ability to perform the 

hydrogen control function via alternate capabilities must be verified by 

administrative means within 1 hour. The alternate hydrogen control 

capabilities are provided by [one division of the hydrogen ignitors]. The 

1 hour Completion Time allows a reasonable period of time to verify that a 

loss of hydrogen control function does not exist. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The following is to be used if a non-Technical Specification alternate 

hydrogen control function is used to justify this Condition: In addition, the 

alternate hydrogen control system capability must be verified once per 

12 hours thereafter to ensure its continued availability. 

-------------------------------------------------------------------------------------------------- 
 [Drywell Purge System] 

B 3.6.3.2 

BWR/6 STS B 3.6.3.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[Both] the [initial] verification may [and all subsequent verifications] may 

be performed as an administrative check by examining logs or other 

information to determine the availability of the alternate hydrogen control 

system. It does not mean to perform the surveillances needed to 

demonstrate OPERABILITY of the alternate hydrogen control system. If 

the ability to perform the hydrogen control function is maintained, 

continued operation is permitted with two [drywell purge] subsystems 

inoperable for up to 7 days. Seven days is a reasonable time to allow two 

[drywell purge] subsystems to be inoperable because the hydrogen 

control function is maintained and because of the low probability of the 

occurrence of a LOCA that would generate hydrogen in amounts capable 

of exceeding the flammability limit. 

C.1

If any Required Action and the required Completion Time cannot be met, 

the plant must be brought to a MODE in which the LCO does not apply. 

To achieve this status, the plant must be brought to at least MODE 3 

within 12 hours. The allowed Completion Time of 12 hours is reasonable, 

based on operating experience, to reach MODE 3 from full power 

conditions in an orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.6.3.2.1

REQUIREMENTS 

Operating each [drywell purge] subsystem for ≥ 15 minutes ensures that 

each subsystem is OPERABLE and that all associated controls are 

functioning properly. It also ensures that blockage, compressor failure, or 

excessive vibration can be detected for corrective action. The 92 day 

Frequency is consistent with Inservice Testing Program Frequencies, 

operating experience, the known reliability of the compressor and 

controls, and the two redundant subsystems available. 

[ SR 3.6.3.2.2

Verifying that each [drywell purge] subsystem flow rate is ≥ [500] scfm 

ensures that each subsystem is capable of maintaining drywell hydrogen 

concentrations below the flammability limit. The 18 month Frequency is 

based on the need to perform this Surveillance under the conditions that 

apply during a plant outage and the potential for an unplanned transient if 

the Surveillance were performed with the reactor at power. Operating 

experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint. ] 
 [Drywell Purge System] 

B 3.6.3.2 

BWR/6 STS B 3.6.3.2-5 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. Regulatory Guide 1.7, Revision [1]. 

 2. FSAR, Section [6.2.5].
 [Secondary Containment] 

B 3.6.4.1 

BWR/6 STS B 3.6.4.1-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.4.1 [Secondary Containment] 

BASES 

BACKGROUND The function of the [secondary containment] is to contain, dilute, and hold 

up fission products that may leak from primary containment following a 

Design Basis Accident (DBA). In conjunction with operation of the 

Standby Gas Treatment (SGT) System and closure of certain valves 

whose lines penetrate the [secondary containment], the [secondary 

containment] is designed to reduce the activity level of the fission 

products prior to release to the environment and to isolate and contain 

fission products that are released during certain operations that take 

place inside primary containment, when primary containment is not 

required to be OPERABLE, or that take place outside primary 

containment. 

The [secondary containment] is a structure that completely encloses the 

primary containment and those components that may be postulated to 

contain primary system fluid. This structure forms a control volume that 

serves to hold up and dilute the fission products. It is possible for the 

pressure in the control volume to rise relative to the environmental 

pressure (e.g., due to pump/motor heat load additions). To prevent 

ground level exfiltration while allowing the [secondary containment] to be 

designed as a conventional structure, the [secondary containment] 

requires support systems to maintain the control volume pressure at less 

than the external pressure. Requirements for these systems are 

specified separately in LCO 3.6.4.2, "Secondary Containment Isolation 

Valves (SCIVs)," and LCO 3.6.4.3, "Standby Gas Treatment (SGT) 

System." 

APPLICABLE There are three principal accidents for which credit is taken for 

SAFETY [secondary containment] OPERABILITY. These are a LOCA (Ref. 1), a 

ANALYSES fuel handling accident [involving handling recently irradiated fuel (i.e., fuel 

that has occupied part of a critical reactor core within the previous [X] 

days)] inside primary containment (Ref. 2), and a fuel handling accident 

[involving handling recently irradiated fuel] in the auxiliary building 

(Ref. 3). The [secondary containment] performs no active function in 

response to each of these limiting events; however, its leak tightness is 

required to ensure that the release of radioactive materials from the 

primary containment is restricted to those leakage paths and associated 

leakage rates assumed in the accident analysis, and that fission products 

entrapped within the [secondary containment] structure will be treated by 

the SGT System prior to discharge to the environment. 

[Secondary containment] satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
 [Secondary Containment] 

B 3.6.4.1 

BWR/6 STS B 3.6.4.1-2 Rev. 3.0, 03/31/04 

BASES 

LCO An OPERABLE [secondary containment] provides a control volume into 

which fission products that bypass or leak from primary containment, or 

are released from the reactor coolant pressure boundary components 

located in [secondary containment], can be diluted and processed prior to 

release to the environment. For the [secondary containment] to be 

considered OPERABLE, it must have adequate leak tightness to ensure 

that the required vacuum can be established and maintained. 

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to 

primary containment that leaks to [secondary containment]. Therefore, 

[secondary containment] OPERABILITY is required during the same 

operating conditions that require primary containment OPERABILITY. 

In MODES 4 and 5, the probability and consequences of the LOCA are 

reduced due to the pressure and temperature limitations in these 

MODES. Therefore, maintaining [secondary containment] OPERABLE is 

not required in MODE 4 or 5 to ensure a control volume, except for other 

situations for which significant releases of radioactive material can be 

postulated, such as during operations with a potential for draining the 

reactor vessel (OPDRVs) or during movement of [recently] irradiated fuel 

assemblies in the [primary or secondary containment]. 

[Due to radioactive decay, secondary containment is only required to be 

OPERABLE during fuel handling involving handling recently irradiated 

fuel (i.e., fuel that has occupied part of a critical reactor core within the 

previous [X] days).] 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The addition of the term "recently" associated with handling irradiated fuel 

in all of the containment function Technical Specification requirements is 

only applicable to those licensees who have demonstrated by analysis 

that after sufficient radioactive decay has occurred, off-site doses 

resulting from a fuel handling accident remain below the Standard Review 

Plan limits (well within 10 CFR 100). 

Additionally, licensees adding the term "recently" must make the following 

commitment which is consistent with NUMARC 93-01, Revision 4, 

Section 11.3.6.5, "Safety Assessment for Removal of Equipment from 

Service During Shutdown Conditions," subheading "Containment - 

Secondary (BWR)." 

"The following guidelines are included in the assessment of systems 

removed from service during movement of irradiated fuel: 
 [Secondary Containment] 

B 3.6.4.1 

BWR/6 STS B 3.6.4.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

- During fuel handling/core alterations, ventilation system and 

radiation monitor availability (as defined in NUMARC 91-06) should 

be assessed, with respect to filtration and monitoring of releases from 

the fuel. Following shutdown, radioactivity in the fuel decays away 

fairly rapidly. The basis of the Technical Specification operability 

amendment is the reduction in doses due to such decay. The goal of 

maintaining ventilation system and radiation monitor availability is to 

reduce doses even further below that provided by the natural decay. 

- A single normal or contingency method to promptly close primary or 

secondary containment penetrations should be developed. Such 

prompt methods need not completely block the penetration or be 

capable of resisting pressure. 

The purpose of the "prompt methods" mentioned above are to enable 

ventilation systems to draw the release from a postulated fuel handling 

accident in the proper direction such that it can be treated and 

monitored." 

-------------------------------------------------------------------------------------------------- 

ACTIONS A.1

If [secondary containment] is inoperable, it must be restored to 

OPERABLE status within 4 hours. The 4 hour Completion Time provides 

a period of time to correct the problem that is commensurate with the 

importance of maintaining [secondary containment] during MODES 1, 2, 

and 3. This time period also ensures that the probability of an accident 

(requiring [secondary containment] OPERABILITY) occurring during 

periods where [secondary containment] is inoperable is minimal. 

B.1 and B.2

If the [secondary containment] cannot be restored to OPERABLE status 

within the required Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 12 hours and to MODE 4 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 
 [Secondary Containment] 

B 3.6.4.1 

BWR/6 STS B 3.6.4.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ C.1 and C.2

Movement of [recently] irradiated fuel assemblies in the [primary or 

secondary containment] and OPDRVs can be postulated to cause 

significant fission product release to the [secondary containment]. In 

such cases, the [secondary containment] is the only barrier to release of 

fission products to the environment. Therefore, movement of [recently] 

irradiated fuel assemblies must be immediately suspended if the 

[secondary containment] is inoperable. 

Suspension of these activities shall not preclude completing an action that 

involves moving a component to a safe position. Also, action must be 

immediately initiated to suspend OPDRVs to minimize the probability of a 

vessel draindown and subsequent potential for fission product release. 

Actions must continue until OPDRVs are suspended. 

Required Action C.1 has been modified by a Note stating that LCO 3.0.3 

is not applicable. If moving [recently] irradiated fuel assemblies while in 

MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving 

[recently] irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel 

movement is independent of reactor operations. Therefore, in either 

case, inability to suspend movement of [recently] irradiated fuel 

assemblies would not be a sufficient reason to require a reactor 

shutdown. ] 

SURVEILLANCE [ SR 3.6.4.1.1

REQUIREMENTS 

This SR ensures that the [secondary containment] boundary is sufficiently 

leak tight to preclude exfiltration under expected wind conditions. The 

24 hour Frequency of this SR was developed based on operating 

experience related to [secondary containment] vacuum variations during 

the applicable MODES and the low probability of a DBA occurring 

between surveillances. 

Furthermore, the 24 hour Frequency is considered adequate in view of 

other indications available in the control room, including alarms, to alert 

the operator to an abnormal [secondary containment] vacuum condition. ]
 [Secondary Containment] 

B 3.6.4.1 

BWR/6 STS B 3.6.4.1-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.4.1.2 and SR 3.6.4.1.3

Verifying that [secondary containment] equipment hatches and one 

access door in each access opening are closed ensures that the 

infiltration of outside air of such a magnitude as to prevent maintaining the 

desired negative pressure does not occur. Verifying that all such 

openings are closed provides adequate assurance that exfiltration from 

the [secondary containment] will not occur. In this application, the term 

"sealed" has no connotation of leak tightness. Maintaining [secondary 

containment] OPERABILITY requires verifying one door in the access 

opening is closed. [An access opening contains one inner and one outer 

door. In some cases, [secondary] containment access openings are 

shared such that a [secondary] containment barrier may have multiple 

inner or multiple outer doors. The intent is to not breach the [secondary] 

containment at any time when [secondary] containment is required. This 

is achieved by maintaining the inner or outer portion of the barrier closed 

at all times.] However, all [secondary] containment access doors are 

normally kept closed, except when the access opening is being used for 

entry and exit or when maintenance is being performed on an access 

opening. The 31 day Frequency for these SRs has been shown to be 

adequate based on operating experience, and is considered adequate in 

view of the other indications of door and hatch status that are available to 

the operator. 

[SR 3.6.4.1.4 and] SR 3.6.4.1.5

The SGT System exhausts the [secondary] containment atmosphere to 

the environment through appropriate treatment equipment. Each SGT 

subsystem is designed to draw down pressure in the [secondary] 

containment to ≥[0.25] inches of vacuum water gauge in ≤ [120] seconds 

and maintain pressure in the [secondary] containment at ≥ [0.266] inches 

of vacuum water gauge for 1 hour at a flow rate ≤ [4000] cfm. To ensure 

that all fission products released to the [secondary] containment are 

treated, [SR 3.6.4.1.4 and] SR 3.6.4.1.5 verify that a pressure in the 

[secondary] containment that is less than the lowest postulated pressure 

external to the [secondary] containment boundary can [rapidly] be 

[established and] maintained. When the SGT System is operating as 

designed, the establishment and maintenance of [secondary] containment 

pressure cannot be accomplished if the [secondary] containment 
 [Secondary Containment] 

B 3.6.4.1 

BWR/6 STS B 3.6.4.1-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

boundary is not intact. [Establishment of this pressure is confirmed by 

SR 3.6.4.1.4, which demonstrates that the [secondary] containment can 

be drawn down to ≥ [0.25] inches of vacuum water gauge in 

≤ [120] seconds using one SGT subsystem.] SR 3.6.4.1.5 demonstrates 

that the pressure in the [secondary] containment can be maintained 

≥ [0.266] inches of vacuum water gauge for 1 hour using one SGT 

subsystem at a flow rate ≤ [4000] cfm. The 1 hour test period allows 

[secondary] containment to be in thermal equilibrium at steady state 

conditions. The primary purpose of these SR[s] is to ensure [secondary] 

containment boundary integrity. The secondary purpose of these SR[s] is 

to ensure that the SGT subsystem being tested functions as designed. 

There is a separate LCO with Surveillance Requirements which serves 

the primary purpose of ensuring OPERABILITY of the SGT System. 

These SR[s] need not be performed with each SGT subsystem. The SGT 

subsystem used for these Surveillance[s] is staggered to ensure that in 

addition to the requirements of LCO 3.6.4.3, either SGT subsystem will 

perform this test. The inoperability of the SGT System does not 

necessarily constitute a failure of these Surveillance[s] relative to the 

[secondary] containment OPERABILITY. Operating experience has 

shown the [secondary] containment boundary usually passes these 

Surveillance[s] when performed at the [18] month Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint. 

REFERENCES 1. FSAR, Section [15.6.5]. 

 2. FSAR, Section [15.7.6]. 

 3. FSAR, Section [15.7.4]. 
SCIVs 

B 3.6.4.2 

BWR/6 STS B 3.6.4.2-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.4.2 Secondary Containment Isolation Valves (SCIVs) 

BASES 

BACKGROUND The function of the SCIVs, in combination with other accident mitigation 

systems, is to limit fission product release during and following postulated 

Design Basis Accidents (DBAs) (Ref. 1). Secondary containment 

isolation within the time limits specified for those isolation valves designed 

to close automatically ensures that fission products that leak from primary 

containment following a DBA, that are released during certain operations 

when primary containment is not required to be OPERABLE, or that take 

place outside primary containment, are maintained within the secondary 

containment boundary. 

The OPERABILITY requirements for SCIVs help ensure that an adequate 

secondary containment boundary is maintained during and after an 

accident by minimizing potential paths to the environment. These 

isolation devices are either passive or active (automatic). Manual valves, 

de-activated automatic valves secured in their closed position (including 

check valves with flow through the valve secured), and blind flanges are 

considered passive devices. Check valves or other automatic valves 

designed to close without operator action following an accident are 

considered active devices. Isolation barrier(s) for the penetration are 

discussed in Reference 2. 

Automatic SCIVs close on a secondary containment isolation signal to 

establish a boundary for untreated radioactive material within secondary 

containment following a DBA or other accidents. 

Other penetrations are isolated by the use of valves in the closed position 

or blind flanges. 

APPLICABLE The SCIVs must be OPERABLE to ensure the secondary containment 

SAFETY barrier to fission product releases is established. The principal accidents 

ANALYSES for which the secondary containment boundary is required are a loss of 

coolant accident (Ref. 1), a fuel handling accident [involving handling 

recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor 

core within the previous [X] days)] inside primary containment (Ref. 3), 

and a fuel handling accident [involving handling recently irradiated fuel] in 

the auxiliary building (Ref. 4). The secondary containment performs no 

active function in response to each of these limiting events, but the 

boundary established by SCIVs is required to ensure that leakage from 

the primary containment is processed by the Standby Gas Treatment 

(SGT) System before being released to the environment. 
SCIVs 

B 3.6.4.2 

BWR/6 STS B 3.6.4.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

Maintaining SCIVs OPERABLE with isolation times within limits ensures 

that fission products will remain trapped inside secondary containment so 

that they can be treated by the SGT System prior to discharge to the 

environment. 

SCIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO SCIVs form a part of the secondary containment boundary. The SCIV 

safety function is related to control of offsite radiation releases resulting 

from DBAs. 

The power operated, automatic isolation valves are considered 

OPERABLE when their isolation times are within limits and the valves 

actuate on an automatic isolation signal. The valves covered by this 

LCO, along with their associated stroke times, are listed in Reference 5. 

The normally closed isolation valves or blind flanges are considered 

OPERABLE when manual valves are closed or open in accordance with 

appropriate administrative controls, automatic SCIVs are de-activated and 

secured in their closed position, and blind flanges are in place. These 

passive isolation valves or devices are listed in Reference 5. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to 

the primary containment that leaks to the secondary containment. 

Therefore, OPERABILITY of SCIVs is required. 

In MODES 4 and 5, the probability and consequences of these events are 

reduced due to pressure and temperature limitations in these MODES. 

Therefore, maintaining SCIVs OPERABLE is not required in MODE 4 

or 5, except for other situations under which significant releases of 

radioactive material can be postulated, such as during operations with a 

potential for draining the reactor vessel (OPDRVs) or during movement of 

[recently] irradiated fuel assemblies. Moving [recently] irradiated fuel 

assemblies in the [primary or secondary containment] may also occur in 

MODES 1, 2, and 3. [Due to radioactive decay, SCIVs are only required 

to be OPERABLE during fuel handling involving handling recently 

irradiated fuel (i.e., fuel that has occupied part of a critical reactor core 

within the previous [X] days).] 

ACTIONS The ACTIONS are modified by three Notes. The first Note allows 

penetration flow paths to be unisolated intermittently under administrative 

controls. These controls consist of stationing a dedicated operator, who 

is in continuous communication with the control room, at the controls of 

the isolation device. In this way, the penetration can be rapidly isolated 

when the need for [secondary containment] isolation is indicated. 
SCIVs 

B 3.6.4.2 

BWR/6 STS B 3.6.4.2-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The second Note provides clarification that for the purpose of this LCO 

separate Condition entry is allowed for each penetration flow path. This 

is acceptable, since the Required Actions for each Condition provide 

appropriate compensatory actions for each inoperable SCIV. Complying 

with the Required Actions may allow for continued operation, and 

subsequent inoperable SCIVs are governed by subsequent Condition 

entry and application of associated Required Actions. 

The third Note ensures appropriate remedial actions are taken, if 

necessary, if the affected system(s) are rendered inoperable by an 

inoperable SCIV. 

A.1 and A.2

In the event that there are one or more penetration flow paths with one 

SCIV inoperable, the affected penetration flow path(s) must be isolated. 

The method of isolation must include the use of at least one isolation 

barrier that cannot be adversely affected by a single active failure. 

Isolation barriers that meet this criteria are a closed and de-activated 

automatic SCIV, a closed manual valve, and a blind flange. For 

penetrations isolated in accordance with Required Action A.1, the device 

used to isolate the penetration should be the closest available device to 

secondary containment. This Required Action must be completed within 

the 8 hour Completion Time. The specified time period is reasonable 

considering the time required to isolate the penetration and the low 

probability of a DBA, which requires the SCIVs to close, occurring during 

this short time. 

For affected penetrations that have been isolated in accordance with 

Required Action A.1, the affected penetration must be verified to be 

isolated on a periodic basis. This is necessary to ensure that secondary 

containment penetrations required to be isolated following an accident, 

but no longer capable of being automatically isolated, will be in the 

isolation position should an event occur. This Required Action does not 

require any testing or device manipulation. Rather, it involves verification 

that the affected penetration remains isolated. 

Required Action A.2 is modified by two Notes. Note 1 applies to devices 

located in high radiation areas and allows them to be verified by use of 

administrative controls. Allowing verification by administrative controls is 

considered acceptable, since access to these areas is typically 
SCIVs 

B 3.6.4.2 

BWR/6 STS B 3.6.4.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

restricted. Note 2 applies to isolation devices that are locked, sealed, or 

otherwise secured in position and allows these devices to be verified 

closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. Therefore, the probability of 

misalignment, once they have been verified to be in the proper position, is 

low. 

B.1

With two SCIVs in one or more penetration flow paths inoperable, the 

affected penetration flow path must be isolated within 4 hours. The 

method of isolation must include the use of at least one isolation barrier 

that cannot be adversely affected by a single active failure. Isolation 

barriers that meet this criterion are a closed and de-activated automatic 

valve, a closed manual valve, and a blind flange. The 4 hour Completion 

Time is reasonable, considering the time required to isolate the 

penetration and the low probability of a DBA, which requires the SCIVs to 

close, occurring during this short time. 

The Condition has been modified by a Note stating that Condition B is 

only applicable to penetration flow paths with two isolation valves. This 

clarifies that only Condition A is entered if one SCIV is inoperable in each 

of two penetrations. 

C.1 and C.2

If any Required Action and associated Completion Time cannot be met, 

the plant must be brought to a MODE in which the LCO does not apply. 

To achieve this status, the plant must be brought to at least MODE 3 

within 12 hours and to MODE 4 within 36 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required plant conditions from full power conditions in an orderly manner 

and without challenging plant systems. 
SCIVs 

B 3.6.4.2 

BWR/6 STS B 3.6.4.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1 and D.2

If any Required Action and associated Completion Time cannot be met, 

the plant must be placed in a condition in which the LCO does not apply. 

If applicable, the movement of [recently] irradiated fuel assemblies in the 

[primary and secondary containment] must be immediately suspended. 

Suspension of these activities shall not preclude completion of movement 

of a component to a safe position. Also, if applicable, action must be 

immediately initiated to suspend OPDRVs in order to minimize the 

probability of a vessel draindown and the subsequent potential for fission 

product release. Actions must continue until OPDRVs are suspended. 

Required Action D.1 has been modified by a Note stating that LCO 3.0.3 

is not applicable. If moving [recently] irradiated fuel assemblies while in 

MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving 

[recently] irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel 

movement is independent of reactor operations. Therefore, in either 

case, inability to suspend movement of [recently] irradiated fuel 

assemblies would not be a sufficient reason to require a reactor 

shutdown. 

SURVEILLANCE SR 3.6.4.2.1

REQUIREMENTS 

This SR verifies each secondary containment isolation manual valve and 

blind flange that is not locked, sealed, or otherwise secured and is 

required to be closed during accident conditions is closed. The SR helps 

to ensure that post accident leakage of radioactive fluids or gases outside 

of the [secondary containment] boundary is within design limits. This SR 

does not require any testing or valve manipulation. Rather, it involves 

verification that those SCIVs in [secondary containment] that are capable 

of being mispositioned are in the correct position. 

Since these SCIVs are readily accessible to personnel during normal unit 

operation and verification of their position is relatively easy, the 31 day 

Frequency was chosen to provide added assurance that the SCIVs are in 

the correct positions. This SR does not apply to valves that are locked, 

sealed, or otherwise secured in the closed position, since these were 

verified to be in the correct position upon locking, sealing, or securing. 
SCIVs 

B 3.6.4.2 

BWR/6 STS B 3.6.4.2-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Two Notes have been added to this SR. The first Note applies to valves 

and blind flanges located in high radiation areas and allows them to be 

verified by use of administrative controls. Allowing verification by 

administrative controls is considered acceptable, since access to these 

areas is typically restricted during MODES 1, 2, and 3 for ALARA 

reasons. Therefore, the probability of misalignment of these SCIVs, once 

they have been verified to be in the proper position, is low. 

A second Note has been included to clarify that SCIVs that are open 

under administrative controls are not required to meet the SR during the 

time the SCIVs are open. 

SR 3.6.4.2.2

Verifying the isolation time of each power operated, automatic SCIV is 

within limits is required to demonstrate OPERABILITY. The isolation time 

test ensures that the SCIV will isolate in a time period less than or equal 

to that assumed in the safety analyses. The isolation time and Frequency 

of this SR are [in accordance with the Inservice Testing Program or 

92 days]. 

SR 3.6.4.2.3

Verifying that each automatic SCIV closes on a [secondary containment] 

isolation signal is required to prevent leakage of radioactive material from 

[secondary containment] following a DBA or other accidents. This SR 

ensures that each automatic SCIV will actuate to the isolation position on 

a [secondary containment] isolation signal. The LOGIC SYSTEM 

FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete 

testing of the safety function. The [18] month Frequency is based on the 

need to perform this Surveillance under the conditions that apply during a 

plant outage and the potential for an unplanned transient if the 

Surveillance were performed with the reactor at power. Operating 

experience has shown these components usually pass the Surveillance 

when performed at the [18] month Frequency. Therefore, the Frequency 

was concluded to be acceptable from a reliability standpoint. 
SCIVs 

B 3.6.4.2 

BWR/6 STS B 3.6.4.2-7 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [15.6.5]. 

 2. FSAR, Section [6.2.3]. 

 3. FSAR, Section [15.7.6]. 

 4. FSAR, Section [15.7.4]. 

 5. FSAR, Section [ ]. 
SGT System 

B 3.6.4.3 

BWR/6 STS B 3.6.4.3-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.4.3 Standby Gas Treatment (SGT) System 

BASES 

BACKGROUND The SGT System is required by 10 CFR 50, Appendix A, GDC 41, 

"Containment Atmosphere Cleanup" (Ref. 1). The function of the SGT 

System is to ensure that radioactive materials that leak from the primary 

containment into the secondary containment following a Design Basis 

Accident (DBA) are filtered and adsorbed prior to exhausting to the 

environment. 

The SGT System consists of two fully redundant subsystems, each with 

its own set of ductwork, dampers, charcoal filter train, and controls. 

Each charcoal filter train consists of (components listed in order of the 

direction of the air flow): 

a. A moisture separator, 

b. An electric heater, 

c. A prefilter, 

d. A high efficiency particulate air (HEPA) filter, 

e. A charcoal adsorber, 

f. A second HEPA filter, and 

g. A centrifugal fan with inlet flow control vanes. 

The sizing of the SGT System equipment and components is based on 

the results of an infiltration analysis, as well as an exfiltration analysis of 

the auxiliary and enclosure building structures. The internal pressure of 

the SGT System boundary region is maintained at a negative pressure of 

[0.25] inch water gauge when the system is in operation, which 

represents the internal pressure required to ensure zero exfiltration of air 

from the building when exposed to a [10] mph wind blowing at an angle of 

[45]° to the building. 
SGT System 

B 3.6.4.3 

BWR/6 STS B 3.6.4.3-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The moisture separator is provided to remove entrained water in the air, 

while the electric heater reduces the relative humidity of the airstream to 

less than [70]% (Ref. 2). The prefilter removes large particulate matter, 

while the HEPA filter is provided to remove fine particulate matter and 

protect the charcoal from fouling. The charcoal adsorber removes 

gaseous elemental iodine and organic iodides, and the final HEPA filter is 

provided to collect any carbon fines exhausted from the charcoal 

adsorber. 

The SGT System automatically starts and operates in response to 

actuation signals indicative of conditions or an accident that could require 

operation of the system. Following initiation, both enclosure building 

recirculation fans and both charcoal filter train fans start. SGT System 

flows are controlled by modulating inlet vanes installed on the charcoal 

filter train exhaust fans and two position volume control dampers installed 

in branch ducts to individual regions of the secondary containment. 

APPLICABLE The design basis for the SGT System is to mitigate the consequences of 

SAFETY a loss of coolant accident and fuel handling accidents. [Due to 

ANALYSES radioactive decay, the SGT System is only required to be OPERABLE 

during fuel handling involving handling recently irradiated fuel (i.e., fuel 

that has occupied part of a critical reactor core within the previous [X] 

days).] (Ref. 3). For all events analyzed, the SGT System is shown to be 

automatically initiated to reduce, via filtration and adsorption, the 

radioactive material released to the environment. 

The SGT System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Following a DBA, a minimum of one SGT subsystem is required to 

maintain the secondary containment at a negative pressure with respect 

to the environment and to process gaseous releases. Meeting the LCO 

requirements for two operable subsystems ensures operation of at least 

one SGT subsystem in the event of a single active failure. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to 

primary containment that leaks to secondary containment. Therefore, 

SGT System OPERABILITY is required during these MODES. 

In MODES 4 and 5, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations in these 

MODES. Therefore, maintaining the SGT System OPERABLE is not 

required in MODE 4 or 5, except for other situations under which 
SGT System 

B 3.6.4.3 

BWR/6 STS B 3.6.4.3-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

significant releases of radioactive material can be postulated, such as 

during operations with a potential for draining the reactor vessel 

(OPDRVs) or during movement of [recently] irradiated fuel assemblies in 

the [primary or secondary containment]. [Due to radioactive decay, the 

SGT System is only required to be OPERABLE during fuel handling 

involving handling recently irradiated fuel (i.e., fuel that has occupied part 

of a critical reactor core within the previous [X] days).] 

ACTIONS A.1

With one SGT subsystem inoperable, the inoperable subsystem must be 

restored to OPERABLE status within 7 days. In this Condition, the 

remaining OPERABLE SGT subsystem is adequate to perform the 

required radioactivity release control function. However, the overall 

system reliability is reduced because a single failure in the OPERABLE 

subsystem could result in the radioactivity release control function not 

being adequately performed. The 7 day Completion Time is based on 

consideration of such factors as the availability of the OPERABLE 

redundant SGT subsystem and the low probability of a DBA occurring 

during this period. 

B.1 and B.2

If the SGT subsystem cannot be restored to OPERABLE status within the 

required Completion Time in MODE 1, 2, or 3, the plant must be brought 

to a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 12 hours and to MODE 4 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

C.1, C.2.1, and C.2.2

During movement of [recently] irradiated fuel assemblies in the [primary 

or secondary containment] or during OPDRVs, when Required Action A.1 

cannot be completed within the required Completion Time, the 

OPERABLE SGT subsystem should be immediately placed in operation. 

This Required Action ensures that the remaining subsystem is 

OPERABLE, that no failures that could prevent automatic actuation have 

occurred, and that any other failure would be readily detected. 
SGT System 

B 3.6.4.3 

BWR/6 STS B 3.6.4.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

An alternative to Required Action C.1 is to immediately suspend activities 

that represent a potential for releasing a significant amount of radioactive 

material to the secondary containment, thus placing the unit in a 

Condition that minimizes risk. If applicable, movement of [recently] 

irradiated fuel assemblies must be immediately suspended. Suspension 

of these activities shall not preclude completion of movement of a 

component to a safe position. Also, if applicable, action must be 

immediately initiated to suspend OPDRVs to minimize the probability of a 

vessel draindown and subsequent potential for fission product release. 

Action must continue until OPDRVs are suspended. 

The Required Actions of Condition C have been modified by a Note 

stating that LCO 3.0.3 is not applicable. If moving [recently] irradiated 

fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any 

action. If moving [recently] irradiated fuel assemblies while in MODE 1, 2, 

or 3, the fuel movement is independent of reactor operations. Therefore, 

in either case, inability to suspend movement of [recently] irradiated fuel 

assemblies would not be a sufficient reason to require a reactor 

shutdown. 

D.1

If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT 

system may not be capable of supporting the required radioactivity 

release control function. Therefore, actions are required to enter 

LCO 3.0.3 immediately. 

E.1 and E.2

When two SGT subsystems are inoperable, if applicable, movement of 

[recently] irradiated fuel assemblies in the [primary and secondary 

containment] must be immediately suspended. Suspension of these 

activities shall not preclude completion of movement of a component to a 

safe position. Also, if applicable, actions must be immediately initiated to 

suspend OPDRVs to minimize the probability of a vessel draindown and 

subsequent potential for fission product release. Action must continue 

until OPDRVs are suspended. 
SGT System 

B 3.6.4.3 

BWR/6 STS B 3.6.4.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Action E.1 has been modified by a Note stating that LCO 3.0.3 

is not applicable. If moving [recently] irradiated fuel assemblies while in 

MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving 

[recently] irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel 

movement is independent of reactor operations. Therefore, in either 

case, inability to suspend movement of [recently] irradiated fuel 

assemblies would not be sufficient reason to require a reactor shutdown. 

SURVEILLANCE SR 3.6.4.3.1

REQUIREMENTS 

Operating each SGT subsystem for ≥ [10] continuous hours ensures that 

both subsystems are OPERABLE and that all associated controls are 

functioning properly. It also ensures that blockage, fan or motor failure, or 

excessive vibration can be detected for corrective action. Operation [with 

the heaters on (automatic heater cycling to maintain temperature)] for 

≥ [10] continuous hours every 31 days eliminates moisture on the 

adsorbers and HEPA filters. The 31 day Frequency was developed in 

consideration of the known reliability of fan motors and controls and the 

redundancy available in the system. 

SR 3.6.4.3.2

This SR verifies that the required SGT filter testing is performed in 

accordance with the Ventilation Filter Testing Program (VFTP). The 

VFTP includes testing HEPA filter performance, charcoal adsorber 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal (general use and following specific operations). 

Specified test frequencies and additional information are discussed in 

detail in the VFTP. 

SR 3.6.4.3.3

This SR requires verification that each SGT subsystem starts upon 

receipt of an actual or simulated initiation signal. The LOGIC SYSTEM 

FUNCTIONAL TEST in SR 3.3.6.2.5 overlaps this SR to provide complete 

testing of the safety function. While this Surveillance can be performed 

with the reactor at power, operating experience has shown these 

components usually pass the Surveillance when performed at the 

[18] month Frequency, which is based on the refueling cycle. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint. 
SGT System 

B 3.6.4.3 

BWR/6 STS B 3.6.4.3-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.6.4.3.4

This SR requires verification that the SGT filter cooler bypass damper can 

be opened and the fan started. This ensures that the ventilation mode of 

SGT System operation is available. While this Surveillance can be 

performed with the reactor at power, operating experience has shown 

these components usually pass the Surveillance when performed at the 

[18] month Frequency, which is based on the refueling cycle. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint. ] 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 41. 

 2. FSAR, Section [6.2.3]. 

 3. FSAR, Section [15.6.5]. 
Drywell 

B 3.6.5.1 

BWR/6 STS B 3.6.5.1-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.5.1 Drywell 

BASES 

BACKGROUND The drywell houses the reactor pressure vessel (RPV), the reactor 

coolant recirculating loops, and branch connections of the Reactor 

Coolant System (RCS), which have isolation valves at the primary 

containment boundary. The function of the drywell is to maintain a 

pressure boundary that channels steam from a loss of coolant accident 

(LOCA) to the suppression pool, where it is condensed. Air forced from 

the drywell is released into the primary containment. The pressure 

suppression capability assures that peak LOCA temperature and 

pressure in the primary containment are within design limits. The drywell 

also protects accessible areas of the containment from radiation 

originating in the reactor core and RCS. 

To ensure the drywell pressure suppression capability, the drywell bypass 

leakage must be minimized to prevent overpressurization of the primary 

containment during the drywell pressurization phase of a LOCA. This 

requires periodic testing of the drywell bypass leakage, confirmation that 

the drywell air lock is leak tight, OPERABILITY of the drywell isolation 

valves (DIVs), and confirmation that the drywell vacuum relief valves are 

closed. 

The isolation devices for the drywell penetrations are a part of the drywell 

barrier. To maintain this barrier: 

a. The drywell air lock is OPERABLE except as provided in 

LCO 3.6.5.2, "Drywell Air Lock," 

b. The drywell penetrations required to be closed during accident 

conditions are either: 

1. Capable of being closed by an OPERABLE automatic DIV or 

2. Closed by manual valves, blind flanges, or de-activated 

automatic valves secured in closed positions except as provided 

in LCO 3.6.5.3, "Drywell Isolation Valves (DIVs)," and 

c. The Drywell Vacuum Relief System is OPERABLE except as 

provided in LCO 3.6.5.6, "Drywell Vacuum Relief System." 

This Specification is intended to ensure that the performance of the 

drywell in the event of a DBA meets the assumptions used in the safety 

analyses (Ref. 1). 
Drywell 

B 3.6.5.1 

BWR/6 STS B 3.6.5.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE Analytical methods and assumptions involving the drywell are presented 

SAFETY in Reference 1. The safety analyses assume that for a high energy line 

ANALYSES break inside the drywell, the steam is directed to the suppression pool 

through the horizontal vents where it is condensed. Maintaining the 

pressure suppression capability assures that safety analyses remain valid 

and that the peak LOCA temperature and pressure in the primary 

containment are within design limits. 

The drywell satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Maintaining the drywell OPERABLE is required to ensure that the 

pressure suppression design functions assumed in the safety analyses 

are met. The drywell is OPERABLE if the drywell structural integrity is 

intact and the bypass leakage is within limits, except prior to the first 

startup after performing a required drywell bypass leakage test. At this 

time, the drywell bypass leakage must be ≤ [10%] of the drywell bypass 

leakage limit. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to the primary containment. In MODES 4 and 5, the probability 

and consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, the drywell is not 

required to be OPERABLE in MODES 4 and 5. 

ACTIONS A.1

In the event the drywell is inoperable, it must be restored to OPERABLE 

status within 1 hour. The 1 hour Completion Time provides a period of 

time to correct the problem commensurate with the importance of 

maintaining the drywell OPERABLE during MODES 1, 2, and 3. This 

time period also ensures that the probability of an accident (requiring 

drywell OPERABILITY) occurring during periods when the drywell is 

inoperable is minimal. Also, the Completion Time is the same as that 

applied to inoperability of the primary containment in LCO 3.6.1.1, 

"Primary Containment." 

B.1 and B.2

If the drywell cannot be restored to OPERABLE status within the required 

Completion Time, the plant must be brought to a MODE in which the LCO 

does not apply. To achieve this status, the plant must be brought to at 

least MODE 3 within 12 hours and to MODE 4 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems. 
Drywell 

B 3.6.5.1 

BWR/6 STS B 3.6.5.1-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.6.5.1.1

REQUIREMENTS 

The analyses in Reference 2 are based on a maximum drywell bypass 

leakage. This Surveillance ensures that the actual drywell bypass 

leakage is less than or equal to the acceptable A/√k design value of 

[1.0] ft2

 assumed in the safety analysis. As left drywell bypass leakage, 

prior to the first startup after performing a required drywell bypass 

leakage test, is required to be ≤ [10%] of the drywell bypass leakage limit. 

At all other times between required drywell leakage rate tests, the 

acceptance criteria is based on design A/√k. At the design A/√k the 

containment temperature and pressurization response are bounded by 

the assumptions of the safety analysis. The leakage test is performed 

every [18] months, consistent with the difficulty of performing the test, risk 

of high radiation exposure, and the remote possibility that a component 

failure that is not identified by some other drywell or primary containment 

SR might occur. Operating experience has shown that these components 

usually pass the Surveillance when performed at the [18] month 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint. 

SR 3.6.5.1.2

The exposed accessible drywell interior and exterior surfaces are 

inspected to ensure there are no apparent physical defects that would 

prevent the drywell from performing its intended function. This SR 

ensures that drywell structural integrity is maintained. The [40] month 

Frequency was chosen so that the interior and exterior surfaces of the 

drywell can be inspected at every other refueling outage. Due to the 

passive nature of the drywell structure, the [40] month Frequency is 

sufficient to identify component degradation that may affect drywell 

structural integrity. 

REFERENCES 1. FSAR, Chapter [6] and Chapter [15]. 
Drywell Air Lock 

B 3.6.5.2 

BWR/6 STS B 3.6.5.2-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.5.2 Drywell Air Lock 

BASES 

BACKGROUND The drywell air lock forms part of the drywell boundary and provides a 

means for personnel access during MODES 2 and 3 during low power 

phase of unit startup. For this purpose, one double door drywell air lock 

has been provided, which maintains drywell isolation during personnel 

entry and exit from the drywell. Under the normal unit operation, the 

drywell air lock is kept sealed. The air pressure in the seals is maintained 

> [60] psig by the seal air flask and pneumatic system, which is 

maintained at a pressure > [90] psig. 

The drywell air lock is designed to the same standards as the drywell 

boundary. Thus, the drywell air lock must withstand the pressure and 

temperature transients associated with the rupture of any primary system 

line inside the drywell and also the rapid reversal in pressure when the 

steam in the drywell is condensed by the Emergency Core Cooling 

System flow following loss of coolant accident flooding of the reactor 

pressure vessel (RPV). It is also designed to withstand the high 

temperature associated with the break of a small steam line in the drywell 

that does not result in rapid depressurization of the RPV. 

The air lock is nominally a right circular cylinder, [10] ft in diameter, with 

doors at each end that are interlocked to prevent simultaneous opening. 

During periods when the drywell is not required to be OPERABLE, the air 

lock interlock mechanism may be disabled, allowing both doors of the air 

lock to remain open for extended periods when frequent drywell entry is 

necessary. Each air lock door has been designed and tested to certify its 

ability to withstand a pressure in excess of the maximum expected 

pressure following a Design Basis Accident (DBA). 

The air lock is provided with limit switches on both doors that provide 

control room indication of door position. Additionally, control room 

indication is provided to alert the operator whenever an air lock interlock 

mechanism is defeated. 

The drywell air lock forms part of the drywell pressure boundary. Not 

maintaining air lock OPERABILITY may result in degradation of the 

pressure suppression capability, which is assumed to be functional in the 

unit safety analyses. The drywell air lock does not need to meet the 

requirements of 10 CFR 50, Appendix J (Ref. 1), since it is not part of the 

primary containment leakage boundary. However, it is prudent to specify 

a leakage rate requirement for the drywell air lock. A seal leakage rate 

limit of ≤ 200 scfh and an air lock overall leakage rate limit of ≤ 200 scfh, 

at pressure ≥ Pa (11.5 psig), have been established to assure the integrity 

of the seals. 
Drywell Air Lock 

B 3.6.5.2 

BWR/6 STS B 3.6.5.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE Analytical methods and assumptions involving the drywell are presented 

SAFETY in Reference 2. The safety analyses assume that for a high energy line 

ANALYSES break inside the drywell, the steam is directed to the suppression pool 

through the horizontal vents where it is condensed. Since the drywell air 

lock is part of the drywell pressure boundary, its design and maintenance 

are essential to support drywell OPERABILITY, which assures that the 

safety analyses are met. 

The drywell air lock satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The drywell air lock forms part of the drywell pressure boundary. The air 

lock safety function assures that steam resulting from a DBA is directed to 

the suppression pool. Thus, the air lock's structural integrity is essential 

to the successful mitigation of such an event. 

The air lock is required to be OPERABLE. For the air lock to be 

considered OPERABLE, the air lock interlock mechanism must be 

OPERABLE, air lock leakage must be within limits, and both air lock 

doors must be OPERABLE. The interlock allows only one air lock door of 

an air lock to be opened at one time. This provision ensures that a gross 

breach of the drywell does not exist when the drywell is required to be 

OPERABLE. 

Closure of a single door in the air lock is necessary to support drywell 

OPERABILITY following postulated events. Nevertheless, both doors are 

kept closed when the air lock is not being used for entry into and exit from 

the drywell. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to the primary containment. In MODES 4 and 5, the probability 

and consequences of these events are reduced due to the pressure and 

temperature limitations in these MODES. Therefore, the drywell air lock 

is not required to be OPERABLE in MODES 4 and 5. 

ACTIONS The ACTIONS are modified by Note 1 that allows entry and exit to 

perform repairs on the affected air lock component. If the outer door is 

inoperable, then it may be easily accessed to repair. If the inner door is 

inoperable, however, then there is a short time during which the drywell 

boundary is not intact (during access through the outer door). The ability 

to open the OPERABLE door, even if it means the drywell boundary is 

temporarily not intact, is acceptable due to the low probability of an event 

that could pressurize the drywell during the short time in which the 

OPERABLE door is expected to be open. The OPERABLE door must be 

immediately closed after each entry and exit. 
Drywell Air Lock 

B 3.6.5.2 

BWR/6 STS B 3.6.5.2-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The ACTIONS are modified by a second Note, which ensures appropriate 

remedial actions are taken when necessary. Pursuant to LCO 3.0.6, 

ACTIONS are not required even if the drywell is exceeding its bypass 

leakage limit. Therefore, the Note is added to require ACTIONS for 

LCO 3.6.5.1 to be taken in this event. 

A.1, A.2, and A.3

With one drywell air lock door inoperable, the OPERABLE door must be 

verified closed (Required Action A.1). This ensures that a leak tight 

drywell barrier is maintained by the use of an OPERABLE air lock door. 

This action must be completed within 1 hour. The 1 hour Completion 

Time is consistent with the ACTIONS of LCO 3.6.5.1, "Drywell," which 

requires that the drywell be restored to OPERABLE status within 1 hour. 

In addition, the air lock penetration must be isolated by locking closed the 

OPERABLE air lock door within the 24 hour Completion Time. The 

Completion Time is considered reasonable for locking the OPERABLE air 

lock door, considering that the OPERABLE door is being maintained 

closed. 

Required Action A.3 verifies that the air lock has been isolated by the use 

of a locked and closed OPERABLE air lock door. This ensures that an 

acceptable drywell boundary is maintained. The Completion Time of 

once per 31 days is based on engineering judgment and is considered 

adequate in view of the low likelihood of a locked door being 

mispositioned and other administrative controls that ensure that the 

OPERABLE air lock door remains closed. 

The Required Actions are modified by two Notes. Note 1 ensures only 

the Required Actions and associated Completion Times of Condition C 

are required if both doors in the air lock are inoperable. The exception of 

the Note does not affect tracking the Completion Times from the initial 

entry into Condition A; only the requirement to comply with the Required 

Actions. Note 2 allows use of the air lock for entry and exit for 7 days 

under administrative controls. Drywell entry may be required to perform 

Technical Specifications (TS) Surveillances and Required Actions, as well 

as other activities on equipment inside the drywell that are required by TS 

or activities on equipment that support TS-required equipment. This Note 

is not intended to preclude performing other activities (i.e., non-TSrequired activities) if the drywell was entered, using the inoperable air 

lock, to perform an allowed activity listed above. This allowance is 

acceptable due to the low probability of an event that could pressurize the 

drywell during the short time that the OPERABLE door is expected to be 

open. 
Drywell Air Lock 

B 3.6.5.2 

BWR/6 STS B 3.6.5.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1, B.2, and B.3

With the drywell air lock interlock mechanism inoperable, the Required 

Actions and associated Completion Times consistent with Condition A are 

applicable. 

The Required Actions are modified by two Notes. Note 1 ensures only 

the Required Actions and associated Completion Times of Condition C 

are required if both doors in the air lock are inoperable. Note 2 allows 

entry and exit into the drywell under the control of a dedicated individual 

stationed at the air lock to ensure that only one door is opened at a time 

(i.e., the individual performs the function of the interlock). 

C.1, C.2, and C.3

With the air lock inoperable for reasons other than those described in 

Condition A or B, Required Action C.1 requires action to be immediately 

initiated to evaluate drywell bypass leakage using current air lock test 

results. An evaluation is acceptable, since it is overly conservative to 

immediately declare the drywell inoperable if both doors in an air lock 

have failed a seal test or the overall air lock leakage is not within limits. In 

many instances (e.g., only one seal per door has failed), drywell remains 

OPERABLE, yet only 1 hour (per LCO 3.6.5.1) would be provided to 

restore the air lock door to OPERABLE status prior to requiring a plant 

shutdown. In addition, even with both doors failing the seal test, the 

overall drywell leakage rate can still be within limits. 

Required Action C.2 requires that one door in the drywell air lock must be 

verified to be closed. This Required Action must be completed within the 

1 hour Completion Time. This specified time period is consistent with the 

ACTIONS of LCO 3.6.5.1, which requires that the drywell be restored to 

OPERABLE status within 1 hour. 

Additionally, the air lock must be restored to OPERABLE status within 

24 hours. The 24 hour Completion Time is reasonable for restoring an 

inoperable air lock to OPERABLE status, considering that at least one 

door is maintained closed in the air lock. 
Drywell Air Lock 

B 3.6.5.2 

BWR/6 STS B 3.6.5.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1 and D.2

If the inoperable drywell air lock cannot be restored to OPERABLE status 

within the required Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 12 hours and to MODE 4 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE SR 3.6.5.2.1

REQUIREMENTS 

This SR requires a test be performed to verify seal leakage of the drywell 

air lock doors at pressures ≥ [11.5] psig. A seal leakage rate limit of 

≤ [200] scfh has been established to ensure the integrity of the seals. 

The Surveillance is only required to be performed once after each closing. 

The Frequency of 72 hours is based on operating experience and is 

considered adequate in view of the other indications available to plant 

operations personnel that the seal is intact. 

SR 3.6.5.2.2

Every 7 days the drywell air lock seal air flask pressure is verified to be 

≥ [90] psig to ensure that the seal system remains viable. It must be 

checked because it could bleed down during or following access through 

the air lock, which occurs regularly. The 7 day Frequency has been 

shown to be acceptable, based on operating experience, and is 

considered adequate in view of the other indications to the plant 

operations personnel that the seal air flask pressure is low. 

SR 3.6.5.2.3

The air lock door interlock is designed to prevent simultaneous opening of 

both doors in the air lock. Since both the inner and outer doors of the air 

lock are designed to withstand the maximum expected post accident 

drywell pressure, closure of either door will support drywell 

OPERABILITY. Thus, the door interlock feature supports drywell 

OPERABILITY while the air lock is being used for personnel transit in and 

out of the drywell. Periodic testing of this interlock demonstrates that the 

interlock will function as designed and that simultaneous inner and outer 
Drywell Air Lock 

B 3.6.5.2 

BWR/6 STS B 3.6.5.2-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

door opening will not inadvertently occur. Due to the purely mechanical 

nature of this interlock, and given that the interlock mechanism is only 

challenged when drywell is entered, this test is only required to be 

performed once every [18] months. The [18] month Frequency is based 

on the need to perform this Surveillance under the conditions that apply 

during a plant outage and the potential for an unplanned transient if the 

Surveillance were performed with the reactor at power. Operating 

experience has shown these components usually pass the Surveillance 

when performed at the [18] month Frequency, which is based on the 

refueling cycle. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

The Surveillance is modified by a Note requiring the Surveillance to be 

performed only upon entry into the drywell. 

SR 3.6.5.2.4

This SR requires a test to be performed to verify overall air lock leakage 

of the drywell air lock at pressures ≥ [11.5] psig. The [18] month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power. Operating experience has shown these components usually pass 

the Surveillance when performed at the [18] month Frequency, which is 

based on the refueling cycle. Therefore, the Frequency was concluded to 

be acceptable from a reliability standpoint. 

This SR has been modified by a Note indicating that an inoperable air 

lock door does not invalidate the previous successful performance of an 

overall air lock leakage test. This is considered reasonable, since either 

air lock door is capable of providing a fission product barrier in the event 

of a DBA. 

SR 3.6.5.2.5

This SR ensures that the drywell air lock seal pneumatic system pressure 

does not decay at an unacceptable rate. The air lock seal will support 

drywell OPERABILITY down to a pneumatic pressure of [90] psig. Since 

the air lock seal air flask pressure is verified in SR 3.6.5.2.2 to be 

≥ [90] psig, a decay rate ≤ [30] psig over [10] days is acceptable. The 

[10] day interval is based on engineering judgment, considering that there 

is no postulated DBA where the drywell is still pressurized [10] days after 

the event. 
Drywell Air Lock 

B 3.6.5.2 

BWR/6 STS B 3.6.5.2-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint. 

REFERENCES 1. 10 CFR 50, Appendix J. 

 2. FSAR, Chapters [6 and 15]. 
Drywell Isolation Valve[s] 

B 3.6.5.3 

BWR/6 STS B 3.6.5.3-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.5.3 Drywell Isolation Valve[s] 

BASES 

BACKGROUND The drywell isolation valves, in combination with other accident mitigation 

systems, function to ensure that steam and water releases to the drywell 

are channeled to the suppression pool to maintain the pressure 

suppression function of the drywell. 

The OPERABILITY requirements for drywell isolation valves help ensure 

that valves are closed, when required, and isolation occurs within the time 

limits specified for those isolation valves designed to close automatically. 

Therefore, the OPERABILITY requirements support minimizing drywell 

bypass leakage assumed in the safety analysis (Ref. 1) for a DBA. These 

isolation devices are either passive or active (automatic). Manual valves, 

de-activated automatic valves secured in their closed position (including 

check valves with flow through the valve secured), blind flanges, and 

closed systems are considered passive devices. Check valves, or other 

automatic valves designed to close without operator action following an 

accident, are considered active devices. Two barriers in series are 

provided for each penetration so that no credible single failure or 

malfunction of an active component can result in a loss of isolation. 

The Drywell Vacuum Relief System valves serve a dual function, one of 

which is drywell isolation. However, since the other safety function of 

vacuum relief would not be available if the normal drywell isolation valve 

actions were taken, the drywell isolation valve OPERABILITY 

requirements are not applicable to the Drywell Vacuum Relief System 

isolation valves. Similar surveillance requirements in the LCO for Drywell 

Vacuum Relief System provide assurance that the isolation capability is 

available without conflicting with the vacuum relief function. 

The Drywell Vent and Purge System is a high capacity system with a 

[20] inch line, which has isolation valves covered by this LCO. The 

system supplies filtered outside air directly to the drywell through two 

lines, each containing two primary containment isolation valves (PCIVs) 

and two drywell isolation valves called drywell purge isolation valves. The 

drywell air is exhausted through a line also containing two drywell purge 

isolation valves by means of two fan units, which are part of the 

Containment Cooling System charcoal filter trains located inside primary 

containment. After the air is conditioned and filtered, it is exhausted 

through two PCIVs. The system is used to remove trace radioactive 

airborne products prior to personnel entry. The Drywell Vent and Purge 

System is seldom used in MODE 1, 2, or 3; therefore, the drywell purge 

isolation valves are seldom open during power operation. 
Drywell Isolation Valve[s] 

B 3.6.5.3 

BWR/6 STS B 3.6.5.3-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The drywell purge isolation valves fail closed on loss of instrument air or 

power. The drywell purge isolation valves are fast closing valves 

(approximately [4] seconds). These valves are qualified to close against 

the differential pressure induced by a loss of coolant accident (LOCA). 

APPLICABLE This LCO is intended to ensure that releases from the core do not bypass 

SAFETY the suppression pool so that the pressure suppression capability of the 

ANALYSES drywell is maintained. Therefore, as part of the drywell boundary, drywell 

isolation valve OPERABILITY minimizes drywell bypass leakage. 

Therefore, the safety analysis of any event requiring isolation of the 

drywell is applicable to this LCO. 

The DBA resulting in a release of steam, water, or radioactive material 

within the drywell is a LOCA. In the analysis for these accidents, it is 

assumed that drywell isolation valves either are closed or function to 

close within the required isolation time following event initiation. Analyses 

(Ref. 1) also assumed a 4 second drywell purge isolation valve closure 

time following a 1 second delay prior to closure. 

The drywell isolation valves and drywell purge isolation valves satisfy 

Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The drywell isolation valve safety function is to form a part of the drywell 

boundary. 

The drywell isolation valves are required to have isolation times of 

automatic drywell isolation valves within limits, automatic drywell isolation 

valves actuate on an automatic isolation signal, drywell isolation manual 

valves closed, purge valves closed, and 20 inch purge valves blocked to 

restrict maximum valve opening. While the Drywell Vacuum Relief 

System valves isolate drywell penetrations, they are excluded from this 

Specification. Controls on their isolation function are adequately 

addressed in LCO 3.6.5.6, "Drywell Vacuum Relief System." The valves 

covered by this LCO are included (with their associated stroke time for 

automatic valves) in Reference 2. 

The normally closed isolation valves or blind flanges are considered 

OPERABLE when manual valves are closed or open in accordance with 

appropriate administrative controls, automatic valves are de-activated and 

secured in their closed position (including check valves with flow through 

the valve secured), and blind flanges are in place. These passive 

isolation valves and devices are those listed in Reference 2. 
Drywell Isolation Valve[s] 

B 3.6.5.3 

BWR/6 STS B 3.6.5.3-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to the primary containment. In MODES 4 and 5, the probability 

and consequences of these events are reduced due to the pressure and 

temperature limitations in these MODES. Therefore, the drywell isolation 

valves are not required to be OPERABLE in MODES 4 and 5. 

ACTIONS The ACTIONS are modified by three Notes. The first Note allows 

penetration flow paths to be unisolated intermittently under administrative 

controls. These controls consist of stationing a dedicated operator, who 

is in continuous communication with the control room, at the controls of 

the valve. In this way, the penetration can be rapidly isolated when a 

need for drywell isolation is indicated. 

The second Note provides clarification that for the purpose of this LCO 

separate Condition entry is allowed for each penetration flow path. 

The third Note requires the OPERABILITY of affected systems to be 

evaluated when a drywell isolation valve is inoperable. This ensures 

appropriate remedial actions are taken, if necessary, if the affected 

system(s) are rendered inoperable by an inoperable drywell isolation 

valve. 

The fourth Note ensures appropriate remedial actions are taken when the 

drywell bypass leakage limits are exceeded. Pursuant to LCO 3.0.6, 

these ACTIONS are not required even when the associated LCO is not 

met. Therefore, Note 4 is added to require the proper actions be taken. 

A.1 and A.2

With one or more penetration flow paths with one drywell isolation valve 

inoperable, the affected penetration flow path must be isolated. The 

method of isolation must include the use of at least one isolation barrier 

that cannot be adversely affected by a single active failure. Isolation 

barriers that meet this criterion are a closed and de-activated automatic 

drywell isolation valve, a closed manual valve, a blind flange, and a check 

valve with flow through the valve secured. In this Condition, the 

remaining OPERABLE drywell isolation valve is adequate to perform the 

isolation function. However, the overall reliability is reduced because a 

single failure in the OPERABLE drywell isolation valve could result in a 

loss of drywell isolation. The 8 hour Completion Time is acceptable, 

since the drywell design bypass leakage A/√k of [1.0] ft2

 would be 

maintained even with a single failure due to application of ACTIONS Note 

4. In addition, the Completion Time is reasonable, considering the time 

required to isolate the penetration and the relative importance of 

supporting drywell OPERABILITY during MODES 1, 2, and 3. 
Drywell Isolation Valve[s] 

B 3.6.5.3 

BWR/6 STS B 3.6.5.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

For affected penetration flow paths that have been isolated in accordance 

with Required Action A.1, the affected penetrations must be verified to be 

isolated on a periodic basis. This is necessary to ensure that drywell 

penetrations that are required to be isolated following an accident, and 

are no longer capable of being automatically isolated, will be in the 

isolation position should an event occur. This Required Action does not 

require any testing or device manipulation; rather, it involves verification 

that those devices outside drywell and capable of potentially being 

mispositioned are in the correct position. Since these devices are inside 

primary containment, the time period specified as "prior to entering 

MODE 2 or 3 from MODE 4, if not performed within the previous 

92 days," is based on engineering judgment and is considered 

reasonable in view of the inaccessibility of the devices and other 

administrative controls that will ensure that device misalignment is an 

unlikely possibility. Also, this Completion Time is consistent with the 

Completion Time specified for PCIVs in LCO 3.6.1.3, "Primary 

Containment Isolation Valves (PCIVs)." 

Required Action A.2 is modified by two Notes. Note 1 applies to isolation 

devices located in high radiation areas and allows them to be verified by 

use of administrative controls. Allowing verification by administrative 

controls is considered acceptable, since access to these areas is typically 

restricted. Note 2 applies to isolation devices that are locked, sealed, or 

otherwise secured in position and allows these devices to be verified 

closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. Therefore, the probability of 

misalignment once they have been verified to be in the proper position, is 

low. 

B.1

With one or more penetration flow paths with two drywell isolation valves 

inoperable, the affected penetration flow path must be isolated. The 

method of isolation must include the use of at least one isolation barrier 

that cannot be adversely affected by a single active failure. Isolation 

barriers that meet this criterion are a closed and de-activated automatic 

valve, a closed manual valve, a blind flange, and a check valve with flow 

through the valve secured. The 4 hour Completion Time is acceptable, 

since the drywell design bypass leakage A/√k of [1.0] ft2

 is maintained 

due to application of ACTIONS Note 4. The Completion Time is 

reasonable, considering the time required to isolate the penetration, and 

the probability of a DBA, which requires the drywell isolation valves to 

close, occurring during this short time is very low. 
Drywell Isolation Valve[s] 

B 3.6.5.3 

BWR/6 STS B 3.6.5.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition B is modified by a Note indicating this Condition is only 

applicable to penetration flow paths with two isolation valves. For 

penetration flow paths with one drywell isolation valve, Condition A 

provides the appropriate Required Actions. 

C.1 and C.2

If any Required Action and associated Completion Time cannot be met, 

the plant must be placed in a MODE in which the LCO does not apply. 

To achieve this status, the plant must be brought to at least MODE 3 

within 12 hours and to MODE 4 within 36 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required plant conditions from full power conditions in an orderly manner 

and without challenging plant systems. 

SURVEILLANCE [ SR 3.6.5.3.1

REQUIREMENTS 

Each [ ] inch drywell purge isolation valve is required to be verified 

sealed closed at 31 day intervals. This Surveillance is intended to be 

used for drywell purge isolation valves that are not qualified to open under 

accident conditions. This SR is designed to ensure that a gross breach of 

drywell is not caused by an inadvertent or spurious drywell purge isolation 

valve opening. Detailed analysis of these [ ] inch drywell purge valves 

failed to conclusively demonstrate their ability to close during a LOCA in 

time to support drywell OPERABILITY. Therefore, these valves are 

required to be in sealed closed position during MODES 1, 2, and 3. 

These [ ] inch drywell purge valves that are sealed closed must have 

motive power to the valve operator removed. This can be accomplished 

by de-energizing the source of electric power or removing the air supply 

to the valve operator. In this application, the term "sealed" has no 

connotation of leakage within limits. The Frequency is a result of the 

NRC resolution of Generic Issue B-24 (Ref. 3) related to purge valve use 

during unit operations. ]
Drywell Isolation Valve[s] 

B 3.6.5.3 

BWR/6 STS B 3.6.5.3-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.6.5.3.2

This SR ensures that the [20] inch drywell purge isolation valves are 

closed as required or, if open, open for an allowable reason. This SR is 

intended to be used for drywell purge isolation valves that are fully 

qualified to close under accident conditions; therefore, these valves are 

allowed to be open for limited periods of time. This SR has been modified 

by a Note indicating the SR is not required to be met when the drywell 

purge supply or exhaust valves are open for pressure control, ALARA or 

air quality considerations for personnel entry, or surveillances that require 

the valve to be open [provided the [20] inch containment [purge system 

supply and exhaust] lines are isolated]. The 31 day Frequency is 

consistent with the valve requirements discussed under SR 3.6.5.3.1. ]

SR 3.6.5.3.3

This SR requires verification that each drywell isolation manual valve and 

blind flange that is not locked, sealed, or otherwise secured and is 

required to be closed during accident conditions is closed. The SR helps 

to ensure that drywell bypass leakage is maintained to a minimum. Since 

these valves are inside primary containment, the Frequency specified as 

"prior to entering MODE 2 or 3 from MODE 4, if not performed in the 

previous 92 days," is appropriate because of the inaccessibility of the 

drywell isolation valves and because these drywell isolation valves are 

operated under administrative controls and the probability of their 

misalignment is low. This SR does not apply to valves that are locked, 

sealed, or otherwise secured in the closed position, since these were 

verified to be in the correct position upon locking, sealing, or securing. 

A Note has been included to clarify that valves that are open under 

administrative controls are not required to meet the SR during the time 

the valves are open. 

SR 3.6.5.3.4

Verifying that the isolation time of each power operated, automatic drywell 

isolation valve is within limits is required to demonstrate OPERABILITY. 

The isolation time test ensures the valve will isolate in a time period less 

than or equal to that assumed in the safety analysis. The isolation time 

and Frequency of this SR are [in accordance with the Inservice Testing 

Program or 92 days]. 
Drywell Isolation Valve[s] 

B 3.6.5.3 

BWR/6 STS B 3.6.5.3-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.6.5.3.5

Verifying that each automatic drywell isolation valve closes on a drywell 

isolation signal is required to prevent bypass leakage from the drywell 

following a DBA. This SR ensures each automatic drywell isolation valve 

will actuate to its isolation position on a drywell isolation signal. The 

LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.6 overlaps this SR to 

provide complete testing of the safety function. The [18] month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power, since isolation of penetrations would eliminate cooling water flow 

and disrupt the normal operation of many critical components. Operating 

experience has shown these components usually pass this Surveillance 

when performed at the [18] month Frequency. Therefore, the Frequency 

was concluded to be acceptable from a reliability standpoint. 

SR 3.6.5.3.6

Verifying that each [ ] inch drywell purge valve is blocked to restrict 

opening to > [50]% is required to ensure that the valves can be closed 

under DBA conditions within the time limits assumed in the safety 

analyses. 

The [18] month Frequency is appropriate because the blocking devices 

are typically removed only during a refueling outage. 

REFERENCES 1. FSAR, Section [6.2.4]. 

 2. FSAR, Table [6.2-44]. 

 3. Generic Issue B-24. 
Drywell Pressure 

B 3.6.5.4 

BWR/6 STS B 3.6.5.4-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.5.4 Drywell Pressure 

BASES 

BACKGROUND Drywell-to-primary containment differential pressure is an assumed initial 

condition in the analyses that determine the primary containment thermal 

hydraulic and dynamic loads during a postulated loss of coolant accident 

(LOCA). 

If drywell pressure is less than the primary containment airspace 

pressure, the water level in the weir annulus will increase and, 

consequently, the liquid inertia above the top vent will increase. This will 

cause top vent clearing during a postulated LOCA to be delayed, and that 

would increase the peak drywell pressure. In addition, an inadvertent 

upper pool dump occurring with a negative drywell-to-primary 

containment differential pressure could result in overflow over the weir 

wall. 

The limitation on negative drywell-to-primary containment differential 

pressure ensures that changes in calculated peak LOCA drywell 

pressures due to differences in water level of the suppression pool and 

the drywell weir annulus are negligible. It also ensures that the possibility 

of weir wall overflow after an inadvertent pool dump is minimized. The 

limitation on positive drywell-to-primary containment differential pressure 

helps ensure that the horizontal vents are not cleared with normal weir 

annulus water level. 

APPLICABLE Primary containment performance is evaluated for the entire spectrum of 

SAFETY break sizes for postulated LOCAs. Among the inputs to the design basis 

ANALYSES analysis is the initial drywell internal pressure (Ref. 1). The initial drywell 

internal pressure affects the drywell pressure response to a LOCA 

(Ref. 1) and the suppression pool swell load definition (Ref. 2). 

Additional analyses (Refs. 3 and 4) have been performed to show that if 

initial drywell pressure does not exceed the negative pressure limit, the 

suppression pool swell and vent clearing loads will not be significantly 

increased and the probability of weir wall overflow is minimized after an 

inadvertent upper pool dump. 

Drywell pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
Drywell Pressure 

B 3.6.5.4 

BWR/6 STS B 3.6.5.4-2 Rev. 3.0, 03/31/04 

BASES 

LCO A limitation on the drywell-to-primary containment differential pressure of 

[≥ -0.26 psid and ≤ 2.0 psid] is required to ensure that suppression pool 

water is not forced over the weir wall, vent clearing does not occur during 

normal operation, containment conditions are consistent with the safety 

analyses, and LOCA drywell pressures and pool swell loads are within 

design values. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to the primary containment. In MODES 4 and 5, the probability 

and consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, maintaining the 

drywell-to-primary containment differential pressure limitation is not 

required in MODE 4 or 5. 

ACTIONS A.1

With drywell-to-primary containment differential pressure not within the 

limits of the LCO, it must be restored within 1 hour. The Required Action 

is necessary to return operation to within the bounds of the safety 

analyses. The 1 hour Completion Time is consistent with the ACTIONS 

of LCO 3.6.5.1, "Drywell," which requires that the drywell be restored to 

OPERABLE status within 1 hour. 

B.1 and B.2

If drywell-to-primary containment differential pressure cannot be restored 

to within limits within the required Completion Time, the plant must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 12 hours and 

to MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

SURVEILLANCE SR 3.6.5.4.1

REQUIREMENTS 

This SR provides assurance that the limitations on drywell-to-primary 

containment differential pressure stated in the LCO are met. The 12 hour 

Frequency of this SR was developed, based on operating experience 

related to trending of drywell pressure variations during the applicable 

MODES and to assessing proximity to the specified LCO pressure limits. 

Furthermore, the 12 hour Frequency is considered adequate in view of 

other indications available in the control room, including alarms, to alert 

the operator to an abnormal drywell pressure condition. 
Drywell Pressure 

B 3.6.5.4 

BWR/6 STS B 3.6.5.4-3 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [6.2.1]. 

 2. FSAR, Section [3.8]. 

 3. FSAR, Section [6.2.1.1.6]. 

 4. FSAR, Section [6.2.7]. 
Drywell Air Temperature 

B 3.6.5.5 

BWR/6 STS B 3.6.5.5-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.5.5 Drywell Air Temperature 

BASES 

BACKGROUND The drywell contains the reactor vessel and piping, which add heat to the 

airspace. Drywell coolers remove heat and maintain a suitable 

environment. The drywell average air temperature affects equipment 

OPERABILITY, personnel access, and the calculated response to 

postulated Design Basis Accidents (DBAs). The limitation on drywell 

average air temperature ensures that the peak drywell temperature during 

a design basis loss of coolant accident (LOCA) does not exceed the 

design temperature of [330]°F. The limiting DBA for drywell atmosphere 

temperature is a small steam line break, assuming no heat transfer to the 

passive steel and concrete heat sinks in the drywell. 

APPLICABLE Primary containment performance for the DBA is evaluated for the entire 

SAFETY spectrum of break sizes for postulated LOCAs inside containment 

ANALYSES (Ref. 1). Among the inputs to the design basis analysis is the initial 

drywell average air temperature. Increasing the initial drywell average air 

temperature could change the calculated results of the design bases 

analysis. The safety analyses (Ref. 1) assume an initial average drywell 

air temperature of [135]°F. This limitation ensures that the safety 

analyses remain valid by maintaining the expected initial conditions and 

ensures that the peak LOCA drywell temperature does not exceed the 

maximum allowable temperature of [330]°F. The consequence of 

exceeding this design temperature may result in the degradation of the 

drywell structure under accident loads. Equipment inside the drywell that 

is required to mitigate the effects of a DBA is designed and qualified to 

operate under environmental conditions expected for the accident. 

Drywell average air temperature satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO If the initial drywell average air temperature is less than or equal to the 

LCO temperature limit, the peak accident temperature can be maintained 

below the drywell design temperature during a DBA. This ensures the 

ability of the drywell to perform its design function. 

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive 

material to the primary containment. In MODES 4 and 5, the probability 

and consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, maintaining drywell 

average air temperature within the limit is not required in MODE 4 or 5. 
Drywell Air Temperature 

B 3.6.5.5 

BWR/6 STS B 3.6.5.5-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

When the drywell average air temperature is not within the limit of the 

LCO, it must be restored within 8 hours. The Required Action is 

necessary to return operation to within the bounds of the safety analyses. 

The 8 hour Completion Time is acceptable, considering the sensitivity of 

the analyses to variations in this parameter, and provides sufficient time 

to correct minor problems. 

B.1 and B.2

If drywell average air temperature cannot be restored to within limit within 

the associated Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 12 hours and to MODE 4 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. 

SURVEILLANCE SR 3.6.5.5.1

REQUIREMENTS 

Verifying that the drywell average air temperature is within the LCO limit 

ensures that operation remains within the limits assumed for the drywell 

analysis. Drywell air temperature is monitored in all quadrants and at 

various elevations. Since the measurements are uniformly distributed, an 

arithmetic average is an accurate representation of actual drywell 

average temperature. 

The 24 hour Frequency of the SR was developed based on operating 

experience related to variations in drywell average air temperature 

variations during the applicable MODES. Furthermore, the 24 hour 

Frequency is considered adequate in view of other indications available in 

the control room, including alarms, to alert the operator to an abnormal 

drywell air temperature condition. 

REFERENCES 1. FSAR, Section [6.2]. 
Drywell Vacuum Relief System 

B 3.6.5.6 

BWR/6 STS B 3.6.5.6-1 Rev. 3.0, 03/31/04 

B 3.6 CONTAINMENT SYSTEMS 

B 3.6.5.6 Drywell Vacuum Relief System 

BASES 

BACKGROUND The Mark III pressure suppression containment is designed to condense, 

in the suppression pool, the steam released into the drywell in the event 

of a loss of coolant accident (LOCA). The steam discharging to the pool 

carries the noncondensibles from the drywell. Therefore, the drywell 

atmosphere changes from low humidity air to nearly 100% steam (no air) 

as the event progresses. When the drywell subsequently cools and 

depressurizes, noncondensibles in the drywell must be replaced to avoid 

excessive weir wall overflow into the drywell. Rapid weir wall overflow 

must be controlled in a large break LOCA, so that essential equipment 

and systems located above the weir wall in the drywell are not subjected 

to excessive drag and impact loads. The drywell post-LOCA and the 

drywell purge vacuum relief subsystems are the means by which 

noncondensibles are transferred from the primary containment back to 

the drywell. 

The vacuum relief systems are a potential source of bypass leakage (i.e., 

some of the steam released into the drywell from a LOCA bypasses the 

suppression pool and leaks directly to the primary containment airspace). 

Since excessive bypass leakage could degrade the pressure suppression 

function, the Drywell Vacuum Relief System has been designed with at 

least two valves in series in each vacuum breaker line. This minimizes 

the potential for a stuck open valve to threaten drywell OPERABILITY. 

The [two] drywell purge vacuum relief subsystems use separate [10] inch 

lines penetrating the drywell, and each subsystem consists of a series 

arrangement of a motor operated isolation valve and two check valves. 

The [two] drywell post-LOCA vacuum relief subsystems use a common 

[10] inch line penetrating the drywell, and each subsystem consists of a 

motor operated valve in series with a check valve. At least two [10] inch 

lines must be available to provide adequate relief to control rapid weir wall 

overflow. 

APPLICABLE The Drywell Vacuum Relief System must function in the event of a large 

SAFETY break LOCA to control rapid weir wall overflow that could cause drag and 

ANALYSES impact loadings on essential equipment and systems in the drywell above 

the weir wall. The Drywell Vacuum Relief System is not required to assist 

in hydrogen dilution or to protect the structural integrity of the drywell 

following a large break LOCA. Furthermore, their passive operation 

(remaining closed and not leaking during drywell pressurization) is implicit 

in all of the LOCA analyses (Ref. 1). 

The Drywell Vacuum Relief System satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
Drywell Vacuum Relief System 

B 3.6.5.6 

BWR/6 STS B 3.6.5.6-2 Rev. 3.0, 03/31/04 

BASES 

LCO The LCO ensures that in the event of a LOCA, [two] drywell post-LOCA 

and [two] drywell purge vacuum relief subsystems are available to 

mitigate the potential subsequent drywell depressurization. Each vacuum 

relief subsystem is OPERABLE when capable of opening at the required 

setpoint but is maintained in the closed position during normal operation. 

APPLICABILITY In MODES 1, 2, and 3, a Design Basis Accident could cause 

pressurization of primary containment. Therefore, Drywell Vacuum Relief 

System OPERABILITY is required during these MODES. In MODES 4 

and 5, the probability and consequences of these events are reduced due 

to the pressure and temperature limitations in these MODES. Therefore, 

maintaining the Drywell Vacuum Relief System OPERABLE is not 

required in MODE 4 or 5. 

ACTIONS The ACTIONS Note ensures appropriate remedial actions are taken when 

the drywell bypass leakage limits are exceeded. Pursuant to LCO 3.0.6, 

these ACTIONS are not required even when the associated LCO is not 

met. Therefore, the Note is added to require the proper actions be taken. 

A.1

With one or more vacuum relief subsystems open, the subsystem must 

be closed within 4 hours. This assures that drywell leakage would not 

result if a postulated LOCA were to occur. The 4 hour Completion Time 

is acceptable, since the drywell design bypass leakage A/√k) of [1.0] ft2

 is 

maintained, and is considered a reasonable length of time needed to 

complete the Required Action. 

A Note has been added to provide clarification that separate Condition 

entry is allowed for vacuum relief subsystems not closed. 

B.1 and C.1

With one [or two] drywell post-LOCA vacuum relief subsystems 

inoperable or one drywell purge vacuum relief subsystem inoperable, for 

reasons other then being not closed, the inoperable subsystem(s) must 

be restored to OPERABLE status within 30 days. In these Conditions, 

the remaining OPERABLE vacuum relief subsystems are adequate to 

perform the depressurization mitigation function since two [10] inch lines 

remain available. The 30 day Completion Time takes into account the 

redundant capability afforded by the remaining subsystems, a reasonable 

time for repairs, and the low probability of an event requiring the vacuum 

relief subsystems to function occurring during this period. 
Drywell Vacuum Relief System 

B 3.6.5.6 

BWR/6 STS B 3.6.5.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1 and E.1

With [two] drywell purge vacuum relief subsystems inoperable or with 

[two] drywell post-LOCA and one drywell purge vacuum relief subsystems 

inoperable, for reasons other than being not closed, at least one 

inoperable subsystem must be restored to OPERABLE status within 

72 hours. In these Conditions, only one [10] inch line remains available. 

The 72 hour Completion Time takes into account at least one vacuum 

relief subsystem is still OPERABLE, a reasonable time for repairs, and 

the low probability of an event requiring the vacuum relief subsystems to 

function occurring during this period. 

F.1, F.2, G.1, and G.2

If the inoperable drywell vacuum relief subsystem(s) cannot be closed or 

restored to OPERABLE status within the required Completion Time, or if 

two drywell purge vacuum relief subsystems are inoperable, for reasons 

other than being not closed, and one or two drywell post-LOCA vacuum 

relief subsystem(s) are inoperable, for reasons other than being not 

closed, the plant must be brought to a MODE in which the LCO does not 

apply. To achieve this status, the plant must be brought to at least 

MODE 3 within 12 hours and to MODE 4 within 36 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required plant conditions from full power conditions in an 

orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.6.5.6.1

REQUIREMENTS 

Each vacuum breaker and its associated isolation valve is verified to be 

closed to ensure that this potential large bypass leakage path is not 

present. This Surveillance is performed by observing the vacuum breaker 

or associated isolation valve position indication or by verifying that the 

vacuum breakers are closed when a differential pressure of [1.0] psid 

between the drywell and primary containment is maintained for 1 hour 

without makeup. The 7 day Frequency is based on engineering 

judgment, is considered adequate in view of other indications of vacuum 

breaker or isolation valve status available to the plant personnel, and has 

been shown to be acceptable through operating experience. 
Drywell Vacuum Relief System 

B 3.6.5.6 

BWR/6 STS B 3.6.5.6-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Two Notes are added to this SR. The first Note allows drywell vacuum 

breakers opened in conjunction with the performance of a Surveillance to 

not be considered as failing this SR. These periods of opening drywell 

vacuum breakers are controlled by plant procedures and do not represent 

inoperable drywell vacuum breakers. A second Note is included to clarify 

that vacuum breakers open due to an actual differential pressure are not 

considered as failing this SR. 

SR 3.6.5.6.2

Each vacuum breaker and its associated isolation valve must be cycled to 

ensure that it opens adequately to perform its design function and returns 

to the fully closed position. This provides assurance that the safety 

analysis assumptions are valid. A 31 day Frequency was chosen to 

provide additional assurance that the vacuum breakers and their 

associated isolation valves are OPERABLE. 

SR 3.6.5.6.3

Verification of the vacuum breaker opening setpoint is necessary to 

ensure that the safety analysis assumption that the vacuum breaker will 

open fully at a differential pressure of [1.0] psid is valid. The [18] month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power. Operating experience has shown these components usually pass 

the Surveillance when performed at the [18] month Frequency, which is 

based on the refueling cycle. Therefore, the Frequency was concluded to 

be acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [6.2]. 
 [SSW] System and [UHS] 

B 3.7.1 

BWR/6 STS B 3.7.1-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.1 [Standby Service Water (SSW)] System and [Ultimate Heat Sink (UHS)] 

BASES 

BACKGROUND The [SSW] System is designed to provide cooling water for the removal of 

heat from unit auxiliaries, such as Residual Heat Removal (RHR) System 

heat exchangers, standby diesel generators (DGs), and room coolers for 

Emergency Core Cooling System equipment required for a safe reactor 

shutdown following a Design Basis Accident (DBA) or transient. The 

[SSW] System also provides cooling to unit components, as required, 

during normal shutdown and reactor isolation modes. During a DBA, the 

equipment required for normal operation only is isolated from the [SSW] 

System, and cooling is directed only to safety related equipment. 

The [SSW] System consists of the [UHS], two independent cooling water 

headers (subsystems A and B), and their associated pumps, piping, 

valves, and instrumentation. The two [SSW] pumps, or one [SSW] pump 

and the high pressure core spray service water pump, are sized to 

provide sufficient cooling capacity to support the required safety related 

systems during safe shutdown of the unit following a loss of coolant 

accident (LOCA). Subsystems A and B are redundant and service 

equipment in [SSW] Divisions 1 and 2, respectively. 

The [UHS] consists of two concrete makeup water basins, each 

containing one cooling tower with two fan cells per basin. The combined 

basin volume is sized such that sufficient water inventory is available for 

all [SSW] System post LOCA cooling requirements for a 30 day period 

with no external makeup water source available (Regulatory Guide 1.27, 

Ref. 1). Normal makeup for each basin is provided automatically by the 

Plant Service Water System. 

Cooling water is pumped from the cooling tower basins by the two [SSW] 

pumps to the essential components through the two main redundant 

supply headers (subsystems A and B). After removing heat from the 

components, the water is discharged to the cooling towers where the heat 

is rejected through direct contact with ambient air. 

Subsystems A and B supply cooling water to redundant equipment 

required for a safe reactor shutdown. Additional information on the 

design and operation of the [SSW] System and [UHS] along with the 

specific equipment for which the [SSW] System supplies cooling water is 

provided in the FSAR, Section [9.2.1] and the FSAR, Table [9.2-3] 

(Refs. 2 and 3, respectively). The [SSW] System is designed to withstand 

a single active or passive failure, coincident with a loss of offsite power, 

without losing the capability to supply adequate cooling water to 

equipment required for safe reactor shutdown. 
 [SSW] System and [UHS] 

B 3.7.1 

BWR/6 STS B 3.7.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Following a DBA or transient, the [SSW] System will operate 

automatically without operator action. Manual initiation of supported 

systems (e.g., suppression pool cooling) is, however, performed for long 

term cooling operations. 

APPLICABLE The volume of each water source incorporated in a [UHS] complex is 

SAFETY sized so that sufficient water inventory is available for all [SSW] System 

ANALYSES post LOCA cooling requirements for a 30 day period with no additional 

makeup water source available (Ref. 1). The ability of the [SSW] System 

to support long term cooling of the reactor or containment is assumed in 

evaluations of the equipment required for safe reactor shutdown 

presented in the FSAR, Sections [9.2.1], [6.2.1.1.3.3.1.6] and 

Chapter [15], (Refs. 2, 4, and 5, respectively). These analyses include 

the evaluation of the long term primary containment response after a 

design basis LOCA. The [SSW] System provides cooling water for the 

RHR suppression pool cooling mode to limit suppression pool 

temperature and primary containment pressure following a LOCA. This 

ensures that the primary containment can perform its intended function of 

limiting the release of radioactive materials to the environment following a 

LOCA. The [SSW] System also provides cooling to other components 

assumed to function during a LOCA (e.g., RHR and Low Pressure Core 

Spray systems). Also, the ability to provide onsite emergency AC power 

is dependent on the ability of the [SSW] System to cool the DGs. 

The safety analyses for long term containment cooling were performed, 

as discussed in the FSAR, Sections [6.2.1.1.3.3.1.6] and [6.2.2.3] (Refs. 4 

and 6, respectively), for a LOCA, concurrent with a loss of offsite power, 

and minimum available DG power. The worst case single failure affecting 

the performance of the [SSW] System is the failure of one of the two 

standby DGs, which would in turn affect one [SSW] subsystem. The 

[SSW] flow assumed in the analyses is [7900] gpm per pump to the heat 

exchanger (FSAR, Table [6.2-2], Ref. 7). Reference 2 discusses [SSW] 

System performance during these conditions. 

The [SSW] System, together with the [UHS], satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The OPERABILITY of subsystem A (Division 1) and subsystem B 

(Division 2) of the [SSW] System is required to ensure the effective 

operation of the RHR System in removing heat from the reactor, and the 

effective operation of other safety related equipment during a DBA or 

transient. Requiring both subsystems to be OPERABLE ensures that 

either subsystem A or B will be available to provide adequate capability to 

meet cooling requirements of the equipment required for safe shutdown in 

the event of a single failure. 
 [SSW] System and [UHS] 

B 3.7.1 

BWR/6 STS B 3.7.1-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

A subsystem is considered OPERABLE when: 

a. The associated pump is OPERABLE, 

b. The associated [UHS] is OPERABLE, and 

c. The associated piping, valves, instrumentation, and controls required 

to perform the safety related function are OPERABLE. 

OPERABILITY of the [UHS] is based on a maximum water temperature of 

[95]°F with OPERABILITY of each subsystem requiring a minimum basin 

water level at or above elevation [130 ft 3 inches] mean sea level 

(equivalent to an indicated level of ≥ [7 ft 3 inches]) and four OPERABLE 

cooling tower fans. 

The isolation of the [SSW] System to components or systems may render 

those components or systems inoperable, but does not affect the 

OPERABILITY of the [SSW] System. 

OPERABILITY of the High Pressure Core Spray (HPCS) Service Water 

System (SWS) is addressed by LCO 3.7.2, "HPCS SWS." 

APPLICABILITY In MODES 1, 2, and 3, the [SSW] System and [UHS] are required to be 

OPERABLE to support OPERABILITY of the equipment serviced by the 

[SSW] System and [UHS], and are required to be OPERABLE in these 

MODES. 

In MODES 4 and 5, the OPERABILITY requirements of the [SSW] 

System and [UHS] are determined by the systems they support. 

ACTIONS [ A.1

If one or more cooling towers have one fan inoperable (i.e., up to one fan 

per cooling tower inoperable), action must be taken to restore the 

inoperable cooling tower fan(s) to OPERABLE status within 7 days. 

The 7 day Completion Time is reasonable, based on the low probability of 

an accident occurring during the 7 days that one cooling tower fan is 

inoperable in one or more cooling towers, the number of available 

systems, and the time required to complete the Required Action. ]
 [SSW] System and [UHS] 

B 3.7.1 

BWR/6 STS B 3.7.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ B.1

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The [ ]°F is the maximum allowed UHS temperature value and is based 

on temperature limitations of the equipment that is relied upon for 

accident mitigation and safe shutdown of the unit. 

-------------------------------------------------------------------------------------------------- 

With water temperature of the UHS > [90]°F, the design basis assumption 

associated with initial UHS temperature is bounded provided the 

temperature of the UHS averaged over the previous 24 hour period is 

≤ [90]°F. With the water temperature of the UHS > [90]°F, long term 

cooling capability of the ECCS loads and DGs may be affected. 

Therefore, to ensure long term cooling capability is provided to the ECCS 

loads when water temperature of the UHS is > [90]°F, Required Action 

B.1 is provided to more frequently monitor the water temperature of the 

UHS and verify the temperature is ≤ [90]°F when averaged over the 

previous 24 hour period. The once per hour Completion Time takes into 

consideration UHS temperature variations and the increased monitoring 

frequency needed to ensure design basis assumptions and equipment 

limitations are not exceeded in this condition. If the water temperature of 

the UHS exceeds [90]°F when averaged over the previous 24 hour period 

or the water temperature of the UHS exceeds [ ]°F, Condition D must be 

entered immediately.]

C.1

If one [SSW] subsystem is inoperable [for reasons other than 

Condition A], it must be restored to OPERABLE status within 72 hours. 

With the unit in this condition, the remaining OPERABLE [SSW] 

subsystem is adequate to perform the heat removal function. However, 

the overall reliability is reduced because a single failure in the 

OPERABLE [SSW] subsystem could result in loss of [SSW] function. The 

72 hour Completion Time was developed taking into account the 

redundant capabilities afforded by the OPERABLE subsystem and the 

low probability of a DBA occurring during this period. 

The Required Action is modified by two Notes indicating that the 

applicable Conditions of LCO 3.8.1, "AC Sources - Operating," and 

LCO 3.4.9, "Residual Heat Removal (RHR) Shutdown Cooling System - 

Hot Shutdown," be entered and the Required Actions taken if the 

inoperable [SSW] subsystem results in an inoperable DG or RHR 

shutdown cooling, respectively. This is in accordance with LCO 3.0.6 and 

ensures the proper actions are taken for these components. 
 [SSW] System and [UHS] 

B 3.7.1 

BWR/6 STS B 3.7.1-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1 and D.2

If the [SSW] subsystem cannot be restored to OPERABLE status within 

the associated Completion Time, or both [SSW] subsystems are 

inoperable [for reasons other than Condition A], or the [[UHS] is 

determined inoperable for reasons other than Condition A or B], the unit 

must be placed in a MODE in which the LCO does not apply. To achieve 

this status, the unit must be placed in at least MODE 3 within 12 hours 

and in MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems. 

SURVEILLANCE [ SR 3.7.1.1

REQUIREMENTS 

This SR ensures adequate long term (30 days) cooling can be 

maintained. With the [UHS] water source below the minimum level, the 

affected [SSW] subsystem must be declared inoperable. The 24 hour 

Frequency is based on operating experience related to trending of the 

parameter variations during the applicable MODES. ]

[ SR 3.7.1.2

This SR verifies the water level [in each [SSW] pump well of the intake 

structure] to be sufficient for the proper operation of the [SSW] pumps 

(net positive suction head and pump vortexing are considered in 

determining this limit). The 24 hour Frequency is based on operating 

experience related to trending of the parameter variations during the 

applicable MODES. ]

[ SR 3.7.1.3

Verification of the [UHS] temperature ensures that the heat removal 

capability of the [SSW] System is within the assumptions of the DBA 

analysis. The 24 hour Frequency is based on operating experience 

related to trending of the parameter variations during the applicable 

MODES. ]
 [SSW] System and [UHS] 

B 3.7.1 

BWR/6 STS B 3.7.1-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

[ SR 3.7.1.4

Operating each cooling tower fan for ≥ 15 minutes ensures that all fans 

are OPERABLE and that all associated controls are functioning properly. 

It also ensures that fan or motor failure, or excessive vibration can be 

detected for corrective action. The 31 day Frequency is based on 

operating experience, the known reliability of the fan units, the 

redundancy available, and the low probability of significant degradation of 

the cooling tower fans occurring between Surveillances. ]

SR 3.7.1.5

Verifying the correct alignment for each manual, power operated, and 

automatic valve in each [SSW] subsystem flow path provides assurance 

that the proper flow paths will exist for [SSW] operation. This SR does 

not apply to valves that are locked, sealed, or otherwise secured in 

position, since these valves were verified to be in the correct position prior 

to locking, sealing, or securing. A valve is also allowed to be in the 

nonaccident position and yet considered in the correct position, provided 

it can be automatically realigned to its accident position. This SR does 

not require any testing or valve manipulation; rather, it involves 

verification that those valves capable of potentially being mispositioned 

are in the correct position. This SR does not apply to valves that cannot 

be inadvertently misaligned, such as check valves. 

This SR is modified by a Note indicating that isolation of the [SSW] 

System to components or systems may render those components or 

systems inoperable, but does not affect the OPERABILITY of the [SSW] 

System. As such, when all [SSW] pumps, valves, and piping are 

OPERABLE, but a branch connection off the main header is isolated, the 

[SSW] System is still OPERABLE. 

The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions. 
 [SSW] System and [UHS] 

B 3.7.1 

BWR/6 STS B 3.7.1-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.7.1.6

This SR verifies that the automatic isolation valves of the [SSW] System 

will automatically switch to the safety or emergency position to provide 

cooling water exclusively to the safety related equipment during an 

accident event. This is demonstrated by use of an actual or simulated 

initiation signal. This SR also verifies the automatic start capability of the 

[SSW] pump and cooling tower fans in each subsystem. The LOGIC 

SYSTEM FUNCTIONAL TEST in SR 3.3.5.1.6 overlaps this SR to 

provide complete testing of the safety function. 

Operating experience has shown that these components usually pass the 

SR when performed on the [18] month Frequency. Therefore, this 

Frequency is concluded to be acceptable from a reliability standpoint. 

REFERENCES 1. Regulatory Guide 1.27, Revision 2, January 1976. 

 2. FSAR, Section [9.2.1]. 

 3. FSAR, Table [9.2-3]. 

 4. FSAR, Section [6.2.1.1.3.3.1.6]. 

 5. FSAR, Chapter [15]. 

 6. FSAR, Section [6.2.2.3]. 

 7. FSAR, Table [6.2-2]. 
HPCS SWS 

B 3.7.2 

BWR/6 STS B 3.7.2-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.2 High Pressure Core Spray (HPCS) Service Water System (SWS) 

BASES 

BACKGROUND The HPCS SWS is designed to provide cooling water for the removal of 

heat from components of the Division 3 HPCS System. 

The HPCS SWS consists of the Ultimate Heat Sink (UHS) Basin A, one 

cooling water header (subsystem C of the Standby Service Water (SSW) 

System), and the associated pumps, piping, and valves. The UHS is also 

considered part of the SSW System (LCO 3.7.1, "[Standby Service Water 

(SSW)] System and [Ultimate Heat Sink (UHS)]"). 

Cooling water is pumped from a UHS water source by the HPCS service 

water pump to the essential components through the HPCS service water 

supply header. After removing heat from the components, the water is 

discharged to the cooling towers, where the heat is rejected through 

direct contact with ambient air. 

The HPCS SWS specifically supplies cooling water to the Division 3 

HPCS diesel generator jacket water coolers and HPCS pump room 

cooler. The HPCS SWS pump is sized such that it will provide adequate 

cooling water to the equipment required for safe shutdown. Following a 

Design Basis Accident or transient, the HPCS SWS will operate 

automatically and without operator action as described in the FSAR, 

Section [9.2.1] (Ref. 1). 

APPLICABLE The ability of the HPCS SWS to provide adequate cooling to the HPCS 

SAFETY System is an implicit assumption for safety analyses evaluated in the 

ANALYSES FSAR, Chapters [6] and [15] (Refs. 2 and 3, respectively). 

The HPCS SWS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The HPCS SWS is required to be OPERABLE to ensure that the HPCS 

System will operate as required. An OPERABLE HPCS SWS consists of 

an OPERABLE UHS; an OPERABLE pump; and an OPERABLE UHS 

flow path, capable of taking suction from the associated SSW source and 

transferring the water to the appropriate unit equipment. 

The OPERABILITY of the UHS is specified in LCO 3.7.1. However, the 

OPERABILITY of the basin cooling tower fans does not affect the 

OPERABILITY of the HPCS SWS, due to the limited heat removal during 

its operation. 
HPCS SWS 

B 3.7.2 

BWR/6 STS B 3.7.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY In MODES 1, 2, and 3, the HPCS SWS is required to be OPERABLE to 

support OPERABILITY of the HPCS System since it is required to be 

OPERABLE in these MODES. 

In MODES 4 and 5, the OPERABILITY requirements of the HPCS SWS 

and the UHS are determined by the HPCS System. 

ACTIONS A.1

When the HPCS SWS is inoperable, the capability of the HPCS System 

to perform its intended function cannot be ensured. Therefore, if the 

HPCS SWS is inoperable, the HPCS System must be declared 

inoperable immediately and Condition C of LCO 3.5.1, "ECCS - 

Operating," entered. 

SURVEILLANCE SR 3.7.2.1

REQUIREMENTS 

This SR ensures that adequate cooling can be maintained. With the UHS 

water source below the minimum level, the HPCS SWS must be declared 

inoperable. The 24 hour Frequency is based on operating experience 

related to trending of the parameter variations during the applicable 

MODES. 

SR 3.7.2.2

Verifying the correct alignment for each manual, power operated, and 

automatic valve in the HPCS service water flow path provides assurance 

that the proper flow paths will exist for HPCS service water operation. 

This SR does not apply to valves that are locked, sealed, or otherwise 

secured in position, since these valves are verified to be in correct 

position prior to locking, sealing, or securing. 

A valve is also allowed to be in the nonaccident position and yet 

considered in the correct position, provided it can be automatically 

realigned to its accident position within the required time. This SR does 

not require any testing or valve manipulation; rather, it involves 

verification that those valves capable of potentially being mispositioned 

are in the correct position. This SR does not apply to valves that cannot 

be inadvertently misaligned, such as check valves. 

This SR is modified by a Note indicating that isolation of the [HPCS SWS] 

System to components or systems may render those components or 

systems inoperable, but does not affect the OPERABILITY of the [HPCS 

SWS] System. As such, when all [HPCS SWS] pumps, valves, and 

piping are OPERABLE, but a branch connection off the main header is 

isolated, the [HPCS SWS] System is still OPERABLE. 
HPCS SWS 

B 3.7.2 

BWR/6 STS B 3.7.2-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions. 

SR 3.7.2.3

This SR verifies that the automatic valves of the HPCS SWS will 

automatically switch to the safety or emergency position to provide 

cooling water exclusively to the safety related equipment during an 

accident event. This is demonstrated by use of an actual or simulated 

initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in 

SR 3.3.5.1.5 overlaps this SR to provide complete testing of the safety 

function. 

Operating experience has shown that these components usually pass the 

SR when performed at the [18] month Frequency. Therefore, this 

Frequency is concluded to be acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [9.2.1]. 

 2. FSAR, Chapter [6]. 

 3. FSAR, Chapter [15]. 
 [CRFA] System 

B 3.7.3 

BWR/6 STS B 3.7.3-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.3 [Control Room Fresh Air (CRFA)] System 

BASES 

BACKGROUND The [CRFA] System provides a radiologically controlled environment from 

which the unit can be safely operated following a Design Basis Accident 

(DBA). 

The safety related function of the [CRFA] System used to control radiation 

exposure consists of two independent and redundant high efficiency air 

filtration subsystems for treatment of recirculated air or outside supply air. 

Each subsystem consists of a demister, an electric heater, a prefilter, a 

high efficiency particulate air (HEPA) filter, an activated charcoal adsorber 

section, a second HEPA filter, a fan, and the associated ductwork and 

dampers. Demisters remove water droplets from the airstream. Prefilters 

and HEPA filters remove particulate matter that may be radioactive. The 

charcoal adsorbers provide a holdup period for gaseous iodine, allowing 

time for decay. 

In addition to the safety related standby emergency filtration function, 

parts of the [CRFA] System are operated to maintain the control room 

environment during normal operation. Upon receipt of the initiation 

signal(s) (indicative of conditions that could result in radiation exposure to 

control room personnel), the [CRFA] System automatically switches to the 

isolation mode of operation to prevent infiltration of contaminated air into 

the control room. A system of dampers isolates the control room, and 

control room air flow is recirculated and processed through either of the 

two filter subsystems. 

The [CRFA] System is designed to maintain the control room environment 

for a 30 day continuous occupancy after a DBA, without exceeding a 

5 rem whole body dose or its equivalent to any part of the body. [CRFA] 

System operation in maintaining the control room habitability is discussed 

in the FSAR, Sections [6.5.1] and [9.4.1] (Refs. 1 and 2, respectively). 

APPLICABLE The ability of the [CRFA] System to maintain the habitability of the control 

SAFETY room is an explicit assumption for the safety analyses presented in the 

ANALYSES FSAR, Chapters [6] and [15] (Refs. 3 and 4, respectively). The isolation 

mode of the [CRFA] System is assumed to operate following a loss of 

coolant accident, main steam line break, fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)], and control rod drop 

accident. The radiological doses to control room personnel as a result of 

the various DBAs are summarized in Reference 4. No single active or 

passive failure will cause the loss of outside or recirculated air from the 

control room. 
 [CRFA] System 

B 3.7.3 

BWR/6 STS B 3.7.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The [CRFA] System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Two redundant subsystems of the [CRFA] System are required to be 

OPERABLE to ensure that at least one is available, assuming a single 

failure disables the other subsystem. Total system failure could result in 

exceeding a dose of 5 rem to the control room operators in the event of a 

DBA. 

The [CRFA] System is considered OPERABLE when the individual 

components necessary to control operator exposure are OPERABLE in 

both subsystems. A subsystem is considered OPERABLE when its 

associated: 

a. Fan is OPERABLE, 

b. HEPA filter and charcoal adsorber are not excessively restricting flow 

and are capable of performing their filtration functions, and 

c. Heater, demister, ductwork, valves, and dampers are OPERABLE, 

and air circulation can be maintained. 

In addition, the control room boundary must be maintained, including the 

integrity of the walls, floors, ceilings, ductwork, and access doors. 

The LCO is modified by a Note allowing the control room boundary to be 

opened intermittently under administrative controls. For entry and exit 

through doors, the administrative control of the opening is performed by 

the person(s) entering or exiting the area. For other openings, these 

controls consist of stationing a dedicated individual at the opening who is 

in continuous communication with the control room. This individual will 

have a method to rapidly close the opening when a need for control room 

isolation is indicated. 

APPLICABILITY In MODES 1, 2, and 3, the [CRFA] System must be OPERABLE to 

control operator exposure during and following a DBA, since the DBA 

could lead to a fission product release. 

In MODES 4 and 5, the probability and consequences of a DBA are 

reduced due to the pressure and temperature limitations in these 

MODES. Therefore, maintaining the [CRFA] System OPERABLE is not 

required in MODE 4 or 5, except for the following situations under which 

significant radioactive releases can be postulated: 
 [CRFA] System 

B 3.7.3 

BWR/6 STS B 3.7.3-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

a. During operations with a potential for draining the reactor vessel 

(OPDRVs) and 

b. During movement of [recently] irradiated fuel assemblies in the 

[primary or secondary containment]. [Due to radioactive decay, the 

CRFA System is only required to be OPERABLE during fuel handling 

involving handling recently irradiated fuel (i.e., fuel that has occupied 

part of a critical reactor core within the previous [X] days).] 

ACTIONS A.1

With one [CRFA] subsystem inoperable, the inoperable [CRFA] 

subsystem must be restored to OPERABLE status within 7 days. With 

the unit in this condition, the remaining OPERABLE [CRFA] subsystem is 

adequate to perform control room radiation protection. However, the 

overall reliability is reduced because a single failure in the OPERABLE 

subsystem could result in loss of [CRFA] System function. The 7 day 

Completion Time is based on the low probability of a DBA occurring 

during this time period, and that the remaining subsystem can provide the 

required capabilities. 

B.1

-----------------------------------REVIEWER’S NOTE----------------------------------- 

Adoption of Condition B is dependent on a commitment from the licensee 

to have written procedures available describing compensatory measures 

to be taken in the event of an intentional or unintentional entry into 

Condition B. 

-------------------------------------------------------------------------------------------------- 

If the control room boundary is inoperable in MODE 1, 2, or 3, the CRFA 

subsystems cannot perform their intended functions. Actions must be 

taken to restore an OPERABLE control room boundary within 24 hours. 

During the period that the control room boundary is inoperable, 

appropriate compensatory measures (consistent with the intent of 

GDC 19) should be utilized to protect control room operators from 

potential hazards such as radioactive contamination, toxic chemicals, 

smoke, temperature and relative humidity, and physical security. 

Preplanned measures should be available to address these concerns for 

intentional and unintentional entry into the condition. The 24 hour 

Completion Time is reasonable based on the low probability of a DBA 

occurring during this time period, and the use of compensatory measures. 

The 24 hour Completion Time is a typically reasonable time to diagnose, 

plan and possibly repair, and test most problems with the control room 

boundary. 
 [CRFA] System 

B 3.7.3 

BWR/6 STS B 3.7.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

In MODE 1, 2, or 3, if the inoperable [CRFA] subsystem or control room 

boundary cannot be restored to OPERABLE status within the associated 

Completion Time, the unit must be placed in a MODE that minimizes risk. 

To achieve this status, the unit must be placed in at least MODE 3 within 

12 hours and in MODE 4 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems. 

D.1, D.2.1 and D.2.2

The Required Actions of Condition D are modified by a Note indicating 

that LCO 3.0.3 does not apply. If moving [recently] irradiated fuel 

assemblies while in MODE 1, 2, or 3, the fuel movement is independent 

of reactor operations. Therefore, inability to suspend movement of 

[recently] irradiated fuel assemblies is not sufficient reason to require a 

reactor shutdown. 

During movement of [recently] irradiated fuel assemblies in the [primary 

or secondary containment] or during OPDRVs, if the inoperable [CRFA] 

subsystem cannot be restored to OPERABLE status within the required 

Completion Time, the OPERABLE [CRFA] subsystem may be placed in 

the isolation mode. This action ensures that the remaining subsystem is 

OPERABLE, that no failures that would prevent automatic actuation will 

occur, and that any active failure will be readily detected. 

Required Action D.1 is modified by a Note alerting the operator to [place 

the system in the toxic gas protection mode if the toxic gas, automatic 

transfer capability is inoperable]. 

An alternative to Required Action D.1 is to immediately suspend activities 

that present a potential for releasing radioactivity that might require 

isolation of the control room. This places the unit in a condition that 

minimizes risk. 

If applicable, movement of [recently] irradiated fuel assemblies in the 

[primary and secondary containment] must be suspended immediately. 

Suspension of these activities shall not preclude completion of movement 

of a component to a safe position. Also, if applicable, actions must be 

initiated immediately to suspend OPDRVs to minimize the probability of a 

vessel draindown and subsequent potential for fission product release. 

Actions must continue until the OPDRVs are suspended. 
 [CRFA] System 

B 3.7.3 

BWR/6 STS B 3.7.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1

If both [CRFA] subsystems are inoperable in MODE 1, 2, or 3 for reasons 

other than an inoperable control room boundary (i.e., Condition B), the 

[CRFA] System may not be capable of performing the intended function 

and the unit is in a condition outside of the accident analyses. Therefore, 

LCO 3.0.3 must be entered immediately. 

F.1 and F.2

The Required Actions of Condition F are modified by a Note indicating 

that LCO 3.0.3 does not apply. If moving [recently] irradiated fuel 

assemblies while in MODE 1, 2, or 3, the fuel movement is independent 

of reactor operations. Therefore, inability to suspend movement of 

[recently] irradiated fuel assemblies is not sufficient reason to require a 

reactor shutdown. 

During movement of [recently] irradiated fuel assemblies in the [primary 

or secondary containment] or during OPDRVs, with two [CRFA] 

subsystems inoperable, action must be taken immediately to suspend 

activities that present a potential for releasing radioactivity that might 

require isolation of the control room. This places the unit in a condition 

that minimizes risk. 

If applicable, movement of [recently] irradiated fuel assemblies in the 

[primary and secondary containment] must be suspended immediately. 

Suspension of these activities shall not preclude completion of movement 

of a component to a safe position. If applicable, actions must be initiated 

immediately to suspend OPDRVs to minimize the probability of a vessel 

draindown and subsequent potential for fission product release. Actions 

must continue until the OPDRVs are suspended. 

SURVEILLANCE SR 3.7.3.1

REQUIREMENTS 

This SR verifies that a subsystem in a standby mode starts on demand 

and continues to operate. Standby systems should be checked 

periodically to ensure that they start and function properly. As the 

environmental and normal operating conditions of this system are not 

severe, testing each subsystem once every month provides an adequate 

check on this system. Monthly heater operation dries out any moisture 

accumulated in the charcoal from humidity in the ambient air. [Systems 

with heaters must be operated for ≥ 10 continuous hours with the heaters 

energized. Systems without heaters need only be operated for 
 [CRFA] System 

B 3.7.3 

BWR/6 STS B 3.7.3-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

≥ 15 minutes to demonstrate the function of the system.] Furthermore, 

the 31 day Frequency is based on the known reliability of the equipment 

and the two subsystem redundancy available. 

SR 3.7.3.2

This SR verifies that the required CRFA testing is performed in 

accordance with the [Ventilation Filter Testing Program (VFTP)]. The 

[VFTP] includes testing HEPA filter performance, charcoal adsorber 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal (general use and following specific operations). 

Specific test frequencies and additional information are discussed in 

detail in the [VFTP]. 

SR 3.7.3.3

This SR verifies that each [CRFA] subsystem starts and operates on an 

actual or simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL 

TEST in SR 3.3.7.1.5 overlaps this SR to provide complete testing of the 

safety function. The [18] month Frequency is specified in Reference 5. 

SR 3.7.3.4

This SR verifies the integrity of the control room enclosure and the 

assumed inleakage rates of potentially contaminated air. The control 

room positive pressure, with respect to potentially contaminated adjacent 

areas, is periodically tested to verify proper function of the [CRFA] 

System. During the emergency mode of operation, the [CRFA] System is 

designed to slightly pressurize the control room to [0.1] inches water 

gauge positive pressure with respect to adjacent areas to prevent 

unfiltered inleakage. The [CRFA] System is designed to maintain this 

positive pressure at a flow rate of [500] cfm to the control room in the 

isolation mode. The Frequency of [18] months on a STAGGERED TEST 

BASIS is consistent with industry practice and other filtration system SRs. 
 [CRFA] System 

B 3.7.3 

BWR/6 STS B 3.7.3-7 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [6.5.1]. 

 2. FSAR, Section [9.4.1]. 

 3. FSAR, Chapter [6]. 

 4. FSAR, Chapter [15]. 

 5. Regulatory Guide 1.52, Rev. [2]. 
 [Control Room AC] System 

B 3.7.4 

BWR/6 STS B 3.7.4-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.4 [Control Room Air Conditioning (AC)] System 

BASES 

BACKGROUND The [Control Room AC] System provides temperature control for the 

control room following isolation of the control room. 

The [Control Room AC] System consists of two independent, redundant 

subsystems that provide cooling and heating of recirculated control room 

air. Each subsystem consists of heating coils, cooling coils, fans, chillers, 

compressors, ductwork, dampers, and instrumentation and controls to 

provide for control room temperature control. 

The [Control Room AC] System is designed to provide a controlled 

environment under both normal and accident conditions. A single 

subsystem provides the required temperature control to maintain a 

suitable control room environment for a sustained occupancy of 

12 persons. The design conditions for the control room environment are 

72°F and 50% relative humidity. The [Control Room AC] System 

operation in maintaining the control room temperature is discussed in the 

FSAR, Sections [6.4] and [9.4.1] (Refs. 1 and 2, respectively). 

APPLICABLE The design basis of the [Control Room AC] System is to maintain the 

SAFETY control room temperature for a 30 day continuous occupancy. 

ANALYSES 

The [Control Room AC] System components are arranged in redundant 

safety related subsystems. During emergency operation, the [Control 

Room AC] System maintains a habitable environment and ensures the 

OPERABILITY of components in the control room. A single active failure 

of a component of the [Control Room AC] System, assuming a loss of 

offsite power, does not impair the ability of the system to perform its 

design function. Redundant detectors and controls are provided for 

control room temperature control. The [Control Room AC] System is 

designed in accordance with Seismic Category I requirements. The 

[Control Room AC] System is capable of removing sensible and latent 

heat loads from the control room, including consideration of equipment 

heat loads and personnel occupancy requirements to ensure equipment 

OPERABILITY. 

The [Control Room AC] System satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
 [Control Room AC] System 

B 3.7.4 

BWR/6 STS B 3.7.4-2 Rev. 3.0, 03/31/04 

BASES 

LCO Two independent and redundant subsystems of the [Control Room AC] 

System are required to be OPERABLE to ensure that at least one is 

available, assuming a single failure disables the other subsystem. Total 

system failure could result in the equipment operating temperature 

exceeding limits. 

The [Control Room AC] System is considered OPERABLE when the 

individual components necessary to maintain the control room 

temperature are OPERABLE in both subsystems. These components 

include the cooling coils, fans, chillers, compressors, ductwork, dampers, 

and associated instrumentation and controls. 

APPLICABILITY In MODE 1, 2, or 3, the [Control Room AC] System must be OPERABLE 

to ensure that the control room temperature will not exceed equipment 

OPERABILITY limits following control room isolation. 

In MODES 4 and 5, the probability and consequences of a Design Basis 

Accident are reduced due to the pressure and temperature limitations in 

these MODES. Therefore, maintaining the [Control Room AC] System 

OPERABLE is not required in MODE 4 or 5, except for the following 

situations under which significant radioactive releases can be postulated: 

a. During operations with a potential for draining the reactor vessel 

(OPDRVs) and 

b. During movement of [recently] irradiated fuel assemblies in the 

[primary or secondary containment]. [Due to radioactive decay, the 

Control Room AC System is only required to be OPERABLE during 

fuel handling involving handling recently irradiated fuel (i.e., fuel that 

has occupied part of a critical reactor core within the previous [X] 

days).] 

ACTIONS A.1

With one [control room AC] subsystem inoperable, the inoperable [control 

room AC] subsystem must be restored to OPERABLE status within 

30 days. With the unit in this condition, the remaining OPERABLE 

[control room AC] subsystem is adequate to perform the control room air 

conditioning function. However, the overall reliability is reduced because 

a single failure in the OPERABLE subsystem could result in loss of the 

control room air conditioning function. The 30 day Completion Time is 

based on the low probability of an event occurring requiring control room 

isolation, the consideration that the remaining subsystem can provide the 

required protection, and the availability of alternate cooling methods. 
 [Control Room AC] System 

B 3.7.4 

BWR/6 STS B 3.7.4-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

In MODE 1, 2, or 3, if the inoperable [control room AC] subsystem cannot 

be restored to OPERABLE status within the associated Completion Time, 

the unit must be placed in a MODE that minimizes risk. To achieve this 

status the unit must be placed in at least MODE 3 within 12 hours and in 

MODE 4 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging unit 

systems. 

C.1, C.2.1, and C.2.2

The Required Actions of Condition C are modified by a Note indicating 

that LCO 3.0.3 does not apply. 

If moving [recently] irradiated fuel assemblies while in MODE 1, 2, or 3, 

the fuel movement is independent of reactor operations. Therefore, 

inability to suspend movement of [recently] irradiated fuel assemblies is 

not sufficient reason to require a reactor shutdown. 

During movement of [recently] irradiated fuel assemblies in the [primary 

or secondary containment] or during OPDRVs, if Required Action A.1 

cannot be completed within the required Completion Time, the 

OPERABLE [control room AC] subsystem may be placed immediately in 

operation. This action ensures that the remaining subsystem is 

OPERABLE, that no failures that would prevent actuation will occur, and 

that any active failure will be readily detected. 

An alternative to Required Action C.1 is to immediately suspend activities 

that present a potential for releasing radioactivity that might require 

isolation of the control room. This places the unit in a condition that 

minimizes risk. 

If applicable, movement of [recently] irradiated fuel assemblies in the 

[primary and secondary containment] must be suspended immediately. 

Suspension of these activities shall not preclude completion of movement 

of a component to a safe position. Also, if applicable, actions must be 

initiated immediately to suspend OPDRVs to minimize the probability of a 

vessel draindown and subsequent potential for fission product release. 

Actions must continue until the OPDRVs are suspended. 
 [Control Room AC] System 

B 3.7.4 

BWR/6 STS B 3.7.4-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1

If both [control room AC] subsystems are inoperable in MODE 1, 2, or 3, 

the [Control Room AC] System may not be capable of performing the 

intended function. Therefore, LCO 3.0.3 must be entered immediately. 

E.1 and E.2

The Required Actions of Condition E.1 are modified by a Note indicating 

that LCO 3.0.3 does not apply. If moving [recently] irradiated fuel 

assemblies while in MODE 1, 2, or 3, the fuel movement is independent 

of reactor operations. Therefore, inability to suspend movement of 

[recently] irradiated fuel assemblies is not sufficient reason to require a 

reactor shutdown. 

During movement of [recently] irradiated fuel assemblies in the [primary 

or secondary containment] or during OPDRVs with two [control room AC] 

subsystems inoperable, action must be taken to immediately suspend 

activities that present a potential for releasing radioactivity that might 

require isolation of the control room. This places the unit in a condition 

that minimizes risk. 

If applicable, handling of [recently] irradiated fuel in the [primary or 

secondary containment] must be suspended immediately. Suspension of 

these activities shall not preclude completion of movement of a 

component to a safe position. Also, if applicable, actions must be initiated 

immediately to suspend OPDRVs to minimize the probability of a vessel 

draindown and subsequent potential for fission product release. Actions 

must continue until the OPDRVs are suspended. 

SURVEILLANCE SR 3.7.4.1

REQUIREMENTS 

This SR verifies that the heat removal capability of the system is sufficient 

to remove the control room heat load assumed in the [safety analyses]. 

The SR consists of a combination of testing and calculation. The 

[18] month Frequency is appropriate since significant degradation of the 

[Control Room AC] System is not expected over this time period. 

REFERENCES 1. FSAR, Section [6.4]. 

 2. FSAR, Section [9.4.1]. 
Main Condenser Offgas 

B 3.7.5 

BWR/6 STS B 3.7.5-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.5 Main Condenser Offgas 

BASES 

BACKGROUND During unit operation, steam from the low pressure turbine is exhausted 

directly into the condenser. Air and noncondensible gases are collected 

in the condenser, then exhausted through the steam jet air ejectors 

(SJAEs) to the Main Condenser Offgas System. The offgas from the 

main condenser normally includes radioactive gases. 

The Main Condenser Offgas System has been incorporated into the unit 

design to reduce the gaseous radwaste emission. This system uses a 

catalytic recombiner to recombine radiolytically dissociated hydrogen and 

oxygen. The gaseous mixture is cooled by the offgas condenser; the 

water and condensibles are stripped out by the offgas condenser and 

moisture separator. The radioactivity of the remaining gaseous mixture 

(i.e., the offgas recombiner effluent) is monitored downstream of the 

moisture separator prior to entering the holdup line. 

APPLICABLE The main condenser offgas gross gamma activity rate is an initial 

SAFETY condition of the Main Condenser Offgas System failure event as 

ANALYSES discussed in the FSAR, Section [15.7.1] (Ref. 1). The analysis assumes 

a gross failure in the Main Condenser Offgas System that results in the 

rupture of the Main Condenser Offgas System pressure boundary. The 

gross gamma activity rate is controlled to ensure that during the event, 

the calculated offsite doses will be well within the limits (NUREG-0800, 

Ref. 2) of 10 CFR 100 (Ref. 3), or the NRC staff approved licensing basis. 

The main condenser offgas limits satisfy Criterion 2 of 

10 CFR 50.36(c)(2)(ii). 

LCO To ensure compliance with the assumptions of the Main Condenser 

Offgas System failure event (Ref. 1), the fission product release rate 

should be consistent with a noble gas release to the reactor coolant of 

100 μCi/Mwt-second after decay of 30 minutes. The LCO is established 

consistent with this requirement ([3833] Mwt x 100 μCi/Mwt-second 

= [380] mCi/second). 

APPLICABILITY The LCO is applicable when steam is being exhausted to the main 

condenser and the resulting noncondensibles are being processed via the 

Main Condenser Offgas System. This occurs during MODE 1, and during 

MODES 2 and 3 with any main steam line not isolated and the SJAE in 

operation. In MODES 4 and 5, steam is not being exhausted to the main 

condenser and the requirements are not applicable. 
Main Condenser Offgas 

B 3.7.5 

BWR/6 STS B 3.7.5-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

If the offgas radioactivity rate limit is exceeded, 72 hours is allowed to 

restore the gross gamma activity rate to within the limit. The 72 hour 

Completion Time is reasonable, based on engineering judgment 

considering the time required to complete the Required Action, the large 

margins associated with permissible dose and exposure limits, and the 

low probability of a Main Condenser Offgas System rupture occurring. 

B.1, B.2, B.3.1, and B.3.2

If the gross gamma activity rate is not restored to within the limits within 

the associated Completion Time, [all main steam lines] or the SJAE must 

be isolated. This isolates the Main Condenser Offgas System from the 

source of the radioactive steam. The main steam lines are considered 

isolated if at least one main steam isolation valve in each main steam line 

is closed, and at least one main steam line drain valve in each drain line 

is closed. The 12 hour Completion Time is reasonable, based on 

operating experience, to perform the actions from full power conditions in 

an orderly manner and without challenging unit systems. 

An alternative to Required Actions B.1 and B.2 is to place the unit in a 

MODE in which the LCO does not apply. To achieve this status, the unit 

must be placed in at least MODE 3 within 12 hours and in MODE 4 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

SURVEILLANCE SR 3.7.5.1

REQUIREMENTS 

This SR, on a 31 day Frequency, requires an isotopic analysis of an 

offgas sample to ensure that the required limits are satisfied. The noble 

gases to be sampled are Xe-133, Xe-135, Xe-138, Kr-85, Kr-87, 

and Kr-88. If the measured rate of radioactivity increases significantly (by 

≥ 50% after correcting for expected increases due to changes in 

THERMAL POWER), an isotopic analysis is also performed within 

4 hours after the increase is noted, to ensure that the increase is not 

indicative of a sustained increase in the radioactivity rate. The 31 day 

Frequency is adequate in view of other instrumentation that continuously 

monitor the offgas, and is acceptable based on operating experience. 

This SR is modified by a Note indicating that the SR is not required to be 

performed until 31 days after any [main steam line is not isolated] and the 

SJAE is in operation. Only in this condition can radioactive fission gases 

be in the Main Condenser Offgas System at significant rates. 
Main Condenser Offgas 

B 3.7.5 

BWR/6 STS B 3.7.5-3 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. FSAR, Section [15.7.1]. 

 2. NUREG-0800. 

 3. 10 CFR 100. 
Main Turbine Bypass System 

B 3.7.6 

BWR/6 STS B 3.7.6-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.6 Main Turbine Bypass System 

BASES 

BACKGROUND The Main Turbine Bypass System is designed to control steam pressure 

when reactor steam generation exceeds turbine requirements during unit 

startup, sudden load reduction, and cooldown. It allows excess steam 

flow from the reactor to the condenser without going through the turbine. 

The bypass capacity of the system is [35]% of the Nuclear Steam Supply 

System rated steam flow. Sudden load reductions within the capacity of 

the steam bypass can be accommodated without reactor scram. The 

Main Turbine Bypass System consists of a two valve chest connected to 

the main steam lines between the main steam isolation valves and the 

turbine stop valves. Each of these valves is sequentially operated by 

hydraulic cylinders. The bypass valves are controlled by the pressure 

regulation function of the Turbine Electro Hydraulic Control System, as 

discussed in the FSAR, Section [7.7.1.5] (Ref. 1). The bypass valves are 

normally closed, and the pressure regulator controls the turbine control 

valves, directing all steam flow to the turbine. If the speed governor or 

the load limiter restricts steam flow to the turbine, the pressure regulator 

controls the system pressure by opening the bypass valves. When the 

bypass valves open, the steam flows from the bypass chest, through 

connecting piping, to the pressure breakdown assemblies, where a series 

of orifices are used to further reduce the steam pressure before the steam 

enters the condenser. 

APPLICABLE The Main Turbine Bypass System is assumed to function during the 

SAFETY design basis feedwater controller failure, maximum demand event, 

ANALYSES described in the FSAR, Section [15.1.2] (Ref. 2). Opening the bypass 

valves during the pressurization event mitigates the increase in reactor 

vessel pressure, which affects the MCPR during the event. An inoperable 

Main Turbine Bypass System may result in APLHGR and MCPR 

penalties. 

The Main Turbine Bypass System satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The Main Turbine Bypass System is required to be OPERABLE to limit 

peak pressure in the main steam lines and maintain reactor pressure 

within acceptable limits during events that cause rapid pressurization, 

such that the Safety Limit MCPR is not exceeded. [With the Main Turbine 

Bypass System inoperable, modifications to the APLHGR limits 

(LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE 

(APLHGR)") and the MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL 

POWER RATIO (MCPR)") may be applied to allow continued operation.] 
Main Turbine Bypass System 

B 3.7.6 

BWR/6 STS B 3.7.6-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

An OPERABLE Main Turbine Bypass System requires the bypass valves 

to open in response to increasing main steam line pressure. This 

response is within the assumptions of the applicable analysis (Ref. 2). 

The APLHGR and MCPR limits for the inoperable Main Turbine Bypass 

System are specified in the COLR. 

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at 

≥ 25% RTP to ensure that the fuel cladding integrity Safety Limit and the 

cladding 1% plastic strain limit are not violated during the feedwater 

controller failure, maximum demand event. As discussed in the Bases for 

LCO 3.2.1 and LCO 3.2.2, sufficient margin to these limits exists 

< 25% RTP. Therefore, these requirements are only necessary when 

operating at or above this power level. 

ACTIONS [ A.1

If the Main Turbine Bypass System is inoperable (one or more bypass 

valves inoperable), or the APLHGR and MCPR limits for an inoperable 

Main Turbine Bypass System, as specified in the COLR, are not applied, 

the assumptions of the design basis transient analysis may not be met. 

Under such circumstances, prompt action should be taken to restore the 

Main Turbine Bypass System to OPERABLE status or adjust the 

APLHGR and MCPR limits accordingly. The 2 hour Completion Time is 

reasonable, based on the time to complete the Required Action and the 

low probability of an event occurring during this period requiring the Main 

Turbine Bypass System. ]

B.1

If the Main Turbine Bypass System cannot be restored to OPERABLE 

status or the APLHGR and MCPR limits for an inoperable Main Turbine 

Bypass System are not applied, THERMAL POWER must be reduced to 

< 25% RTP. As discussed in the Applicability section, operation at 

< 25% RTP results in sufficient margin to the required limits, and the Main 

Turbine Bypass System is not required to protect fuel integrity during the 

feedwater controller failure, maximum demand event. The 4 hour 

Completion Time is reasonable, based on operating experience, to reach 

the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. 
Main Turbine Bypass System 

B 3.7.6 

BWR/6 STS B 3.7.6-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.7.6.1

REQUIREMENTS 

Cycling each main turbine bypass valve through one complete cycle of 

full travel demonstrates that the valves are mechanically OPERABLE and 

will function when required. The 31 day Frequency is based on 

engineering judgment, is consistent with the procedural controls 

governing valve operation, and ensures correct valve positions. 

Therefore, the Frequency is acceptable from a reliability standpoint. 

SR 3.7.6.2

The Main Turbine Bypass System is required to actuate automatically to 

perform its design function. This SR demonstrates that, with the required 

system initiation signals, the valves will actuate to their required position. 

The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a unit outage and 

because of the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. Operating experience has 

shown the [18] month Frequency, which is based on the refueling cycle, is 

acceptable from a reliability standpoint. 

SR 3.7.6.3

This SR ensures that the TURBINE BYPASS SYSTEM RESPONSE 

TIME is in compliance with the assumptions of the appropriate safety 

analysis. The response time limits are specified in [unit specific 

documentation]. The [18] month Frequency is based on the need to 

perform this Surveillance under the conditions that apply during a unit 

outage and because of the potential for an unplanned transient if the 

Surveillance were performed with the reactor at power. Operating 

experience has shown the [18] month Frequency, which is based on the 

refueling cycle, is acceptable from a reliability standpoint. 

REFERENCES 1. FSAR, Section [7.7.1.5]. 

 2. FSAR, Section [15.1.2]. 
Fuel Pool Water Level 

B 3.7.7 

BWR/6 STS B 3.7.7-1 Rev. 3.0, 03/31/04 

B 3.7 PLANT SYSTEMS 

B 3.7.7 Fuel Pool Water Level 

BASES 

BACKGROUND The minimum water level in the spent fuel storage pool and upper 

containment fuel storage pool meets the assumptions of iodine 

decontamination factors following a fuel handling accident. 

A general description of the spent fuel storage pool and upper 

containment fuel storage pool design is found in the FSAR, 

Section [9.1.2] (Ref. 1). The assumptions of the fuel handling accident 

are found in the FSAR, Sections [15.7.4] and [15.7.6] (Refs. 2 and 3, 

respectively). 

APPLICABLE The water level above the irradiated fuel assemblies is an explicit 

SAFETY assumption of the fuel handling accident. A fuel handling accident is 

ANALYSES evaluated to ensure that the radiological consequences (calculated whole 

body and thyroid doses at the exclusion area and low population zone 

boundaries) are ≤ 25% (NUREG-0800, Section 15.7.4, Ref. 4) of the 

10 CFR 100 (Ref. 5) exposure guidelines. A fuel handling accident could 

release a fraction of the fission product inventory by breaching the fuel 

rod cladding as discussed in the Regulatory Guide 1.25 (Ref. 6). 

The fuel handling accident is evaluated for the dropping of an irradiated 

fuel assembly onto stored fuel bundles. The consequences of a fuel 

handling accident inside the auxiliary building and inside containment are 

documented in References 2 and 3, respectively. The water levels in the 

spent fuel storage pool and upper containment fuel storage pool provide 

for absorption of water soluble fission product gases and transport delays 

of soluble and insoluble gases that must pass through the water before 

being released to the secondary containment atmosphere. This 

absorption and transport delay reduces the potential radioactivity of the 

release during a fuel handling accident. 

The fuel pool water level satisfies Criteria 2 and 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO The specified water level preserves the assumption of the fuel handling 

accident analysis (Refs. 2 and 3). As such, it is the minimum required for 

fuel movement within the spent fuel storage pool and upper containment 

fuel storage pool. 

APPLICABILITY This LCO applies whenever movement of irradiated fuel assemblies 

occurs in the associated fuel storage racks since the potential for a 

release of fission products exists. 
Fuel Pool Water Level 

B 3.7.7 

BWR/6 STS B 3.7.7-2 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does 

not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, 

the fuel movement is independent of reactor operations. Therefore, 

inability to suspend movement of irradiated fuel assemblies is not a 

sufficient reason to require a reactor shutdown. 

When the initial conditions for an accident cannot be met, steps should be 

taken to preclude the accident from occurring. With either fuel pool level 

less than required, the movement of irradiated fuel assemblies in the 

associated storage pool is suspended immediately. Suspension of this 

activity shall not preclude completion of movement of an irradiated fuel 

assembly to a safe position. This effectively precludes a spent fuel 

handling accident from occurring. 

SURVEILLANCE SR 3.7.7.1

REQUIREMENTS 

This SR verifies that sufficient water is available in the event of a fuel 

handling accident. The water level in the spent fuel storage pool and 

upper containment fuel storage racks must be checked periodically. The 

7 day Frequency is acceptable, based on operating experience, 

considering that the water volume in the pool is normally stable and water 

level changes are controlled by unit procedures. 

REFERENCES 1. FSAR, Section [9.1.2]. 

 2. FSAR, Section [15.7.4]. 

 3. FSAR, Section [15.7.6]. 

 4. NUREG-0800, Section 15.7.4, Revision 1, July 1981. 

 5. Regulatory Guide 1.52, Rev. [2]. 

 6. Regulatory Guide 1.25, March 1972. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.1 AC Sources - Operating 

BASES 

BACKGROUND The unit Class 1E AC Electrical Power Distribution System AC sources 

consist of the offsite power sources and the onsite standby power 

sources (diesel generators (DGs) 2A, 2C, and 1B). As required by 

10 CFR 50, Appendix A, GDC 17 (Ref. 1), the design of the AC electrical 

power system provides independence and redundancy to ensure an 

available source of power to the Engineered Safety Feature (ESF) 

systems. 

The Class 1E AC distribution system supplies electrical power to three 

divisional load groups, with each division powered by an independent 

Class 1E 4.16 kV ESF bus (refer to LCO 3.8.9, "Distribution Systems - 

Operating"). Each ESF bus has three separate and independent offsite 

sources of power. Each ESF bus has a dedicated onsite DG. The ESF 

systems of any two of the three divisions provide for the minimum safety 

functions necessary to shut down the unit and maintain it in a safe 

shutdown condition. 

Offsite power is supplied to the switchyard from the transmission network. 

From the switchyard two electrically and physically separated circuits 

provide AC power to each 4.16 kV ESF bus. A 115 kV power source 

provides a third completely independent circuit. The offsite AC electrical 

power sources are designed and located so as to minimize to the extent 

practical the likelihood of their simultaneous failure under operating and 

postulated accident and environmental conditions. A detailed description 

of the offsite power network and circuits to the onsite Class 1E [ESF 

buses] is found in FSAR, Chapter [8] (Ref. 2). 

An offsite circuit consists of all breakers, transformers, switches, 

interrupting devices, cabling, and controls required to transmit power from 

the offsite transmission network to the [onsite Class 1E ESF bus(es)]. 

Certain required plant loads are returned to service in a predetermined 

sequence in order to prevent overloading the transformer supplying offsite 

power to the onsite Class 1E Distribution System. Within [1 minute] after 

the initiating signal is received, all automatic and permanently connected 

loads needed to recover the unit or maintain it in a safe condition are 

returned to service via the load sequencer. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The onsite standby power source for each 4.16 kV ESF bus is a 

dedicated DG. A DG starts automatically on loss of coolant accident 

(LOCA) signal (i.e., low reactor water level signal or high drywell pressure 

signal) or on an ESF bus degraded voltage or undervoltage signal (refer 

to LCO 3.3.8.1, "Loss of Power (LOP) Instrumentation"). 

In the event of a loss of preferred power, the ESF electrical loads are 

automatically connected to the DGs in sufficient time to provide for safe 

reactor shutdown and to mitigate the consequences of a Design Basis 

Accident (DBA) such as a LOCA. 

Certain required plant loads are returned to service in a predetermined 

sequence in order to prevent overloading the DG. For Divisions 1 and 2, 

the automatic diesel start and the power from normal to emergency power 

supplies is controlled by the Load Shedding and Sequencing (LSS) 

System. The LSS circuits actuate on loss of offsite power or LOCA 

signal. The system starts the DGs and, if an undervoltage exists on a 

Division 1 or 2 bus, it sheds nonvital loads from the affected bus and then 

sequentially starts the vital loads. The Division 3 bus has no shedding or 

sequencing. 

Ratings for DGs satisfy the requirements of Regulatory Guide 1.9 

(Ref. 3). The continuous service rating is 7000 kW for Divisions 1 and 2 

and is 3300 kW for Division 3, with 10% overload permissible for up to 

2 hours in any 24 hour period. 

APPLICABLE The initial conditions of DBA and transient analyses in the FSAR, 

SAFETY Chapter [6] (Ref. 4) and Chapter [15] (Ref. 5), assume ESF systems are 

ANALYSES OPERABLE. The AC electrical power sources are designed to provide 

sufficient capacity, capability, redundancy, and reliability to ensure the 

availability of necessary power to ESF systems so that the fuel, Reactor 

Coolant System (RCS), and containment design limits are not exceeded. 

These limits are discussed in more detail in the Bases for Section 3.2, 

Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS); 

and Section 3.6, Containment Systems. 

The OPERABILITY of the AC electrical power sources is consistent with 

the initial assumptions of the accident analyses and is based upon 

meeting the design basis of the unit. This includes maintaining the onsite 

or offsite AC sources OPERABLE during accident conditions in the event 

of: 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

a. An assumed loss of all offsite power or all onsite AC power and 

b. A worst case single failure. 

AC sources satisfy the requirements of Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Two qualified circuits between the offsite transmission network and the 

onsite Class 1E Distribution System, and three separate and independent 

DGs (11, 12, and 13), ensure availability of the required power to shut 

down the reactor and maintain it in a safe shutdown condition after an 

anticipated operational occurrence (AOO) or a postulated DBA. 

Qualified offsite circuits are those that are described in the FSAR and are 

part of the licensing basis for the unit. 

[ In addition, [one required automatic load sequencer per ESF bus] shall be 

OPERABLE. In general, Division 3 does not have a load sequencer since 

it has only one large load (i.e., the high pressure core spray (HPCS) 

pump). In such cases the LCO should refer to the Division 1 and 2 

sequencers only. ] 

Each offsite circuit must be capable of maintaining rated frequency and 

voltage, and accepting required loads during an accident, while 

connected to the ESF buses. Each offsite circuit consists of incoming 

breaker and disconnect to the respective service transformers 11 and 21, 

the 11 and 21 service transformers, the ESF transformers 11 and 21, and 

the respective circuit path including feeder breakers to the 4.16 kV ESF 

buses. 

Each DG must be capable of starting, accelerating to rated speed and 

voltage, and connecting to its respective ESF bus on detection of bus 

undervoltage. This sequence must be accomplished within 10 seconds. 

Each DG must also be capable of accepting required loads within the 

assumed loading sequence intervals, and must continue to operate until 

offsite power can be restored to the ESF buses. These capabilities are 

required to be met from a variety of initial conditions such as DG in 

standby with engine hot and DG in standby with engine at ambient 

conditions. Additional DG capabilities must be demonstrated to meet 

required Surveillances, e.g., capability of the DG to revert to standby 

status on an ECCS signal while operating in parallel test mode. 

Proper sequencing of loads, including tripping of nonessential loads, is a 

required function for DG OPERABILITY. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

The AC sources in one division must be separate and independent (to the 

extent possible) of the AC sources in the other division(s). For the DGs, 

the separation and independence are complete. For the offsite AC 

sources, the separation and independence are to the extent practical. 

APPLICABILITY The AC sources and sequencers are required to be OPERABLE in 

MODES 1, 2, and 3 to ensure that: 

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and 

b. Adequate core cooling is provided and containment OPERABILITY 

and other vital functions are maintained in the event of a postulated 

DBA. 

A Note has been added taking exception to the Applicability requirements 

for Division 3 sources, provided the HPCS System is declared inoperable. 

This exception is intended to allow declaring of the Division 3 inoperable 

either in lieu of declaring the Division 3 source inoperable, or at any time 

subsequent to entering ACTIONS for an inoperable Division 3 source. 

This exception is acceptable since, with the Division 3 inoperable and the 

associated ACTIONS entered, the Division 3 AC sources provide no 

additional assurance of meeting the above criteria. 

AC power requirements for MODES 4 and 5 are covered in LCO 3.8.2, 

"AC Sources - Shutdown." 

ACTIONS A.1

A Note prohibits the application of LCO 3.0.4.b to an inoperable DG. 

There is an increased risk associated with entering a MODE or other 

specified condition in the Applicability with an inoperable DG and the 

provisions of LCO 3.0.4.b, which allow entry into a MODE or other 

specified condition in the Applicability with the LCO not met after 

performance of a risk assessment addressing inoperable systems and 

components, should not be applied in this circumstance. 

To ensure a highly reliable power source remains, it is necessary to verify 

the availability of the remaining required offsite circuits on a more 

frequent basis. Since the Required Action only specifies "perform," a 

failure of SR 3.8.1.1 acceptance criteria does not result in the Required 

Action not met. However, if a second required circuit fails SR 3.8.1.1, the 

second offsite circuit is inoperable, and Condition C, for two offsite circuits 

inoperable, is entered. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.2

Required Action A.2, which only applies if the division cannot be powered 

from an offsite source, is intended to provide assurance that an event with 

a coincident single failure of the associated DG does not result in a 

complete loss of safety function of critical systems. These features are 

designed with redundant safety related divisions (i.e., single division 

systems are not included, although, for this Required Action, Division 3 is 

considered redundant to Division 1 and 2 Emergency Core Cooling 

Systems (ECCS)). Redundant required features failures consist of 

inoperable features associated with a division redundant to the division 

that has no offsite power. 

The Completion Time for Required Action A.2 is intended to allow time for 

the operator to evaluate and repair any discovered inoperabilities. This 

Completion Time also allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." In this Required Action, 

the Completion Time only begins on discovery that both: 

a. The division has no offsite power supplying its loads and 

b. A required feature on the other division is inoperable. 

If, at any time during the existence of this Condition (one offsite circuit 

inoperable), a required feature subsequently becomes inoperable, this 

Completion Time begins to be tracked. 

Discovering no offsite power to one division of the onsite Class 1E Power 

Distribution System coincident with one or more inoperable required 

support or supported features, or both, that are associated with the other 

division that has offsite power, results in starting the Completion Times for 

the Required Action. Twenty-four hours is acceptable because it 

minimizes risk while allowing time for restoration before the unit is 

subjected to transients associated with shutdown. 

The remaining OPERABLE offsite circuit and DGs are adequate to supply 

electrical power to the onsite Class 1E Distribution System. Thus, on a 

component basis, single failure protection may have been lost for the 

required feature's function; however, function is not lost. The 24 hour 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Completion Time takes into account the component OPERABILITY of the 

redundant counterpart to the inoperable required feature. Additionally, 

the 24 hour Completion Time takes into account the capacity and 

capability of the remaining AC sources, a reasonable time for repairs, and 

the low probability of a DBA occurring during this period. 

A.3

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition A for a period that should not exceed 72 hours. 

This Completion Time assumes sufficient offsite power remains to power 

the minimum loads needed to respond to analyzed events. In the event 

more than one division is without offsite power, this assumption is not 

met. Therefore, the optional Completion Time is specified. Should two or 

more divisions be affected, the 24 hour Completion Time is conservative 

with respect to the Regulatory Guide assumptions supporting a 24 hour 

Completion Time for both offsite circuits inoperable. With one offsite 

circuit inoperable, the reliability of the offsite system is degraded, and the 

potential for a loss of offsite power is increased, with attendant potential 

for a challenge to the plant safety systems. In this Condition, however, 

the remaining OPERABLE offsite circuit and DGs are adequate to supply 

electrical power to the onsite Class 1E distribution system. 

The Completion Time takes into account the capacity and capability of the 

remaining AC sources, reasonable time for repairs, and the low 

probability of a DBA occurring during this period. 

The third Completion Time for Required Action A.3 establishes a limit on 

the maximum time allowed for any combination of required AC power 

sources to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition A is entered while, for instance, a 

DG is inoperable and that DG is subsequently returned OPERABLE, the 

LCO may already have been not met for up to 72 hours. This situation 

could lead to a total of 144 hours, since initial failure to meet the LCO, to 

restore the offsite circuit. At this time, a DG could again become 

inoperable, the circuit restored OPERABLE, and an additional 72 hours 

for a total of 9 days) allowed prior to complete restoration of the LCO. 

The 6 day Completion Time provides a limit on the time allowed in a 

specified condition after discovery of failure to meet the LCO. This limit is 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

(considered reasonable for situations in which Conditions A and B are 

entered concurrently. The "AND" connector between the 72 hour and 

6 day Completion Times means that both Completion Times apply 

simultaneously, and the more restrictive must be met. 

As in Required Action A.2, the Completion Time allows for an exception 

to the normal "time zero" for beginning the allowed outage time "clock." 

This exception results in establishing the "time zero" at the time the LCO 

was initially not met, instead of at the time that Condition A was entered. 

B.1

To ensure a highly reliable power source remains, it is necessary to verify 

the availability of the remaining required offsite circuit on a more frequent 

basis. Since the Required Action only specifies "perform," a failure of 

SR 3.8.1.1 acceptance criteria does not result in a Required Action being 

not met. However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. 

Upon offsite circuit inoperability, additional Conditions must then be 

entered. 

B.2

Required Action B.2 is intended to provide assurance that a loss of offsite 

power, during the period that a DG is inoperable, does not result in a 

complete loss of safety function of critical systems. These features are 

designed with redundant safety related divisions (i.e., single division 

systems are not included, although for this Required Action, Division 3 is 

considered redundant to Division 1 and 2 Emergency Core Cooling 

Systems (ECCS)). Redundant required features failures consist of 

inoperable features associated with a division redundant to the division 

that has an inoperable DG. 

The Completion Time is intended to allow the operator time to evaluate 

and repair any discovered inoperabilities. This Completion Time also 

allows for an exception to the normal "time zero" for beginning the 

allowed outage time "clock." In this Required Action, the Completion Time 

only begins on discovery that both: 

a. An inoperable DG exists and 

b. A required feature on another division is inoperable. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

If, at any time during the existence of this Condition (one DG inoperable), 

a required feature subsequently becomes inoperable, this Completion 

Time begins to be tracked. 

Discovering one required DG inoperable coincident with one or more 

required support or supported features, or both, that are associated with 

the OPERABLE DG(s), results in starting the Completion Time for the 

Required Action. Four hours from the discovery of these events existing 

concurrently is acceptable because it minimizes risk while allowing time 

for restoration before subjecting the unit to transients associated with 

shutdown. 

The remaining OPERABLE DGs and offsite circuits are adequate to 

supply electrical power to the onsite Class 1E Distribution System. Thus, 

on a component basis, single failure protection for the required feature's 

function may have been lost; however, function has not been lost. The 

4 hour Completion Time takes into account the component 

OPERABILITY of the redundant counterpart to the inoperable required 

feature. Additionally, the 4 hour Completion Time takes into account the 

capacity and capability of the remaining AC sources, reasonable time for 

repairs, and low probability of a DBA occurring during this period. 

B.3.1 and B.3.2

Required Action B.3.1 provides an allowance to avoid unnecessary 

testing of OPERABLE DGs. If it can be determined that the cause of the 

inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 does 

not have to be performed. If the cause of inoperability exists on other 

DGs, the other DGs are declared inoperable upon discovery, and 

Condition E of LCO 3.8.1 is entered. Once the failure is repaired, and the 

common cause failure no longer exists, Required Action B.3.1 is satisfied. 

If the cause of the initial inoperable DG cannot be confirmed not to exist 

on the remaining DG(s), performance of SR 3.8.1.2 suffices to provide 

assurance of continued OPERABILITY of those DG(s). 

In the event the inoperable DG is restored to OPERABLE status prior to 

completing either B.3.1 or B.3.2, the [plant corrective action program] will 

continue to evaluate the common cause possibility. This continued 

evaluation, however, is no longer under the 24 hour constraint imposed 

while in Condition B. 

According to Generic Letter 84-15 (Ref. 7), [24] hours is reasonable time 

to confirm that the OPERABLE DG(s) are not affected by the same 

problem as the inoperable DG. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-9 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.4

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition B for a period that should not exceed 72 hours. In Condition B, 

the remaining OPERABLE DGs and offsite circuits are adequate to 

supply electrical power to the onsite Class 1E distribution system. The 

72 hour Completion Time takes into account the capacity and capability of 

the remaining AC sources, reasonable time for repairs, and low 

probability of a DBA occurring during this period. 

The second Completion Time for Required Action B.4 established a limit 

on the maximum time allowed for any combination of required AC power 

sources to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition B is entered while, for instance, an 

offsite circuit is inoperable and that circuit is subsequently restored 

OPERABLE, the LCO may already have been not met for up to 72 hours. 

This situation could lead to a total of 144 hours, since initial failure to 

meet the LCO, to restore the DG. At this time, an offsite circuit could 

again become inoperable, the DG restored OPERABLE, and an 

additional 72 hours (for a total of 9 days) allowed prior to complete 

restoration of the LCO. The 6 day Completion Time provides a limit on 

the time allowed in a specified condition after discovery of failure to meet 

the LCO. This limit is considered reasonable for situations in which 

Conditions A and B are entered concurrently. The "AND" connector 

between the 72 hour and 6 day Completion Times means that both 

Completion Times apply simultaneously, and the more restrictive 

Completion Time must be met. 

As in Required Action B.2, the Completion Time allows for an exception 

to the normal "time zero" for beginning the allowed outage time "clock." 

This exception results in establishing the "time zero" at the time the LCO 

was initially not met, instead of the time Condition B was entered. 

C.1 and C.2

Required Action C.1 addresses actions to be taken in the event of 

concurrent failure of redundant required features. Required Action C.1 

reduces the vulnerability to a loss of function. The Completion Time for 

taking these actions is reduced to 12 hours from that allowed with only 

one division without offsite power (Required Action A.2). The rationale for 

the reduction to 12 hours is that Regulatory Guide 1.93 (Ref. 6) allows a 

Completion Time of 24 hours for two required offsite circuits inoperable, 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-10 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

based upon the assumption that two complete safety divisions are 

OPERABLE. When a concurrent redundant required feature failure 

exists, this assumption is not the case, and a shorter Completion Time of 

12 hours is appropriate. These redundant required features do not 

include monitoring requirements, such as Post Accident Monitoring and 

Remote Shutdown. These features are designed with redundant safety 

related divisions (i.e., single division systems are not included in the list, 

although, for this Required Action, Division 3 is considered redundant to 

Division 1 and 2 ECCS). Redundant required features failures consist of 

any of these features that are inoperable, because any inoperability is on 

a division redundant to a division with inoperable offsite circuits. 

The Completion Time for Required Action C.1 is intended to allow the 

operator time to evaluate and repair any discovered inoperabilities. This 

Completion Time also allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." In this Required Action, 

the Completion Time only begins on discovery that both: 

a. All required offsite circuits are inoperable and 

b. A required feature is inoperable. 

If, at any time during the existence of this Condition (two offsite circuits 

inoperable), a required feature subsequently becomes inoperable, this 

Completion Time begins to be tracked. 

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition C for a period that should not exceed 24 hours. This level of 

degradation means that the offsite electrical power system does not have 

the capability to effect a safe shutdown and to mitigate the effects of an 

accident; however, the onsite AC sources have not been degraded. This 

level of degradation generally corresponds to a total loss of the 

immediately accessible offsite power sources. 

Because of the normally high availability of the offsite sources, this level 

of degradation may appear to be more severe than other combinations of 

two AC sources inoperable that involve one or more DGs inoperable. 

However, two factors tend to decrease the severity of this degradation 

level: 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-11 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

a. The configuration of the redundant AC electrical power system that 

remains available is not susceptible to a single bus or switching 

failure and 

b. The time required to detect and restore an unavailable offsite power 

source is generally much less than that required to detect and restore 

an unavailable onsite AC source. 

With both of the required offsite circuits inoperable, sufficient onsite AC 

sources are available to maintain the unit in a safe shutdown condition in 

the event of a DBA or transient. In fact, a simultaneous loss of offsite AC 

sources, a LOCA, and a worst case single failure were postulated as a 

part of the design basis in the safety analysis. Thus, the 24 hour 

Completion Time provides a period of time to effect restoration of one of 

the offsite circuits commensurate with the importance of maintaining an 

AC electrical power system capable of meeting its design criteria. 

According to Regulatory Guide 1.93 (Ref. 6), with the available offsite AC 

sources two less than required by the LCO, operation may continue for 

24 hours. If two offsite sources are restored within 24 hours, unrestricted 

operation may continue. If only one offsite source is restored within 

24 hours, power operation continues in accordance with Condition A. 

D.1 and D.2

Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be 

entered even if all AC sources to it were inoperable, resulting in deenergization. Therefore, the Required Actions of Condition D are 

modified by a Note to indicate that when Condition D is entered with no 

AC source to any division, Actions for LCO 3.8.9, "Distribution Systems - 

Operating," must be immediately entered. This allows Condition D to 

provide requirements for the loss of the offsite circuit and one DG without 

regard to whether a division is de-energized. LCO 3.8.9 provides the 

appropriate restrictions for a de-energized division. 

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition D for a period that should not exceed 12 hours. In Condition D, 

individual redundancy is lost in both the offsite electrical power system 

and the onsite AC electrical power system. Since power system 

redundancy is provided by two diverse sources of power, however, the 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-12 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

reliability of the power systems in this Condition may appear higher than 

that in Condition C (loss of both required offsite circuits). This difference 

in reliability is offset by the susceptibility of this power system 

configuration to a single bus or switching failure. The 12 hour Completion 

Time takes into account the capacity and capability of the remaining AC 

sources, reasonable time for repairs, and low probability of a DBA 

occurring during this period. 

E.1

With two DGs inoperable, there is one remaining standby AC source. 

Thus, with an assumed loss of offsite electrical power, insufficient standby 

AC sources are available to power the minimum required ESF functions. 

Since the offsite electrical power system is the only source of AC power 

for the majority of ESF equipment at this level of degradation, the risk 

associated with continued operation for a very short time could be less 

than that associated with an immediate controlled shutdown (the 

immediate shutdown could cause grid instability, which could result in a 

total loss of AC power). Since any inadvertent generator trip could also 

result in a total loss of offsite AC power, however, the time allowed for 

continued operation is severely restricted. The intent here is to avoid the 

risk associated with an immediate controlled shutdown and to minimize 

the risk associated with this level of degradation. 

According to Regulatory Guide 1.93 (Ref. 6), with both DGs inoperable, 

operation may continue for a period that should not exceed 2 hours. This 

Completion Time assumes complete loss of onsite (DG) AC capability to 

power the minimum loads needed to respond to analyzed events. In the 

event Division 3 DG in conjunction with Division 1 or 2 DG is inoperable, 

with Division 1 or 2 remaining, a significant spectrum of breaks would be 

capable of being responded to with onsite power. Even the worst case 

event would be mitigated to some extent - an extent greater than a typical 

two division design in which this condition represents complete loss of 

onsite power function. Given the remaining function, a 24 hour 

Completion Time is appropriate. At the end of this 24 hour period, 

Division 3 systems could be declared inoperable (see Applicability Note) 

and this Condition could be exited with only one required DG remaining 

inoperable. However, with a Division 1 or 2 DG remaining inoperable and 

the HPCS declared inoperable, a redundant required feature failure 

exists, according to Required Action B.2. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-13 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

[ F.1

The sequencer(s) is an essential support system to [both the offsite circuit 

and the DG associated with a given ESF bus.] [Furthermore, the 

sequencer(s) is on the primary success path for most major AC 

electrically powered safety systems powered from the associated ESF 

bus.] Therefore, loss of an [ESF bus's sequencer] affects every major 

ESF system in the [division]. The [12] hour Completion Time provides a 

period of time to correct the problem commensurate with the importance 

of maintaining sequencer OPERABILITY. This time period also ensures 

that the probability of an accident requiring sequencer OPERABILITY 

occurring during periods when the sequencer is inoperable is minimal. 

This Condition is preceded by a Note that allows the Condition to be 

deleted if the plant design is such that any sequencer failure mode only 

affects the ability of the associated DG to power its respective safety 

loads under any conditions. Implicit in this Note is the concept that the 

Condition must be retained if any sequencer failure mode results in the 

inability to start all or part of the safety loads when required, regardless of 

power availability, or results in overloading the offsite power circuit to a 

safety bus during an event thereby causing its failure. Also implicit in the 

Note is the concept that the Condition is not applicable to any Division 

that does not have a sequencer [Division 3 does not normally have a 

sequencer in the circuitry]. ] 

G.1 and G.2

If the inoperable AC electrical power sources [and sequencers] cannot be 

restored to OPERABLE status within the associated Completion Time, 

the unit must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the unit must be brought to MODE 3 within 12 hours 

and to MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

H.1

Condition H corresponds to a level of degradation in which all redundancy 

in the AC electrical power supplies has been lost. At this severely 

degraded level, any further losses in the AC electrical power system will 

cause a loss of function. Therefore, no additional time is justified for 

continued operation. The unit is required by LCO 3.0.3 to commence a 

controlled shutdown. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-14 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE The AC sources are designed to permit inspection and testing of all 

REQUIREMENTS important areas and features, especially those that have a standby 

function, in accordance with 10 CFR 50, GDC 18 (Ref. 8). Periodic 

component tests are supplemented by extensive functional tests during 

refueling outages under simulated accident conditions. The SRs for 

demonstrating the OPERABILITY of the DGs are in accordance with the 

recommendations of Regulatory Guide 1.9 (Ref. 3), Regulatory 

Guide 1.108 (Ref. 9), and Regulatory Guide 1.137 (Ref. 10). 

Where the SRs discussed herein specify voltage and frequency 

tolerances, the following summary is applicable. The minimum steady 

state output voltage of [3740] V is 90% of the nominal 4160 V output 

voltage. This value, which is specified in ANSI C84.1 (Ref. 11), allows for 

voltage drop to the terminals of 4000 V motors whose minimum operating 

voltage is specified as 90%, or 3600 V. It also allows for voltage drops to 

motors and other equipment down through the 120 V level where 

minimum operating voltage is also usually specified as 90% of name plate 

rating. The specified maximum steady state output voltage of [4576] V is 

equal to the maximum operating voltage specified for 4000 V motors. It 

ensures that for a lightly loaded distribution system, the voltage at the 

terminals of 4000 V motors is no more than the maximum rated operating 

voltages. The specified minimum and maximum frequencies of the DG 

are 58.8 Hz and 61.2 Hz, respectively. These values are equal to ± 2% of 

the 60 Hz nominal frequency and are derived from the recommendations 

given in Regulatory Guide 1.9 (Ref. 3). 

SR 3.8.1.1

This SR ensures proper circuit continuity for the offsite AC electrical 

power supply to the onsite distribution network and availability of offsite 

AC electrical power. The breaker alignment verifies that each breaker is 

in its correct position to ensure that distribution buses and loads are 

connected to their preferred power source and that appropriate 

independence of offsite circuits is maintained. The 7 day Frequency is 

adequate since breaker position is not likely to change without the 

operator being aware of it and because its status is displayed in the 

control room. 

SR 3.8.1.2 and SR 3.8.1.7

These SRs help to ensure the availability of the standby electrical power 

supply to mitigate DBAs and transients and maintain the unit in a safe 

shutdown condition. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-15 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

To minimize the wear on moving parts that do not get lubricated when the 

engine is not running, these SRs have been modified by Notes (Note 1 for 

SR 3.8.1.2 and Note for SR 3.8.1.7) to indicate that all DG starts for these 

Surveillances may be preceded by an engine prelube period and followed 

by a warmup period prior to loading. 

For the purposes of this testing, the DGs are started from standby 

conditions. Standby conditions for a DG mean that the diesel engine 

coolant and oil are being continuously circulated and temperature is being 

maintained consistent with manufacturer recommendations. 

[ In order to reduce stress and wear on diesel engines, some 

manufacturers recommend that the starting speed of DGs be limited, that 

warmup be limited to this lower speed, and that DGs be gradually 

accelerated to synchronous speed prior to loading. These start 

procedures are the intent of Note 2, which is only applicable when such 

procedures are recommended by the manufacturer. ] 

SR 3.8.1.7 requires that, at a 184 day Frequency, the DG starts from 

standby conditions and achieves required voltage and frequency within 

10 seconds. The 10 second start requirement supports the assumptions 

in the design basis LOCA analysis (Ref. 10). The 10 second start 

requirement may not be applicable to SR 3.8.1.2 (see Note 2 of 

SR 3.8.1.2), when a modified start procedure as described above is used. 

If a modified start is not used, the 10 second start requirement of 

SR 3.8.1.7 applies. Since SR 3.8.1.7 does require a 10 second start, it is 

more restrictive than SR 3.8.1.2, and it may be performed in lieu of 

SR 3.8.1.2. 

In addition to the SR requirements, the time for the DG to reach steady 

state operation, unless the modified DG start method is employed, is 

periodically monitored and the trend evaluated to identify degradation of 

governor and voltage regulator performance. 

The 31 day Frequency for SR 3.8.1.2 is consistent with Regulatory 

Guide 1.9 (Ref. 3). The 184 day Frequency for SR 3.8.1.7 is a reduction 

in cold testing consistent with Generic Letter 84-15 (Ref. 7). These 

Frequencies provide adequate assurance of DG OPERABILITY, while 

minimizing degradation resulting from testing. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-16 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.3

This Surveillance demonstrates that the DGs are capable of 

synchronizing and accepting greater than or equal to the equivalent of the 

maximum expected accident loads. A minimum run time of 60 minutes is 

required to stabilize engine temperatures, while minimizing the time that 

the DG is connected to the offsite source. 

Although no power factor requirements are established by this SR, the 

DG is normally operated at a power factor between [0.8 lagging] and 

[1.0]. The [0.8] value is the design rating of the machine, while [1.0] is an 

operational limitation [to ensure circulating currents are minimized]. The 

load band is provided to avoid routine overloading of the DG. Routine 

overloading may result in more frequent teardown inspections in 

accordance with vendor recommendations in order to maintain DG 

OPERABILITY. 

The 31 day Frequency for this Surveillance is consistent with Regulatory 

Guide 1.9 (Ref. 3). 

Note 1 modifies this Surveillance to indicate that diesel engine runs for 

this Surveillance may include gradual loading, as recommended by the 

manufacturer, so that mechanical stress and wear on the diesel engine 

are minimized. 

Note 2 modifies this Surveillance by stating that momentary transients 

because of changing bus loads do not invalidate this test. 

Note 3 indicates that this Surveillance must be conducted on only one DG 

at a time in order to avoid common cause failures that might result from 

offsite circuit or grid perturbations. 

Note 4 stipulates a prerequisite requirement for performance of this SR. 

A successful DG start must precede this test to credit satisfactory 

performance. 

SR 3.8.1.4

This SR provides verification that the level of fuel oil in the day tank [and 

engine mounted tank] is at or above the level at which fuel oil is 

automatically added. The level is expressed as an equivalent volume in 

gallons, and is selected to ensure adequate fuel oil for a minimum of 

1 hour of DG operation at full load plus 10%. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-17 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The 31 day Frequency is adequate to assure that a sufficient supply of 

fuel oil is available, since low level alarms are provided and facility 

operators would be aware of any large uses of fuel oil during this period. 

SR 3.8.1.5

Microbiological fouling is a major cause of fuel oil degradation. There are 

numerous bacteria that can grow in fuel oil and cause fouling, but all must 

have a water environment in order to survive. Removal of water from the 

fuel oil day [and engine mounted] tanks once every [31] days eliminates 

the necessary environment for bacterial survival. This is most effective 

means in controlling microbiological fouling. In addition, it eliminates the 

potential for water entrainment in the fuel oil during DG operation. Water 

may come from any of several sources, including condensation, ground 

water, rain water, contaminated fuel oil, and breakdown of the fuel oil by 

bacteria. Frequent checking for and removal of accumulated water 

minimizes fouling and provides data regarding the watertight integrity of 

the fuel oil system. The Surveillance Frequencies are established by 

Regulatory Guide 1.137 (Ref. 10). This SR is for preventive 

maintenance. The presence of water does not necessarily represent a 

failure of this SR provided that accumulated water is removed during 

performance of this Surveillance. 

SR 3.8.1.6

This Surveillance demonstrates that each required fuel oil transfer pump 

operates and transfers fuel oil from its associated storage tank to its 

associated day tank. It is required to support the continuous operation of 

standby power sources. This Surveillance provides assurance that the 

fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, 

the fuel delivery piping is not obstructed, and the controls and control 

systems for automatic fuel transfer systems are OPERABLE. 

[ The Frequency for this SR is variable, depending on individual system 

design, with up to a 92 day interval. The 92 day Frequency corresponds 

to the testing requirements for pumps as contained in the ASME Boiler 

and Pressure Vessel Code, Section XI (Ref. 12); however, the design of 

fuel transfer systems is such that pumps operate automatically or must be 

started manually in order to maintain an adequate volume of fuel oil in the 

day [and engine mounted] tanks during or following DG testing. In such a 

case, a 31 day Frequency is appropriate. Since proper operation of fuel 

transfer systems is an inherent part of DG OPERABILITY, the Frequency 

of this SR should be modified to reflect individual designs. ] 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-18 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.7

See SR 3.8.1.2. 

[ SR 3.8.1.8

Transfer of each 4.16 kV ESF bus power supply from the normal offsite 

circuit to the alternate offsite circuit demonstrates the OPERABILITY of 

the alternate circuit distribution network to power the shutdown loads. 

The [18 month] Frequency of the Surveillance is based on engineering 

judgment taking into consideration the plant conditions required to 

perform the Surveillance, and is intended to be consistent with expected 

fuel cycle lengths. Operating experience has shown that these 

components usually pass the SR when performed on the [18 month] 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint. 

This SR is modified by a Note. The reason for the Note is that, during 

operation with the reactor critical, performance of this SR could cause 

perturbations to the electrical distribution systems that could challenge 

continued steady state operation and, as a result, plant safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. ] 

Credit may be taken for unplanned events that satisfy this SR. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-19 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.9

Each DG is provided with an engine overspeed trip to prevent damage to 

the engine. Recovery from the transient caused by the loss of a large 

load could cause diesel engine overspeed, which, if excessive, might 

result in a trip of the engine. This Surveillance demonstrates the DG load 

response characteristics and capability to reject the largest single load 

without exceeding predetermined voltage and frequency and while 

maintaining a specified margin to the overspeed trip. The load referenced 

for DG 11 is the 1200 kW low pressure core spray pump; for DG 12, the 

550 kW residual heat removal (RHR) pump; and for DG 13 the 2180 kW 

HPCS pump. The Standby Service Water (SSW) pump values are not 

used as the largest load since the SSW supplies cooling to the associated 

DG. If this load were to trip, it would result in the loss of the DG. This 

Surveillance may be accomplished by: 

a. Tripping the DG output breaker with the DG carrying greater than or 

equal to its associated single largest post-accident load while 

paralleled to offsite power, or while solely supplying the bus, or 

b. Tripping its associated single largest post-accident load with the DG 

solely supplying the bus. 

As required by IEEE-308 (Ref. 13), the load rejection test is acceptable if 

the increase in diesel speed does not exceed 75% of the difference 

between synchronous speed and the overspeed trip setpoint, or 

15% above synchronous speed, whichever is lower. For the Grand Gulf 

Nuclear Station these values are the same. 

The time, voltage, and frequency tolerances specified in this SR are 

derived from Regulatory Guide 1.9 (Ref. 3) recommendations for 

response during load sequence intervals. The 3 seconds specified is 

equal to 60% of the 5 second load sequence interval associated with 

sequencing of this largest load. The voltage and frequency specified are 

consistent with the design range of the equipment powered by the DG. 

SR 3.8.1.9.a corresponds to the maximum frequency excursion, while 

SR 3.8.1.9.b and SR 3.8.1.9.c are steady state voltage and frequency 

values to which the system must recover following load rejection. The 

[18 month] Frequency is consistent with the recommendation of 

Regulatory Guide 1.108 (Ref. 9). 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-20 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR has been modified by two Notes. The reason for Note 1 is that 

during operation with the reactor critical, performance of this SR could 

cause perturbations to the electrical distribution systems that could 

challenge continued steady state operation and, as a result, plant safety 

systems. This restriction from normally performing the Surveillance in 

MODE 1 or 2 is further amplified to allow the Surveillance to be performed 

for the purpose of reestablishing OPERABILITY (e.g., post work testing 

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. Note 2 

ensures that the DG is tested under load conditions that are as close to 

design basis conditions as possible. When synchronized with offsite 

power, testing should be performed at a power factor of ≤ [0.9]. This 

power factor is representative of the actual inductive loading a DG would 

see under design basis accident conditions. Under certain conditions, 

however, Note 2 allows the surveillance to be conducted at a power factor 

other than ≤ [0.9]. These conditions occur when grid voltage is high, and 

the additional field excitation needed to get the power factor to ≤ [0.9] 

results in voltages on the emergency busses that are too high. Under 

these conditions, the power factor should be maintained as close as 

practicable to [0.9] while still maintaining acceptable voltage limits on the 

emergency busses. In other circumstances, the grid voltage may be such 

that the DG excitation levels needed to obtain a power factor of [0.9] may 

not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DG. In such 

cases, the power factor shall be maintained as close as practicable to 

[0.9] without exceeding the DG excitation limits. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-21 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable: 

a. Performance of the SR will not render any safety system or 

component inoperable, 

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and 

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems. 

-------------------------------------------------------------------------------------------------- 

SR 3.8.1.10

This Surveillance demonstrates the DG capability to reject a full load 

without overspeed tripping or exceeding the predetermined voltage limits. 

The DG full load rejection may occur because of a system fault or 

inadvertent breaker tripping. This Surveillance ensures proper engine 

generator load response under the simulated test conditions. This test 

simulates the loss of the total connected load that the DG experiences 

following a full load rejection and verifies that the DG does not trip upon 

loss of the load. These acceptance criteria provide DG damage 

protection. While the DG is not expected to experience this transient 

during an event, and continues to be available, this response ensures that 

the DG is not degraded for future application, including reconnection to 

the bus if the trip initiator can be corrected or isolated. 

In order to ensure that the DG is tested under load conditions that are as 

close to design basis conditions as possible, testing must be performed 

using a power factor ≤ [0.9]. This power factor is chosen to be 

representative of the actual design basis inductive loading that the DG 

would experience. 

The [18 month] Frequency is consistent with the recommendation of 

Regulatory Guide 1.108 (Ref. 9) and is intended to be consistent with 

expected fuel cycle lengths. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-22 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR has been modified by two Notes. The reason for Note 1 is that 

during operation with the reactor critical, performance of this SR could 

cause perturbation to the electrical distribution systems that could 

challenge continued steady state operation and, as a result, plant safety 

systems. This restriction from normally performing the Surveillance in 

MODE 1 or 2 is further amplified to allow the Surveillance to be performed 

for the purpose of reestablishing OPERABILITY (e.g., post work testing 

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable: 

a. Performance of the SR will not render any safety system or 

component inoperable, 

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and 

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems. 

-------------------------------------------------------------------------------------------------- 

Note 2 ensures that the DG is tested under load conditions that are as 

close to design basis conditions as possible. When synchronized with 

offsite power, testing should be performed at a power factor of ≤ [0.9]. 

This power factor is representative of the actual inductive loading a DG 

would see under design basis accident conditions. Under certain 

conditions, however, Note 2 allows the Surveillance to be conducted at a 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-23 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

power factor other than ≤ [0.9]. These conditions occur when grid voltage 

is high, and the additional field excitation needed to get the power factor 

to ≤ [0.9] results in voltages on the emergency busses that are too high. 

Under these conditions, the power factor should be maintained as close 

as practicable to [0.9] while still maintaining acceptable voltage limits on 

the emergency busses. In other circumstances, the grid voltage may be 

such that the DG excitation levels needed to obtain a power factor of [0.9] 

may not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DG. In such 

cases, the power factor shall be maintained as close to practicable to 

[0.9] without exceeding the DG excitation limits. 

SR 3.8.1.11

As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), this 

Surveillance demonstrates the as designed operation of the standby 

power sources during loss of the offsite source. This test verifies all 

actions encountered from the loss of offsite power, including shedding of 

the nonessential loads and energization of the emergency buses and 

respective loads from the DG. It further demonstrates the capability of 

the DG to automatically achieve the required voltage and frequency within 

the specified time. 

The DG auto-start time of 10 seconds is derived from requirements of the 

accident analysis to respond to a design basis large break LOCA. The 

Surveillance should be continued for a minimum of 5 minutes in order to 

demonstrate that all starting transients have decayed and stability has 

been achieved. 

The requirement to verify the connection and power supply of permanent 

and auto-connected loads is intended to satisfactorily show the 

relationship of these loads to the DG loading logic. In certain 

circumstances, many of these loads cannot actually be connected or 

loaded without undue hardship or potential for undesired operation. For 

instance, ECCS injection valves are not desired to be stroked open, 

systems are not capable of being operated at full flow, or RHR systems 

performing a decay heat removal function are not desired to be realigned 

to the ECCS mode of operation. In lieu of actual demonstration of the 

connection and loading of these loads, testing that adequately shows the 

capability of the DG system to perform these functions is acceptable. 

This testing may include any series of sequential, overlapping, or total 

steps so that the entire connection and loading sequence is verified. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-24 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), takes into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths. 

This SR is modified by two Notes. The reason for Note 1 is to minimize 

wear and tear on the DGs during testing. For the purpose of this testing, 

the DGs must be started from standby conditions, that is, with the engine 

coolant and oil being continuously circulated and temperature maintained 

consistent with manufacturer recommendations for [Division 1 and 2] 

DGs. [For the [Division 3] DG, standby conditions mean that the lube oil 

is heated and continuously circulated through a portion of the system as 

recommended by the vendor. Engine jacket water is heated by the 

lubricating oil and circulates through the system by natural circulation.] 

The reason for Note 2 is that performing the Surveillance would remove a 

required offsite circuit from service, perturb the electrical distribution 

system, and challenge plant safety systems. This restriction from 

normally performing the Surveillance in MODE 1 or 2 is further amplified 

to allow portions of the Surveillance to be performed for the purpose of 

reestablishing OPERABILITY (e.g., post work testing following corrective 

maintenance, corrective modification, deficient or incomplete surveillance 

testing, and other unanticipated OPERABILITY concerns) provided an 

assessment determines plant safety is maintained or enhanced. This 

assessment shall, as a minimum, consider the potential outcomes and 

transients associated with a failed partial Surveillance, a successful 

partial Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the partial 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when portions of the Surveillance are performed in MODE 1 or 

2. Risk insights or deterministic methods may be used for the 

assessment. Credit may be taken for unplanned events that satisfy this 

SR. 

[ SR 3.8.1.12

This Surveillance demonstrates that the DG automatically starts and 

achieves the required voltage and frequency within the specified time 

([10] seconds) from the design basis actuation signal (LOCA signal) and 

operates for ≥ [5] minutes. The [5] minute period provides sufficient time 

to demonstrate stability. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that 

permanently connected loads and emergency loads are energized from 

the offsite electrical power system on an ECCS signal without loss of 

offsite power. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-25 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The requirement to verify the connection and power supply of permanent 

and autoconnected loads is intended to satisfactorily show the 

relationship of these loads to the loading logic for loading onto offsite 

power. In certain circumstances, many of these loads cannot actually be 

connected or loaded without undue hardship or potential for undesired 

operation. For instance, ECCS injection valves are not desired to be 

stroked open, high pressure injection systems are not capable of being 

operated at full flow, or RHR systems performing a decay heat removal 

function are not desired to be realigned to the ECCS mode of operation. 

In lieu of actual demonstration of the connection and loading of these 

loads, testing that adequately shows the capability of the DG system to 

perform these functions is acceptable. This testing may include any 

series of sequential, overlapping, or total steps so that the entire 

connection and loading sequence is verified. 

The Frequency of [18 months] takes into consideration plant conditions 

required to perform the Surveillance and is intended to be consistent with 

the expected fuel cycle lengths. Operating experience has shown that 

these components usually pass the SR when performed at the [18 month] 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint. 

This SR is modified by two Notes. The reason for the Note 1 is to 

minimize wear and tear on the DGs during testing. For the purpose of 

this testing, the DGs must be started from standby conditions, that is, with 

the engine coolant and oil being continuously circulated and temperature 

maintained consistent with manufacturer recommendations. The reason 

for Note 2 is that during operation with the reactor critical, performance of 

this SR could cause perturbations to the electrical distribution systems 

that could challenge continued steady state operation and, as a result, 

plant safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-26 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR. ]

SR 3.8.1.13

This Surveillance demonstrates that DG non-critical protective functions 

(e.g., high jacket water temperature) are bypassed on a loss of voltage 

signal concurrent with an ECCS initiation test signal. The non-critical trips 

are bypassed during DBAs and provide an alarm on an abnormal engine 

condition. This alarm provides the operator with sufficient time to react 

appropriately. The DG availability to mitigate the DBA is more critical 

than protecting the engine against minor problems that are not 

immediately detrimental to emergency operation of the DG. 

The [18 month] Frequency is based on engineering judgment, taking into 

consideration plant conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths. Operating 

experience has shown that these components usually pass the SR when 

performed at the [18 month] Frequency. Therefore, the Frequency was 

concluded to be acceptable from a reliability standpoint. 

The SR is modified by a Note. The reason for the Note is that performing 

the Surveillance removes a required DG from service. This restriction 

from normally performing the Surveillance in MODE 1 or 2 is further 

amplified to allow the Surveillance to be performed for the purpose of 

reestablishing OPERABILITY (e.g., post work testing following corrective 

maintenance, corrective modification, deficient or incomplete surveillance 

testing, and other unanticipated OPERABILITY concerns) provided an 

assessment determines plant safety is maintained or enhanced. This 

assessment shall, as a minimum, consider the potential outcomes and 

transients associated with a failed Surveillance, a successful 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the Surveillance; as well 

as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when the Surveillance is performed in MODE 1 or 2. Risk insights or 

deterministic methods may be used for this assessment. Credit may be 

taken for unplanned events that satisfy this SR. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-27 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable: 

a. Performance of the SR will not render any safety system or 

component inoperable, 

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and 

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems. 

-------------------------------------------------------------------------------------------------- 

SR 3.8.1.14

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3), requires 

demonstration once per 18 months that the DGs can start and run 

continuously at full load capability for an interval of not less than 24 hours 

- 22 hours of which is at a load equivalent to the continuous rating of the 

DG, and 2 hours of which is at a load equivalent to 110% of the 

continuous duty rating of the DG. The DG starts for this Surveillance can 

be performed either from standby or hot conditions. The provisions for 

prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, 

discussed in SR 3.8.1.3, are applicable to this SR. 

In order to ensure that the DG is tested under load conditions that are as 

close to design conditions as possible, testing must be performed using a 

power factor ≤ [0.9]. This power factor is chosen to be representative of 

the actual design basis inductive loading that the DG could experience. 

The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3); takes into 

consideration plant conditions required to perform the Surveillance; and is 

intended to be consistent with expected fuel cycle lengths. 

This Surveillance is modified by three Notes. Note 1 states that 

momentary transients due to changing bus loads do not invalidate this 

test. The load band is provided to avoid routine overloading of the DG. 

Routine overloading may result in more frequent teardown inspections in 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-28 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

accordance with vendor recommendations in order to maintain DG 

OPERABILITY. Similarly, momentary power factor transients above the 

limit do not invalidate the test. The reason for Note 2 is that during 

operation with the reactor critical, performance of this SR could cause 

perturbations to the electrical distribution systems that would challenge 

continued steady state operation and, as a result, plant safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g. post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. Note 3 

ensures that the DG is tested under load conditions that are as close to 

design basis conditions as possible. When synchronized with offsite 

power, testing should be performed at a power factor of ≤ [0.9]. This 

power factor is representative of the actual inductive loading a DG would 

see under design basis accident conditions. Under certain conditions, 

however, Note 3 allows the surveillance to be conducted at a power factor 

other than ≤ [0.9]. These conditions occur when grid voltage is high, and 

the additional field excitation needed to get the power factor to ≤ [0.9] 

results in voltages on the emergency busses that are too high. Under 

these conditions, the power factor should be maintained as close as 

practicable to [0.9] while still maintaining acceptable voltage limits on the 

emergency busses. In other circumstances, the grid voltage may be such 

that the DG excitation levels needed to obtain a power factor of [0.9] may 

not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DG. In such 

cases, the power factor shall be maintained as close as practicable to 

[0.9] without exceeding the DG excitation limits. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-29 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.15

This Surveillance demonstrates that the diesel engine can restart from a 

hot condition, such as subsequent to shutdown from normal 

Surveillances, and achieve the required voltage and frequency within 

10 seconds. The 10 second time is derived from the requirements of the 

accident analysis to respond to a design basis large break LOCA. 

The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(5). 

This SR has been modified by two Notes. Note 1 ensures that the test is 

performed with the diesel sufficiently hot. The requirement that the diesel 

has operated for at least 2 hours at full load conditions prior to 

performance of this Surveillance is based on manufacturer 

recommendations for achieving hot conditions. The load band is provided 

to avoid routine overloading of the DG. Routine overloads may result in 

more frequent teardown inspections in accordance with vendor 

recommendations in order to maintain DG OPERABILITY. Momentary 

transients due to changing bus loads do not invalidate this test. Note 2 

allows all DG starts to be preceded by an engine prelube period to 

minimize wear and tear on the diesel during testing. 

SR 3.8.1.16

As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), this 

Surveillance ensures that the manual synchronization and automatic load 

transfer from the DG to the offsite source can be made and that the DG 

can be returned to ready-to-load status when offsite power is restored. It 

also ensures that the auto-start logic is reset to allow the DG to reload if a 

subsequent loss of offsite power occurs. The DG is considered to be in 

ready-to-load status when the DG is at rated speed and voltage, the 

output breaker is open and can receive an auto-close signal on bus 

undervoltage, and the load sequence timers are reset. 

The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.1.(6), and takes into 

consideration plant conditions required to perform the Surveillance. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-30 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required offsite circuit from service, 

perturb the electrical distribution system, and challenge safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. 

SR 3.8.1.17

Demonstration of the test mode override ensures that the DG availability 

under accident conditions is not compromised as the result of testing. 

Interlocks to the LOCA sensing circuits cause the DG to automatically 

reset to ready-to-load operation if an ECCS initiation signal is received 

during operation in the test mode. Ready-to-load operation is defined as 

the DG running at rated speed and voltage with the DG output breaker 

open. These provisions for automatic switchover are required by 

IEEE-308 (Ref. 13), paragraph 6.2.6(2). 

The requirement to automatically energize the emergency loads with 

offsite power is essentially identical to that of SR 3.8.1.12. The intent in 

the requirement associated with SR 3.8.1.17.b is to show that the 

emergency loading is not affected by the DG operation in test mode. In 

lieu of actual demonstration of connection and loading of loads, testing 

that adequately shows the capability of the emergency loads to perform 

these functions is acceptable. This testing may include any series of 

sequential, overlapping, or total steps so that the entire connection and 

loading sequence is verified. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-31 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(8); takes into 

consideration plant conditions required to perform the Surveillance; and is 

intended to be consistent with expected fuel cycle lengths. 

This SR has been modified by a Note. The reason for the Note is that 

performing the Surveillance would remove a required offsite circuit from 

service, perturb the electrical distribution system, and challenge safety 

systems. This restriction from normally performing the Surveillance in 

MODE 1 or 2 is further amplified to allow portions of the Surveillance to 

be performed for the purpose of reestablishing OPERABILITY (e.g., post 

work testing following corrective maintenance, corrective modification, 

deficient or incomplete surveillance testing, and other unanticipated 

OPERABILITY concerns) provided an assessment determines plant 

safety is maintained or enhanced. This assessment shall, as a minimum, 

consider the potential outcomes and transients associated with a failed 

partial Surveillance, a successful partial Surveillance, and a perturbation 

of the offsite or onsite system when they are tied together or operated 

independently for the partial Surveillance; as well as the operator 

procedures available to cope with these outcomes. These shall be 

measured against the avoided risk of a plant shutdown and startup to 

determine that plant safety is maintained or enhanced when portions of 

the Surveillance are performed in MODE 1 or 2. Risk insights or 

deterministic methods may be used for the assessment. Credit may be 

taken for unplanned events that satisfy this SR. 

SR 3.8.1.18

Under accident conditions [and loss of offsite power] loads are 

sequentially connected to the bus by the load sequencing panel. The 

sequencing logic controls the permissive and starting signals to motor 

breakers to prevent overloading of the DGs due to high motor starting 

currents. The [10]% load sequence time interval tolerance ensures that 

sufficient time exists for the DG to restore frequency and voltage prior to 

applying the next load and that safety analysis assumptions regarding 

ESF equipment time delays are not violated. Reference 2 provides a 

summary of the automatic loading of ESF buses. 

The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(2); takes into 

consideration plant conditions required to perform the Surveillance; and is 

intended to be consistent with expected fuel cycle lengths. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-32 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance during these MODES would remove a required offsite 

circuit from service, perturb the electrical distribution system, and 

challenge plant safety systems. This restriction from normally performing 

the Surveillance in MODE 1 or 2 is further amplified to allow the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed Surveillance, a successful Surveillance, and a 

perturbation of the offsite or onsite system when they are tied together or 

operated independently for the Surveillance; as well as the operator 

procedures available to cope with these outcomes. These shall be 

measured against the avoided risk of a plant shutdown and startup to 

determine that plant safety is maintained or enhanced when the 

Surveillance is performed in MODE 1 or 2. Risk insights or deterministic 

methods may be used for this assessment. Credit may be taken for 

unplanned events that satisfy this SR. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable: 

a. Performance of the SR will not render any safety system or 

component inoperable, 

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and 

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems. 

-------------------------------------------------------------------------------------------------- 

SR 3.8.1.19

In the event of a DBA coincident with a loss of offsite power, the DGs are 

required to supply the necessary power to ESF systems so that the fuel, 

RCS, and containment design limits are not exceeded. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-33 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This Surveillance demonstrates the DG operation, as discussed in the 

Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal 

in conjunction with an ECCS initiation signal. In lieu of actual 

demonstration of connection and loading of loads, testing that adequately 

shows the capability of the DG system to perform these functions is 

acceptable. This testing may include any series of sequential, 

overlapping, or total steps so that the entire connection and loading 

sequence is verified. 

The Frequency of [18 months] takes into consideration plant conditions 

required to perform the Surveillance and is intended to be consistent with 

an expected fuel cycle length of [18 months]. 

This SR is modified by two Notes. The reason for Note 1 is to minimize 

wear and tear on the DGs during testing. For the purpose of this testing, 

the DGs must be started from standby conditions, that is, with the engine 

coolant and oil being continuously circulated and temperature maintained 

consistent with manufacturer recommendations. The reason for Note 2 is 

that performing the Surveillance would remove a required offsite circuit 

from service, perturb the electrical distribution system, and challenge 

plant safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR. 
AC Sources - Operating 

B 3.8.1 

BWR/6 STS B 3.8.1-34 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.1.20

This Surveillance demonstrates that the DG starting independence has 

not been compromised. Also, this Surveillance demonstrates that each 

engine can achieve proper speed within the specified time when the DGs 

are started simultaneously. 

The 10 year Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9). 

This SR is modified by a Note. The reason for the Note is to minimize 

wear on the DG during testing. For the purpose of this testing, the DGs 

must be started from standby conditions, that is, with the engine coolant 

and oil continuously circulated and temperature maintained consistent 

with manufacturer recommendations. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17. 

 2. FSAR, Chapter [8]. 

 3. Regulatory Guide 1.9. 

 4. FSAR, Chapter [6]. 

 5. FSAR, Chapter [15]. 

 6. Regulatory Guide 1.93. 

 7. Generic Letter 84-15, July 2, 1984. 

 8. 10 CFR 50, Appendix A, GDC 18. 

 9. Regulatory Guide 1.108. 

 10. Regulatory Guide 1.137. 

 11. ANSI C84.1, 1982. 

 12. ASME, Boiler and Pressure Vessel Code, Section XI. 

 13. IEEE Standard 308. 
AC Sources - Shutdown 

B 3.8.2 

BWR/6 STS B 3.8.2-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.2 AC Sources - Shutdown 

BASES 

BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, 

"AC Sources - Operating." 

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 4 and 5 

SAFETY and during movement of [recently] irradiated fuel assemblies ensures 

ANALYSES that: 

a. The unit can be maintained in the shutdown or refueling condition for 

extended periods, 

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and 

c. Adequate AC electrical power is provided to mitigate events 

postulated during shutdown, such as an inadvertent draindown of the 

vessel or a fuel handling accident [involving handling recently 

irradiated fuel. Due to radioactive decay, AC electrical power is only 

required to mitigate fuel handling accidents involving handling 

recently irradiated fuel (i.e., fuel that has occupied part of a critical 

reactor core within the previous [X] days)]. 

In general, when the unit is shut down the Technical Specifications (TS) 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or loss of all onsite power is not 

required. The rationale for this is based on the fact that many Design 

Basis Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no 

specific analyses in MODES 4 and 5. Worst case bounding events are 

deemed not credible in MODES 4 and 5 because the energy contained 

within the reactor pressure boundary, reactor coolant temperature and 

pressure, and the corresponding stresses result in the probabilities of 

occurrence significantly reduced or eliminated, and minimal 

consequences. These deviations from DBA analysis assumptions and 

design requirements during shutdown conditions are allowed by the LCO 

for required systems. 

During MODES 1, 2, and 3, various deviations from the analysis 

assumptions and design requirements are allowed within the ACTIONS. 

This allowance is in recognition that certain testing and maintenance 
AC Sources - Shutdown 

B 3.8.2 

BWR/6 STS B 3.8.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

activities must be conducted provided an acceptable level of risk is not 

exceeded. During MODES 4 and 5, performance of a significant number 

of required testing and maintenance activities is also required. In 

MODES 4 and 5, the activities are generally planned and administratively 

controlled. Relaxations from typical MODE 1, 2, and 3 LCO requirements 

are acceptable during shutdown MODES based on: 

a. The fact that time in an outage is limited. This is a risk prudent goal 

as well as utility economic consideration. 

b. Requiring appropriate compensatory measures for certain conditions. 

These may include administrative controls, reliance on systems that 

do not necessarily meet typical design requirements applied to 

systems credited in operating MODE analyses, or both. 

c. Prudent utility consideration of the risk associated with multiple 

activities that could affect multiple systems. 

d. Maintaining, to the extent practical, the ability to perform required 

functions (even if not meeting MODE 1, 2, and 3 OPERABILITY 

requirements) with systems assumed to function during an event. 

In the event of an accident during shutdown, this LCO ensures the 

capability of supporting systems necessary to avoid immediate difficulty, 

assuming either a loss of all offsite power or a loss of all onsite (diesel 

generator (DG)) power. 

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO One offsite circuit capable of supplying onsite Class 1E power distribution 

subsystem(s) of LCO 3.8.10, "Distribution Systems - Shutdown," ensures 

that all required Division 1 loads, Division 2 loads, or both, are powered 

from offsite power. An OPERABLE DG, associated with a Division 1 or 

Division 2 Distribution System Engineered Safety Feature (ESF) bus 

required OPERABLE by LCO 3.8.10, ensures a diverse power source is 

available to provide electrical power support, assuming a loss of the 

offsite circuit. Similarly, when the high pressure core spray (HPCS) is 

required to be OPERABLE, a separate offsite circuit to the Division 3 

Class 1E onsite electrical power distribution subsystem, or an 

OPERABLE Division 3 DG, ensures an additional source of power for the 

HPCS. This additional source for Division 3 is not necessarily required to 

be connected to be OPERABLE. Either the circuit required by LCO 
AC Sources - Shutdown 

B 3.8.2 

BWR/6 STS B 3.8.2-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Item a., or a circuit required to meet LCO Item c. may be connected, with 

the second source available for connection. Together, OPERABILITY of 

the required offsite circuit(s) and DG(s) ensure the availability of sufficient 

AC sources to operate the plant in a safe manner and to mitigate the 

consequences of postulated events during shutdown (e.g., fuel handling 

accidents [involving handling recently irradiated fuel], reactor vessel 

draindown). Automatic initiation of the required DG during shutdown 

conditions is specified in LCO 3.3.5.1, “ECCS Instrumentation,” and 

LCO 3.3.8.1, “LOP Instrumentation.” 

The qualified offsite circuit(s) must be capable of maintaining rated 

frequency and voltage while connected to their respective ESF bus(es), 

and of accepting required loads during an accident. Qualified offsite 

circuits are those that are described in the FSAR and are part of the 

licensing basis for the plant. [The offsite circuit consists of incoming 

breaker and disconnect to the respective service transformers 11 and 21, 

the 11 and 21 service transformers, the ESF transformers 11 and 21, and 

the respective circuit path including feeder breakers to all 4.16 kV ESF 

buses required by LCO 3.8.10.] 

The required DG must be capable of starting, accelerating to rated speed 

and voltage, and connecting to its respective ESF bus on detection of bus 

undervoltage, and accepting required loads. This sequence must be 

accomplished within [10] seconds. Each DG must also be capable of 

accepting required loads within the assumed loading sequence intervals, 

and must continue to operate until offsite power can be restored to the 

ESF buses. These capabilities are required to be met from a variety of 

initial conditions such as: DG in standby with the engine hot and DG in 

standby with the engine at ambient conditions. Additional DG capabilities 

must be demonstrated to meet required Surveillances, e.g., capability of 

the DG to revert to standby status on an ECCS signal while operating in 

parallel test mode. 

Proper sequencing of loads, including tripping of nonessential loads, is a 

required function for DG OPERABILITY. [In addition, proper sequencer 

operation is an integral part of offsite circuit OPERABILITY since its 

inoperability impacts on the ability to start and maintain energized loads 

required OPERABLE by LCO 3.8.10.] 

It is acceptable for divisions to be cross tied during shutdown conditions, 

permitting a single offsite power circuit to supply all required divisions. 

[No fast transfer capability is required for offsite circuits to be considered 

OPERABLE.] 
AC Sources - Shutdown 

B 3.8.2 

BWR/6 STS B 3.8.2-4 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

As described in Applicable Safety Analyses, in the event of an accident 

during shutdown, the TS are designed to maintain the plant in a condition 

such that, even with a single failure, the plant will not be in immediate 

difficulty. 

APPLICABILITY The AC sources required to be OPERABLE in MODES 4 and 5 and 

during movement of [recently] irradiated fuel assemblies in the [primary or 

secondary] containment provide assurance that: 

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel in the core in case of an inadvertent draindown 

of the reactor vessel, 

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available, 

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and 

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition. 

The AC power requirements for MODES 1, 2, and 3 are covered in 

LCO 3.8.1. 

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, or 3, the fuel movement is independent 

of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, or 3 

would require the unit to be shutdown unnecessarily. 

A.1

An offsite circuit is considered inoperable if it is not available to one 

required ESF division. If two or more ESF 4.16 kV buses are required per 

LCO 3.8.10, division(s) with offsite power available may be capable of 

supporting sufficient required features to allow continuation of CORE 
AC Sources - Shutdown 

B 3.8.2 

BWR/6 STS B 3.8.2-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

ALTERATIONS, [recently] irradiated fuel movement, and operations with 

a potential for draining the reactor vessel. By the allowance of the option 

to declare required features inoperable with no offsite power available, 

appropriate restrictions can be implemented in accordance with the 

affected required feature(s) LCOs' ACTIONS. 

A.2.1, A.2.2, A.2.3, A.2.4, B.1, B.2, B.3, and B.4

With the offsite circuit not available to all required divisions, the option still 

exists to declare all required features inoperable. Since this option may 

involve undesired administrative efforts, the allowance for sufficiently 

conservative actions is made. With the required DG inoperable, the 

minimum required diversity of AC power sources is not available. It is, 

therefore, required to suspend CORE ALTERATIONS, movement of 

[recently] irradiated fuel assemblies in the [primary or secondary 

containment], and activities that could potentially result in inadvertent 

draining of the reactor vessel. 

Suspension of these activities shall not preclude completion of actions to 

establish a safe conservative condition. These actions minimize 

probability of the occurrence of postulated events. It is further required to 

initiate action immediately to restore the required AC sources and to 

continue this action until restoration is accomplished in order to provide 

the necessary AC power to the plant safety systems. 

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required AC 

electrical power sources should be completed as quickly as possible in 

order to minimize the time during which the plant safety systems may be 

without sufficient power. 

Pursuant to LCO 3.0.6, the Distribution System ACTIONS are not entered 

even if all AC sources to it are inoperable, resulting in de-energization. 

Therefore, the Required Actions of Condition A have been modified by a 

Note to indicate that when Condition A is entered with no AC power to 

any required ESF bus, ACTIONS for LCO 3.8.10 must be immediately 

entered. This Note allows Condition A to provide requirements for the 

loss of the offsite circuit whether or not a division is de-energized. 

LCO 3.8.10 provides the appropriate restrictions for the situation involving 

a de-energized division. 
AC Sources - Shutdown 

B 3.8.2 

BWR/6 STS B 3.8.2-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

When the HPCS is required to be OPERABLE, and the additional 

required Division 3 AC source is inoperable, the required diversity of AC 

power sources to the HPCS is not available. Since these sources only 

affect the HPCS, the HPCS is declared inoperable and the Required 

Actions of the affected Emergency Core Cooling Systems LCO entered. 

In the event all sources of power to Division 3 are lost, Condition A will 

also be entered and direct that the ACTIONS of LCO 3.8.10 be taken. If 

only the Division 3 additional required AC source is inoperable, and 

power is still supplied to HPCS, 72 hours is allowed to restore the 

additional required AC source to OPERABLE. This is reasonable 

considering HPCS will still perform its function, absent an additional 

single failure. 

SURVEILLANCE SR 3.8.2.1

REQUIREMENTS 

SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for 

ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 

and 3. SR 3.8.1.8 is not required to be met since only one offsite circuit is 

required to be OPERABLE. SR 3.8.1.17 is not required to be met 

because the required OPERABLE DG(s) is not required to undergo 

periods of being synchronized to the offsite circuit. SR 3.8.1.20 is 

excepted because starting independence is not required with the DG(s) 

that is not required to be OPERABLE. Refer to the corresponding Bases 

for LCO 3.8.1 for a discussion of each SR. 

This SR is modified by two Notes. The reason for Note 1 is to preclude 

requiring the OPERABLE DG(s) from being paralleled with the offsite 

power network or otherwise rendered inoperable during the performance 

of SRs. With limited AC sources available, a single event could 

compromise both the required circuit and the DG, and to preclude 

deenergizing a required 4160 V ESF bus or disconnecting a required 

offsite circuit during performance of SRs. It is the intent that these SRs 

must still be capable of being met, but actual performance is not required 

during periods when the DG and offsite circuit is required to be 

OPERABLE. Note 2 states that SRs 3.8.1.12 and 3.8.1.19 are not 
AC Sources - Shutdown 

B 3.8.2 

BWR/6 STS B 3.8.2-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

required to be met when its associated ECCS subsystem(s) are not 

required to be OPERABLE. These SRs demonstrate the DG response to 

an ECCS signal (either alone or in conjunction with a loss-of-power 

signal). This is consistent with the ECCS instrumentation requirements 

that do not require the ECCS signals when the ECCS System is not 

required to be OPERABLE per LCO 3.5.2, "ECCS-Shutdown." 

REFERENCES None. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWR/6 STS B 3.8.3-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air 

BASES 

BACKGROUND Each diesel generator (DG) is provided with a storage tank having a fuel 

oil capacity sufficient to operate that DG for a period of 7 days while the 

DG is supplying maximum post loss of coolant accident load demand 

(Ref. 1). The maximum load demand is calculated using the assumption 

that at least two DGs are available. This onsite fuel oil capacity is 

sufficient to operate the DGs for longer than the time to replenish the 

onsite supply from outside sources. 

Fuel oil is transferred from each storage tank to its respective day tank by 

a transfer pump associated with each storage tank. Redundancy of 

pumps and piping precludes the failure of one pump, or the rupture of any 

pipe, valve, or tank to result in the loss of more than one DG. All outside 

tanks, pumps, and piping are located underground. The fuel oil level in 

the storage tank is indicated in the control room. 

For proper operation of the standby DGs, it is necessary to ensure the 

proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses 

the recommended fuel oil practices as supplemented by ANSI N195 

(Ref. 3). The fuel oil properties governed by these SRs are the water and 

sediment content, the kinematic viscosity, specific gravity (or API gravity), 

and impurity level. 

The DG lubrication system is designed to provide sufficient lubrication to 

permit proper operation of its associated DG under all loading conditions. 

The system is required to circulate the lube oil to the diesel engine 

working surfaces and to remove excess heat generated by friction during 

operation. Each engine oil sump contains an inventory capable of 

supporting a minimum of [7] days of operation. [The onsite storage in 

addition to the engine oil sump is sufficient to ensure 7 days continuous 

operation.] This supply is sufficient to allow the operator to replenish lube 

oil from outside sources. 

Each DG has an air start system with adequate capacity for five 

successive start attempts on the DG without recharging the air start 

receiver(s). 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWR/6 STS B 3.8.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in FSAR, Chapter [6] (Ref. 4) and Chapter [15] (Ref. 5), 

ANALYSES assume Engineered Safety Feature (ESF) systems are OPERABLE. The 

DGs are designed to provide sufficient capacity, capability, redundancy, 

and reliability to ensure the availability of necessary power to ESF 

systems so that fuel, reactor coolant system, and containment design 

limits are not exceeded. These limits are discussed in more detail in the 

Bases for Section 3.2, Power Distribution Limits; Section 3.4, Reactor 

Coolant System (RCS); and Section 3.6, Containment Systems. 

Since diesel fuel oil, lube oil, and starting air subsystem support the 

operation of the standby AC power sources, they satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Stored diesel fuel oil is required to have sufficient supply for 7 days of full 

load operation. It is also required to meet specific standards for quality. 

Additionally, sufficient lube oil supply must be available to ensure the 

capability to operate at full load for 7 days. This requirement, in 

conjunction with an ability to obtain replacement supplies within 7 days, 

supports the availability of DGs required to shut down the reactor and to 

maintain it in a safe condition for an anticipated operational occurrence 

(AOO) or a postulated DBA with loss of offsite power. DG day tank fuel 

requirements, as well as transfer capability from the storage tank to the 

day tank, are addressed in LCO 3.8.1, "AC Sources - Operating," and 

LCO 3.8.2, "AC Sources - Shutdown." 

The starting air system is required to have a minimum capacity for five 

successive DG start attempts without recharging the air start receivers. 

APPLICABILITY The AC sources, LCO 3.8.1 and LCO 3.8.2, are required to ensure the 

availability of the required power to shut down the reactor and maintain it 

in a safe shutdown condition after an AOO or a postulated DBA. Since 

stored diesel fuel oil, lube oil, and starting air subsystem support 

LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, lube oil, and starting air 

are required to be within limits when the associated DG is required to be 

OPERABLE. 

ACTIONS The ACTIONS Table is modified by a Note indicating that separate 

Condition entry is allowed for each DG. This is acceptable, since the 

Required Actions for each Condition provide appropriate compensatory 

actions for each inoperable DG subsystem. Complying with the Required 

Actions for one inoperable DG subsystem may allow for continued 

operation, and subsequent inoperable DG subsystem(s) are governed by 

separate Condition entry and application of associated Required Actions. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWR/6 STS B 3.8.3-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

In this Condition, the 7 day fuel oil supply for a DG is not available. 

However, the Condition is restricted to fuel oil level reductions that 

maintain at least a 6 day supply. These circumstances may be caused by 

events such as: 

a. Full load operation required after an inadvertent start while at 

minimum required level, or 

b. Feed and bleed operations that may be necessitated by increasing 

particulate levels or any number of other oil quality degradations. 

This restriction allows sufficient time for obtaining the requisite 

replacement volume and performing the analyses required prior to 

addition of the fuel oil to the tank. A period of 48 hours is considered 

sufficient to complete restoration of the required level prior to declaring 

the DG inoperable. This period is acceptable based on the remaining 

capacity (> 6 days), the fact that procedures will be initiated to obtain 

replenishment, and the low probability of an event during this brief period. 

B.1

With lube oil inventory < 500 gal, sufficient lube oil to support 7 days of 

continuous DG operation at full load conditions may not be available. 

However, the Condition is restricted to lube oil volume reductions that 

maintain at least a 6 day supply. This restriction allows sufficient time for 

obtaining the requisite replacement volume. A period of 48 hours is 

considered sufficient to complete restoration of the required volume prior 

to declaring the DG inoperable. This period is acceptable based on the 

remaining capacity (> 6 days), the low rate of usage, the fact that 

procedures will be initiated to obtain replenishment, and the low 

probability of an event during this brief period. 

C.1

This Condition is entered as a result of a failure to meet the acceptance 

criterion for particulates. Normally, trending of particulate levels allows 

sufficient time to correct high particulate levels prior to reaching the limit 

of acceptability. Poor sample procedures (bottom sampling), 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWR/6 STS B 3.8.3-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

contaminated sampling equipment, and errors in laboratory analysis can 

produce failures that do not follow a trend. Since the presence of 

particulate does not mean failure of the fuel oil to burn properly in the 

diesel engine, since particulate concentration is unlikely to change 

significantly between Surveillance Frequency intervals, and since proper 

engine performance has been recently demonstrated (within 31 days), it 

is prudent to allow a brief period prior to declaring the associated DG 

inoperable. The 7 day Completion Time allows for further evaluation, 

resampling, and re-analysis of the DG fuel oil. 

D.1

With the new fuel oil properties defined in the Bases for SR 3.8.3.3 not 

within the required limits, a period of 30 days is allowed for restoring the 

stored fuel oil properties. This period provides sufficient time to test the 

stored fuel oil to determine that the new fuel oil, when mixed with 

previously stored fuel oil, remains acceptable, to restore the stored fuel oil 

properties. This restoration may involve feed and bleed procedures, 

filtering, or a combination of these procedures. Even if a DG start and 

load was required during this time interval and the fuel oil properties were 

outside limits, there is high likelihood that the DG would still be capable of 

performing its intended function. 

E.1

With starting air receiver pressure < [225] psig, sufficient capacity for five 

successive DG start attempts does not exist. However, as long as the 

receiver pressure is > [125] psig, there is adequate capacity for at least 

one start attempt, and the DG can be considered OPERABLE while the 

air receiver pressure is restored to the required limit. A period of 48 hours 

is considered sufficient to complete restoration to the required pressure 

prior to declaring the DG inoperable. This period is acceptable based on 

the remaining air start capacity, the fact that most DG starts are 

accomplished on the first attempt, and the low probability of an event 

during this brief period. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWR/6 STS B 3.8.3-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

F.1

With a Required Action and associated Completion Time not met, or the 

stored diesel fuel oil, lube oil, or starting air subsystem not within limits for 

reasons other than addressed by Conditions A through E, the associated 

DG may be incapable of performing its intended function and must be 

immediately declared inoperable. 

SURVEILLANCE SR 3.8.3.1

REQUIREMENTS 

This SR provides verification that there is an adequate inventory of fuel oil 

in the storage tanks to support each DG's operation for 7 days at full load. 

The 7 day period is sufficient time to place the unit in a safe shutdown 

condition and to bring in replenishment fuel from an offsite location. 

The 31 day Frequency is adequate to ensure that a sufficient supply of 

fuel oil is available, since low level alarms are provided and unit operators 

would be aware of any large uses of fuel oil during this period. 

SR 3.8.3.2

This Surveillance ensures that sufficient lube oil inventory is available to 

support at least 7 days of full load operation for each DG. The 500 gal 

requirement is based on the DG manufacturer's consumption values for 

the run time of the DG. Implicit in this SR is the requirement to verify the 

capability to transfer the lube oil from its storage location to the DG when 

the DG lube oil sump does not hold adequate inventory for 7 days of full 

load operation without the level reaching the manufacturer's 

recommended minimum level. 

A 31 day Frequency is adequate to ensure that a sufficient lube oil supply 

is onsite, since DG starts and run times are closely monitored by the plant 

staff. 

SR 3.8.3.3

The tests listed below are a means of determining whether new fuel oil is 

of the appropriate grade and has not been contaminated with substances 

that would have an immediate detrimental impact on diesel engine 

combustion and operation. If results from these tests are within 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWR/6 STS B 3.8.3-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

acceptable limits, the fuel oil may be added to the storage tanks without 

concern for contaminating the entire volume of fuel oil in the storage 

tanks. These tests are to be conducted prior to adding the new fuel to the 

storage tank(s), but in no case is the time between receipt of new fuel and 

conducting the tests to exceed 31 days. The tests, limits, and applicable 

ASTM Standards are as follows: 

a. Sample the new fuel oil in accordance with ASTM D4057-[ ] 

(Ref. 6), 

b. Verify in accordance with the tests specified in ASTM D975-[ ] 

(Ref. 6) that the sample has an absolute specific gravity at 60/60°F of 

≥ 0.83 and ≤ 0.89 or an API gravity at 60°F of ≥ 27° and ≤ 39° when 

tested in accordance with ASTM D1298-[ ] (Ref. 6), a kinematic 

viscosity at 40°C of ≥ 1.9 centistokes and ≤ 4.1 centistokes, and a 

flash point of ≥ 125°F, and 

c. Verify that the new fuel oil has a clear and bright appearance with 

proper color when tested in accordance with ASTM D4176-[ ] or a 

water and sediment content within limits when tested in accordance 

with [ASTM D2709-[ ]] (Ref. 6). 

Failure to meet any of the above limits is cause for rejecting the new fuel 

oil, but does not represent a failure to meet the LCO since the fuel oil is 

not added to the storage tanks. 

Within 31 days following the initial new fuel oil sample, the fuel oil is 

analyzed to establish that the other properties specified in Table 1 of 

ASTM D975-[ ] (Ref. 6) are met for new fuel oil when tested in 

accordance with ASTM D975-[ ] (Ref. 6), except that the analysis for 

sulfur may be performed in accordance with ASTM D1522-[ ], 

ASTM D2622-[ ], or ASTM D4294-[ ] (Ref. 6). The 31 day period is 

acceptable because the fuel oil properties of interest, even if not within 

stated limits, would not have an immediate effect on DG operation. This 

Surveillance ensures the availability of high quality fuel oil for the DGs. 

Fuel oil degradation during long term storage shows up as an increase in 

particulate, mostly due to oxidation. The presence of particulate does not 

mean that the fuel oil will not burn properly in a diesel engine. However, 

the particulate can cause fouling of filters and fuel oil injection equipment, 

which can cause engine failure. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWR/6 STS B 3.8.3-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Particulate concentrations should be determined in accordance with 

ASTM D5452-[ ] (Ref. 6). This method involves a gravimetric 

determination of total particulate concentration in the fuel oil and has a 

limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent 

laboratory testing in lieu of field testing. [For those designs in which the 

total volume of stored fuel oil is contained in two or more interconnected 

tanks, each tank must be considered and tested separately.] 

The Frequency of this Surveillance takes into consideration fuel oil 

degradation trends indicating that particulate concentration is unlikely to 

change between Frequency intervals. 

SR 3.8.3.4

This Surveillance ensures that, without the aid of the refill compressor, 

sufficient air start capacity for each DG is available. The system design 

requirements provide for a minimum of five engine start cycles without 

recharging. [A start cycle is defined by the DG vendor, but usually is 

measured in terms of time (seconds of cranking) or engine cranking 

speed.] The pressure specified in this SR is intended to reflect the lowest 

value at which the [five] starts can be accomplished. 

The 31 day Frequency takes into account the capacity, capability, 

redundancy, and diversity of the AC sources and other indications 

available in the control room, including alarms, to alert the operator to 

below normal air start pressure. 

SR 3.8.3.5

Microbiological fouling is a major cause of fuel oil degradation. There are 

numerous bacteria that can grow in fuel oil and cause fouling, but all must 

have a water environment in order to survive. Removal of water from the 

storage tanks once every 31 days eliminates the necessary environment 

for bacterial survival. This is the most effective means of controlling 

microbiological fouling. In addition, it eliminates the potential for water 

entrainment in the fuel oil during DG operation. Water may come from 

any of several sources, including condensation, ground water, rain water, 

contaminated fuel oil, and from breakdown of the fuel oil by bacteria. 
Diesel Fuel Oil, Lube Oil, and Starting Air 

B 3.8.3 

BWR/6 STS B 3.8.3-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

Frequent checking for and removal of accumulated water minimizes 

fouling and provides data regarding the watertight integrity of the fuel oil 

system. The Surveillance Frequencies are established by Regulatory 

Guide 1.137 (Ref. 2). This SR is for preventive maintenance. The 

presence of water does not necessarily represent a failure of this SR 

provided that accumulated water is removed during performance of the 

Surveillance. 

REFERENCES 1. FSAR, Section [9.5.4]. 

 2. Regulatory Guide 1.137. 

 3. ANSI N195, Appendix B, 1976. 

 4. FSAR, Chapter [6]. 

 5. FSAR, Chapter [15]. 

 6. ASTM Standards: D4057-[ ]; D975-[ ]; D1298-[ ]; D4176-[ ]; 

[D2709-[ ];] D1552-[ ]; D2622-[ ]; D4294-[ ]; D5452-[ ]. 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.4 DC Sources - Operating 

BASES 

BACKGROUND The station DC electrical power system provides the AC emergency 

power system with control power. It also provides both motive and 

control power to selected safety related equipment. As required by 

10 CFR 50, Appendix A, GDC 17 (Ref. 1), the DC electrical power system 

is designed to have sufficient independence, redundancy, and testability 

to perform its safety functions, assuming a single failure. The DC 

electrical power system also conforms to the requirements of Regulatory 

Guide 1.6 (Ref. 2) and IEEE-308 (Ref. 3). 

The 125 VDC electrical power system consists of three independent 

Class 1E DC electrical power subsystems, Divisions 1, 2, and 3. Each 

subsystem consists of a battery, associated battery charger(s), and all the 

associated control equipment and interconnecting cabling. 

During normal operation, the DC loads are powered from the battery 

chargers with the batteries floating on the system. In case of loss of 

normal power to the battery charger, the DC loads are automatically 

powered from the Engineered Safety Feature (ESF) batteries. 

Each of the Division 1 and 2 electrical power subsystems provides the 

control power for its associated Class 1E AC power load group, 4.16 kV 

switchgear, and 480 V load centers. Also, these DC subsystems provide 

DC electrical power to the inverters, which in turn power the AC vital 

buses. The Division 3 DC electrical power subsystem provides DC 

motive and control power as required for the High Pressure Core Spray 

(HPCS) System diesel generator (DG) set control and protection. 

The DC power distribution system is described in more detail in Bases for 

LCO 3.8.9, "Distribution Systems - Operating," and LCO 3.8.10, 

"Distribution Systems - Shutdown." 

Each DC battery subsystem is separately housed in a ventilated room 

apart from its charger and distribution centers. Each subsystem is 

located in an area separated physically and electrically from the other 

subsystems to ensure that a single failure in one subsystem does not 

cause a failure in a redundant subsystem. There is no sharing between 

redundant Class 1E subsystems such as batteries, battery chargers, or 

distribution panels. 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-2 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

Each Division 1 and 2 battery has adequate storage capacity to meet the 

duty cycle(s) discussed in the FSAR, Chapter [8] (Ref. 4). The battery is 

designed with additional capacity above that required by the design duty 

cycle to allow for temperature variations and other factors. The Division 3 

battery has adequate storage to meet the duty cycle(s) discussed in the 

FSAR, Chapter [8] (Ref. 4). The battery is designed with additional 

capacity above that required by the design duty cycle to allow for 

temperature variations and other factors. 

The batteries for a DC electrical power subsystem are sized to produce 

required capacity at 80% of nameplate rating, corresponding to warranted 

capacity at end of life cycles and the 100% design demand. The 

minimum design voltage limit is 105/210 V. 

The battery cells are of flooded lead acid construction with a nominal 

specific gravity of [1.215]. This specific gravity corresponds to an open 

circuit battery voltage of approximately 120 V for a [58] cell battery (i.e., 

cell voltage of [2.065] volts per cell (Vpc)). The open circuit voltage is the 

voltage maintained when there is no charging or discharging. Once fully 

charged with its open circuit voltage ≥ [2.065] Vpc, the battery cell will 

maintain its capacity for [30] days without further charging per 

manufacturer's instructions. Optimal long term performance however, is 

obtained by maintaining a float voltage [2.20 to 2.25] Vpc. This provides 

adequate over-potential, which limits the formation of lead sulfate and self 

discharge. The nominal float voltage of [2.22] Vpc corresponds to a total 

float voltage output of [128.8] V for a [58] cell battery as discussed in the 

FSAR, Chapter [8] (Ref. 4). 

Each battery charger of Division 1 and 2 DC electrical power subsystem 

has ample power output capacity for the steady state operation of 

connected loads required during normal operation, while at the same time 

maintaining its battery bank fully charged. Each battery charger has 

sufficient excess capacity to restore the battery bank from the design 

minimum charge to its fully charged state within 12 hours while supplying 

normal steady state loads (Ref. 4). 

The battery charger of Division 3 DC electrical power subsystem has 

sufficient excess capacity to restore the battery bank from the design 

minimum charge to its fully charged state in 8 hours while supplying 

normal steady state loads (Ref. 4). 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-3 Rev. 3.0, 03/31/04 

BASES 

BACKGROUND (continued) 

The battery charger is normally in the float-charge mode. Float-charge is 

the condition in which the charger is supplying the connected loads and 

the battery cells are receiving adequate current to optimally charge the 

battery. This assures the internal losses of a battery are overcome and 

the battery is maintained in a fully charged state. 

When desired, the charger can be placed in the equalize mode. The 

equalize mode is at a higher voltage than the float mode and charging 

current is correspondingly higher. The battery charger is operated in the 

equalize mode after a battery discharge or for routine maintenance. 

Following a battery discharge, the battery recharge characteristic accepts 

current at the current limit of the battery charger (if the discharge was 

significant, e.g., following a battery service test) until the battery terminal 

voltage approaches the charger voltage setpoint. Charging current then 

reduces exponentially during the remainder of the recharge cycle. Leadcalcium batteries have recharge efficiencies of greater than 95%, so once 

at least 105% of the ampere-hours discharged have been returned, the 

battery capacity would be restored to the same condition as it was prior to 

the discharge. This can be monitored by direct observation of the 

exponentially decaying charging current or by evaluating the amp-hours 

discharged from the battery and amp-hours returned to the battery. 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 5) and Chapter [15] (Ref. 6), 

ANALYSES assume that ESF systems are OPERABLE. The DC electrical power 

system provides normal and emergency DC electrical power for the DGs, 

emergency auxiliaries, and control and switching during all MODES of 

operation. 

The OPERABILITY of the DC subsystems is consistent with the initial 

assumptions of the accident analyses and is based upon meeting the 

design basis of the unit. This includes maintaining DC sources 

OPERABLE during accident conditions in the event of: 

a. An assumed loss of all offsite AC power or of all onsite AC power and 

b. A worst case single failure. 

The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-4 Rev. 3.0, 03/31/04 

BASES 

LCO The DC electrical power subsystems, each subsystem consisting of one 

battery, one battery charger, and the corresponding control equipment 

and interconnecting cabling supplying power to the associated bus within 

the divisions, are required to be OPERABLE to ensure the availability of 

the required power to shut down the reactor and maintain it in a safe 

condition after an anticipated operational occurrence (AOO) or a 

postulated DBA. Loss of any DC electrical power subsystem does not 

prevent the minimum safety function from being performed (Ref. 4). 

APPLICABILITY The DC electrical power sources are required to be OPERABLE in 

MODES 1, 2, and 3 to ensure safe unit operation and to ensure that: 

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and 

b. Adequate core cooling is provided, and containment integrity and 

other vital functions are maintained in the event of a postulated DBA. 

The DC electrical power requirements for MODES 4 and 5 are addressed 

in the Bases for LCO 3.8.5, "DC Sources - Shutdown." 

ACTIONS A.1, A.2, and A.3

Condition A represents one division with one [or two] battery chargers 

inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The 

ACTIONS provide a tiered response that focuses on returning the battery 

to the fully charged state and restoring a fully qualified charger to 

OPERABLE status in a reasonable time period. Required Action A.1 

requires that the battery terminal voltage be restored to greater than or 

equal to the minimum established float voltage within 2 hours. This time 

provides for returning the inoperable charger to OPERABLE status or 

providing an alternate means of restoring battery terminal voltage to 

greater than or equal to the minimum established float voltage. Restoring 

the battery terminal voltage to greater than or equal to the minimum 

established float voltage provides good assurance that, within [12] hours, 

the battery will be restored to its fully charged condition (Required Action 

A.2) from any discharge that might have occurred due to the charger 

inoperability. 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3). 

-------------------------------------------------------------------------------------------------- 

A discharged battery having terminal voltage of at least the minimum 

established float voltage indicates that the battery is on the exponential 

charging current portion (the second part) of its recharge cycle. The time 

to return a battery to its fully charged state under this condition is simply a 

function of the amount of the previous discharge and the recharge 

characteristic of the battery. Thus there is good assurance of fully 

recharging the battery within [12] hours, avoiding a premature shutdown 

with its own attendant risk. 

If established battery terminal float voltage cannot be restored to greater 

than or equal to the minimum established float voltage within 2 hours, and 

the charger is not operating in the current-limiting mode, a faulty charger 

is indicated. A faulty charger that is incapable of maintaining established 

battery terminal float voltage does not provide assurance that it can revert 

to and operate properly in the current limit mode that is necessary during 

the recovery period following a battery discharge event that the DC 

system is designed for. 

If the charger is operating in the current limit mode after 2 hours that is an 

indication that the battery is partially discharged and its capacity margins 

will be reduced. The time to return the battery to its fully charged 

condition in this case is a function of the battery charger capacity, the 

amount of loads on the associated DC system, the amount of the 

previous discharge, and the recharge characteristic of the battery. The 

charge time can be extensive, and there is not adequate assurance that it 

can be recharged within [12] hours (Required Action A.2). 

Required Action A.2 requires that the battery float current be verified as 

less than or equal to [2] amps. This indicates that, if the battery had been 

discharged as the result of the inoperable battery charger, it has now 

been fully recharged. If at the expiration of the initial [12] hour period the 

battery float current is not less than or equal to [2] amps this indicates 

there may be additional battery problems and the battery must be 

declared inoperable. 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Action A.3 limits the restoration time for the inoperable battery 

charger to 7 days. This action is applicable if an alternate means of 

restoring battery terminal voltage to greater than or equal to the minimum 

established float voltage has been used (e.g., balance of plant non-Class 

1E battery charger). The 7 day Completion Time reflects a reasonable 

time to effect restoration of the qualified battery charger to OPERABLE 

status. 

B.1

-----------------------------------REVIEWER’S NOTE----------------------------------- 

The 2 hour Completion Times of Required Actions B.1 and C.1 are in 

brackets. Any licensee wishing to request a longer Completion Time will 

need to demonstrate that the longer Completion Time is appropriate for 

the plant in accordance with the guidance in Regulatory Guide (RG) 

1.177, "An Approach for Plant-Specific, Risk-Informed Decisionmaking: 

Technical Specifications." 

-------------------------------------------------------------------------------------------------- 

Condition B represents one division with one [or two] batter[y][ies] 

inoperable. With one [or two] batter[y][ies] inoperable, the DC bus is 

being supplied by the OPERABLE battery charger[s]. Any event that 

results in a loss of the AC bus supporting the battery charger[s] will also 

result in loss of DC to that division. Recovery of the AC bus, especially if 

it is due to a loss of offsite power, will be hampered by the fact that many 

of the components necessary for the recovery (e.g., diesel generator 

control and field flash, AC load shed and diesel generator output circuit 

breakers, etc.) likely rely upon the batter[y][ies]. In addition the 

energization transients of any DC loads that are beyond the capability of 

the battery charger[s] and normally require the assistance of the 

batter[y][ies] will not be able to be brought online. The [2] hour limit 

allows sufficient time to effect restoration of an inoperable battery given 

that the majority of the conditions that lead to battery inoperability (e.g., 

loss of battery charger, battery cell voltage less than [2.07] V, etc.) are 

identified in Specifications 3.8.4, 3.8.5, and 3.8.6 together with additional 

specific completion times. 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1

Condition C represents one division with a loss of ability to completely 

respond to an event, and a potential loss of ability to remain energized 

during normal operation. It is, therefore, imperative that the operator's 

attention focus on stabilizing the unit, minimizing the potential for 

complete loss of DC power to the affected division. The 2 hour limit is 

consistent with the allowed time for an inoperable DC distribution system 

division. 

If one of the required [Division 1 or 2] DC electrical power subsystems is 

inoperable for reasons other than Condition A or B (e.g., inoperable 

battery charger and associated inoperable battery), the remaining DC 

electrical power subsystems have the capacity to support a safe 

shutdown and to mitigate an accident condition. Since a subsequent 

worst case single failure could, however, result in the loss of minimum 

necessary DC electrical subsystems, continued power operation should 

not exceed 2 hours. The 2 hour Completion Time is based on Regulatory 

Guide 1.93 (Ref. 7) and reflects a reasonable time to assess unit status 

as a function of the inoperable DC electrical power subsystem and, if the 

DC electrical power subsystem is not restored to OPERABLE status, to 

prepare to effect an orderly and safe unit shutdown. 

D.1

With the Division 3 DC electrical power subsystem inoperable for reasons 

other than Condition A or B, the HPCS and 2C Standby Service Water 

System may be incapable of performing their intended functions and must 

be immediately declared inoperable. This declaration also requires entry 

into applicable Conditions and Required Actions of LCO 3.5.1, "ECCS - 

Operating," [and LCO 3.7.1, "Standby Service Water (SSW)] System and 

[Ultimate Heat Sink (UHS)"]]. 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

E.1 and E.2

If the inoperable DC electrical power subsystem cannot be restored to 

OPERABLE status within the associated Completion Time, the unit must 

be brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 12 hours and 

to MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. The Completion Time to bring the unit to 

MODE 4 is consistent with the time required in Regulatory Guide 1.93 

(Ref. 7). 

SURVEILLANCE SR 3.8.4.1

REQUIREMENTS 

Verifying battery terminal voltage while on float charge helps to ensure 

the effectiveness of the battery chargers, which support the ability of the 

batteries to perform their intended function. Float charge is the condition 

in which the charger is supplying the continuous charge required to 

overcome the internal losses of a battery and maintain the battery in a 

fully charged state while supplying the continuous steady state loads of 

the associated DC subsystem. On float charge, battery cells will receive 

adequate current to optimally charge the battery. The voltage 

requirements are based on the nominal design voltage of the battery and 

are consistent with the minimum float voltage established by the battery 

manufacturer ([2.20] Vpc or [127.6] V at the battery terminals). This 

voltage maintains the battery plates in a condition that supports 

maintaining the grid life (expected to be approximately 20 years). The 

7 day Frequency is consistent with manufacturer recommendations and 

IEEE-450 (Ref. 8). 

SR 3.8.4.2

This SR verifies the design capacity of the battery chargers. According to 

Regulatory Guide 1.32 (Ref. 9), the battery charger supply is 

recommended to be based on the largest combined demands of the 

various steady state loads and the charging capacity to restore the 

battery from the design minimum charge state to the fully charged state, 

irrespective of the status of the unit during these demand occurrences. 

The minimum required amperes and duration ensures that these 

requirements can be satisfied. 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

This SR provides two options. One option requires that each battery 

charger be capable of supplying [400] amps at the minimum established 

float voltage for [8] hours. The ampere requirements are based on the 

output rating of the chargers. The voltage requirements are based on the 

charger voltage level after a response to a loss of AC power. The time 

period is sufficient for the charger temperature to have stabilized and to 

have been maintained for at least [2] hours. 

The other option requires that each battery charger be capable of 

recharging the battery after a service test coincident with supplying the 

largest coincident demands of the various continuous steady state loads 

(irrespective of the status of the plant during which these demands 

occur). This level of loading may not normally be available following the 

battery service test and will need to be supplemented with additional 

loads. The duration for this test may be longer than the charger sizing 

criteria since the battery recharge is affected by float voltage, 

temperature, and the exponential decay in charging current. The battery 

is recharged when the measured charging current is ≤ [2] amps. 

The Surveillance Frequency is acceptable, given the unit conditions 

required to perform the test and the other administrative controls existing 

to ensure adequate charger performance during these [18 month] 

intervals. In addition, this Frequency is intended to be consistent with 

expected fuel cycle lengths. 

SR 3.8.4.3

A battery service test is a special test of the battery's capability, as found, 

to satisfy the design requirements (battery duty cycle) of the DC electrical 

power system. The discharge rate and test length corresponds to the 

design duty cycle requirements as specified in Reference 4. 

The Surveillance Frequency of [18 months] is consistent with the 

recommendations of Regulatory Guide 1.32 (Ref. 9) and Regulatory 

Guide 1.129 (Ref. 10), which state that the battery service test should be 

performed during refueling operations or at some other outage, with 

intervals between tests not to exceed [18 months]. 

This SR is modified by two Notes. Note 1 allows the performance of a 

modified performance discharge test in lieu of a service test. 
DC Sources - Operating 

B 3.8.4 

BWR/6 STS B 3.8.4-10 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The reason for Note 2 is that performing the Surveillance would remove a 

required DC electrical power subsystem from service, perturb the 

electrical distribution system, and challenge safety systems. This 

restriction from normally performing the Surveillance in MODE 1 or 2 is 

further amplified to allow portions of the Surveillance to be performed for 

the purpose of reestablishing OPERABILITY (e.g., post work testing 

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed partial 

Surveillance, a successful partial Surveillance, and a perturbation of the 

offsite or onsite system when they are tied together or operated 

independently for the partial Surveillance; as well as the operator 

procedures available to cope with these outcomes. These shall be 

measured against the avoided risk of a plant shutdown and startup to 

determine that plant safety is maintained or enhanced when portions of 

the Surveillance are performed in MODE 1 or 2. Risk insights or 

deterministic methods may be used for the assessment. Credit may be 

taken for unplanned events that satisfy the Surveillance. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17. 

 2. Regulatory Guide 1.6, March 10, 1971. 

 3. IEEE Standard 308, 1978. 

 4. FSAR, Chapter [8]. 

 5. FSAR, Chapter [6]. 

 6. FSAR, Chapter [15]. 

 7. Regulatory Guide 1.93, December 1974. 

 8. IEEE Standard 450, 1995. 

 9. Regulatory Guide 1.32, February 1977. 

 10. Regulatory Guide 1.129, December 1974. 
DC Sources - Shutdown 

B 3.8.5 

BWR/6 STS B 3.8.5-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.5 DC Sources - Shutdown 

BASES 

BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, 

"DC Sources - Operating." 

APPLICABLE The initial conditions of Design Basis Accident and transient analyses in 

SAFETY the FSAR, Chapter [6] (Ref. 1) and Chapter [15] (Ref. 2), assume that 

ANALYSES Engineered Safety Feature systems are OPERABLE. The DC electrical 

power system provides normal and emergency DC electrical power for 

the diesel generators, emergency auxiliaries, and control and switching 

during all MODES of operation. 

The OPERABILITY of the DC subsystems is consistent with the initial 

assumptions of the accident analyses and the requirements for the 

supported systems' OPERABILITY. 

The OPERABILITY of the minimum DC electrical power sources during 

MODES 4 and 5 and during movement of [recently] irradiated fuel 

assemblies ensures that: 

a. The facility can be maintained in the shutdown or refueling condition 

for extended periods, 

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and 

c. Adequate DC electrical power is provided to mitigate events 

postulated during shutdown, such as an inadvertent draindown of the 

vessel or a fuel handling accident [involving handling recently 

irradiated fuel. Due to radioactive decay, DC electrical power is only 

required to mitigate fuel handling accidents involving handling 

recently irradiated fuel (i.e., fuel that has occupied part of a critical 

reactor core within the previous [X] days)]. 

In general, when the unit is shut down, the Technical Specifications 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or all onsite power is not required. 

The rationale for this is based on the fact that many Design Basis 

Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no 

specific analyses in MODES 4 and 5. Worst case bounding events are 

deemed not credible in MODES 4 and 5 because the energy contained 
DC Sources - Shutdown 

B 3.8.5 

BWR/6 STS B 3.8.5-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

within the reactor pressure boundary, reactor coolant temperature and 

pressure, and the corresponding stresses result in the probabilities of 

occurrence being significantly reduced or eliminated, and in minimal 

consequences. These deviations from DBA analysis assumptions and 

design requirements during shutdown conditions are allowed by the LCO 

for required systems. 

The shutdown Technical Specification requirements are designed to 

ensure that the unit has the capability to mitigate the consequences of 

certain postulated accidents. Worst case DBAs which are analyzed for 

operating MODES are generally viewed not to be a significant concern 

during shutdown MODES due to the lower energies involved. The 

Technical Specifications therefore require a lesser complement of 

electrical equipment to be available during shutdown than is required 

during operating MODES. More recent work completed on the potential 

risks associated with shutdown, however, have found significant risk 

associated with certain shutdown evolutions. As a result, in addition to 

the requirements established in the Technical Specifications, the industry 

has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess 

Shutdown Management," as an industry initiative to manage shutdown 

tasks and associated electrical support to maintain risk at an acceptable 

low level. This may require the availability of additional equipment 

beyond that required by the shutdown Technical Specifications. 

The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The DC electrical power subsystems, [each required] [the required] 

consisting of [two] battery banks, [one or two] battery charger[s], and the 

corresponding control equipment and interconnecting cabling within the 

division, are required to be OPERABLE to support [required] [one] 

division[s] of Distribution System [divisions required OPERABLE by 

LCO 3.8.10, "Distribution Systems - Shutdown."][.] This ensures the 

availability of sufficient DC electrical power sources to operate the unit in 

a safe manner and to mitigate the consequences of postulated events 

during shutdown (e.g., fuel handling accidents [involving handling recently 

irradiated fuel] and inadvertent reactor vessel draindown). 

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 4 

and 5 and during movement of [recently] irradiated fuel assemblies in the 

[primary or secondary containment] provide assurance that: 
DC Sources - Shutdown 

B 3.8.5 

BWR/6 STS B 3.8.5-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

a. Required features to provide adequate coolant inventory makeup are 

available for the irradiated fuel assemblies in the core in case of an 

inadvertent draindown of the reactor vessel, 

b. Required features needed to mitigate a fuel handling accident 

[involving handling recently irradiated fuel (i.e., fuel that has occupied 

part of a critical reactor core within the previous [X] days)] are 

available, 

c. Required features necessary to mitigate the effects of events that can 

lead to core damage during shutdown are available, and 

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition. 

The DC electrical power requirements for MODES 1, 2, and 3 are 

covered in LCO 3.8.4. 

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, or 3, the fuel movement is independent 

of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, or 3 

would require the unit to be shutdown unnecessarily. 

A.1, A.2, and A.3

-----------------------------------REVIEWER’S NOTE----------------------------------- 

ACTION A is included only when plant-specific implementation of LCO 

3.8.5 includes the potential to require both divisions of the DC System to 

be OPERABLE. If plant-specific implementation results in LCO 3.8.5 

requiring only one division of the DC System to be OPERABLE, then 

ACTION A is omitted and ACTION B is renumbered as ACTION A. 

-------------------------------------------------------------------------------------------------- 
DC Sources - Shutdown 

B 3.8.5 

BWR/6 STS B 3.8.5-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition A represents one division with one [or two] battery chargers 

inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The 

ACTIONS provide a tiered response that focuses on returning the battery 

to the fully charged state and restoring a fully qualified charger to 

OPERABLE status in a reasonable time period. Required Action A.1 

requires that the battery terminal voltage be restored to greater than or 

equal to the minimum established float voltage within 2 hours. This time 

provides for returning the inoperable charger to OPERABLE status or 

providing an alternate means of restoring battery terminal voltage to 

greater than or equal to the minimum established float voltage. Restoring 

the battery terminal voltage to greater than or equal to the minimum 

established float voltage provides good assurance that, within [12] hours, 

the battery will be restored to its fully charged condition (Required Action 

A.2) from any discharge that might have occurred due to the charger 

inoperability. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3). 

-------------------------------------------------------------------------------------------------- 

A discharged battery having terminal voltage of at least the minimum 

established float voltage indicates that the battery is on the exponential 

charging current portion (the second part) of its recharge cycle. The time 

to return a battery to its fully charged state under this condition is simply a 

function of the amount of the previous discharge and the recharge 

characteristic of the battery. Thus there is good assurance of fully 

recharging the battery within [12] hours, avoiding a premature shutdown 

with its own attendant risk. 

If established battery terminal float voltage cannot be restored to greater 

than or equal to the minimum established float voltage within 2 hours, and 

the charger is not operating in the current-limiting modes, a faulty charger 

is indicated. A faulty charger that is incapable of maintaining established 

battery terminal float voltage does not provide assurance that it can revert 

to and operate properly in the current limit mode that is necessary during 

the recovery period following a battery discharge event that the DC 

system is designed for. 
DC Sources - Shutdown 

B 3.8.5 

BWR/6 STS B 3.8.5-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

If the charger is operating in the current limit mode after 2 hours that is an 

indication that the battery is partially discharged and its capacity margins 

will be reduced. The time to return the battery to its fully charged 

condition in this case is a function of the battery charger capacity, the 

amount of loads on the associated DC system, the amount of the 

previous discharge, and the recharge characteristic of the battery. The 

charge time can be extensive, and there is not adequate assurance that it 

can be recharged within [12] hours (Required Action A.2). 

Required Action A.2 requires that the battery float current be verified as 

less than or equal to [2] amps. This indicates that, if the battery had been 

discharged as the result of the inoperable battery charger, it has now 

been fully recharged. If at the expiration of the initial [12] hour period the 

battery float current is not less than or equal to [2] amps this indicates 

there may be additional battery problems and the battery must be 

declared inoperable. 

Required Action A.3 limits the restoration time for the inoperable battery 

charger to 7 days. This action is applicable if an alternate means of 

restoring battery terminal voltage to greater than or equal to the minimum 

established float voltage has been used (e.g., balance of plant non-Class 

1E battery charger). The 7 day Completion Time reflects a reasonable 

time to effect restoration of the qualified battery charger to OPERABLE 

status. 

B.1, B.2.1, B.2.2, B.2.3, and B.2.4

[If more than one DC distribution subsystem is required according to 

LCO 3.8.10, the DC subsystems remaining OPERABLE with one or more 

DC power sources inoperable may be capable of supporting sufficient 

required features to allow continuation of CORE ALTERATIONS, 

[recently] irradiated fuel movement, and operations with a potential for 

draining the reactor vessel.] By allowing the option to declare required 

features inoperable with associated DC power source(s) inoperable, 

appropriate restrictions are implemented in accordance with the affected 

system LCOs' ACTIONS. In many instances this option may involve 

undesired administrative efforts. Therefore, the allowance for sufficiently 

conservative actions is made (i.e., to suspend CORE ALTERATIONS, 

movement of [recently] irradiated fuel assemblies, and any activities that 

could result in inadvertent draining of the reactor vessel). 
DC Sources - Shutdown 

B 3.8.5 

BWR/6 STS B 3.8.5-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Suspension of these activities shall not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required DC electrical power 

subsystem[s] and to continue this action until restoration is accomplished 

in order to provide the necessary DC electrical power to the plant safety 

systems. 

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required DC 

electrical power subsystems should be completed as quickly as possible 

in order to minimize the time during which the plant safety systems may 

be without sufficient power. 

SURVEILLANCE SR 3.8.5.1

REQUIREMENTS 

SR 3.8.5.1 requires performance of all Surveillances required by 

SR 3.8.4.1 through SR 3.8.4.3 Therefore, see the corresponding Bases 

for LCO 3.8.4 for a discussion of each SR. 

This SR is modified by a Note. The reason for the Note is to preclude 

requiring the OPERABLE DC sources from being discharged below their 

capability to provide the required power supply or otherwise rendered 

inoperable during the performance of SRs. It is the intent that these SRs 

must still be capable of being met, but actual performance is not required. 

REFERENCES 1. FSAR, Chapter [6]. 

 2. FSAR, Chapter [15]. 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.6 Battery Parameters 

BASES 

BACKGROUND This LCO delineates the limits on battery float current as well as 

electrolyte temperature, level, and float voltage for the DC power source 

batteries. A discussion of these batteries and their OPERABILITY 

requirements is provided in the Bases for LCO 3.8.4, "DC Sources - 

Operating," and LCO 3.8.5, "DC Sources - Shutdown." In addition to the 

limitations of this Specification, the [licensee controlled program] also 

implements a program specified in Specification 5.5.14 for monitoring 

various battery parameters that is based on the recommendations of 

IEEE Standard 450-1995, "IEEE Recommended Practice For 

Maintenance, Testing, And Replacement Of Vented Lead-Acid Batteries 

For Stationary Applications" (Ref. 1). 

The battery cells are of flooded lead acid construction with a nominal 

specific gravity of [1.215]. This specific gravity corresponds to an open 

circuit battery voltage of approximately 120 V for [58] cell battery (i.e., cell 

voltage of [2.065] volts per cell (Vpc)). The open circuit voltage is the 

voltage maintained when there is no charging or discharging. Once fully 

charged with its open circuit voltage ≥ [2.065] Vpc, the battery cell will 

maintain its capacity for [30] days without further charging per 

manufacturer's instructions. Optimal long term performance however, is 

obtained by maintaining a float voltage [2.20 to 2.25] Vpc. This provides 

adequate over-potential which limits the formation of lead sulfate and self 

discharge. The nominal float voltage of [2.22] Vpc corresponds to a total 

float voltage output of [128.8] V for a [58] cell battery as discussed in the 

FSAR, Chapter [8] (Ref. 2). 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in FSAR, Chapter [6] (Ref. 3) and Chapter [15] (Ref. 4), 

ANALYSES assume Engineered Safety Feature systems are OPERABLE. The DC 

electrical power subsystems provide normal and emergency DC electrical 

power for the diesel generators, emergency auxiliaries, and control and 

switching during all MODES of operation. 

The OPERABILITY of the DC subsystems is consistent with the initial 

assumptions of the accident analyses and is based upon meeting the 

design basis of the unit. This includes maintaining at least one division of 

DC sources OPERABLE during accident conditions, in the event of: 

a. An assumed loss of all offsite AC power or all onsite AC power and 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

b. A worst case single failure. 

Since battery parameters support the operation of the DC power sources, 

they satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO Battery parameters must remain within acceptable limits to ensure 

availability of the required DC power to shut down the reactor and 

maintain it in a safe condition after an anticipated operational occurrence 

or a postulated DBA. Battery parameter limits are conservatively 

established, allowing continued DC electrical system function even with 

limits not met. Additional preventative maintenance, testing, and 

monitoring performed in accordance with the [licensee controlled 

program] is conducted as specified in Specification 5.5.14. 

APPLICABILITY The battery parameters are required solely for the support of the 

associated DC electrical power subsystem. Therefore, battery parameter 

limits are only required when the DC power source is required to be 

OPERABLE. Refer to the Applicability discussion in Bases for LCO 3.8.4 

and LCO 3.8.5. 

ACTIONS A.1, A.2, and A.3

With one or more cells in one or more batteries in one division < [2.07] V, 

the battery cell is degraded. Within 2 hours verification of the required 

battery charger OPERABILITY is made by monitoring the battery terminal 

voltage (SR 3.8.4.1) and of the overall battery state of charge by 

monitoring the battery float charge current (SR 3.8.6.1). This assures that 

there is still sufficient battery capacity to perform the intended function. 

Therefore, the affected battery is not required to be considered inoperable 

solely as a result of one or more cells in one or more batteries < [2.07] V, 

and continued operation is permitted for a limited period up to 24 hours. 

Since the Required Actions only specify "perform," a failure of SR 3.8.4.1 

or SR 3.8.6.1 acceptance criteria does not result in this Required Action 

not met. However, if one of the SRs is failed the appropriate Condition(s), 

depending on the cause of the failures, is entered. If SR 3.8.6.1 is failed 

then there is not assurance that there is still sufficient battery capacity to 

perform the intended function and the battery must be declared 

inoperable immediately. 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1 and B.2

One or more batteries in one division with float > [2] amps indicates that a 

partial discharge of the battery capacity has occurred. This may be due 

to a temporary loss of a battery charger or possibly due to one or more 

battery cells in a low voltage condition reflecting some loss of capacity. 

Within 2 hours verification of the required battery charger OPERABILITY 

is made by monitoring the battery terminal voltage. If the terminal voltage 

is found to be less than the minimum established float voltage there are 

two possibilities, the battery charger is inoperable or is operating in the 

current limit mode. Condition A addresses charger inoperability. If the 

charger is operating in the current limit mode after 2 hours that is an 

indication that the battery has been substantially discharged and likely 

cannot perform its required design functions. The time to return the 

battery to its fully charged condition in this case is a function of the battery 

charger capacity, the amount of loads on the associated DC system, the 

amount of the previous discharge, and the recharge characteristic of the 

battery. The charge time can be extensive, and there is not adequate 

assurance that it can be recharged within [12] hours (Required 

Action B.2). The battery must therefore be declared inoperable. 

If the float voltage is found to be satisfactory but there are one or more 

battery cells with float voltage less than [2.07] V, the associated "OR" 

statement in Condition F is applicable and the battery must be declared 

inoperable immediately. If float voltage is satisfactory and there are no 

cells less than [2.07] V there is good assurance that, within [12] hours, the 

battery will be restored to its fully charged condition (Required Action B.2) 

from any discharge that might have occurred due to a temporary loss of 

the battery charger. 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3). 

-------------------------------------------------------------------------------------------------- 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A discharged battery with float voltage (the charger setpoint) across its 

terminals indicates that the battery is on the exponential charging current 

portion (the second part) of its recharge cycle. The time to return a 

battery to its fully charged state under this condition is simply a function of 

the amount of the previous discharge and the recharge characteristic of 

the battery. Thus there is good assurance of fully recharging the battery 

within [12] hours, avoiding a premature shutdown with its own attendant 

risk. 

If the condition is due to one or more cells in a low voltage condition but 

still greater than [2.07] V and float voltage is found to be satisfactory, this 

is not indication of a substantially discharged battery and [12] hours is a 

reasonable time prior to declaring the battery inoperable. 

Since Required Action B.1 only specifies "perform," a failure of SR 3.8.4.1 

acceptance criteria does not result in the Required Action not met. 

However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending 

on the cause of the failure, is entered. 

C.1, C.2, and C.3

With one or more batteries in one division with one or more cells 

electrolyte level above the top of the plates, but below the minimum 

established design limits, the battery still retains sufficient capacity to 

perform the intended function. Therefore, the affected battery is not 

required to be considered inoperable solely as a result of electrolyte level 

not met. Within 31 days the minimum established design limits for 

electrolyte level must be re-established. 

With electrolyte level below the top of the plates there is a potential for 

dryout and plate degradation. Required Actions C.1 and C.2 address this 

potential (as well as provisions in Specification 5.5.14, Battery Monitoring 

and Maintenance Program). They are modified by a Note that indicates 

they are only applicable if electrolyte level is below the top of the plates. 

Within 8 hours level is required to be restored to above the top of the 

plates. The Required Action C.2 requirement to verify that there is no 

leakage by visual inspection and the Specification 5.5.14.b item to initiate 

action to equalize and test in accordance with manufacturer's 

recommendation are taken from Annex D of IEEE Standard 450-1995. 

They are performed following the restoration of the electrolyte level to 

above the top of the plates. Based on the results of the manufacturer's 

recommended testing the batter[y][ies] may have to be declared 

inoperable and the affected cell[s] replaced. 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

D.1

With one or more batteries in one division with pilot cell temperature less 

than the minimum established design limits, 12 hours is allowed to restore 

the temperature to within limits. A low electrolyte temperature limits the 

current and power available. Since the battery is sized with margin, while 

battery capacity is degraded, sufficient capacity exists to perform the 

intended function and the affected battery is not required to be considered 

inoperable solely as a result of the pilot cell temperature not met. 

E.1

With one or more batteries in redundant divisions with battery parameters 

not within limits there is not sufficient assurance that battery capacity has 

not been affected to the degree that the batteries can still perform their 

required function, given that redundant batteries are involved. With 

redundant batteries involved this potential could result in a total loss of 

function on multiple systems that rely upon the batteries. The longer 

Completion Times specified for battery parameters on non-redundant 

batteries not within limits are therefore not appropriate, and the 

parameters must be restored to within limits on at least one division within 

2 hours. 

F.1

When any battery parameter is outside the allowances of the Required 

Actions for Condition A, B, C, D, or E, sufficient capacity to supply the 

maximum expected load requirement is not assured and the 

corresponding battery must be declared inoperable. Additionally, 

discovering one or more batteries in one division with one or more battery 

cells float voltage less than [2.07] V and float current greater than 

[2] amps indicates that the battery capacity may not be sufficient to 

perform the intended functions. The battery must therefore be declared 

inoperable immediately. 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-6 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.8.6.1

REQUIREMENTS 

Verifying battery float current while on float charge is used to determine 

the state of charge of the battery. Float charge is the condition in which 

the charger is supplying the continuous charge required to overcome the 

internal losses of a battery and maintain the battery in a charged state. 

The float current requirements are based on the float current indicative of 

a charged battery. Use of float current to determine the state of charge of 

the battery is consistent with IEEE-450 (Ref. 1). The 7 day Frequency is 

consistent with IEEE-450 (Ref. 1). 

This SR is modified by a Note that states the float current requirement is 

not required to be met when battery terminal voltage is less than the 

minimum established float voltage of SR 3.8.4.1. When this float voltage 

is not maintained the Required Actions of LCO 3.8.4 ACTION A are being 

taken, which provide the necessary and appropriate verifications of the 

battery condition. Furthermore, the float current limit of [2] amps is 

established based on the nominal float voltage value and is not directly 

applicable when this voltage is not maintained. 

SR 3.8.6.2 and SR 3.8.6.5

Optimal long term battery performance is obtained by maintaining a float 

voltage greater than or equal to the minimum established design limits 

provided by the battery manufacturer, which corresponds to [130.5] V at 

the battery terminals, or [2.25] Vpc. This provides adequate overpotential, which limits the formation of lead sulfate and self discharge, 

which could eventually render the battery inoperable. Float voltages in 

this range or less, but greater than [2.07] Vpc, are addressed in 

Specification 5.5.14. SRs 3.8.6.2 and 3.8.6.5 require verification that the 

cell float voltages are equal to or greater than the short term absolute 

minimum voltage of [2.07] V. The Frequency for cell voltage verification 

every 31 days for pilot cell and 92 days for each connected cell is 

consistent with IEEE-450 (Ref. 1). 

SR 3.8.6.3

The limit specified for electrolyte level ensures that the plates suffer no 

physical damage and maintains adequate electron transfer capability. 

The Frequency is consistent with IEEE-450 (Ref. 1). 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-7 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.8.6.4

This Surveillance verifies that the pilot cell temperature is greater than or 

equal to the minimum established design limit (i.e., [40]°F). Pilot cell 

electrolyte temperature is maintained above this temperature to assure 

the battery can provided the required current and voltage to meet the 

design requirements. Temperatures lower than assumed in battery sizing 

calculations act to inhibit or reduce battery capacity. The Frequency is 

consistent with IEEE-450 (Ref. 1). 

SR 3.8.6.6

A battery performance discharge test is a test of constant current capacity 

of a battery, normally done in the as found condition, after having been in 

service, to detect any change in the capacity determined by the 

acceptance test. The test is intended to determine overall battery 

degradation due to age and usage. 

Either the battery performance discharge test or the modified 

performance discharge test is acceptable for satisfying SR 3.8.6.6; 

however, only the modified performance discharge test may be used to 

satisfy the battery service test requirements of SR 3.8.4.3. 

A modified discharge test is a test of the battery capacity and its ability to 

provide a high rate, short duration load (usually the highest rate of the 

duty cycle). This will often confirm the battery's ability to meet the critical 

period of the load duty cycle, in addition to determining its percentage of 

rated capacity. Initial conditions for the modified performance discharge 

test should be identical to those specified for a service test. 

It may consist of just two rates; for instance, the one minute rate for the 

battery or the largest current load of the duty cycle, followed by the test 

rate employed for the performance test, both of which envelope the duty 

cycle of the service test. Since the ampere-hours removed by a one 

minute discharge represents a very small portion of the battery capacity, 

the test rate can be changed to that for the performance test without 

compromising the results of the performance discharge test. The battery 

terminal voltage for the modified performance discharge test must remain 

above the minimum battery terminal voltage specified in the battery 

service test for the duration of time equal to that of the service test. 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-8 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The acceptance criteria for this Surveillance are consistent with IEEE-450 

(Ref. 1) and IEEE-485 (Ref. 5). These references recommend that the 

battery be replaced if its capacity is below 80% of the manufacturer's 

rating. A capacity of 80% shows that the battery rate of deterioration is 

increasing, even if there is ample capacity to meet the load requirements. 

Furthermore, the battery is sized to meet the assumed duty cycle loads 

when the battery design capacity reaches this [80]% limit. 

The Surveillance Frequency for this test is normally 60 months. If the 

battery shows degradation, or if the battery has reached 85% of its 

expected life and capacity is < 100% of the manufacturer's rating, the 

Surveillance Frequency is reduced to 12 months. However, if the battery 

shows no degradation but has reached 85% of its expected life, the 

Surveillance Frequency is only reduced to 24 months for batteries that 

retain capacity ≥ 100% of the manufacturer's rating. Degradation is 

indicated, according to IEEE-450 (Ref. 3), when the battery capacity 

drops by more than 10% relative to its capacity on the previous 

performance test or when it is 10% below the manufacturer's rating. All 

these Frequencies are consistent with the recommendations in IEEE-450 

(Ref. 1). 

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required DC electrical power subsystem 

from service, perturb the electrical distribution system, and challenge 

safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR. 
Battery Parameters 

B 3.8.6 

BWR/6 STS B 3.8.6-9 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. IEEE Standard 450, 1995. 

 2. FSAR, Chapter [8]. 

 3. FSAR, Chapter [6]. 

 4. FSAR, Chapter [15]. 

 5. IEEE Standard 485, 1983. 
Inverters - Operating 

B 3.8.7 

BWR/6 STS B 3.8.7-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.7 Inverters - Operating 

BASES 

BACKGROUND The inverters are the preferred source of power for the AC vital buses 

because of the stability and reliability they achieve. There is one inverter 

per AC vital bus, making a total of four inverters. The function of the 

inverter is to provide AC electrical power to the vital buses. The inverter 

can be powered from an internal AC source/rectifier or from the station 

battery. The station battery provides an uninterruptible power source for 

the instrumentation and controls for the Reactor Protection System (RPS) 

and the Emergency Core Cooling Systems (ECCS) initiation. 

 [ Specific details on inverters, such as type, capacity, operating limits, and 

number and status of spares, can be found in the FSAR, Chapter [8] 

(Ref. 1). ] 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 2) and Chapter [15] (Ref. 3), 

ANALYSES assume Engineered Safety Feature systems are OPERABLE. The 

inverters are designed to provide the required capacity, capability, 

redundancy, and reliability to ensure the availability of necessary power to 

the RPS and ECCS instrumentation and controls so that the fuel, Reactor 

Coolant System, and containment design limits are not exceeded. These 

limits are discussed in more detail in the Bases for Section 3.2, Power 

Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and 

Section 3.6, Containment Systems. 

The OPERABILITY of the inverters is consistent with the initial 

assumptions of the accident analyses and is based on meeting the design 

basis of the unit. This includes maintaining electrical power sources 

OPERABLE during accident conditions in the event of: 

a. An assumed loss of all offsite AC or all onsite AC electrical power 

and 

b. A worst case single failure. 

Inverters are a part of the distribution system and, as such, satisfy 

Criterion 3 of 10 CFR 50.36(c)(2)(ii). 
Inverters - Operating 

B 3.8.7 

BWR/6 STS B 3.8.7-2 Rev. 3.0, 03/31/04 

BASES 

LCO The inverters ensure the availability of AC electrical power for the 

instrumentation for the systems required to shut down the reactor and 

maintain it in a safe condition after an anticipated operational occurrence 

(AOO) or a postulated DBA. 

Maintaining the required inverters OPERABLE ensures that the 

redundancy incorporated into the design of the RPS and ECCS 

instrumentation and controls is maintained. The four battery powered 

inverters ensure an uninterruptible supply of AC electrical power to the 

AC vital buses even if the 4.16 kV safety buses are de-energized. 

OPERABLE inverters require the associated vital bus to be powered by 

the inverter with output voltage and frequency within tolerances, and 

power input to the inverter from a [125 VDC] station battery. 

Alternatively, power supply may be from an internal AC source via 

rectifier as long as the station battery is available as the uninterruptible 

power supply. 

This LCO is modified by a Note allowing [one or two] inverters to be 

disconnected from an [associated common] battery for ≤ 24 hours. This 

allowance is provided to allow the performance of an equalizing charge 

on one battery. If the inverters were not disconnected, the resulting 

voltage condition might damage the inverters. Disconnecting the 

inverters is allowed provided the associated AC vital buses are energized 

from their [Class 1E constant voltage source transformer or inverter using 

internal AC source] and that the AC vital buses for the other batteries are 

energized from the associated inverters. These provisions minimize the 

loss of equipment that would occur in the event of a loss of offsite power. 

The 24 hour time period for the allowance minimizes the time during 

which a loss of offsite power could result in the loss of equipment 

energized from the affected AC vital bus while it takes into consideration 

the time required to perform an equalizing charge on the battery bank. 

The intent of this Note is to limit the number of inverters that may be 

disconnected. Only those inverters associated with the single battery 

undergoing an equalizing charge may be disconnected. All other 

inverters must be aligned to their associated batteries, regardless of the 

number of inverters or plant design. 
Inverters - Operating 

B 3.8.7 

BWR/6 STS B 3.8.7-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The inverters are required to be OPERABLE in MODES 1, 2, and 3 to 

ensure that: 

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and 

b. Adequate core cooling is provided, and containment OPERABILITY 

and other vital functions are maintained in the event of a postulated 

DBA. 

Inverter requirements for MODES 4 and 5 are covered in the Bases for 

LCO 3.8.8, "Inverters - Shutdown." 

ACTIONS A.1

With a required inverter inoperable, its associated AC vital bus becomes 

inoperable until it is manually re-energized from its [Class 1E constant 

voltage source transformer or inverter using internal AC source]. 

LCO 3.8.9 addresses this action; however, pursuant to LCO 3.0.6, these 

actions would not be entered even if the AC vital bus were de-energized. 

Therefore, the ACTIONS are modified by a Note stating that ACTIONS for 

LCO 3.8.9 must be entered immediately. This ensures the vital bus is reenergized within 2 hours. 

Required Action A.1 allows 24 hours to fix the inoperable inverter and 

return it to service. The 24 hour limit is based upon engineering 

judgment, taking into consideration the time required to repair an inverter 

and the additional risk to which the plant is exposed because of the 

inverter inoperability. This risk has to be balanced against the risk of an 

immediate shutdown, along with the potential challenges to safety 

systems that such a shutdown might entail. When the AC vital bus is 

powered from its constant voltage source, it is relying upon interruptible 

AC electrical power sources (offsite and onsite). The uninterruptible 

inverter source to the AC vital buses is the preferred source for powering 

instrumentation trip setpoint devices. 

B.1

With the Division 3 inverter inoperable, the associated Division 3 ECCS 

subsystem may be incapable of performing intended function and must 

be immediately declared inoperable. This also requires entry into 

applicable Conditions and Required Actions for LCO 3.5.1, "ECCS - 

Operating." 
Inverters - Operating 

B 3.8.7 

BWR/6 STS B 3.8.7-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

C.1 and C.2

If the inoperable devices or components cannot be restored to 

OPERABLE status within the associated Completion Time, the plant must 

be brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 12 hours and 

to MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

SURVEILLANCE SR 3.8.7.1

REQUIREMENTS 

This Surveillance verifies that the inverters are functioning properly with 

all required circuit breakers closed and AC vital buses energized from the 

inverter. The verification of proper voltage and frequency output ensures 

that the required power is readily available for the instrumentation 

connected to the AC vital buses. The 7 day Frequency takes into account 

the redundant capability of the inverters and other indications available in 

the control room that alert the operator to inverter malfunctions. 

REFERENCES 1. FSAR, Chapter [8]. 

 2. FSAR, Chapter [6]. 

 3. FSAR, Chapter [15]. 
Inverters - Shutdown 

B 3.8.8 

BWR/6 STS B 3.8.8-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.8 Inverters - Shutdown 

BASES 

BACKGROUND A description of the inverters is provided in the Bases for LCO 3.8.7, 

"Inverters - Operating." 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY accident analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [15] 

ANALYSES (Ref. 2), assume Engineered Safety Feature systems are OPERABLE. 

The DC to AC inverters are designed to provide the required capacity, 

capability, redundancy, and reliability to ensure the availability of 

necessary power to the Reactor Protection System and Emergency Core 

Cooling Systems instrumentation and controls so that the fuel, Reactor 

Coolant System, and containment design limits are not exceeded. 

The OPERABILITY of the inverters is consistent with the initial 

assumptions of the accident analyses and the requirements for the 

supported systems' OPERABILITY. 

The OPERABILITY of the minimum inverters to each AC vital bus during 

MODES 4 and 5 ensures that: 

a. The facility can be maintained in the shutdown or refueling condition 

for extended periods, 

b. Sufficient instrumentation and control capability are available for 

monitoring and maintaining the unit status, and 

c. Adequate power is available to mitigate events postulated during 

shutdown, such as an inadvertent draindown of the vessel or a fuel 

handling accident [involving handling recently irradiated fuel. Due to 

radioactive decay, the DC to AC inverters are only required to 

mitigate fuel handling accidents involving handling recently irradiated 

fuel (i.e., fuel that has occupied part of a critical reactor core within 

the previous [X] days)]. 

In general, when the unit is shut down, the Technical Specifications 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or all onsite power is not required. 

The rationale for this is based on the fact that many Design Basis 
Inverters - Shutdown 

B 3.8.8 

BWR/6 STS B 3.8.8-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

Accidents (DBAs) that are analyzed in MODES 1, 2, and 3 have no 

specific analyses in MODES 4 and 5. Worst case bounding events are 

deemed not credible in MODES 4 and 5 because the energy contained 

within the reactor pressure boundary, reactor coolant temperature and 

pressure, and the corresponding stresses result in the probabilities of 

occurrence being significantly reduced or eliminated, and in minimal 

consequences. These deviations from DBA analysis assumptions and 

design requirements during shutdown conditions are allowed by the LCO 

for required systems. 

The shutdown Technical Specification requirements are designed to 

ensure that the unit has the capability to mitigate the consequences of 

certain postulated accidents. Worst case DBAs which are analyzed for 

operating MODES are generally viewed not to be a significant concern 

during shutdown MODES due to the lower energies involved. The 

Technical Specifications therefore require a lesser complement of 

electrical equipment to be available during shutdown than is required 

during operating MODES. More recent work completed on the potential 

risks associated with shutdown, however, have found significant risk 

associated with certain shutdown evolutions. As a result, in addition to 

the requirements established in the Technical Specifications, the industry 

has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess 

Shutdown Management," as an Industry initiative to manage shutdown 

tasks and associated electrical support to maintain risk at an acceptable 

low level. This may require the availability of additional equipment 

beyond that required by the shutdown Technical Specifications. 

The inverters were previously identified as part of the Distribution System 

and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The inverter[s] ensure the availability of electrical power for the 

instrumentation for systems required to shut down the reactor and 

maintain it in a safe condition after an anticipated operational occurrence 

or postulated DBA. The battery powered inverter[s] provide[s] 

uninterruptible supply of AC electrical power to the AC vital bus[es] even 

if the 4.16 kV safety buses are de-energized. OPERABLE inverters 

require the AC vital bus be powered by the inverter through inverted DC 

voltage. This ensures the availability of sufficient inverter power sources 

to operate the plant in a safe manner and to mitigate the consequences of 

postulated events during shutdown (e.g., fuel handling accidents 

[involving handling recently irradiated fuel] and inadvertent reactor vessel 

draindown). 
Inverters - Shutdown 

B 3.8.8 

BWR/6 STS B 3.8.8-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY The inverter[s] required to be OPERABLE in MODES 4 and 5 and also 

any time during movement of [recently] irradiated fuel assemblies in the 

[primary or secondary] containment provide assurance that: 

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel in the core in case of an inadvertent draindown 

of the reactor vessel, 

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available, 

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and 

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition. 

Inverter requirements for MODES 1, 2, and 3 are covered in LCO 3.8.7. 

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, or 3, the fuel movement is independent 

of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, or 3 

would require the unit to be shutdown unnecessarily. 

A.1, A.2.1, A.2.2, A.2.3, and A.2.4

[If two divisions are required by LCO 3.8.10, "Distribution Systems - 

Shutdown," the remaining OPERABLE inverters may be capable of 

supporting sufficient required feature(s) to allow continuation of CORE 

ALTERATIONS, [recently] irradiated fuel movement, and operations with 

a potential for draining the reactor vessel.] By the allowance of the option 

to declare required feature(s) inoperable with the associated inverter(s) 

inoperable, appropriate restrictions are implemented in accordance with 

the affected required feature(s) of the LCOs' ACTIONS. In many 

instances, this option may involve undesired administrative efforts. 

Therefore, the allowance for sufficiently conservative actions is made 

(i.e., to suspend CORE ALTERATIONS, movement of [recently] irradiated 

fuel assemblies in the [primary or secondary] containment, and any 

activities that could result in inadvertent draining of the reactor vessel). 
Inverters - Shutdown 

B 3.8.8 

BWR/6 STS B 3.8.8-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Suspension of these activities shall not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required inverter[s] and to 

continue this action until restoration is accomplished in order to provide 

the necessary inverter power to the plant safety systems. 

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required 

inverters should be completed as quickly as possible in order to minimize 

the time the plant safety systems may be without power or powered from 

a constant voltage source transformer. 

SURVEILLANCE SR 3.8.8.1

REQUIREMENTS 

This Surveillance verifies that the inverters are functioning properly with 

all required circuit breakers closed and AC vital buses energized from the 

inverter. The verification of proper voltage and frequency output ensures 

that the required power is readily available for the instrumentation 

connected to the AC vital buses. The 7 day Frequency takes into account 

the redundant capability of the inverters and other indications available in 

the control room that alert the operator to inverter malfunctions. 

REFERENCES 1. FSAR, Chapter [6]. 

 2. FSAR, Chapter [15]. 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.9 Distribution Systems - Operating 

BASES 

BACKGROUND The onsite Class 1E AC and DC electrical power distribution system is 

divided by division into three independent AC, DC, and AC vital bus 

electrical power distribution subsystems. 

The primary AC electrical power distribution subsystem for each division 

consists of a 4.16 kV Engineered Safety Feature (ESF) bus that has at 

least one separate and independent offsite source of power, as well as a 

dedicated onsite diesel generator (DG) source. Each 4.16 kV ESF bus is 

normally connected to a preferred source. If all offsite sources are 

unavailable, the onsite emergency DGs supply power to the 4.16 kV ESF 

buses. Control power for the 4.16 kV breakers is supplied from the 

Class 1E batteries. Additional description of this system may be found in 

the Bases for LCO 3.8.1, "AC Sources - Operating," and the Bases for 

LCO 3.8.4, "DC Sources - Operating." 

The secondary plant AC distribution subsystem includes 480 V ESF load 

centers and associated loads, motor control centers, distribution panels, 

and transformers. 

The 120 VAC vital buses 2YV1, 2YV2, 2YV3, and 2YV4 are arranged in 

four load groups and are normally powered from DC. The alternate 

power supply for the vital buses is a Class 1E constant voltage source 

transformer powered from the same division as the associated inverter; 

its use is governed by LCO 3.8.7, "Inverters - Operating." Each constant 

voltage source transformer is powered from AC. 

There are three independent 125 VDC electrical power distribution 

subsystems. Each subsystem consists of a 125 V bus and associated 

distribution panels. The list of all distribution buses is located in 

Table B 3.8.9-1. 

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [15] (Ref. 2), 

ANALYSES assume ESF systems are OPERABLE. The AC, DC, and AC vital bus 

electrical power distribution systems are designed to provide sufficient 

capacity, capability, redundancy, and reliability to ensure the availability of 

necessary power to ESF systems so that the fuel, Reactor Coolant 

System, and containment design limits are not exceeded. These limits 

are discussed in more detail in the Bases for Section 3.2, Power 

Distribution Limits; Section 3.4, Reactor Coolant System (RCS); and 

Section 3.6, Containment Systems. 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

The OPERABILITY of the AC, DC, and AC vital bus electrical power 

distribution systems is consistent with the initial assumptions of the 

accident analyses and is based upon meeting the design basis of the 

plant. This includes maintaining the AC and DC electrical power sources 

and associated distribution systems OPERABLE during accident 

conditions in the event of: 

a. An assumed loss of all offsite or onsite AC electrical power and 

b. A worst case single failure. 

The AC, DC, and AC vital bus electrical power distribution systems satisfy 

Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO The required AC, DC, and AC vital bus power distribution subsystems 

listed in Table B 3.8.9-1 ensure the availability of AC, DC, and AC vital 

bus electrical power for the systems required to shut down the reactor 

and maintain it in a safe condition after an anticipated operational 

occurrence (AOO) or a postulated DBA. The Division 1, 2, and 3 AC, DC, 

and AC vital bus electrical power primary distribution subsystems are 

required to be OPERABLE. 

Maintaining the Division 1, 2, and 3 AC, DC, and AC vital bus electrical 

power distribution subsystems OPERABLE ensures that the redundancy 

incorporated into the design of ESF is not defeated. Any two of the three 

divisions of the distribution system are capable of providing the necessary 

electrical power to the associated ESF components. Therefore, a single 

failure within any system or within the electrical power distribution 

subsystems does not prevent safe shutdown of the reactor. 

OPERABLE AC, electrical power distribution subsystems require the 

associated buses, including any load centers, motor control centers, and 

distribution panels, to be energized to their proper voltages. OPERABLE 

DC electrical power distribution subsystems require the associated buses 

to be energized to their proper voltage from either the associated battery 

or charger. OPERABLE vital bus electrical power distribution subsystems 

require the associated buses to be energized to their proper voltage from 

the associated [inverter via inverted DC voltage, inverter using internal 

AC source, or Class 1E constant voltage transformer]. 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

In addition, tie breakers between redundant safety related AC, DC, and 

AC vital bus power distribution subsystems, if they exist, must be open. 

This prevents any electrical malfunction in any power distribution 

subsystem from propagating to the redundant subsystem, which could 

cause the failure of a redundant subsystem and a loss of essential safety 

function(s). If any tie breakers are closed, the affected redundant 

electrical power distribution subsystems are considered inoperable. This 

applies to the onsite, safety related, redundant electrical power 

distribution subsystems. It does not, however, preclude redundant 

Class 1E 4.16 kV buses from being powered from the same offsite circuit. 

APPLICABILITY The electrical power distribution subsystems are required to be 

OPERABLE in MODES 1, 2, and 3 to ensure that: 

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and 

b. Adequate core cooling is provided, and containment OPERABILITY 

and other vital functions are maintained, in the event of a postulated 

DBA. 

Electrical power distribution subsystem requirements for MODES 4 and 5 

are covered in the Bases for LCO 3.8.10, "Distribution Systems - 

Shutdown." 

ACTIONS A.1

With one or more Division 1 and 2 required AC buses, load centers, 

motor control centers, or distribution panels (except AC vital buses), in 

one division inoperable and a loss of function has not occurred, the 

remaining AC electrical power distribution subsystems are capable of 

supporting the minimum safety functions necessary to shut down the 

reactor and maintain it in a safe shutdown condition, assuming no single 

failure. The overall reliability is reduced, however, because a single 

failure in the remaining power distribution subsystems could result in the 

minimum required ESF functions not being supported. Therefore, the 

required AC buses, load centers, motor control centers, and distribution 

panels must be restored to OPERABLE status within 8 hours. 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

The Condition A worst scenario is one division without AC power (i.e., no 

offsite power to the division and the associated DG inoperable). In this 

Condition, the unit is more vulnerable to a complete loss of AC power. It 

is, therefore, imperative that the unit operators' attention be focused on 

minimizing the potential for loss of power to the remaining division by 

stabilizing the unit, and on restoring power to the affected division. The 

8 hour time limit before requiring a unit shutdown in this Condition is 

acceptable because: 

a. There is potential for decreased safety if the unit operators' attention 

is diverted from the evaluations and actions necessary to restore 

power to the affected division to the actions associated with taking 

the unit to shutdown within this time limit. 

b. The potential for an event in conjunction with a single failure of a 

redundant component in the division with AC power. (The redundant 

component is verified OPERABLE in accordance with 

Specification 5.5.12, "Safety Function Determination Program 

(SFDP).") 

The second Completion Time for Required Action A.1 establishes a limit 

on the maximum time allowed for any combination of required distribution 

subsystems to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition A is entered while, for instance, a 

DC bus is inoperable and subsequently returned OPERABLE, the LCO 

may already have been not met for up to 2 hours. This situation could 

lead to a total duration of 10 hours, since initial failure of the LCO, to 

restore the AC distribution system. At this time, a DC circuit could again 

become inoperable, and AC distribution could be restored OPERABLE. 

This could continue indefinitely. 

This Completion Time allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." This results in establishing 

the "time zero" at the time the LCO was initially not met, instead of at the 

time Condition A was entered. The 16 hour Completion Time is an 

acceptable limitation on this potential to fail to meet the LCO indefinitely. 

Required Action A.1 is modified by a Note that requires the applicable 

Conditions and Required Actions of LCO 3.8.4, "DC Sources - Operating," 

to be entered for DC divisions made inoperable by inoperable power 

distribution subsystems. This is an exception to LCO 3.0.6 and ensures 

the proper actions are taken for these components. Inoperability of a 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-5 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

distribution system can result in loss of charging power to batteries and 

eventual loss of DC power. This Note ensures that the appropriate 

attention is given to restoring charging power to batteries, if necessary, 

after loss of distribution systems. 

[ B.1

With one or more Division 1 and 2 AC vital buses inoperable, and a loss 

of function has not yet occurred, the remaining OPERABLE AC vital 

buses are capable of supporting the minimum safety functions necessary 

to shut down and maintain the unit in the safe shutdown condition. 

Overall reliability is reduced, however, because an additional single 

failure could result in the minimum required ESF functions not being 

supported. Therefore, the required AC vital bus must be restored to 

OPERABLE status within 2 hours by powering the bus from the 

associated [inverter via inverted DC, inverter using internal AC source, or 

Class 1E constant voltage transformer]. 

Condition B represents one or more AC vital buses without power; 

potentially both the DC source and the associated AC source 

nonfunctioning. In this situation, the plant is significantly more vulnerable 

to a complete loss of all noninterruptible power. It is, therefore, 

imperative that the operator's attention focus on stabilizing the plant, 

minimizing the potential for loss of power to the remaining vital buses, 

and restoring power to the affected vital bus. 

This 2 hour limit is more conservative than Completion Times allowed for 

the majority of components that are without adequate vital AC power. 

Taking exception to LCO 3.0.2 for components without adequate AC vital 

power, that would have Required Action Completion Times shorter than 

2 hours if declared inoperable, is acceptable because of: 

[ a. The potential for decreased safety when requiring a change in plant 

conditions (i.e., requiring a shutdown) while not allowing stable 

operations to continue, 

b. The potential for decreased safety when requiring entry into 

numerous applicable Conditions and Required Actions for 

components without adequate vital AC power, while not providing 

sufficient time for the operators to perform the necessary evaluations 

and actions to restore power to the affected division, and 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-6 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

c. The potential for an event in conjunction with a single failure of a 

redundant component. 

The 2 hour Completion Time takes into account the importance to safety 

of restoring the AC vital bus to OPERABLE status, the redundant 

capability afforded by the other OPERABLE vital buses, and the low 

probability of a DBA occurring during this period. 

The second Completion Time for Required Action B.1 establishes a limit 

on the maximum time allowed for any combination of required distribution 

subsystems to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition B is entered while, for instance, an 

AC bus is inoperable and subsequently returned OPERABLE, the LCO 

may already have been not met for up to 8 hours. This situation could 

lead to a total duration of 10 hours, since initial failure of the LCO, for 

restoring the vital bus distribution system. At this time, an AC division 

could again become inoperable, and vital bus distribution could be 

restored to OPERABLE. This could continue indefinitely. 

This Completion Time allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." This allowance results in 

establishing the "time zero" at the time the LCO was initially not met, 

instead of at the time that Condition B was entered. The 16 hour 

Completion Time is an acceptable limitation on this potential of failing to 

meet the LCO indefinitely. ]

C.1

With one or more Division 1 and 2 DC buses or distribution panels in one 

[division] inoperable, and a loss of function has not yet occurred, the 

remaining DC electrical power distribution subsystems are capable of 

supporting the minimum safety functions necessary to shut down the 

reactor and maintain it in a safe shutdown condition, assuming no single 

failure. The overall reliability is reduced, however, because a single 

failure in the remaining DC electrical power distribution subsystems could 

result in the minimum required ESF functions not being supported. 

Therefore, the required DC buses and distribution panels must be 

restored to OPERABLE status within 2 hours by powering the bus from 

the associated battery or charger. 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-7 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition C represents one or more DC buses or distribution panels 

without adequate DC power, potentially with both the battery significantly 

degraded and the associated charger nonfunctioning. In this situation, 

the plant is significantly more vulnerable to a complete loss of all DC 

power. It is, therefore, imperative that the operator's attention focus on 

stabilizing the plant, minimizing the potential for loss of power to the 

remaining divisions, and restoring power to the affected division. 

This 2 hour limit is more conservative than Completion Times allowed for 

the majority of components that could be without power. Taking 

exception to LCO 3.0.2 for components without adequate DC power, that 

would have Required Action Completion Times shorter than 2 hours, is 

acceptable because of: 

a. The potential for decreased safety when requiring a change in plant 

conditions (i.e., requiring a shutdown) while not allowing stable 

operations to continue, 

b. The potential for decreased safety when requiring entry into 

numerous applicable Conditions and Required Actions for 

components without DC power while not providing sufficient time for 

the operators to perform the necessary evaluations and actions for 

restoring power to the affected division, and 

c. The potential for an event in conjunction with a single failure of a 

redundant component. 

The 2 hour Completion Time for DC buses is consistent with Regulatory 

Guide 1.93 (Ref. 3). 

The second Completion Time for Required Action C.1 establishes a limit 

on the maximum time allowed for any combination of required distribution 

subsystems to be inoperable during any single contiguous occurrence of 

failing to meet the LCO. If Condition C is entered while, for instance, an 

AC bus is inoperable and subsequently returned OPERABLE, the LCO 

may already have been not met for up to 8 hours. This situation could 

lead to a total duration of 10 hours, since initial failure of the LCO, to 

restore the DC distribution system. At this time, an AC division could 

again become inoperable, and DC distribution could be restored 

OPERABLE. This could continue indefinitely. 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-8 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

This Completion Time allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." This allowance results in 

establishing the "time zero" at the time the LCO was initially not met, 

instead of the time Condition C was entered. The 16 hour Completion 

Time is an acceptable limitation on this potential of failing to meet the 

LCO indefinitely. 

D.1 and D.2

If the inoperable electrical power distribution system cannot be restored to 

OPERABLE status within the associated Completion Times, the plant 

must be bought to a MODE in which the LCO does not apply. To achieve 

this status, the plant must be brought to at least MODE 3 within 12 hours 

and to MODE 4 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. 

E.1

With the Division 3 electrical power distribution system inoperable, the 

Division 3 powered systems are not capable of performing their intended 

functions. Immediately declaring the high pressure core spray inoperable 

allows the ACTIONS of LCO 3.5.1, "ECCS - Operating," to apply 

appropriate limitations on continued reactor operation. 

F.1

Condition F corresponds to a level of degradation in the electrical 

distribution system that causes a required safety function to be lost. 

(Single division systems are not included, although for this Action, 

Division 3 is considered redundant to Division 1 and 2 ECCS.) When two 

or more inoperable electrical power distribution subsystems result in the 

loss of a required function, the plant is in a condition outside the accident 

analysis. Therefore, no additional time is justified for continued operation. 

LCO 3.0.3 must be entered immediately to commence a controlled 

shutdown. 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-9 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.8.9.1

REQUIREMENTS 

Meeting this Surveillance verifies that the AC, DC, and AC vital bus 

electrical power distribution systems are functioning properly, with the 

correct circuit breaker alignment. The correct breaker alignment ensures 

the appropriate separation and independence of the electrical divisions is 

maintained, and the appropriate voltage is available to each required bus. 

The verification of proper voltage availability on the buses ensures that 

the required voltage is readily available for motive as well as control 

functions for critical system loads connected to these buses. The 7 day 

Frequency takes into account the redundant capability of the AC, DC, and 

AC vital bus electrical power distribution subsystems, and other 

indications available in the control room that alert the operator to 

subsystem malfunctions. 

REFERENCES 1. FSAR, Chapter [6]. 

 2. FSAR, Chapter [15]. 

 3. Regulatory Guide 1.93, December 1974. 
Distribution Systems - Operating 

B 3.8.9 

BWR/6 STS B 3.8.9-10 Rev. 3.0, 03/31/04 

Table B 3.8.9-1 (page 1 of 1) 

AC and DC Electrical Power Distribution Systems 

TYPE VOLTAGE [DIVISION 1]* [DIVISION 2]* 

AC safety buses [4160 V] [ESF Bus] [NB01] [ESF Bus] [NB02] 

 [480 V] Load Centers 

[NG01, NG03] 

Load Centers 

[NG02, NG04] 

 [480 V] Motor Control 

Centers 

[NG01A, NG01I, 

NG01B, NG03C, 

NG03I, NG03D] 

Motor Control 

Centers 

[NG02A, NG02I, 

NG02B, NG04C, 

NG04I, NG04D] 

 [120 V] Distribution Panels 

[NP01, NP03] 

Distribution Panels 

[NP02, NP04] 

DC buses [125 V] Bus [NK01] Bus [NK02] 

 Bus [NK03] Bus [NK04] 

 Distribution Panels 

[NK41, NK43, NK51] 

Distribution Panels 

[NK42, NK44, NK52] 

AC vital buses [120 V] Bus [NN01] Bus [NN02] 

 Bus [NN03] Bus [NN04] 

* Each division of the AC and DC electrical power distribution systems is a subsystem. 
Distribution Systems - Shutdown 

B 3.8.10 

BWR/6 STS B 3.8.10-1 Rev. 3.0, 03/31/04 

B 3.8 ELECTRICAL POWER SYSTEMS 

B 3.8.10 Distribution Systems - Shutdown 

BASES 

BACKGROUND A description of the AC, DC, and AC vital bus electrical power distribution 

systems is provided in the Bases for LCO 3.8.9, "Distribution Systems - 

Operating." 

APPLICABLE The initial conditions of Design Basis Accident and transient analyses in 

SAFETY the FSAR, Chapter [6] (Ref. 1) and Chapter [15] (Ref. 2), assume 

ANALYSES Engineered Safety Feature (ESF) systems are OPERABLE. The AC, DC, 

and AC vital bus electrical power distribution systems are designed to 

provide sufficient capacity, capability, redundancy, and reliability to 

ensure the availability of necessary power to ESF systems so that the 

fuel, Reactor Coolant System, and containment design limits are not 

exceeded. 

The OPERABILITY of the AC, DC, and AC vital bus electrical power 

distribution system is consistent with the initial assumptions of the 

accident analyses and the requirements for the supported systems' 

OPERABILITY. 

The OPERABILITY of the minimum AC, DC, and AC vital bus electrical 

power sources and associated power distribution subsystems during 

MODES 4 and 5, and during movement of [recently] irradiated fuel 

assemblies in the primary or secondary containment ensures that: 

a. The facility can be maintained in the shutdown or refueling condition 

for extended periods, 

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and 

c. Adequate power is provided to mitigate events postulated during 

shutdown, such as an inadvertent draindown of the vessel or a fuel 

handling accident [involving handling recently irradiated fuel. Due to 

radioactive decay, AC and DC electrical power is only required to 

mitigate fuel handling accidents involving handling recently irradiated 

fuel (i.e., fuel that has occupied part of a critical reactor core within 

the previous [X] days)]. 

The AC and DC electrical power distribution systems satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
Distribution Systems - Shutdown 

B 3.8.10 

BWR/6 STS B 3.8.10-2 Rev. 3.0, 03/31/04 

BASES 

LCO Various combinations of subsystems, equipment, and components are 

required OPERABLE by other LCOs, depending on the specific plant 

condition. Implicit in those requirements is the required OPERABILITY of 

necessary support required features. This LCO explicitly requires 

energization of the portions of the electrical distribution system necessary 

to support OPERABILITY of Technical Specifications' required systems, 

equipment, and components - both specifically addressed by their own 

LCOs, and implicitly required by the definition of OPERABILITY. 

Maintaining these portions of the distribution system energized ensures 

the availability of sufficient power to operate the plant in a safe manner to 

mitigate the consequences of postulated events during shutdown (e.g., 

fuel handling accidents [involving handling recently irradiated fuel] and 

inadvertent reactor vessel draindown). 

APPLICABILITY The AC and DC electrical power distribution subsystems required to be 

OPERABLE in MODES 4 and 5 and during movement of [recently] 

irradiated fuel assemblies in the [secondary] containment provide 

assurance that: 

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel in the core in case of an inadvertent draindown 

of the reactor vessel, 

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available, 

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and 

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown or refueling condition. 

The AC, DC, and AC vital bus electrical power distribution subsystem 

requirements for MODES 1, 2, and 3 are covered in LCO 3.8.9. 

ACTIONS LCO 3.0.3 is not applicable while in MODE 4 or 5. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, or 3, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, or 3, the fuel movement is independent 

of reactor operations. Entering LCO 3.0.3, while in MODE 1, 2, or 3 

would require the unit to be shutdown unnecessarily. 
Distribution Systems - Shutdown 

B 3.8.10 

BWR/6 STS B 3.8.10-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5

Although redundant required features may require redundant divisions of 

electrical power distribution subsystems to be OPERABLE, one 

OPERABLE distribution subsystem division may be capable of supporting 

sufficient required features to allow continuation of CORE 

ALTERATIONS, [recently] irradiated fuel movement, and operations with 

a potential for draining the reactor vessel. By allowing the option to 

declare required features associated with an inoperable distribution 

subsystem inoperable, appropriate restrictions are implemented in 

accordance with the affected distribution subsystem LCO's Required 

Actions. In many instances, this option may involve undesired 

administrative efforts. Therefore, the allowance for sufficiently 

conservative actions is made (i.e., to suspend CORE ALTERATIONS, 

movement of [recently] irradiated fuel assemblies in the [primary or 

secondary] containment and any activities that could result in inadvertent 

draining of the reactor vessel). 

Suspension of these activities shall not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required AC and DC electrical 

power distribution subsystems and to continue this action until restoration 

is accomplished in order to provide the necessary power to the plant 

safety systems. 

Notwithstanding performance of the above conservative Required 

Actions, a required residual heat removal - shutdown cooling (RHR-SDC) 

subsystem may be inoperable. In this case, Required Actions A.2.1 

through A.2.4 do not adequately address the concerns relating to coolant 

circulation and heat removal. Pursuant to LCO 3.0.6, the RHR-SDC 

ACTIONS would not be entered. Therefore, Required Action A.2.5 is 

provided to direct declaring RHR-SDC inoperable, which results in taking 

the appropriate RHR-SDC ACTIONS. 

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required 

distribution subsystems should be completed as quickly as possible in 

order to minimize the time the plant safety systems may be without 

power. 
Distribution Systems - Shutdown 

B 3.8.10 

BWR/6 STS B 3.8.10-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.8.10.1

REQUIREMENTS 

This Surveillance verifies that the AC, DC, and AC vital bus electrical 

power distribution subsystem is functioning properly, with the buses 

energized. The verification of proper voltage availability on the buses 

ensures that the required power is readily available for motive as well as 

control functions for critical system loads connected to these buses. The 

7 day Frequency takes into account the redundant capability of the 

electrical power distribution subsystems, as well as other indications 

available in the control room that alert the operator to subsystem 

malfunctions. 

REFERENCES 1. FSAR, Chapter [6]. 

 2. FSAR, Chapter [15]. 
Refueling Equipment Interlocks 

B 3.9.1 

BWR/6 STS B 3.9.1-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.1 Refueling Equipment Interlocks 

BASES 

BACKGROUND Refueling equipment interlocks restrict the operation of the refueling 

equipment or the withdrawal of control rods to reinforce unit procedures in 

preventing the reactor from achieving criticality during refueling. The 

refueling interlock circuitry senses the conditions of the refueling 

equipment and the control rods. Depending on the sensed conditions, 

interlocks are actuated to prevent the operation of the refueling 

equipment or the withdrawal of control rods. 

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required 

independent reactivity control systems be capable of holding the reactor 

core subcritical under cold conditions (Ref. 1). The control rods, when 

fully inserted, serve as the system capable of maintaining the reactor 

subcritical in cold conditions during all fuel movement activities and 

accidents. 

Two channels of instrumentation are provided to sense the position of the 

refueling platform, the loading of the refueling platform main hoist, and the 

full insertion of all control rods. With the reactor mode switch in the 

shutdown or refueling position, the indicated conditions are combined in 

logic circuits to determine if all restrictions on refueling equipment 

operations and control rod insertion are satisfied. 

A control rod not at its full-in position interrupts power to the refueling 

equipment and prevents operating the equipment over the reactor core 

when loaded with a fuel assembly. Conversely, the refueling equipment 

located over the core and loaded with fuel inserts a control rod withdrawal 

block in the Control Rod Drive System to prevent withdrawing a control 

rod. 

The refueling platform has two mechanical switches that open before the 

platform and the fuel grapple are physically located over the reactor 

vessel. The main hoist has two switches that open when the hoist is 

loaded with fuel. The refueling interlocks use these indications to prevent 

operation of the refueling equipment with fuel loaded over the core 

whenever any control rod is withdrawn, or to prevent control rod 

withdrawal whenever fuel loaded refueling equipment is over the core 

(Ref. 2). 

The hoist switches open at a load lighter than the weight of a single fuel 

assembly in water. 
Refueling Equipment Interlocks 

B 3.9.1 

BWR/6 STS B 3.9.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE The refueling interlocks are explicitly assumed in the FSAR analysis of 

SAFETY the control rod removal error during refueling (Ref. 3). This analysis 

ANALYSES evaluates the consequences of control rod withdrawal during refueling. A 

prompt reactivity excursion during refueling could potentially result in fuel 

failure with subsequent release of radioactive material to the environment. 

Criticality and, therefore, subsequent prompt reactivity excursions are 

prevented during the insertion of fuel, provided all control rods are fully 

inserted during the fuel insertion. The refueling interlocks accomplish this 

by preventing loading fuel into the core with any control rod withdrawn, or 

by preventing withdrawal of a rod from the core during fuel loading. 

The refueling platform location switches activate at a point outside of the 

reactor core, such that, considering switch hysteresis and maximum 

platform momentum toward the core at the time of power loss with a fuel 

assembly loaded and a control rod withdrawn, the fuel is not over the 

core. 

Refueling equipment interlocks satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO To prevent criticality during refueling, the refueling interlocks ensure that 

fuel assemblies are not loaded with any control rod withdrawn. 

To prevent these conditions from developing, the all-rods-in, the refueling 

platform position, and the refueling platform main hoist fuel loaded inputs 

are required to be OPERABLE. These inputs are combined in logic 

circuits that provide refueling equipment or control rod blocks to prevent 

operations that could result in criticality during refueling operations. 

APPLICABILITY In MODE 5, a prompt reactivity excursion could cause fuel damage and 

subsequent release of radioactive material to the environment. The 

refueling equipment interlocks protect against prompt reactivity 

excursions during MODE 5. The interlocks are only required to be 

OPERABLE during in-vessel fuel movement with refueling equipment 

associated with the interlocks. 

In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no 

fuel loading activities are possible. Therefore, the refueling interlocks are 

not required to be OPERABLE in these MODES. 
Refueling Equipment Interlocks 

B 3.9.1 

BWR/6 STS B 3.9.1-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1, A.2.1, and A.2.2

With one or more of the required refueling equipment interlocks 

inoperable, the unit must be placed in a condition in which the LCO does 

not apply. Therefore, Required Action A.1 requires that in-vessel fuel 

movement with the affected refueling equipment must be immediately 

suspended. This action ensures that operations are not performed with 

equipment that would potentially not be blocked from unacceptable 

operations (e.g., loading fuel into a cell with a control rod withdrawn). 

Suspension of in-vessel fuel movement shall not preclude completion of 

movement of a component to a safe position. 

Alternatively, Required Actions A.2.1 and A.2.2 require a control rod 

withdrawal block to be inserted, and all control rods to be subsequently 

verified to be fully inserted. Required Action A.2.1 ensures no control 

rods can be withdrawn, because a block to control rod withdrawal is in 

place. The withdrawal block utilized must ensure that if rod withdrawal is 

requested, the rod will not respond (i.e., it will remain inserted). Required 

Action A.2.2 is performed after placing the rod withdrawal block in effect, 

and provides a verification that all control rods are fully inserted. This 

verification that all control rods are fully inserted is in addition to the 

periodic verifications required by SR 3.9.3.1. 

Like Required Action A.1, Required Actions A.2.1 and A.2.2 ensure 

unacceptable operations are blocked (e.g., loading fuel into a cell with the 

control rod withdrawn). 

SURVEILLANCE SR 3.9.1.1

REQUIREMENTS 

Performance of a CHANNEL FUNCTIONAL TEST demonstrates each 

required refueling equipment interlock will function properly when a 

simulated or actual signal indicative of a required condition is injected into 

the logic. A successful test of the required contact(s) of a channel relay 

may be performed by the verification of the change of state of a single 

contact of the relay. This clarifies what is an acceptable CHANNEL 

FUNCTIONAL TEST of a relay. This is acceptable because all of the 

other required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per 

refueling interval with applicable extensions. The CHANNEL 

FUNCTIONAL TEST may be performed by any series of sequential, 

overlapping, or total channel steps so that the entire channel is tested. 

The 7 day Frequency is based on engineering judgment and is 

considered adequate in view of other indications of refueling interlocks 

and their associated input status that are available to unit operations 

personnel. 
Refueling Equipment Interlocks 

B 3.9.1 

BWR/6 STS B 3.9.1-4 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 

 2. FSAR, Section [7.6.1.1]. 

 3. FSAR, Section [15.4.1.1]. 
Refuel Position One-Rod-Out Interlock 

B 3.9.2 

BWR/6 STS B 3.9.2-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.2 Refuel Position One-Rod-Out Interlock 

BASES 

BACKGROUND The refuel position one-rod-out interlock restricts the movement of control 

rods to reinforce unit procedures that prevent the reactor from becoming 

critical during refueling operations. During refueling operations, no more 

than one control rod is permitted to be withdrawn. 

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required 

independent reactivity control systems be capable of holding the reactor 

core subcritical under cold conditions (Ref. 1). The control rods serve as 

the system capable of maintaining the reactor subcritical in cold 

conditions. 

The refuel position one-rod-out interlock prevents the selection of a 

second control rod for movement when any other control rod is not fully 

inserted (Ref. 2). It is a logic circuit that has redundant channels. It uses 

the all-rods-in signal (from the control rod full-in position indicators 

discussed in LCO 3.9.4, "Control Rod Position Indication") and a rod 

selection signal (from the Rod Control and Information System). 

This Specification ensures that the performance of the refuel position 

one-rod-out interlock in the event of a Design Basis Accident meets the 

assumptions used in the safety analysis of Reference 3. 

APPLICABLE The refuel position one-rod-out interlock is explicitly assumed in the 

SAFETY FSAR analysis of the control rod withdrawal error during refueling 

ANALYSES (Ref. 3). This analysis evaluates the consequences of control rod 

withdrawal during refueling. A prompt reactivity excursion during 

refueling could potentially result in fuel failure with subsequent release of 

radioactive material to the environment. 

The refuel position one-rod-out interlock and adequate SDM (LCO 3.1.1, 

"SHUTDOWN MARGIN (SDM)") prevent criticality by preventing 

withdrawal of more than one control rod. With one control rod withdrawn, 

the core will remain subcritical, thereby preventing any prompt critical 

excursion. 

The refuel position one-rod-out interlock satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 
Refuel Position One-Rod-Out Interlock 

B 3.9.2 

BWR/6 STS B 3.9.2-2 Rev. 3.0, 03/31/04 

BASES 

LCO To prevent criticality during MODE 5, the refuel position one-rod-out 

interlock ensures no more than one control rod may be withdrawn. At 

least one channel of the refuel position one-rod-out interlock is required to 

be OPERABLE and the reactor mode switch must be locked in the refuel 

position to support the OPERABILITY of these channels. 

APPLICABILITY In MODE 5, with the reactor mode switch in the refuel position, the 

OPERABLE refuel position one-rod-out interlock provides protection 

against prompt reactivity excursions. 

In MODES 1, 2, 3, and 4, the refuel position one-rod-out interlock is not 

required to be OPERABLE and is bypassed. In MODES 1 and 2, the 

Reactor Protection System (LCO 3.3.1.1) and the control rods 

(LCO 3.1.3) provide mitigation of potential reactivity excursions. In 

MODES 3 and 4, with the reactor mode switch in the shutdown position, a 

control rod block (LCO 3.3.2.1) ensures all control rods are inserted, 

thereby preventing criticality during shutdown conditions. 

ACTIONS A.1 and A.2

With the refuel position one-rod-out interlock inoperable, the refueling 

interlocks are not capable of preventing more than one control rod from 

being withdrawn. This condition may lead to criticality. 

Control rod withdrawal must be immediately suspended, and action must 

be immediately initiated to fully insert all insertable control rods in core 

cells containing one or more fuel assemblies. Action must continue until 

all such control rods are fully inserted. Control rods in core cells 

containing no fuel assemblies do not affect the reactivity of the core and, 

therefore, do not have to be inserted. 

SURVEILLANCE SR 3.9.2.1

REQUIREMENTS 

Proper functioning of the refueling position one-rod-out interlock requires 

the reactor mode switch to be in Refuel. During control rod withdrawal in 

MODE 5, improper positioning of the reactor mode switch could, in some 

instances, allow improper bypassing of required interlocks. Therefore, 

this Surveillance imposes an additional level of assurance that the 

refueling position one-rod-out interlock will be OPERABLE when required. 

By "locking" the reactor mode switch in the proper position (i.e., removing 

the reactor mode switch key from the console while the reactor mode 

switch is positioned in refuel), an additional administrative control is in 

place to preclude operator errors from resulting in unanalyzed operation. 
Refuel Position One-Rod-Out Interlock 

B 3.9.2 

BWR/6 STS B 3.9.2-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

The Frequency of 12 hours is sufficient in view of other administrative 

controls utilized during refueling operations to ensure safe operation. 

SR 3.9.2.2

Performance of a CHANNEL FUNCTIONAL TEST on each channel 

demonstrates the associated refuel position one-rod-out interlock will 

function properly when a simulated or actual signal indicative of a 

required condition is injected into the logic. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable CHANNEL FUNCTIONAL TEST of a relay. 

This is acceptable because all of the other required contacts of the relay 

are verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. The CHANNEL FUNCTIONAL TEST may be performed by 

any series of sequential, overlapping, or total channel steps so that the 

entire channel is tested. The 7 day Frequency is considered adequate 

because of demonstrated circuit reliability, procedural controls on control 

rod withdrawals, and visual and audible indications available in the control 

room to alert the operator of control rods not fully inserted. To perform 

the required testing, the applicable condition must be entered (i.e., a 

control rod must be withdrawn from its full-in position). Therefore, 

SR 3.9.2.1 has been modified by a Note that states the CHANNEL 

FUNCTIONAL TEST is not required to be performed until 1 hour after any 

control rod is withdrawn. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 

 2. FSAR, Section [7.6.1.1]. 

 3. FSAR, Section [15.4.1.1]. 
Control Rod Position 

B 3.9.3 

BWR/6 STS B 3.9.3-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.3 Control Rod Position 

BASES 

BACKGROUND Control rods provide the capability to maintain the reactor subcritical 

under all conditions and to limit the potential amount and rate of reactivity 

increase caused by a malfunction in the Control Rod Drive System. 

During refueling, movement of control rods is limited by the refueling 

interlocks (LCO 3.9.1 and LCO 3.9.2) or the control rod block with the 

reactor mode switch in the shutdown position (LCO 3.3.2.1). 

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required 

independent reactivity control systems be capable of holding the reactor 

core subcritical under cold conditions (Ref. 1). The control rods serve as 

the system capable of maintaining the reactor subcritical in cold 

conditions. 

The refueling interlocks allow a single control rod to be withdrawn at any 

time unless fuel is being loaded into the core. To preclude loading fuel 

assemblies into the core with a control rod withdrawn, all control rods 

must be fully inserted. This prevents the reactor from achieving criticality 

during refueling operations. 

APPLICABLE Prevention and mitigation of prompt reactivity excursions during refueling 

SAFETY are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the 

ANALYSES SDM (LCO 3.1.1), the intermediate range monitor neutron flux scram 

(LCO 3.3.1.1), the average power range monitor neutron flux scram 

(LCO 3.3.1.1), and the control rod block instrumentation (LCO 3.3.2.1). 

The safety analysis of the control rod withdrawal error during refueling in 

the FSAR (Ref. 2) assumes the functioning of the refueling interlocks and 

adequate SDM. Additionally, prior to fuel reload, all control rods must be 

fully inserted to minimize the probability of an inadvertent criticality. 

Control rod position satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO All control rods must be fully inserted during applicable refueling 

conditions to minimize the probability of an inadvertent criticality during 

refueling. 
Control Rod Position 

B 3.9.3 

BWR/6 STS B 3.9.3-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY During MODE 5, loading fuel into core cells with control rods withdrawn 

may result in inadvertent criticality. Therefore, the control rods must be 

inserted before loading fuel into a core cell. All control rods must be 

inserted before loading fuel to ensure that a fuel loading error does not 

result in loading fuel into a core cell with the control rod withdrawn. 

In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no 

fuel loading activities are possible. Therefore, this Specification is not 

applicable in these MODES. 

ACTIONS A.1

With all control rods not fully inserted during the applicable conditions, an 

inadvertent criticality could occur that is not analyzed in the FSAR. All 

fuel loading operations must be immediately suspended. Suspension of 

these activities shall not preclude completion of movement of a 

component to a safe position. 

SURVEILLANCE SR 3.9.3.1

REQUIREMENTS 

During refueling, to ensure that the reactor remains subcritical, all control 

rods must be fully inserted prior to and during fuel loading. Periodic 

checks of the control rod position ensure this condition is maintained. 

The 12 hour Frequency takes into consideration the procedural controls 

on control rod movement during refueling as well as the redundant 

functions of the refueling interlocks. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 

 2. FSAR Section [15.4.1.1]. 
Control Rod Position Indication 

B 3.9.4 

BWR/6 STS B 3.9.4-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.4 Control Rod Position Indication 

BASES 

BACKGROUND The full-in position indication channel for each control rod provides 

information necessary to the refueling interlocks to prevent inadvertent 

criticalities during refueling operations. During refueling, the refueling 

interlocks (LCO 3.9.1 and LCO 3.9.2) use the full-in position indication 

channel to limit the operation of the refueling equipment and the 

movement of the control rods. The absence of the full-in position 

indication channel signal for any control rod removes the all-rods-in 

permissive for the refueling equipment interlocks and prevents fuel 

loading. Also, this condition causes the refuel position one-rod-out 

interlock to not allow the withdrawal of any other control rod. 

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required 

independent reactivity control systems be capable of holding the reactor 

core subcritical under cold conditions (Ref. 1). The control rods serve as 

the system capable of maintaining the reactor subcritical in cold 

conditions. 

APPLICABLE Prevention and mitigation of prompt reactivity excursions during refueling 

SAFETY are provided by the refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the 

ANALYSES SDM (LCO 3.1.1), the intermediate range monitor neutron flux scram 

(LCO 3.3.1.1), and the control rod block instrumentation (LCO 3.3.2.1). 

The safety analysis for the control rod withdrawal error during refueling 

(Ref. 2) assumes the functioning of the refueling interlocks and adequate 

SDM. The full-in position indication channel is required to be OPERABLE 

so that the refueling interlocks can ensure that fuel cannot be loaded with 

any control rod withdrawn and that no more than one control rod can be 

withdrawn at a time. 

Control rod position indication satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO One control rod full-in position indication channel for each control rod 

must be OPERABLE to provide the required inputs to the refueling 

interlocks. A channel is OPERABLE if it provides correct position 

indication to the refueling equipment interlock all-rods-in logic 

(LCO 3.9.1), and correct position indication to at least one channel of the 

refuel position one-rod-out interlock logic (LCO 3.9.2). For the refueling 

equipment interlock all-rods-in logic the required full-in position indication 

channel for each control rod is Channel B. At all other times (when the 

refueling equipment interlocks are not required to be OPERABLE) either 

Channel A or Channel B OPERABILITY for each control rod satisfies the 

LCO. 
Control Rod Position Indication 

B 3.9.4 

BWR/6 STS B 3.9.4-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY During MODE 5, the control rods must have OPERABLE full-in position 

indication channels to ensure the applicable refueling interlocks will be 

OPERABLE. 

In MODES 1 and 2, requirements for control rod position are specified in 

LCO 3.1.3, "Control Rod OPERABILITY." In MODES 3 and 4, with the 

reactor mode switch in the shutdown position, a control rod block 

(LCO 3.3.2.1) ensures all control rods are inserted, thereby preventing 

criticality during shutdown conditions. 

ACTIONS A Note has been provided to modify the ACTIONS related to control rod 

position indication channels. Section 1.3, Completion Times, specifies 

that once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition, 

discovered to be inoperable or not within limits, will not result in separate 

entry into the Condition. Section 1.3 also specifies that Required Actions 

of the Condition continue to apply for each additional failure, with 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for inoperable control rod position indication channels 

provide appropriate compensatory measures for separate inoperable 

channels. As such, this Note has been provided, which allows separate 

Condition entry for each inoperable required control rod position 

indication channel. 

A.1.1, A.1.2, A.1.3, A.2.1, and A.2.2

With one or more required full-in position indication channels inoperable, 

compensating actions must be taken to protect against potential reactivity 

excursions from fuel assembly insertions or control rod withdrawals. This 

may be accomplished by immediately suspending in-vessel fuel 

movement and control rod withdrawal, and immediately initiating action to 

fully insert all insertable control rods in core cells containing one or more 

fuel assemblies. Actions must continue until all insertable control rods in 

core cells containing one or more fuel assemblies are fully inserted. 

Suspension of in-vessel fuel movements and control rod withdrawal shall 

not preclude moving a component to a safe position. 

Alternatively, actions may be immediately initiated to fully insert the 

control rod(s) associated with the inoperable full-in position indicators(s) 

and to disarm the drive(s) to ensure that the control rod is not withdrawn. 

Actions must continue until all associated control rods are fully inserted 

and drives are disarmed. Under these conditions (control rod fully 

inserted and disarmed), an inoperable full-in channel may be bypassed to 

allow refueling operations to proceed. An alternate method must be used 

to ensure the control rod is fully inserted (e.g., use the "00" notch position 

indication). 
Control Rod Position Indication 

B 3.9.4 

BWR/6 STS B 3.9.4-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.9.4.1

REQUIREMENTS 

The full-in position indication channels provide input to the one-rod-out 

interlock and other refueling interlocks that require an all-rods-in 

permissive. The interlocks are activated when the full-in position 

indication for any control rod is not present, since this indicates that all 

rods are not fully inserted. Therefore, testing of the full-in position 

indication channels is performed to ensure that when a control rod is 

withdrawn, the full-in position indication is not present. Note that failure to 

indicate full-in when the control rod is not withdrawn results in 

conservative actuation of the one-rod-out interlock, and therefore, is not 

explicitly required to be verified by this SR. The full-in position indication 

channel is considered inoperable even with the control rod fully inserted, 

if it would continue to indicate full-in with the control rod withdrawn. 

Performing the SR each time a control rod is withdrawn is considered 

adequate because of the procedural controls on control rod withdrawals 

and the visual and audible indications available in the control room to 

alert the operator to control rods not fully inserted. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 

 2. FSAR, Section [15.4.1.1]. 
Control Rod OPERABILITY - Refueling 

B 3.9.5 

BWR/6 STS B 3.9.5-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.5 Control Rod OPERABILITY - Refueling 

BASES 

BACKGROUND Control rods are components of the Control Rod Drive (CRD) System, the 

primary reactivity control system for the reactor. In conjunction with the 

Reactor Protection System, the CRD System provides the means for the 

reliable control of reactivity changes during refueling operation. In 

addition, the control rods provide the capability to maintain the reactor 

subcritical under all conditions and to limit the potential amount and rate 

of reactivity increase caused by a malfunction in the CRD System. 

GDC 26 of 10 CFR 50, Appendix A, requires that one of the two required 

independent reactivity control systems be capable of holding the reactor 

core subcritical under cold conditions (Ref. 1). The CRD System is the 

system capable of maintaining the reactor subcritical in cold conditions. 

APPLICABLE Prevention and mitigation of prompt reactivity excursions during refueling 

SAFETY are provided by refueling interlocks (LCO 3.9.1 and LCO 3.9.2), the SDM 

ANALYSES (LCO 3.1.1), the intermediate range monitor neutron flux scram 

(LCO 3.3.1.1), and the control rod block instrumentation (LCO 3.3.2.1). 

The safety analysis for the control rod withdrawal error during refueling 

(Ref. 2) evaluates the consequences of control rod withdrawal during 

refueling. A prompt reactivity excursion during refueling could potentially 

result in fuel failure with subsequent release of radioactive material to the 

environment. Control rod scram provides protection should a prompt 

reactivity excursion occur. 

Control rod OPERABILITY during refueling satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii). 

LCO Each withdrawn control rod must be OPERABLE. The withdrawn control 

rod is considered OPERABLE if the scram accumulator pressure is 

≥ [1520] psig and the control rod is capable of being automatically 

inserted upon receipt of a scram signal. Inserted control rods have 

already completed their reactivity control function, and therefore, are not 

required to be OPERABLE. 

APPLICABILITY During MODE 5, withdrawn control rods must be OPERABLE to ensure 

that in a scram the control rods will insert and provide the required 

negative reactivity to maintain the reactor subcritical. 
Control Rod OPERABILITY - Refueling 

B 3.9.5 

BWR/6 STS B 3.9.5-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY (continued) 

For MODES 1 and 2, control rod requirements are found in LCO 3.1.2, 

"Reactivity Anomalies," LCO 3.1.3, "Control Rod OPERABILITY," 

LCO 3.1.4, "Control Rod Scram Times," and LCO 3.1.5, "Control Rod 

Scram Accumulators." During MODES 3 and 4, control rods are not able 

to be withdrawn since the reactor mode switch is in shutdown and a 

control rod block is applied. This provides adequate requirements for 

control rod OPERABILITY during these conditions. 

ACTIONS A.1

With one or more withdrawn control rods inoperable, action must be 

immediately initiated to fully insert the inoperable control rod(s). Inserting 

the control rod(s) ensures that the shutdown and scram capabilities are 

not adversely affected. Actions must continue until the inoperable control 

rod(s) is fully inserted. 

SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2

REQUIREMENTS 

During MODE 5, the OPERABILITY of control rods is primarily required to 

ensure that a withdrawn control rod will automatically insert if a signal 

requiring a reactor shutdown occurs. Because no explicit analysis exists 

for automatic shutdown during refueling, the shutdown function is 

satisfied if the withdrawn control rod is capable of automatic insertion and 

the associated CRD scram accumulator pressure is ≥ [1520] psig. 

The 7 day Frequency takes into consideration equipment reliability, 

procedural controls over the scram accumulators, and control room 

alarms and indicating lights that indicate low accumulator charge 

pressures. 

SR 3.9.5.1 is modified by a Note that allows 7 days after withdrawal of the 

control rod to perform the Surveillance. This acknowledges that the 

control rod must first be withdrawn before performance of the 

Surveillance, and therefore avoids potential conflicts with SR 3.0.3 and 

SR 3.0.4. 

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26. 

 2. FSAR, Section [15.4.1.1]. 
RPV Water Level - [Irradiated Fuel] 

B 3.9.6 

BWR/6 STS B 3.9.6-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.6 Reactor Pressure Vessel (RPV) Water Level [ - Irradiated Fuel] 

BASES 

BACKGROUND The movement of [irradiated] fuel assemblies [or handling of control rods] 

within the RPV requires a minimum water level of [22 ft 8 inches] above 

the top of the RPV flange. During refueling, this maintains a sufficient 

water level in the upper containment pool. Sufficient water is necessary 

to retain iodine fission product activity in the water in the event of a fuel 

handling accident (Refs. 1 and 2). Sufficient iodine activity would be 

retained to limit offsite doses from the accident to < 25% of 

10 CFR 100 limits, as provided by the guidance of Reference 3. 

APPLICABLE During movement of [irradiated] fuel assemblies [or handling of control 

SAFETY rods] the water level in the RPV is an initial condition design parameter in 

ANALYSES the analysis of a fuel handling accident in containment postulated by 

Regulatory Guide 1.25 (Ref. 1). A minimum water level of 23 ft allows a 

decontamination factor of 100 (Ref. 4) to be used in the accident analysis 

for iodine. This relates to the assumption that 99% of the total iodine 

released from the pellet to cladding gap of all the dropped fuel assembly 

rods is retained by the refueling cavity water. The fuel pellet to cladding 

gap is assumed to contain 10% of the total fuel rod iodine inventory 

(Ref. 1). 

Analysis of the fuel handling accident inside containment is described in 

Reference 2. With a minimum water level of 23 ft and a minimum decay 

time of 24 hours prior to fuel handling, the analysis and test programs 

demonstrate that the iodine release due to a postulated fuel handling 

accident is adequately captured by the water, and that offsite doses are 

maintained within allowable limits (Ref. 5). 

While the worst case assumptions include the dropping of the irradiated 

fuel assembly being handled onto the reactor core, the possibility exists of 

the dropped assembly striking the RPV flange and releasing fission 

products. Therefore, the minimum depth for water coverage to ensure 

acceptable radiological consequences is specified from the RPV flange. 

Since the worst case event results in failed fuel assemblies seated in the 

core, as well as the dropped assembly, dropping an assembly on the 

RPV flange will result in reduced releases of fission gases. [Based on 

this judgement, and the physical dimensions which preclude normal 

operation with water level 23 feet above the flange, a slight reduction in 

this water level is acceptable (Ref. 4).] 

RPV water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 
RPV Water Level - [Irradiated Fuel] 

B 3.9.6 

BWR/6 STS B 3.9.6-2 Rev. 3.0, 03/31/04 

BASES 

LCO A minimum water level of [22 ft 8 inches] above the top of the RPV flange 

is required to ensure that the radiological consequences of a postulated 

fuel handling accident are within acceptable limits, as provided by the 

guidance of Reference 3. 

APPLICABILITY LCO 3.9.6 is applicable when moving [irradiated] fuel assemblies [or 

handling control rods (i.e., movement with other than the normal control 

rod drive)] within the RPV. The LCO minimizes the possibility of a fuel 

handling accident in containment that is beyond the assumptions of the 

safety analysis. [If irradiated fuel is not present within the RPV, there can 

be no significant radioactivity release as a result of a postulated fuel 

handling accident.] [Requirements for handling of new fuel assemblies or 

control rods (where water depth to the RPV flange is not of concern) are 

covered by LCO 3.9.7, "RPV Water Level - New Fuel or Control Rods."] 

Requirements for fuel handling accidents in the spent fuel storage pool 

are covered by LCO 3.7.7, "Fuel Pool Water Level." 

-----------------------------------REVIEWER’S NOTE----------------------------------- 

LCO 3.9.6 is written to cover new fuel and control rods as well as 

irradiated fuel. If a plant adopts LCO 3.9.7, however, the second 

bracketed portion of this Applicability is adopted in lieu of the first 

bracketed portion. Additional modifications would also be made to the 

title and Required Action A.1. 

-------------------------------------------------------------------------------------------------- 

ACTIONS A.1

If the water level is < [22 ft 8 inches] above the top of the RPV flange, all 

operations involving movement of [irradiated] fuel assemblies [and 

handling of control rods] within the RPV shall be suspended immediately 

to ensure that a fuel handling accident cannot occur. The suspension of 

[irradiated] fuel movement [and control rod handling] shall not preclude 

completion of movement of a component to a safe position. 

SURVEILLANCE SR 3.9.6.1

REQUIREMENTS 

Verification of a minimum water level of [22 ft 8 inches] above the top of 

the RPV flange ensures that the design basis for the postulated fuel 

handling accident analysis during refueling operations is met. Water at 

the required level limits the consequences of damaged fuel rods, which 

are postulated to result from a fuel handling accident in containment 

(Ref. 2). 

The Frequency of 24 hours is based on engineering judgment and is 

considered adequate in view of the large volume of water and the normal 

procedural controls on valve positions, which make significant unplanned 

level changes unlikely. 
RPV Water Level - [Irradiated Fuel] 

B 3.9.6 

BWR/6 STS B 3.9.6-3 Rev. 3.0, 03/31/04 

BASES 

REFERENCES 1. Regulatory Guide 1.25, March 23, 1972. 

 2. FSAR, Section [15.7.6]. 

 3. NUREG-0800, Section [15.7.4]. 

 4. NUREG-0831, Supplement 6, Section [16.4.2]. 

 5. 10 CFR 100.11. 
RPV Water Level - New Fuel or Control Rods 

B 3.9.7 

BWR/6 STS B 3.9.7-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.7 Reactor Pressure Vessel (RPV) Water Level - New Fuel or Control Rods 

BASES 

BACKGROUND The movement of new fuel assemblies or handling of control rods within 

the RPV when fuel assemblies seated within the reactor vessel are 

irradiated requires a minimum water level of [23 ft] above the top of 

irradiated fuel assemblies seated within the RPV. During refueling, this 

maintains a sufficient water level above the irradiated fuel. Sufficient 

water is necessary to retain iodine fission product activity in the water in 

the event of a fuel handling accident (Refs. 1 and 2). Sufficient iodine 

activity would be retained to limit offsite doses from the accident to < 25% 

of 10 CFR 100 limits, as provided by the guidance of Reference 3. 

APPLICABLE During movement of new fuel assemblies or handling of control rods over 

SAFETY irradiated fuel assemblies, the water level in the RPV is an initial 

ANALYSES condition design parameter in the analysis of a fuel handling accident in 

containment postulated by Regulatory Guide 1.25 (Ref. 1). A minimum 

water level of [23 ft] allows a decontamination factor of 100 (Ref. 4) to be 

used in the accident analysis for iodine. This relates to the assumption 

that 99% of the total iodine released from the pellet to cladding gap of all 

the dropped fuel assembly rods is retained by the refueling cavity water. 

The fuel pellet to cladding gap is assumed to contain 10% of the total fuel 

rod iodine inventory (Ref. 1). 

Analysis of the fuel handling accident inside containment is described in 

Reference 2. With a minimum water level of [23 ft] and a minimum decay 

time of 24 hours prior to fuel handling, the analysis and test programs 

demonstrate that the iodine release due to a postulated fuel handling 

accident is adequately captured by the water, and that offsite doses are 

maintained within allowable limits (Ref. 5). 

The related assumptions include the worst case dropping of an irradiated 

fuel assembly onto the reactor core loaded with irradiated fuel 

assemblies. 

RPV water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). 

LCO A minimum water level of [23 ft] above the top of irradiated fuel 

assemblies seated within the RPV is required to ensure that the 

radiological consequences of a postulated fuel handling accident are 

within acceptable limits, as provided by the guidance of Reference 3. 
RPV Water Level - New Fuel or Control Rods 

B 3.9.7 

BWR/6 STS B 3.9.7-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY LCO 3.9.7 is applicable when moving new fuel assemblies or handling 

control rods (i.e., movement with other than the normal control rod drive) 

over irradiated fuel assemblies seated within the RPV. The LCO 

minimizes the possibility of a fuel handling accident in containment that is 

beyond the assumptions of the safety analysis. If irradiated fuel is not 

present within the RPV, there can be no significant radioactivity release 

as a result of a postulated fuel handling accident. Requirements for fuel 

handling accidents in the spent fuel storage pool are covered by 

LCO 3.7.7, "Fuel Pool Water Level." Requirements for handling irradiated 

fuel over the RPV are covered by LCO 3.9.6, "[Reactor Pressure Vessel 

(RPV)] Water Level - [Irradiated Fuel]." 

ACTIONS A.1

If the water level is < [23 ft] above the top of irradiated fuel assemblies 

seated within the RPV, all operations involving movement of new fuel 

assemblies and handling of control rods within the RPV shall be 

suspended immediately to ensure that a fuel handling accident cannot 

occur. The suspension of fuel movement and control rod handling shall 

not preclude completion of movement of a component to a safe position. 

SURVEILLANCE SR 3.9.7.1

REQUIREMENTS 

Verification of a minimum water level of [23 ft] above the top of the 

irradiated fuel assemblies seated within the RPV ensures that the design 

basis for the postulated fuel handling accident analysis during refueling 

operations is met. Water at the required level limits the consequences of 

damaged fuel rods, which are postulated to result from a fuel handling 

accident in containment (Ref. 2). 

The Frequency of 24 hours is based on engineering judgment and is 

considered adequate in view of the large volume of water and the normal 

procedural controls on valve positions, which make significant unplanned 

level changes unlikely. 

REFERENCES 1. Regulatory Guide 1.25, March 23, 1972. 

 2. FSAR, Section [15.7.6]. 

 3. NUREG-0800, Section [15.7.4]. 

 4. NUREG-0831, Supplement 6, Section [16.4.2]. 

 5. 10 CFR 100.11. 
RHR - High Water Level 

B 3.9.8 

BWR/6 STS B 3.9.8-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.8 Residual Heat Removal (RHR) - High Water Level 

BASES 

BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and 

sensible heat from the reactor coolant, as required by GDC 34. Each of 

the two shutdown cooling loops of the RHR System can provide the 

required decay heat removal. Each loop consists of one motor driven 

pump, a heat exchanger, and associated piping and valves. Both loops 

have a common suction from the same recirculation loop. Each pump 

discharges the reactor coolant, after it has been cooled by circulation 

through the respective heat exchangers, to the reactor via separate 

feedwater lines or to the upper containment pool via a common single 

flow distribution sparger or to the reactor via the low pressure coolant 

injection path. The RHR heat exchangers transfer heat to the Standby 

Service Water System. The RHR shutdown cooling mode is manually 

controlled. 

In addition to the RHR subsystems, the volume of water above the 

reactor pressure vessel (RPV) flange provides a heat sink for decay heat 

removal. 

APPLICABLE With the unit in MODE 5, the RHR System is not required to mitigate any 

SAFETY events or accidents evaluated in the safety analyses. The RHR System 

ANALYSES is required for removing decay heat to maintain the temperature of the 

reactor coolant. 

The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). 

LCO Only one RHR shutdown cooling subsystem is required to be OPERABLE 

in MODE 5 with irradiated fuel in the RPV and the water level ≥ [22 ft 

8 inches] above the RPV flange. Only one subsystem is required 

because the volume of water above the RPV flange provides backup 

decay heat removal capability. 

An OPERABLE RHR shutdown cooling subsystem consists of an RHR 

pump, a heat exchanger, valves, piping, instruments, and controls to 

ensure an OPERABLE flow path. 
RHR - High Water Level 

B 3.9.8 

BWR/6 STS B 3.9.8-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

Additionally, each RHR shutdown cooling subsystem is considered 

OPERABLE if it can be manually aligned (remote or local) in the 

shutdown cooling mode for removal of decay heat. Operation (either 

continuous or intermittent) of one subsystem can maintain and reduce the 

reactor coolant temperature as required. However, to ensure adequate 

core flow to allow for accurate average reactor coolant temperature 

monitoring, nearly continuous operation is required. A Note is provided to 

allow a 2 hour exception for the operating subsystem to be removed from 

operation every 8 hours. 

APPLICABILITY One RHR shutdown cooling subsystem must be OPERABLE in MODE 5, 

with irradiated fuel in the RPV and with the water level ≥ [22 ft 8 inches] 

above the top of the RPV flange, to provide decay heat removal. RHR 

System requirements in other MODES are covered by LCOs in 

Section 3.4, Reactor Coolant System (RCS); Section 3.5, Emergency 

Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling 

(RCIC) System; and Section 3.6, Containment Systems. RHR Shutdown 

Cooling System requirements in MODE 5, with irradiated fuel in the 

reactor pressure vessel and with the water level < [22 ft 8 inches] above 

the RPV flange, are given in LCO 3.9.9, "Residual Heat Removal (RHR) - 

Low Water Level." 

ACTIONS A.1

With no RHR shutdown cooling subsystem OPERABLE, an alternate 

method of decay heat removal must be established within 1 hour. In this 

condition, the volume of water above the RPV flange provides adequate 

capability to remove decay heat from the reactor core. However, the 

overall reliability is reduced because loss of water level could result in 

reduced decay heat removal capability. The 1 hour Completion Time is 

based on the decay heat removal function and the probability of a loss of 

the available decay heat removal capabilities. Furthermore, verification of 

the functional availability of these alternate method(s) must be 

reconfirmed every 24 hours thereafter. This will ensure continued heat 

removal capability. 

Alternate decay heat removal methods are available to the operators for 

review and preplanning in the unit's Operating Procedures. For example, 

this may include the use of the Reactor Water Cleanup System, operating 

with the regenerative heat exchanger bypassed. The method used to 

remove the decay heat should be the most prudent choice based on unit 

conditions. 
RHR - High Water Level 

B 3.9.8 

BWR/6 STS B 3.9.8-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

B.1, B.2, B.3, and B.4

If no RHR shutdown cooling subsystem is OPERABLE and an alternate 

method of decay heat removal is not available in accordance with 

Required Action A.1, actions shall be taken immediately to suspend 

operations involving an increase in reactor decay heat load by 

suspending the loading of irradiated fuel assemblies into the RPV. 

Additional actions are required to minimize any potential fission product 

release to the environment. This includes ensuring secondary 

containment is OPERABLE; one standby gas treatment subsystem is 

OPERABLE; and secondary containment isolation capability (i.e., one 

secondary containment isolation valve and associated instrumentation 

are operable or other acceptable administrative controls to assure 

isolation capability) in each associated penetration not isolated that is 

assumed to be isolated to mitigate radioactivity releases. This may be 

performed as an administrative check, by examining logs or other 

information to determine whether the components are out of service for 

maintenance or other reasons. It is not necessary to perform the 

Surveillances needed to demonstrate the OPERABILITY of the 

components. If, however, any required component is inoperable, then it 

must be restored to OPERABLE status. In this case, a surveillance may 

need to be performed to restore the component to OPERABLE status. 

Actions must continue until all required components are OPERABLE. 

C.1 and C.2

If no RHR shutdown cooling subsystem is in operation, an alternate 

method of coolant circulation is required to be established within 1 hour. 

The Completion Time is modified such that 1 hour is applicable 

separately for each occurrence involving a loss of coolant circulation. 

During the period when the reactor coolant is being circulated by an 

alternate method (other than by the required RHR Shutdown Cooling 

System), the reactor coolant temperature must be periodically monitored 

to ensure proper functioning of the alternate method. The once per hour 

Completion Time is deemed appropriate. 
RHR - High Water Level 

B 3.9.8 

BWR/6 STS B 3.9.8-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.9.8.1

REQUIREMENTS 

This Surveillance demonstrates that the RHR subsystem is in operation 

and circulating reactor coolant. The required flow rate is determined by 

the flow rate necessary to provide sufficient decay heat removal 

capability. The Frequency of 12 hours is sufficient in view of other visual 

and audible indications available to the operator for monitoring the RHR 

subsystem in the control room. 

REFERENCES None. 
RHR - Low Water Level 

B 3.9.9 

BWR/6 STS B 3.9.9-1 Rev. 3.0, 03/31/04 

B 3.9 REFUELING OPERATIONS 

B 3.9.9 Residual Heat Removal (RHR) - Low Water Level 

BASES 

BACKGROUND The purpose of the RHR System in MODE 5 is to remove decay heat and 

sensible heat from the reactor coolant, as required by GDC 34. Each of 

the two shutdown cooling loops of the RHR System can provide the 

required decay heat removal. Each loop consists of one motor driven 

pump, a heat exchanger, and associated piping and valves. Both loops 

have a common suction from the same recirculation loop. Each pump 

discharges the reactor coolant, after it has been cooled by circulation 

through the respective heat exchangers, to the reactor via separate 

feedwater lines, to the upper containment pool via a common single flow 

distribution sparger, or to the reactor via the low pressure coolant 

injection path. The RHR heat exchangers transfer heat to the Standby 

Service Water System. The RHR shutdown cooling mode is manually 

controlled. 

APPLICABLE With the unit in MODE 5, the RHR System is not required to mitigate any 

SAFETY events or accidents evaluated in the safety analyses. The RHR System 

ANALYSES is required for removing decay heat to maintain the temperature of the 

reactor coolant. 

The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii). 

LCO In MODE 5 with irradiated fuel in the reactor pressure vessel (RPV) and 

with the water level < 22 ft 8 inches above the RPV flange both RHR 

shutdown cooling subsystems must be OPERABLE. 

An OPERABLE RHR shutdown cooling subsystem consists of an RHR 

pump, a heat exchanger, valves, piping, instruments, and controls to 

ensure an OPERABLE flow path. 

Additionally, each RHR shutdown cooling subsystem is considered 

OPERABLE if it can be manually aligned (remote or local) in the 

shutdown cooling mode for removal of decay heat. Operation (either 

continuous or intermittent) of one subsystem can maintain and reduce the 

reactor coolant temperature as required. However, to ensure adequate 

core flow to allow for accurate average reactor coolant temperature 

monitoring, nearly continuous operation is required. A Note is provided to 

allow a 2 hour exception for the operating subsystem to be removed from 

operation every 8 hours. 
RHR - Low Water Level 

B 3.9.9 

BWR/6 STS B 3.9.9-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY Two RHR shutdown cooling subsystems are required to be OPERABLE 

in MODE 5, with irradiated fuel in the RPV and with the water level < [22 ft 

8 inches] above the top of the RPV flange, to provide decay heat removal. 

RHR System requirements in other MODES are covered by LCOs in 

Section 3.4, Reactor Coolant System (RCS); Section 3.5, Emergency 

Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling 

(RCIC) System; and Section 3.6, Containment Systems. RHR Shutdown 

Cooling System requirements in MODE 5, and with the water level ≥ [22 ft 

8 inches] above the RPV flange, are given in LCO 3.9.8, "Residual Heat 

Removal (RHR) - High Water Level." 

ACTIONS A.1

With one of the two required RHR shutdown cooling subsystems 

inoperable, the remaining subsystem is capable of providing the required 

decay heat removal. However, the overall reliability is reduced. 

Therefore an alternate method of decay heat removal must be provided. 

With both RHR shutdown cooling subsystems inoperable, an alternate 

method of decay heat removal must be provided in addition to that 

provided for the initial RHR shutdown cooling subsystem inoperability. 

This re-establishes backup decay heat removal capabilities, similar to the 

requirements of the LCO. The 1 hour Completion Time is based on the 

decay heat removal function and the probability of a loss of the available 

decay heat removal capabilities. Furthermore, verification of the 

functional availability of these alternate method(s) must be reconfirmed 

every 24 hours thereafter. This will ensure continued heat removal 

capability. 

Alternate decay heat removal methods are available to the operators for 

review and preplanning in the unit's Operating Procedures. For example, 

this may include the use of the Reactor Water Cleanup System, operating 

with the regenerative heat exchanger bypassed. The method used to 

remove decay heat should be the most prudent choice based on unit 

conditions. 

B.1, B.2, and B.3

With the required decay heat removal subsystem(s) inoperable and the 

required alternate method(s) of decay heat removal not available in 

accordance with Required Action A.1, additional actions are required to 

minimize any potential fission product release to the environment. This 

includes ensuring secondary containment is OPERABLE; one standby 

gas treatment subsystem is OPERABLE; and secondary containment 

isolation capability (i.e., one secondary containment isolation valve and 

associated instrumentation are operable or other acceptable 
RHR - Low Water Level 

B 3.9.9 

BWR/6 STS B 3.9.9-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

administrative controls to assure isolation capability) in each associated 

penetration not isolated that is assumed to be isolated to mitigate 

radioactivity releases. This may be performed as an administrative 

check, by examining logs or other information to determine whether the 

components are out of service for maintenance or other reasons. It is not 

necessary to perform the Surveillances needed to demonstrate the 

OPERABILITY of the components. If, however, any required component 

is inoperable, then it must be restored to OPERABLE status. In this case, 

a surveillance may need to be performed to restore the component to 

OPERABLE status. Actions must continue until all required components 

are OPERABLE. 

C.1 and C.2

If no RHR shutdown cooling subsystem is in operation, an alternate 

method of coolant circulation is required to be established within 1 hour. 

The Completion Time is modified such that the 1 hour is applicable 

separately for each occurrence involving a loss of coolant circulation. 

During the period when the reactor coolant is being circulated by an 

alternate method (other than by the required RHR Shutdown Cooling 

System), the reactor coolant temperature must be periodically monitored 

to ensure proper function of the alternate method. The once per hour 

Completion Time is deemed appropriate. 

SURVEILLANCE SR 3.9.9.1

REQUIREMENTS 

This Surveillance demonstrates that one RHR shutdown cooling 

subsystem is in operation and circulating reactor coolant. The required 

flow rate is determined by the flow rate necessary to provide sufficient 

decay heat removal capability. The Frequency of 12 hours is sufficient in 

view of other visual and audible indications available to the operator for 

monitoring the RHR subsystem in the control room. 

REFERENCES None. 
Inservice Leak and Hydrostatic Testing Operation 

B 3.10.1 

BWR/6 STS B 3.10.1-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.1 Inservice Leak and Hydrostatic Testing Operation 

BASES 

BACKGROUND The purpose of this Special Operations LCO is to allow certain reactor 

coolant pressure tests to be performed in MODE 4 when the metallurgical 

characteristics of the reactor pressure vessel (RPV) require the pressure 

testing at temperatures > 200°F (normally corresponding to MODE 3). 

Inservice hydrostatic testing and system leakage pressure tests required 

by Section XI of the American Society of Mechanical Engineers (ASME) 

Boiler and Pressure Vessel Code (Ref. 1) are performed prior to the 

reactor going critical after a refueling outage. Recirculation pump 

operation and a water solid RPV (except for an air bubble for pressure 

control) are used to achieve the necessary temperatures and pressures 

required for these tests. The minimum temperatures (at the required 

pressures) allowed for these tests are determined from the RPV pressure 

and temperature (P/T) limits required by LCO 3.4.11, "Reactor Coolant 

System (RCS) Pressure and Temperature (P/T) Limits." These limits are 

conservatively based on the fracture toughness of the reactor vessel, 

taking into account anticipated vessel neutron fluence. 

With increased reactor vessel fluence over time, the minimum allowable 

vessel temperature increases at a given pressure. Periodic updates to 

the RPV P/T limit curves are performed as necessary, based on the 

results of analyses of irradiated surveillance specimens removed from the 

vessel. Hydrostatic and leak testing will eventually be required with 

minimum reactor coolant temperatures > 200°F. 

The hydrostatic test requires increasing pressure to [ ]% of design 

pressure (1250 psig) or [ ] psig, and because of the expected increase in 

reactor vessel fluence, the minimum allowable vessel temperature 

according to LCO 3.4.11 is increased to [ ]°F. This increase to [ ]% of 

design pressure does not exceed the Safety Limit of 1375 psig. 

APPLICABLE Allowing the reactor to be considered in MODE 4 during hydrostatic or 

SAFETY leak testing, when the reactor coolant temperature is > 200°F, effectively 

ANALYSES provides an exception to MODE 3 requirements, including OPERABILITY 

of primary containment and the full complement of redundant Emergency 

Core Cooling Systems (ECCS). Since the hydrostatic or leak tests are 

performed nearly water solid, at low decay heat values, and near 

MODE 4 conditions, the stored energy in the reactor core will be very low. 

Under these conditions, the potential for failed fuel and a subsequent 
Inservice Leak and Hydrostatic Testing Operation 

B 3.10.1 

BWR/6 STS B 3.10.1-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

increase in coolant activity above the limits of LCO 3.4.8, "Reactor 

Coolant System (RCS) Specific Activity," are minimized. In addition, the 

secondary containment will be OPERABLE, in accordance with this 

Special Operations LCO, and will be capable of handling any airborne 

radioactivity or steam leaks that could occur during the performance of 

hydrostatic or leak testing. The required pressure testing conditions 

provide adequate assurance that the consequences of a steam leak will 

be conservatively bounded by the consequences of the postulated main 

steam line break outside of primary containment described in 

Reference 2. Therefore, these requirements will conservatively limit 

radiation releases to the environment. 

In the event of a large primary system leak, the reactor vessel would 

rapidly depressurize, allowing the low pressure core cooling systems to 

operate. The capability of the low pressure coolant injection and low 

pressure core spray subsystems, as required in MODE 4 by LCO 3.5.2, 

"ECCS - Shutdown," would be more than adequate to keep the core 

flooded under this low decay heat load condition. Small system leaks 

would be detected by leakage inspections before significant inventory 

loss occurred. 

For the purposes of this test, the protection provided by normally required 

MODE 4 applicable LCOs, in addition to the secondary containment 

requirements required to be met by this Special Operations LCO, will 

ensure acceptable consequences during normal hydrostatic test 

conditions and during postulated accident conditions. 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. Operation at reactor coolant temperatures > 200°F, can be in 

accordance with Table 1.1-1 for MODE 3 operation without meeting this 

Special Operations LCO or its ACTIONS. This option may be required 

due to P/T limits, however, which require testing at temperatures > 200°F, 

performance of inservice leak and hydrostatic testing would also 

necessitate the inoperability of some subsystems normally required to be 

OPERABLE when > 200°F. 
Inservice Leak and Hydrostatic Testing Operation 

B 3.10.1 

BWR/6 STS B 3.10.1-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

If it is desired to perform these tests while complying with this Special 

Operations LCO, then the MODE 4 applicable LCOs and specified 

MODE 3 LCOs must be met. This Special Operations LCO allows 

changing Table 1.1-1 temperature limits for MODE 4 to "NA" and 

suspending the requirements of LCO 3.4.10, "Residual Heat Removal 

(RHR) Shutdown Cooling System - Cold Shutdown." The additional 

requirements for secondary containment LCOs to be met will provide 

sufficient protection for operations at reactor coolant temperatures 

> 200°F for the purposes of performing either an inservice leak or 

hydrostatic test. 

This LCO allows primary containment to be open for frequent 

unobstructed access to perform inspections, and for outage activities on 

various systems to continue consistent with the MODE 4 applicable 

requirements that are in effect immediately prior to and immediately after 

this operation. 

APPLICABILITY The MODE 4 requirements may only be modified for the performance of 

inservice leak or hydrostatic tests so that these operations can be 

considered as in MODE 4, even though the reactor coolant temperature is 

> 200°F. The additional requirement for secondary containment 

OPERABILITY according to the imposed MODE 3 requirements provides 

conservatism in the response of the unit to any event that may occur. 

Operations in all other MODES are unaffected by this LCO. 

ACTIONS A Note has been provided to modify the ACTIONS related to inservice 

leak and hydrostatic testing operation. Section 1.3, Completion Times, 

specifies once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition 

discovered to be inoperable or not within limits, will not result in separate 

entry into the Condition. Section 1.3 also specifies Required Actions of 

the Condition continue to apply for each additional failure, with 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for each requirement of the LCO not met provide 

appropriate compensatory measures for separate requirements that are 

not met. As such, a Note has been provided that allows separate 

Condition entry for each requirement of the LCO. 
Inservice Leak and Hydrostatic Testing Operation 

B 3.10.1 

BWR/6 STS B 3.10.1-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

A.1

If an LCO specified in LCO 3.10.1 is not met, the ACTIONS applicable to 

the stated requirements shall be entered immediately and complied with. 

Required Action A.1 has been modified by a Note that clarifies the intent 

of another LCO's Required Action to be in MODE 4 includes reducing the 

average reactor coolant temperature to ≤ 200°F. 

A.2.1 and A.2.2

Required Actions A.2.1 and A.2.2 are alternate Required Actions that can 

be taken instead of Required Action A.1 to restore compliance with the 

normal MODE 4 requirements, and thereby exit this Special Operations 

LCO's Applicability. Activities that could further increase reactor coolant 

temperature or pressure are suspended immediately, in accordance with 

Required Action A.2.1, and the reactor coolant temperature is reduced to 

establish normal MODE 4 requirements. The allowed Completion Time of 

24 hours for Required Action A.2.2 is based on engineering judgment and 

provides sufficient time to reduce the average reactor coolant 

temperature from the highest expected value to ≤ 200°F with normal 

cooldown procedures. The Completion Time is also consistent with the 

time provided in LCO 3.0.3 for reaching MODE 4 from MODE 3. 

SURVEILLANCE SR 3.10.1.1

REQUIREMENTS 

The LCOs made applicable are required to have their Surveillances met 

to establish that this LCO is being met. A discussion of the applicable 

SRs is provided in their respective Bases. 

REFERENCES 1. American Society of Mechanical Engineers, Boiler and Pressure 

Vessel Code, Section XI. 

 2. FSAR, Section [15.1.40]. 
Reactor Mode Switch Interlock Testing 

B 3.10.2 

BWR/6 STS B 3.10.2-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.2 Reactor Mode Switch Interlock Testing 

BASES 

BACKGROUND The purpose of this Special Operations LCO is to permit operation of the 

reactor mode switch from one position to another to confirm certain 

aspects of associated interlocks during periodic tests and calibrations in 

MODES 3, 4, and 5. 

The reactor mode switch is a conveniently located, multiposition, keylock 

switch provided to select the necessary scram functions for various plant 

conditions (Ref. 1). The reactor mode switch selects the appropriate trip 

relays for scram functions and provides appropriate bypasses. The mode 

switch positions and related scram interlock functions are summarized as 

follows: 

a. Shutdown - Initiates a reactor scram; bypasses main steam line 

isolation and reactor high water level scrams, 

b. Refuel - Selects Neutron Monitoring System (NMS) scram function 

for low neutron flux level operation (but does not disable the average 

power range monitor scram); bypasses main steam line isolation and 

reactor high water level scrams, 

c. Startup/Hot Standby - Selects NMS scram function for low neutron 

flux level operation (intermediate range monitors and average power 

range monitors); bypasses main steam line isolation and reactor high 

water level scrams, and 

d. Run - Selects NMS scram function for power range operation. 

The reactor mode switch also provides interlocks for such functions as 

control rod blocks, scram discharge volume trip bypass, refueling 

interlocks, suppression pool makeup, and main steam isolation valve 

isolations. 

APPLICABLE The acceptance criterion for reactor mode switch interlock testing is to 

SAFETY prevent fuel failure by precluding reactivity excursions or core criticality. 

ANALYSES 

The interlock functions of the shutdown and refuel positions of the reactor 

mode switch in MODES 3, 4, and 5 are provided to preclude reactivity 

excursions that could potentially result in fuel failure. Interlock testing that 

requires moving the reactor mode switch to other positions (run, or 
Reactor Mode Switch Interlock Testing 

B 3.10.2 

BWR/6 STS B 3.10.2-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

startup/hot standby) while in MODE 3, 4, or 5, requires administratively 

maintaining all control rods inserted and no other CORE ALTERATIONS 

in progress. With all control rods inserted in core cells containing one or 

more fuel assemblies and no CORE ALTERATIONS in progress, there 

are no credible mechanisms for unacceptable reactivity excursions during 

the planned interlock testing. 

For postulated accidents, such as control rod removal error during 

refueling or loading of fuel with a control rod withdrawn, the accident 

analysis demonstrates that fuel failure will not occur (Ref. 2). The 

withdrawal of a single control rod will not result in criticality when 

adequate SDM is maintained. Also, loading fuel assemblies into the core 

with a single control rod withdrawn will not result in criticality, thereby 

preventing fuel failure. 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Special 

Operations LCOs provide flexibility to perform certain operations by 

appropriately modifying requirements of other LCOs. A discussion of the 

criteria satisfied for the other LCOs is provided in their respective Bases. 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. MODES 3, 4, and 5 operations not specified in Table 1.1-1 

can be performed in accordance with other Special Operations LCOs 

(i.e., LCO 3.10.1, "Inservice Leak and Hydrostatic Testing Operation," 

LCO 3.10.3, "Single Control Rod Withdrawal - Hot Shutdown," 

LCO 3.10.4, "Single Control Rod Withdrawal - Cold Shutdown," and 

LCO 3.10.8, "SDM Test - Refueling") without meeting this LCO or its 

ACTIONS. If any testing is performed that involves the reactor mode 

switch interlocks and requires repositioning beyond that specified in 

Table 1.1-1 for the current MODE of operation, the testing can be 

performed, provided all interlock functions potentially defeated are 

administratively controlled. In MODES 3, 4, and 5 with the reactor mode 

switch in shutdown as specified in Table 1.1-1, all control rods are fully 

inserted and a control rod block is initiated. Therefore, all control rods in 

core cells that contain one or more fuel assemblies must be verified fully 

inserted while in MODES 3, 4, and 5 with the reactor mode switch in other 

than the shutdown position. The additional LCO requirement to preclude 

CORE ALTERATIONS is appropriate for MODE 5 operations, as 

discussed below, and is inherently met in MODES 3 and 4 by the 

definition of CORE ALTERATIONS, which cannot be performed with the 

vessel head in place. 
Reactor Mode Switch Interlock Testing 

B 3.10.2 

BWR/6 STS B 3.10.2-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

In MODE 5, with the reactor mode switch in the refuel position, only one 

control rod can be withdrawn under the refuel position one rod out 

interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock"). The 

refueling equipment interlocks (LCO 3.9.1, "Refueling Equipment 

Interlocks") appropriately control other CORE ALTERATIONS. Due to the 

increased potential for error in controlling these multiple interlocks and the 

limited duration of tests involving the reactor mode switch position, 

conservative controls are required, consistent with MODES 3 and 4. The 

additional controls of administratively not permitting other CORE 

ALTERATIONS will adequately ensure that the reactor does not become 

critical during these tests. 

APPLICABILITY Any required periodic interlock testing involving the reactor mode switch, 

while in MODES 1 and 2, can be performed without the need for Special 

Operations exceptions. Mode switch manipulations in these MODES 

would likely result in unit trips. In MODES 3, 4, and 5, this Special 

Operations LCO is only permitted to be used to allow reactor mode switch 

interlock testing that cannot conveniently be performed without this 

allowance. Such interlock testing may consist of required Surveillances, 

or may be the result of maintenance, repair, or troubleshooting activities. 

In MODES 3, 4, and 5, the interlock functions provided by the reactor 

mode switch in shutdown (i.e., all control rods inserted and incapable of 

withdrawal) and refueling (i.e., refueling interlocks to prevent inadvertent 

criticality during CORE ALTERATIONS) positions can be administratively 

controlled adequately during the performance of certain tests. 

ACTIONS A.1, A.2, A.3.1, and A.3.2

These Required Actions are provided to restore compliance with the 

Technical Specifications overridden by this Special Operations LCO. 

Restoring compliance will also result in exiting the Applicability of this 

Special Operations LCO. 

All CORE ALTERATIONS, except control rod insertion, if in progress, are 

immediately suspended in accordance with Required Action A.1, and all 

insertable control rods in core cells that contain one or more fuel 

assemblies are fully inserted within 1 hour, in accordance with Required 

Action A.2. This will preclude potential mechanisms that could lead to 

criticality. Suspension of CORE ALTERATIONS shall not preclude the 

completion of movement of a component to a safe condition. Placing the 

reactor mode switch in the shutdown position will ensure that all inserted 

control rods remain inserted and result in operation in accordance with 

Table 1.1-1. Alternatively, if in MODE 5, the reactor mode switch may be 

placed in the refuel position, which will also result in operating in 
Reactor Mode Switch Interlock Testing 

B 3.10.2 

BWR/6 STS B 3.10.2-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

accordance with Table 1.1-1. A Note is added to Required Action A.3.2 

to indicate that this Required Action is not applicable in MODES 3 and 4, 

since only the shutdown position is allowed in these MODES. The 

allowed Completion Time of 1 hour for Required Actions A.2, A.3.1, 

and A.3.2 provides sufficient time to normally insert the control rods and 

place the reactor mode switch in the required position, based on 

operating experience, and is acceptable given that all operations that 

could increase core reactivity have been suspended. 

SURVEILLANCE SR 3.10.2.1 and SR 3.10.2.2

REQUIREMENTS 

Meeting the requirements of this Special Operations LCO maintains 

operation consistent with or conservative to operating with the reactor 

mode switch in the shutdown position (or the refuel position for MODE 5). 

The functions of the reactor mode switch interlocks that are not in effect, 

due to the testing in progress, are adequately compensated for by the 

Special Operations LCO requirements. The administrative controls are to 

be periodically verified to ensure that the operational requirements 

continue to be met. The Surveillances performed at the 12 hour and 

24 hour Frequencies are intended to provide appropriate assurance that 

each operating shift is aware of and verify compliance with these Special 

Operations LCO requirements. 

REFERENCES 1. FSAR, Section [7.6.1.1]. 

 2. FSAR, Section [15.4.1.1]. 
Single Control Rod Withdrawal - Hot Shutdown 

B 3.10.3 

BWR/6 STS B 3.10.3-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.3 Single Control Rod Withdrawal - Hot Shutdown 

BASES 

BACKGROUND The purpose of this MODE 3 Special Operations LCO is to permit the 

withdrawal of a single control rod for testing while in hot shutdown, by 

imposing certain restrictions. In MODE 3, the reactor mode switch is in 

the shutdown position, and all control rods are inserted and blocked from 

withdrawal. Many systems and functions are not required in these 

conditions, due to other installed interlocks that are actuated when the 

reactor mode switch is in the shutdown position. However, circumstances 

may arise while in MODE 3 that present the need to withdraw a single 

control rod for various tests (e.g., friction tests, scram timing, and coupling 

integrity checks). These single control rod withdrawals are normally 

accomplished by selecting the refuel position for the reactor mode switch. 

This Special Operations LCO provides the appropriate additional controls 

to allow a single control rod withdrawal in MODE 3. 

APPLICABLE With the reactor mode switch in the refuel position, the analyses for 

SAFETY control rod withdrawal during refueling are applicable and, provided the 

ANALYSES assumptions of these analyses are satisfied in MODE 3, these analyses 

will bound the consequences of an accident. Explicit safety analyses in 

the FSAR (Ref. 1) demonstrate that the functioning of the refueling 

interlocks and adequate SDM will preclude unacceptable reactivity 

excursions. 

Refueling interlocks restrict the movement of control rods to reinforce 

operational procedures that prevent the reactor from becoming critical. 

These interlocks prevent the withdrawal of more than one control rod. 

Under these conditions, since only one control rod can be withdrawn, the 

core will always be shut down even with the highest worth control rod 

withdrawn if adequate SDM exists. 

The control rod scram function provides backup protection to normal 

refueling procedures and the refueling interlocks, which prevent 

inadvertent criticalities during refueling. 

Alternate backup protection can be obtained by ensuring that a five by 

five array of control rods, centered on the withdrawn control rod, are 

inserted and incapable of withdrawal. 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 
Single Control Rod Withdrawal - Hot Shutdown 

B 3.10.3 

BWR/6 STS B 3.10.3-2 Rev. 3.0, 03/31/04 

BASES 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. Operation in MODE 3 with the reactor mode switch in the 

refuel position can be performed in accordance with other Special 

Operations LCOs (i.e., LCO 3.10.2, "Reactor Mode Switch Interlock 

Testing" without meeting this Special Operations LCO or its ACTIONS. 

However, if a single control rod withdrawal is desired in MODE 3, controls 

consistent with those required during refueling must be implemented and 

this Special Operations LCO applied. "Withdrawal" in this application 

includes the actual withdrawal of the control rod as well as maintaining 

the control rod in a position other than the full-in position, and reinserting 

the control rod. The refueling interlocks of LCO 3.9.2, "Refuel Position 

One-Rod-Out Interlock," required by this Special Operations LCO, will 

ensure that only one control rod can be withdrawn. 

To back up the refueling interlocks (LCO 3.9.2), the ability to scram the 

withdrawn control rod in the event of an inadvertent criticality is provided 

by this Special Operations LCO's requirements in Item d.1. Alternately, 

provided a sufficient number of control rods in the vicinity of the 

withdrawn control rod are known to be inserted and incapable of 

withdrawal (Item d.2), the possibility of criticality on withdrawal of this 

control rod is sufficiently precluded, so as not to require the scram 

capability of the withdrawn control rod. Also, once this alternate (Item 

d.2) is completed, the SDM requirement to account for both the 

withdrawn-untrippable control rod and the highest worth control rod may 

be changed to allow the withdrawn-untrippable control rod to be the single 

highest worth control rod. 

APPLICABILITY Control rod withdrawals are adequately controlled in MODES 1, 2, and 5 

by existing LCOs. In MODES 3 and 4, control rod withdrawal is only 

allowed if performed in accordance with this Special Operations LCO or 

Special Operations LCO 3.10.4, and if limited to one control rod. This 

allowance is only provided with the reactor mode switch in the refuel 

position. For these conditions, the one-rod-out interlock (LCO 3.9.2), 

control rod position indication (LCO 3.9.4, "Control Rod Position 

Indication") full insertion requirements for all other control rods, and scram 

functions (LCO 3.3.1.1, "Reaction Protection System (RPS) 

Instrumentation," and LCO 3.9.5, "Control Rod OPERABILITY - 

Refueling"), or the added administrative control in Item d.2 of this Special 

Operations LCO, minimizes potential reactivity excursions. 

ACTIONS A Note has been provided to modify the ACTIONS related to a single 

control rod withdrawal while in MODE 3. Section 1.3, Completion Times, 

specifies once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition 

discovered to be inoperable or not within limits, will not result in separate 

entry into the Condition. Section 1.3 also specifies Required Actions of 

the Condition continue to apply for each additional failure, with 
Single Control Rod Withdrawal - Hot Shutdown 

B 3.10.3 

BWR/6 STS B 3.10.3-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for each requirement of the LCO not met provide 

appropriate compensatory measures for separate requirements that are 

not met. As such, a Note has been provided that allows separate 

Condition entry for each requirement of the LCO. 

A.1

If one or more of the requirements specified in this Special Operations 

LCO are not met, the ACTIONS applicable to the stated requirements of 

the affected LCOs are immediately entered as directed by Required 

Action A.1. This Required Action has been modified by a Note that 

clarifies the intent of any other LCO's Required Action to insert all control 

rods. This Required Action includes exiting this Special Operations 

Applicability LCO by returning the reactor mode switch to the shutdown 

position. A second Note has been added, which clarifies that this 

Required Action is only applicable if the requirements not met are for an 

affected LCO. 

A.2.1 and A.2.2

Required Actions A.2.1 and A.2.2 and are alternative Required Actions 

that can be taken instead of Required Action A.1 to restore compliance 

with the normal MODE 3 requirements, thereby exiting this Special 

Operations LCO's Applicability. Actions must be initiated immediately to 

insert all insertable control rods. Actions must continue until all such 

control rods are fully inserted. Placing the reactor mode switch in the 

shutdown position will ensure that all inserted rods remain inserted and 

restore operation in accordance with Table 1.1-1. The allowed 

Completion Time of 1 hour to place the reactor mode switch in the 

shutdown position provides sufficient time to normally insert the control 

rods. 

SURVEILLANCE SR 3.10.3.1, SR 3.10.3.2, and SR 3.10.3.3

REQUIREMENTS 

The other LCOs made applicable in this Special Operations LCO are 

required to have their Surveillances met to establish that this Special 

Operations LCO is being met. If the local array of control rods is inserted 

and disarmed while the scram function for the withdrawn rod is not 

available, periodic verification in accordance with SR 3.10.3.2 is required 

to preclude the possibility of criticality. SR 3.10.3.2 has been modified by 
Single Control Rod Withdrawal - Hot Shutdown 

B 3.10.3 

BWR/6 STS B 3.10.3-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

a Note, which clarifies that this SR is not required to be met if SR 3.10.3.1 

is satisfied for LCO 3.10.3.d.1 requirements, since SR 3.10.3.2 

demonstrates that the alternative LCO 3.10.3.d.2 requirements are 

satisfied. Also, SR 3.10.3.3 verifies that all control rods other than the 

control rod being withdrawn are fully inserted. The 24 hour Frequency is 

acceptable because of the administrative controls on control rod 

withdrawals, the protection afforded by the LCOs involved, and hardware 

interlocks that preclude additional control rod withdrawals. 

REFERENCES 1. FSAR, Section [15.4.1.1]. 
Single Control Rod Withdrawal - Cold Shutdown 

B 3.10.4 

BWR/6 STS B 3.10.4-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.4 Single Control Rod Withdrawal - Cold Shutdown 

BASES 

BACKGROUND The purpose of this MODE 4 Special Operations LCO is to permit the 

withdrawal of a single control rod for testing or maintenance, while in cold 

shutdown, by imposing certain restrictions. In MODE 4, the reactor mode 

switch is in the shutdown position, and all control rods are inserted and 

blocked from withdrawal. Many systems and functions are not required in 

these conditions, due to the installed interlocks associated with the 

reactor mode switch in the shutdown position. Circumstances may arise 

while in MODE 4, however, that present the need to withdraw a single 

control rod for various tests (e.g., friction tests, scram time testing, and 

coupling integrity checks). Certain situations may also require the 

removal of the associated control rod drive (CRD). These single control 

rod withdrawals and possible subsequent removals are normally 

accomplished by selecting the refuel position for the reactor mode switch. 

APPLICABLE With the reactor mode switch in the refuel position, the analyses for 

SAFETY control rod withdrawal during refueling are applicable and, provided the 

ANALYSES assumptions of these analyses are satisfied in MODE 4, these analyses 

will bound the consequences of an accident. Explicit safety analyses in 

the FSAR (Ref. 1) demonstrate that the functioning of the refueling 

interlocks and adequate SDM will preclude unacceptable reactivity 

excursions. 

Refueling interlocks restrict the movement of control rods to reinforce 

operational procedures that prevent the reactor from becoming critical. 

These interlocks prevent the withdrawal of more than one control rod. 

Under these conditions, since only one control rod can be withdrawn, the 

core will always be shut down even with the highest worth control rod 

withdrawn if adequate SDM exists. 

The control rod scram function provides backup protection in the event 

normal refueling procedures and the refueling interlocks fail to prevent 

inadvertent criticalities during refueling. Alternate backup protection can 

be obtained by ensuring that a five by five array of control rods, centered 

on the withdrawn control rod, are inserted and incapable of withdrawal. 

This alternate backup protection is required when removing the CRD 

because this removal renders the withdrawn control rod incapable of 

being scrammed. 
Single Control Rod Withdrawal - Cold Shutdown 

B 3.10.4 

BWR/6 STS B 3.10.4-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. Operation in MODE 4 with the reactor mode switch in the 

refuel position can be performed in accordance with other LCOs (i.e., 

Special Operations LCO 3.10.2, "Reactor Mode Switch Interlock Testing") 

without meeting this Special Operations LCO or its ACTIONS. If a single 

control rod withdrawal is desired in MODE 4, controls consistent with 

those required during refueling must be implemented and this Special 

Operations LCO applied. "Withdrawal" in this application includes the 

actual withdrawal of the control rod as well as maintaining the control rod 

in a position other than the full-in position, and reinserting the control rod. 

The refueling interlocks of LCO 3.9.2, "Refuel Position One-Rod-Out 

Interlock," required by this Special Operations LCO will ensure that only 

one control rod can be withdrawn. At the time CRD removal begins, the 

disconnection of the position indication probe will cause LCO 3.9.4, 

"Control Rod Position Indication," and therefore, LCO 3.9.2 to fail to be 

met. Therefore, prior to commencing CRD removal, a control rod 

withdrawal block is required to be inserted to ensure that no additional 

control rods can be withdrawn and that compliance with this Special 

Operations LCO is maintained. 

To back up the refueling interlocks (LCO 3.9.2) or the control rod 

withdrawal block, the ability to scram the withdrawn control rod in the 

event of an inadvertent criticality is provided by the Special Operations 

LCO requirements in Item c.1. Alternatively, when the scram function is 

not OPERABLE, or the CRD is to be removed, a sufficient number of rods 

in the vicinity of the withdrawn control rod are required to be inserted and 

made incapable of withdrawal (Item c.2). This precludes the possibility of 

criticality upon withdrawal of this control rod. Also, once this alternate 

(Item c.2) is completed, the SDM requirement to account for both the 

withdrawn-untrippable control rod and the highest worth control rod may 

be changed to allow the withdrawn-untrippable control rod to be the single 

highest worth control rod. 
Single Control Rod Withdrawal - Cold Shutdown 

B 3.10.4 

BWR/6 STS B 3.10.4-3 Rev. 3.0, 03/31/04 

BASES 

APPLICABILITY Control rod withdrawals are adequately controlled in MODES 1, 2, and 5 

by existing LCOs. In MODES 3 and 4, control rod withdrawal is only 

allowed if performed in accordance with Special Operations LCO 3.10.3, 

or this Special Operations LCO, and if limited to one control rod. This 

allowance is only provided with the reactor mode switch in the refuel 

position. 

During these conditions, the full insertion requirements for all other control 

rods, the one-rod-out interlock (LCO 3.9.2), control rod position indication 

(LCO 3.9.4), and scram functions (LCO 3.3.1.1, "Reactor Protection 

System (RPS) Instrumentation," and LCO 3.9.5, "Control Rod 

OPERABILITY - Refueling"), or the added administrative controls in 

Item b.2 and Item c.2 of this Special Operations LCO, provide mitigation 

of potential reactivity excursions. 

ACTIONS A Note has been provided to modify the ACTIONS related to a single 

control rod withdrawal while in MODE 3. Section 1.3, Completion Times, 

specifies once a Condition has been entered, subsequent divisions, 

subsystems, components, or variables expressed in the Condition 

discovered to be inoperable or not within limits, will not result in separate 

entry into the Condition. Section 1.3 also specifies that Required Actions 

of the Condition continue to apply for each additional failure, with 

Completion Times based on initial entry into the Condition. However, the 

Required Actions for each requirement of the LCO not met provide 

appropriate compensatory measures for separate requirements that are 

not met. As such, a Note has been provided that allows separate 

Condition entry for each requirement of the LCO. 

A.1, A.2.1, and A.2.2

If one or more of the requirements of this Special Operations LCO are not 

met with the affected control rod insertable, these Required Actions 

restore operation consistent with normal MODE 4 conditions (i.e., all rods 

inserted) or with the exceptions allowed in this Special Operations LCO. 

Required Action A.1 has been modified by a Note that clarifies that the 

intent of any other LCO is Required Action to insert all control rods. This 

Required Action includes exiting this Special Operations Applicability LCO 

by returning the reactor mode switch to the shutdown position. A second 

Note has been added to Required Action A.1 to clarify that this Required 

Action is only applicable if the requirements not met are for an affected 

LCO. 
Single Control Rod Withdrawal - Cold Shutdown 

B 3.10.4 

BWR/6 STS B 3.10.4-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Required Actions A.2.1 and A.2.2 are specified, based on the assumption 

that the control rod is being withdrawn. If the control rod is still insertable, 

actions must be immediately initiated to fully insert all insertable control 

rods and within 1 hour place the reactor mode switch in the shutdown 

position. Action must continue until all such control rods are fully 

inserted. The allowed Completion Time of 1 hour for placing the reactor 

mode switch in the shutdown position provides sufficient time to normally 

insert the control rods. 

B.1, B.2.1, and B.2.2

If one or more of the requirements of this Special Operations LCO are not 

met with the affected control rod not insertable, withdrawal of the control 

rod and removal of the associated CRD must immediately be suspended. 

If the CRD has been removed, such that the control rod is not insertable, 

the Required Actions require the most expeditious action be taken to 

either initiate action to restore the CRD and insert its control rod, or 

restore compliance with this Special Operations LCO. 

SURVEILLANCE SR 3.10.4.1, SR 3.10.4.2, SR 3.10.4.3, and SR 3.10.4.4

REQUIREMENTS 

The other LCOs made applicable by this Special Operations LCO are 

required to have their associated Surveillances met to establish that this 

Special Operations LCO is being met. If the local array of control rods is 

inserted and disarmed while the scram function for the withdrawn rod is 

not available, periodic verification is required to ensure that the possibility 

of criticality remains precluded. Verification that all the other control rods 

are fully inserted is required to meet the SDM requirements. Verification 

that a control rod withdrawal block has been inserted ensures that no 

other control rods can be inadvertently withdrawn under conditions when 

position indication instrumentation is inoperable for the affected control 

rod. The 24 hour Frequency is acceptable because of the administrative 

controls on control rod withdrawals, the protection afforded by the LCOs 

involved, and hardware interlocks to preclude an additional control rod 

withdrawal. 

SR 3.10.4.2 and SR 3.10.4.4 have been modified by Notes, which clarify 

that these SRs are not required to be met if the alternative requirements 

demonstrated by SR 3.10.4.1 are satisfied. 

REFERENCES 1. FSAR, Section [15.4.1.1]. 
Single CRD Removal - Refueling 

B 3.10.5 

BWR/6 STS B 3.10.5-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.5 Single Control Rod Drive (CRD) Removal - Refueling 

BASES 

BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit the 

removal of a single CRD during refueling operations by imposing certain 

administrative controls. Refueling interlocks restrict the movement of 

control rods and the operation of the refueling equipment to reinforce 

operational procedures that prevent the reactor from becoming critical 

during refueling operations. During refueling operations, no more than 

one control rod is permitted to be withdrawn from a core cell containing 

one or more fuel assemblies. The refueling interlocks use the "full in" 

position indicators to determine the position of all control rods. If the "full 

in" position signal is not present for every control rod, then the all rods in 

permissive for the refueling equipment interlocks is not present and fuel 

loading is prevented. Also, the refuel position one-rod-out interlock will 

not allow the withdrawal of a second control rod. 

The control rod scram function provides backup protection in the event 

normal refueling procedures and the refueling interlocks described above 

fail to prevent inadvertent criticalities during refueling. The requirement 

for this function to be OPERABLE precludes the possibility of removing 

the CRD once a control rod is withdrawn from a core cell containing one 

or more fuel assemblies. This Special Operations LCO provides controls 

sufficient to ensure the possibility of an inadvertent criticality is precluded, 

while allowing a single CRD to be removed from a core cell containing 

one or more fuel assemblies. The removal of the CRD involves 

disconnecting the position indication probe, which causes noncompliance 

with LCO 3.9.4, "Control Rod Position Indication," and, therefore, 

LCO 3.9.1, "Refueling Equipment Interlocks," and LCO 3.9.2, "Refueling 

Position One-Rod-Out Interlock." The CRD removal also requires 

isolation of the CRD from the CRD Hydraulic System, thereby causing 

inoperability of the control rod (LCO 3.9.5, "Control Rod OPERABILITY - 

Refueling"). 

APPLICABLE With the reactor mode switch in the refuel position, the analyses for 

SAFETY control rod withdrawal during refueling are applicable and, provided the 

ANALYSES assumptions of these analyses are satisfied, these analyses will bound 

the consequences of accidents. Explicit safety analyses in the FSAR 

(Ref. 1) demonstrate that the proper operation of the refueling interlocks 

and adequate SDM will preclude unacceptable reactivity excursions. 
Single CRD Removal - Refueling 

B 3.10.5 

BWR/6 STS B 3.10.5-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

Refueling interlocks restrict the movement of control rods and the 

operation of the refueling equipment to reinforce operational procedures 

that prevent the reactor from becoming critical. These interlocks prevent 

the withdrawal of more than one control rod. Under these conditions, 

since only one control rod can be withdrawn, the core will always be shut 

down even with the highest worth control rod withdrawn if adequate SDM 

exists. By requiring all other control rods to be inserted and a control rod 

withdrawal block initiated, the function of the inoperable one-rod-out 

interlock (LCO 3.9.2) is adequately maintained. This Special Operations 

LCO requirement to suspend all CORE ALTERATIONS adequately 

compensates for the inoperable all rods in permissive for the refueling 

equipment interlocks (LCO 3.9.1). 

The control rod scram function provides backup protection to normal 

refueling procedures and the refueling interlocks, which prevent 

inadvertent criticalities during refueling. Since the scram function and 

refueling interlocks may be suspended, alternate backup protection 

required by this Special Operations LCO is obtained by ensuring that a 

five by five array of control rods, centered on the withdrawn control rod, 

are inserted and are incapable of being withdrawn (by insertion of a 

control rod block). 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. Operation in MODE 5 with any of the following LCOs - 

LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation," 

LCO 3.3.8.2, "Reactor Protection System (RPS) Electric Power 

Monitoring," LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, or LCO 3.9.5 - not met 

can be performed in accordance with the Required Actions of these LCOs 

without meeting this Special Operations LCO or its ACTIONS. However, 

if a single CRD removal from a core cell containing one or more fuel 

assemblies is desired in MODE 5, controls consistent with those required 

by LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and 

LCO 3.9.5 must be implemented and this Special Operations LCO 

applied. 
Single CRD Removal - Refueling 

B 3.10.5 

BWR/6 STS B 3.10.5-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

By requiring all other control rods to be inserted and a control rod 

withdrawal block initiated, the function of the inoperable one-rod-out 

interlock (LCO 3.9.2) is adequately maintained. This Special Operations 

LCO requirement to suspend all CORE ALTERATIONS adequately 

compensates for the inoperable all rods in permissive for the refueling 

equipment interlocks (LCO 3.9.1). Ensuring that the five by five array of 

control rods, centered on the withdrawn control rod, are inserted and 

incapable of withdrawal adequately satisfies the backup protection that 

LCO 3.3.1.1 and LCO 3.9.2 would have otherwise provided. Also, once 

these requirements (Items a, b, and c) are completed, the SDM 

requirement to account for both the withdrawn-untrippable control rod and 

the highest worth control rod may be changed to allow the withdrawnuntrippable control rod to be the single highest worth control rod. 

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The allowance to 

comply with this Special Operations LCO in lieu of the ACTIONS of 

LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and 

LCO 3.9.5 is appropriately controlled with the additional administrative 

controls required by this Special Operations LCO, which reduces the 

potential for reactivity excursions. 

ACTIONS A.1, A.2.1, and A.2.2

If one or more of the requirements of this Special Operations LCO are not 

met, the immediate implementation of these Required Actions restores 

operation consistent with the normal requirements for failure to meet 

LCO 3.3.1.1, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 (i.e., all 

control rods inserted) or with the allowances of this Special Operations 

LCO. The Completion Times for Required Action A.1, Required 

Action A.2.1, and Required Action A.2.2 are intended to require these 

Required Actions be implemented in a very short time and carried through 

in an expeditious manner to either initiate action to restore the CRD and 

insert its control rod, or initiate action to restore compliance with this 

Special Operations LCO. Actions must continue until either Required 

Action A.2.1 or Required Action A.2.2 is satisfied. 
Single CRD Removal - Refueling 

B 3.10.5 

BWR/6 STS B 3.10.5-4 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.10.5.1, SR 3.10.5.2, SR 3.10.5.3, SR 3.10.5.4, and SR 3.10.5.5

REQUIREMENTS 

Verification that all the control rods, other than the control rod withdrawn 

for the removal of the associated CRD, are fully inserted is required to 

ensure the SDM is within limits. Verification that the local five by five 

array of control rods other than the control rod withdrawn for the removal 

of the associated CRD, is inserted and disarmed, while the scram 

function for the withdrawn rod is not available, is required to ensure that 

the possibility of criticality remains precluded. Verification that a control 

rod withdrawal block has been inserted ensures that no other control rods 

can be inadvertently withdrawn under conditions when position indication 

instrumentation is inoperable for the withdrawn control rod. The 

Surveillance for LCO 3.1.1, which is made applicable by this Special 

Operations LCO, is required in order to establish that this Special 

Operations LCO is being met. Verification that no other CORE 

ALTERATIONS are being made is required to ensure the assumptions of 

the safety analysis are satisfied. 

Periodic verification of the administrative controls established by this 

Special Operations LCO is prudent to preclude the possibility of an 

inadvertent criticality. The 24 hour Frequency is acceptable, given the 

administrative controls on control rod removal and hardware interlocks to 

block an additional control rod withdrawal. 

REFERENCES 1. FSAR, Section [15.4.1.1]. 
Multiple Control Rod Withdrawal - Refueling 

B 3.10.6 

BWR/6 STS B 3.10.6-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.6 Multiple Control Rod Withdrawal - Refueling 

BASES 

BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit multiple 

control rod withdrawal during refueling by imposing certain administrative 

controls. 

Refueling interlocks restrict the movement of control rods and the 

operation of the refueling equipment to reinforce operational procedures 

that prevent the reactor from becoming critical during refueling 

operations. During refueling operations, no more than one control rod is 

permitted to be withdrawn from a core cell containing one or more fuel 

assemblies. When all four fuel assemblies are removed from a cell, the 

control rods may be withdrawn with no restrictions. Any number of 

control rods may be withdrawn and removed from the reactor vessel if 

their cells contain no fuel. 

The refueling interlocks use the "full in" position indicators to determine 

the position of all control rods. If the "full in" position signal is not present 

for every control rod, then the all rods in permissive for the refueling 

equipment interlocks is not present and fuel loading is prevented. Also, 

the refuel position one-rod-out interlock will not allow the withdrawal of a 

second control rod. 

To allow more than one control rod to be withdrawn during refueling, 

these interlocks must be defeated. This Special Operations LCO 

establishes the necessary administrative controls to allow bypass of the 

"full in" position indicators. 

APPLICABLE Explicit safety analyses in the FSAR (Ref. 1) demonstrate that the 

SAFETY functioning of the refueling interlocks and adequate SDM will prevent 

ANALYSES unacceptable reactivity excursions during refueling. To allow multiple 

control rod withdrawals, control rod removals, associated control rod drive 

(CRD) removal, or any combination of these, the "full in" position 

indication is allowed to be bypassed for each withdrawn control rod if all 

fuel has been removed from the cell. With no fuel assemblies in the core 

cell, the associated control rod has no reactivity control function and is not 

required to remain inserted. Prior to reloading fuel into the cell, however, 

the associated control rod must be inserted to ensure that an inadvertent 

criticality does not occur, as evaluated in the Reference 1 analysis. 
Multiple Control Rod Withdrawal - Refueling 

B 3.10.6 

BWR/6 STS B 3.10.6-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. Operation in MODE 5 with LCO 3.9.3, "Control Rod Position," 

LCO 3.9.4, "Control Rod Position Indication," or LCO 3.9.5, "Control Rod 

OPERABILITY - Refueling," not met, can be performed in accordance 

with the Required Actions of these LCOs without meeting this Special 

Operations LCO or its ACTIONS. If multiple control rod withdrawal or 

removal, or CRD removal is desired, all four fuel assemblies are required 

to be removed from the associated cells. Prior to entering this LCO, any 

fuel remaining in a cell whose CRD was previously removed under the 

provisions of another LCO must be removed. "Withdrawal" in this 

application includes the actual withdrawal of the control rod as well as 

maintaining the control rod in a position other than the full-in position, and 

reinserting the control rod. 

When loading fuel into the core with multiple control rods withdrawn, 

special spiral reload sequences are used to ensure that reactivity 

additions are minimized. Spiral reloading encompasses reloading a cell 

(four fuel locations immediately adjacent to a control rod) on the edge of a 

continuous fueled region (the cell can be loaded in any sequence). 

Otherwise, all control rods must be fully inserted before loading fuel. 

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The exceptions 

from other LCO requirements (e.g., the ACTIONS of LCO 3.9.3, 

LCO 3.9.4 or LCO 3.9.5) allowed by this Special Operations LCO are 

appropriately controlled by requiring all fuel to be removed from cells 

whose "full in" indicators are allowed to be bypassed. 

ACTIONS A.1, A.2.1, and A.2.2

If one or more of the requirements of this Special Operations LCO are not 

met, the immediate implementation of these Required Actions restores 

operation consistent with the normal requirements for refueling (i.e., all 

control rods inserted in core cells containing one or more fuel assemblies) 

or with the exceptions granted by this Special Operations LCO. The 
Multiple Control Rod Withdrawal - Refueling 

B 3.10.6 

BWR/6 STS B 3.10.6-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Completion Times for Required Action A.1, Required Action A.2.1, and 

Required Action A.2.2 are intended to require that these Required Actions 

be implemented in a very short time and carried through in an expeditious 

manner to either initiate action to restore the affected CRDs and insert 

their control rods, or initiate action to restore compliance with this Special 

Operations LCO. 

SURVEILLANCE SR 3.10.6.1, SR 3.10.6.2, and SR 3.10.6.3

REQUIREMENTS 

Periodic verification of the administrative controls established by this 

Special Operations LCO is prudent to preclude the possibility of an 

inadvertent criticality. The 24 hour Frequency is acceptable, given the 

administrative controls on fuel assembly and control rod removal, and 

takes into account other indications of control rod status available in the 

control room. 

REFERENCES 1. FSAR, Section [15.4.1.1]. 
Control Rod Testing - Operating 

B 3.10.7 

BWR/6 STS B 3.10.7-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.7 Control Rod Testing - Operating 

BASES 

BACKGROUND The purpose of this Special Operations LCO is to permit control rod 

testing, while in MODES 1 and 2, by imposing certain administrative 

controls. Control rod patterns during startup conditions are controlled by 

the operator and the rod pattern controller (RPC) (LCO 3.3.2.1, "Control 

Rod Block Instrumentation"), such that only the specified control rod 

sequences and relative positions required by LCO 3.1.6, "Rod Pattern 

Control," are allowed over the operating range from all control rods 

inserted to the low power setpoint (LPSP) of the RPC. The sequences 

effectively limit the potential amount and rate of reactivity increase that 

could occur during a control rod drop accident (CRDA). During these 

conditions, control rod testing is sometimes required that may result in 

control rod patterns not in compliance with the prescribed sequences of 

LCO 3.1.6. These tests may include SDM demonstrations, control rod 

scram time testing, control rod friction testing, and testing performed 

during the Startup Test Program. This Special Operations LCO provides 

the necessary exceptions to the requirements of LCO 3.1.6 and provides 

additional administrative controls to allow the deviations in such tests 

from the prescribed sequences in LCO 3.1.6. 

APPLICABLE The analytical methods and assumptions used in evaluating the CRDA 

SAFETY are summarized in References 1 and 2. CRDA analyses assume the 

ANALYSES reactor operator follows prescribed withdrawal sequences. These 

sequences define the potential initial conditions for the CRDA analyses. 

The RPC provides backup to operator control of the withdrawal 

sequences to ensure that the initial conditions of the CRDA analyses are 

not violated. For special sequences developed for control rod testing, the 

initial control rod patterns assumed in the safety analyses of 

References 1, 2, 3, and 4 may not be preserved. Therefore, special 

CRDA analyses are required to demonstrate that these special 

sequences will not result in unacceptable consequences, should a CRDA 

occur during the testing. These analyses, performed in accordance with 

an NRC approved methodology, are dependent on the specific test being 

performed. 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 
Control Rod Testing - Operating 

B 3.10.7 

BWR/6 STS B 3.10.7-2 Rev. 3.0, 03/31/04 

BASES 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. Control rod testing may be performed in compliance with the 

prescribed sequences of LCO 3.1.6, and during these tests, no 

exceptions to the requirements of LCO 3.1.6 are necessary. For testing 

performed with a sequence not in compliance with LCO 3.1.6, the 

requirements of LCO 3.1.6 may be suspended, provided additional 

administrative controls are placed on the test to ensure that the 

assumptions of the special safety analysis for the test sequence remain 

valid. When deviating from the prescribed sequences of LCO 3.1.6, 

individual control rods must be bypassed in the Rod Action Control 

System (RACS). Assurance that the test sequence is followed can be 

provided by a second licensed operator or other qualified member of the 

technical staff verifying conformance to the approved test sequence. 

These controls are consistent with those normally applied to operation in 

the startup range as defined in SR 3.3.2.1.8, when it is necessary to 

deviate from the prescribed sequence (e.g., an inoperable control rod that 

must be fully inserted). 

APPLICABILITY Control rod testing, while in MODES 1 and 2 with THERMAL POWER 

greater than the LPSP of the RPC, is adequately controlled by the 

existing LCOs on power distribution limits and control rod block 

instrumentation. Control rod movement during these conditions is not 

restricted to prescribed sequences and can be performed within the 

constraints of LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT 

GENERATION RATE (APLHGR)," LCO 3.2.2, "MINIMUM CRITICAL 

POWER RATIO (MCPR)," LCO 3.2.3, "LINEAR HEAT GENERATION 

RATE (LHGR)," and LCO 3.3.2.1. With THERMAL POWER less than or 

equal to the LPSP of the RPC, the provisions of this Special Operations 

LCO are necessary to perform special tests that are not in conformance 

with the prescribed control rod sequences of LCO 3.1.6. While in 

MODES 3 and 4, control rod withdrawal is only allowed if performed in 

accordance with Special Operations LCO 3.10.3, "Single Control Rod 

Withdrawal - Hot Shutdown" or Special Operations LCO 3.10.4, "Single 

Control Rod Withdrawal - Cold Shutdown," which provide adequate 

controls to ensure that the assumptions of the safety analyses of 

Reference 1 and 2 are satisfied. During these Special Operations and 

while in MODE 5, the one rod out interlock (LCO 3.9.2, "Refuel Position 

One-Rod-Out Interlock) and scram functions (LCO 3.3.1.1, "Reactor 

Protection System (RPS) Instrumentation," and LCO 3.9.5, "Control Rod 

OPERABILITY - Refueling"), or the added administrative controls 

prescribed in the applicable Special Operations LCOs, minimize potential 

reactivity excursions. 
Control Rod Testing - Operating 

B 3.10.7 

BWR/6 STS B 3.10.7-3 Rev. 3.0, 03/31/04 

BASES 

ACTIONS A.1

With the requirements of the LCO not met (e.g., the control rod pattern 

not in compliance with the special test sequence), the testing is required 

to be immediately suspended. Upon suspension of the special test, the 

provisions of LCO 3.1.6 are no longer excepted, and appropriate actions 

are to be taken either to restore the control rod sequence to the 

prescribed sequence of LCO 3.1.6, or to shut down the reactor, if required 

by LCO 3.1.6. 

SURVEILLANCE SR 3.10.7.1

REQUIREMENTS 

During performance of the special test, a second licensed operator or 

other qualified member of the technical staff is required to verify 

conformance with the approved sequence for the test. [Note: A member 

of the technical staff is considered to be qualified if he possesses skills 

equal to a licensed operator [in the following areas:].] This verification 

must be performed during control rod movement to prevent deviations 

from the specified sequence. This Surveillance provides adequate 

assurance that the specified test sequence is being followed and is also 

supplemented by SR 3.3.2.1.8, which requires verification of the 

bypassing of control rods in RACS and subsequent movement of these 

control rods. 

REFERENCES 1. NEDE-24011-P-A-US, General Electric Standard Application for 

Reactor Fuel, Supplement for United States (as amended). 

 2. Letter from T. Pickens (BWROG) to G.C. Lainas (NRC), 

"Amendment 17 to General Electric Licensing Topical Report 

NEDE-24011-P-A," August 15, 1986. 
SDM Test - Refueling 

B 3.10.8 

BWR/6 STS B 3.10.8-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.8 SHUTDOWN MARGIN (SDM) Test - Refueling 

BASES 

BACKGROUND The purpose of this MODE 5 Special Operations LCO is to permit SDM 

testing to be performed for those plant configurations in which the reactor 

pressure vessel (RPV) head is either not in place or the head bolts are 

not fully tensioned. 

LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," requires that adequate SDM 

be demonstrated following fuel movements or control rod replacement 

within the RPV. The demonstration must be performed prior to or within 

4 hours after criticality is reached. This SDM test may be performed prior 

to or during the first startup following refueling. Performing the SDM test 

prior to startup requires the test to be performed while in MODE 5 with the 

vessel head bolts less than fully tensioned (and possibly with the vessel 

head removed). While in MODE 5, the reactor mode switch is required to 

be in the shutdown or refuel position, where the applicable control rod 

blocks ensure that the reactor will not become critical. The SDM test 

requires the reactor mode switch to be in the startup/hot standby position, 

since more than one control rod will be withdrawn for the purpose of 

demonstrating adequate SDM. This Special Operations LCO provides 

the appropriate additional controls to allow withdrawing more than one 

control rod from a core cell containing one or more fuel assemblies when 

the reactor vessel head bolts are less than fully tensioned. 

APPLICABLE Prevention and mitigation of unacceptable reactivity excursions during 

SAFETY control rod withdrawal, with the reactor mode switch in the startup/hot 

ANALYSES standby position while in MODE 5, is provided by the Intermediate Range 

Monitor (IRM) neutron flux scram (LCO 3.3.1.1, "Reactor Protection 

System (RPS) Instrumentation"), and control rod block instrumentation 

(LCO 3.3.2.1, "Control Rod Block Instrumentation"). The limiting reactivity 

excursion during startup conditions while in MODE 5 is the control rod 

drop accident (CRDA). 

CRDA analyses assume that the reactor operator follows prescribed 

withdrawal sequences. For SDM tests performed within these defined 

sequences, the analyses of References 1 and 2 are applicable. However, 

for some sequences developed for the SDM testing, the control rod 

patterns assumed in the safety analyses of References 1 and 2 may not 

be met. Therefore, special CRDA analyses, performed in accordance 

with an NRC approved methodology, are required to demonstrate that the 

SDM test sequence will not result in unacceptable consequences should 

a CRDA occur during the testing. For the purpose of this test, the 
SDM Test - Refueling 

B 3.10.8 

BWR/6 STS B 3.10.8-2 Rev. 3.0, 03/31/04 

BASES 

APPLICABLE SAFETY ANALYSES (continued) 

protection provided by the normally required MODE 5 applicable LCOs, in 

addition to the requirements of this LCO, will maintain normal test 

operations as well as postulated accidents within the bounds of the 

appropriate safety analyses (Refs. 1 and 2). In addition to the added 

requirements for the Rod Pattern Controller (RPC), APRM, and control 

rod coupling, the single notch withdrawal mode is specified for out of 

sequence withdrawals. Requiring the single notch withdrawal mode limits 

withdrawal steps to a single notch, which limits inserted reactivity, and 

allows adequate monitoring of changes in neutron flux, which may occur 

during the test. 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. SDM tests may be performed while in MODE 2, in 

accordance with Table 1.1-1, without meeting this Special Operations 

LCO or its ACTIONS. For SDM tests performed while in MODE 5, 

additional requirements must be met to ensure that adequate protection 

against potential reactivity excursions is available. To provide additional 

scram protection, beyond the normally required IRMs, the APRMs are 

also required to be OPERABLE (LCO 3.3.1.1, Functions 2.a and 2.d) as 

though the reactor were in MODE 2. Because multiple control rods will 

be withdrawn and the reactor will potentially become critical, RPS MODE 

2 requirements for Functions 2.a and 2.d of Table 3.3.1.1-1 must be 

enforced and the approved control rod withdrawal sequence must be 

enforced by the RPC (LCO 3.3.2.1, Function 1.b, MODE 2), or must be 

verified by a second licensed operator or other qualified member of the 

technical staff. To provide additional protection against an inadvertent 

criticality, control rod withdrawals that do not conform to the banked 

position withdrawal sequence specified in LCO 3.1.6, "Rod Pattern 

Control" (i.e., out of sequence control rod withdrawals) must be made in 

the notched withdrawal mode to minimize the potential reactivity insertion 

associated with each movement. Coupling integrity of withdrawn control 

rods is required to minimize the probability of a CRDA and ensure proper 

functioning of the withdrawn control rods, if they are required to scram. 

Because the reactor vessel head may be removed during these tests, no 

other CORE ALTERATIONS may be in progress. Furthermore, since the 

control rod scram function with the RCS at atmospheric pressure relies 
SDM Test - Refueling 

B 3.10.8 

BWR/6 STS B 3.10.8-3 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

solely on the CRD accumulator, it is essential that the CRD charging 

water header remain pressurized. This Special Operations LCO then 

allows changing the Table 1.1-1 reactor mode switch position 

requirements to include the startup/hot standby position, such that the 

SDM tests may be performed while in MODE 5. 

APPLICABILITY These SDM test Special Operations requirements are only applicable if 

the SDM tests are to be performed while in MODE 5 with the reactor 

vessel head removed or the head bolts not fully tensioned. Additional 

requirements during these tests to enforce control rod withdrawal 

sequences and restrict other CORE ALTERATIONS provide protection 

against potential reactivity excursions. Operations in all other MODES 

are unaffected by this LCO. 

ACTIONS A.1

With one or more control rods discovered uncoupled during this Special 

Operation, a controlled insertion of each uncoupled control rod is 

required; either to attempt recoupling, or to preclude a control rod drop. 

This controlled insertion is preferred since, if the control rod fails to follow 

the drive as it is withdrawn (i.e., is "stuck" in an inserted position), placing 

the reactor mode switch in the shutdown position per Required Action B.1 

could cause substantial secondary damage. If recoupling is not 

accomplished, operation may continue, provided the control rods are fully 

inserted within 3 hours and disarmed (electrically or hydraulically) within 

4 hours. Inserting a control rod ensures the shutdown and scram 

capabilities are not adversely affected. The control rod is disarmed to 

prevent inadvertent withdrawal during subsequent operations. The 

control rods can be hydraulically disarmed by closing the drive water and 

exhaust water isolation valves. Electrically, the control rods can be 

disarmed by disconnecting power from all four directional control valve 

solenoids. Required Action A.1 is modified by a Note that allows control 

rods to be bypassed in the Rod Action Control System (RACS) if required 

to allow insertion of the inoperable control rods and continued operation. 

SR 3.3.2.1.9 provides additional requirements when the control rods are 

bypassed to ensure compliance with the CRDA analysis. 

The allowed Completion Times are reasonable, considering the small 

number of allowed inoperable control rods, and provide time to insert and 

disarm the control rods in an orderly manner and without challenging 

plant systems. 
SDM Test - Refueling 

B 3.10.8 

BWR/6 STS B 3.10.8-4 Rev. 3.0, 03/31/04 

BASES 

ACTIONS (continued) 

Condition A is modified by a Note allowing separate Condition entry for 

each uncoupled control rod. This is acceptable since the Required 

Actions for this Condition provide appropriate compensatory actions for 

each uncoupled control rod. Complying with the Required Actions may 

allow for continued operation. Subsequent uncoupled control rods are 

governed by subsequent entry into the Condition and application of the 

Required Actions. 

With one or more of the requirements of this LCO not met, for reasons 

other than an uncoupled control rod, the testing should be immediately 

stopped by placing the reactor mode switch in the shutdown or refuel 

position. This results in a condition that is consistent with the 

requirements for MODE 5 where the provisions of this Special Operations 

LCO are no longer required. 

B.1

With the requirements of this LCO not met, the affected control rod shall 

be declared inoperable. This results in a condition that is consistent with 

the requirements for MODE 5 where the provisions of this Special 

Operations LCO are no longer required. 

SURVEILLANCE SR 3.10.8.1, SR 3.10.8.2, and SR 3.10.8.3

REQUIREMENTS 

LCO 3.3.1.1, Functions 2.a and 2.d, made applicable in this Special 

Operations LCO, are required to have applicable Surveillances met to 

establish that this Special Operations LCO is being met. However, the 

control rod withdrawal sequences during the SDM tests may be enforced 

by the RPC (LCO 3.3.2.1, Function 1.b, MODE 2 requirements) or by a 

second licensed operator or other qualified member of the technical staff. 

As noted, either the applicable SRs for the RPC (LCO 3.3.2.1) must be 

satisfied according to the applicable Frequencies (SR 3.10.8.2), or the 

proper movement of control rods must be verified (SR 3.10.8.3). This 

latter verification (i.e., SR 3.10.8.3) must be performed during control rod 

movement to prevent deviations from the specified sequence. These 

surveillances provide adequate assurance that the specified test 

sequence is being followed. 
SDM Test - Refueling 

B 3.10.8 

BWR/6 STS B 3.10.8-5 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE REQUIREMENTS (continued) 

SR 3.10.8.4

Periodic verification of the administrative controls established by this LCO 

will ensure that the reactor is operated within the bounds of the safety 

analysis. The 12 hour Frequency is intended to provide appropriate 

assurance that each operating shift is aware of and verifies compliance 

with these Special Operations LCO requirements. 

SR 3.10.8.5

Coupling verification is performed to ensure the control rod is connected 

to the control rod drive mechanism and will perform its intended function 

when necessary. The verification is required to be performed any time a 

control rod is withdrawn to the "full out" notch position or prior to declaring 

the control rod OPERABLE after work on the control rod or CRD System 

that could affect coupling. This Frequency is acceptable, considering the 

low probability that a control rod will become uncoupled when it is not 

being moved as well as operating experience related to uncoupling 

events. 

SR 3.10.8.6

CRD charging water header pressure verification is performed to ensure 

the motive force is available to scram the control rods in the event of a 

scram signal. A minimum accumulator pressure is specified, below which 

the capability of the accumulator to perform its intended function becomes 

degraded and the accumulator is considered inoperable. The minimum 

accumulator pressure of 1520 psig is well below the expected pressure of 

1750 psig to 2000 psig. The 7 day Frequency has been shown to be 

acceptable through operating experience and takes into account 

indications available in the control room. 

REFERENCES 1. NEDE-24011-P-A-US, General Electric Standard Application for 

Reactor Fuel, Supplement For United States (as amended). 

 2. Letter, T.A. Pickens (BWROG) to G.C. Lainas (NRC), 

"Amendment 17 to General Electric Licensing Topical Report 

NEDE-24011-P-A," August 15, 1986. 
Recirculation Loops - Testing 

B 3.10.9 

BWR/6 STS B 3.10.9-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.9 Recirculation Loops - Testing 

BASES 

BACKGROUND The purpose of this Special Operations LCO in MODES 1 and 2 is to 

allow either the PHYSICS TESTS or the Startup Test Program to be 

performed with less than two recirculation loops in operation. Testing 

performed as part of the Startup Test Program (Ref. 1), or PHYSICS 

TESTS authorized under the provisions of 10 CFR 50.59 (Ref. 2) or 

otherwise approved by the NRC, may be required to be performed under 

natural circulation conditions with the reactor critical. LCO 3.4.1, 

"Recirculation Loops Operating," requires that one or both recirculation 

loops be in operation during MODES 1 and 2. This Special Operations 

LCO provides the appropriate additional restrictions to allow testing at 

natural circulation conditions or in single loop operation with the reactor 

critical. 

APPLICABLE The operation of the Reactor Coolant Recirculation System is an initial 

SAFETY condition assumed in the design basis loss of coolant accident (Ref. 3). 

ANALYSES During a LOCA caused by a recirculation loop pipe break, the intact loop 

is assumed to provide coolant flow during the first few seconds of the 

postulated accident. During PHYSICS TESTS ≤ 5% RTP, or limited 

testing during the Startup Test Program for the initial cycle, the decay 

heat in the reactor coolant is sufficiently low, such that the consequences 

of an accident are reduced and the coastdown characteristics of the 

recirculation loops are not important. In addition, the probability of a 

Design Basis Accident (DBA) or other accidents occurring during the 

limited time allowed at natural circulation or in single loop operation is 

low. 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. However, to perform testing at natural circulation conditions 

or with a single operating loop, operations must be limited to those tests 

defined in the Startup Test Program or approved PHYSICS TESTS 

performed at ≤ [5%] RTP. To minimize the probability of an accident, 
Recirculation Loops - Testing 

B 3.10.9 

BWR/6 STS B 3.10.9-2 Rev. 3.0, 03/31/04 

BASES 

LCO (continued) 

while operating at natural circulation conditions or with one operating 

loop, the duration of these tests is limited to ≤ 24 hours. This Special 

Operations LCO then allows suspension of the requirements of LCO 3.4.1 

during such testing. In addition to the requirements of this LCO, the 

normally required MODE 1 or MODE 2 applicable LCOs must be met. 

APPLICABILITY This Special Operations LCO may only be used while performing testing 

at natural circulation conditions or while operating with a single loop, as 

may be required as part of the Startup Test Program or during low power 

PHYSICS TESTS. Additional requirements during these tests to limit the 

operating time at natural circulation conditions reduce the probability that 

a DBA may occur with both recirculation loops not in operation. 

Operations in all other MODES are unaffected by this LCO. 

ACTIONS A.1

With the testing performed at natural circulation conditions or with a single 

operating loop, and the duration of the test exceeding the 24 hour time 

limit, actions should be taken to promptly shut down. Inserting all 

insertable control rods will result in a condition that does not require both 

recirculation loops to be in operation. The allowed Completion Time of 

[1] hour provides sufficient time to insert the withdrawn control rods. 

B.1

With the requirements of this LCO not met for reasons other than those 

specified in Condition A (e.g., low power PHYSICS TESTS exceeding 

[5]% RTP, or unapproved testing at natural circulation), the reactor mode 

switch should immediately be placed in the shutdown position. This 

results in a condition that does not require both recirculation loops to be in 

operation. The action to immediately place the reactor mode switch in the 

shutdown position prevents unacceptable consequences from an 

accident initiated from outside the analysis bounds. Also, operation 

beyond authorized bounds should be terminated upon discovery. 
Recirculation Loops - Testing 

B 3.10.9 

BWR/6 STS B 3.10.9-3 Rev. 3.0, 03/31/04 

BASES 

SURVEILLANCE SR 3.10.9.1 and SR 3.10.9.2

REQUIREMENTS 

Periodic verification of the administrative controls established by this LCO 

will ensure that the reactor is operated within the bounds of this LCO. 

Because the 1 hour Frequency provides frequent checks of the LCO 

requirements during the allowed 24 hour testing interval, the probability of 

operation outside the limits concurrent with a postulated accident is 

reduced even further. 

REFERENCES 1. FSAR, Chapter [14]. 

 2. 10 CFR 50.59. 

 3. FSAR, Section [6.3.3.4]. 

 4. FSAR, Section [ ]. 
Training Startups 

B 3.10.10 

BWR/6 STS B 3.10.10-1 Rev. 3.0, 03/31/04 

B 3.10 SPECIAL OPERATIONS 

B 3.10.10 Training Startups 

BASES 

BACKGROUND The purpose of this Special Operations LCO is to permit training startups 

to be performed while in MODE 2 to provide plant startup experience for 

reactor operators. This training involves withdrawal of control rods to 

achieve criticality and then further withdrawal of control rods, as would be 

experienced during an actual plant startup. During these training 

startups, if the reactor coolant is allowed to heat up, maintenance of a 

constant reactor vessel water level requires the passage of reactor 

coolant through the Reactor Water Cleanup System, as the reactor 

coolant specific volume increases. Since this results in reactor water 

discharge to the radioactive waste disposal system, the amount of this 

discharge should be minimized. This Special Operations LCO provides 

the appropriate additional controls to allow one residual heat removal 

(RHR) subsystem to be aligned in the shutdown cooling mode, so that the 

reactor coolant temperature can be controlled during the training startups, 

thereby minimizing the discharge of reactor water to the radioactive waste 

disposal system. 

APPLICABLE The Emergency Core Cooling System (ECCS) is designed to provide 

SAFETY core cooling following a loss of coolant accident (LOCA). The low 

ANALYSES pressure coolant injection (LPCI) mode of the RHR System is one of the 

ECCS subsystems assumed to function during a LOCA. With reactor 

power ≤ 1% RTP (equivalent to all OPERABLE intermediate range 

monitor (IRM) channels ≤ 25/40 divisions of full scale on Range 7) and 

average reactor coolant temperature < 200°F, the stored energy in the 

reactor core and coolant system is very low, and a reduced complement 

of ECCS can provide the required core cooling, thereby allowing 

operation with one RHR subsystem in the shutdown cooling mode 

(Ref. 1). 

As described in LCO 3.0.7, compliance with Special Operations LCOs is 

optional, and therefore, no criteria of 10 CFR 50.36(c)(2)(ii) apply. 

Special Operations LCOs provide flexibility to perform certain operations 

by appropriately modifying requirements of other LCOs. A discussion of 

the criteria satisfied for the other LCOs is provided in their respective 

Bases. 
Training Startups 

B 3.10.10 

BWR/6 STS B 3.10.10-2 Rev. 3.0, 03/31/04 

BASES 

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO 

is optional. Training startups may be performed while in MODE 2 with no 

RHR subsystems aligned in the shutdown cooling mode and, therefore, 

without meeting this Special Operations LCO or its ACTIONS. However, 

to minimize the discharge of reactor coolant to the radioactive waste 

disposal system, performance of the training startups may be performed 

with one RHR subsystem aligned in the shutdown cooling mode to 

maintain reactor coolant temperature < 200°F. Under these conditions, 

the THERMAL POWER must be maintained ≤ 1% RTP (equivalent to all 

OPERABLE IRM channels ≤ 25/40 divisions of full scale on Range 7) and 

the reactor coolant temperature must be ≤ 200°F. This Special 

Operations LCO then allows changing the LPCI OPERABILITY 

requirements. In addition to the requirements of this LCO, the normally 

required MODE 2 applicable LCOs must also be met. 

APPLICABILITY Training startups while in MODE 2 may be performed with one RHR 

subsystem aligned in the shutdown cooling mode to control the reactor 

coolant temperature. Additional requirements during these tests to 

restrict the reactor power and reactor coolant temperature provide 

protection against potential conditions that could require operation of both 

RHR subsystems in the LPCI mode of operation. Operations in all other 

MODES are unaffected by this LCO. 

ACTIONS A.1

With one or more of the requirements of this LCO not met, (i.e., any 

OPERABLE IRM channel > 25/40 division of full scale on Range 7, or 

average reactor coolant temperature ≥ 200°F) the reactor may be in a 

condition that requires the full complement of ECCS subsystems, and the 

reactor mode switch must be immediately placed in the shutdown 

position. This results in a condition that does not require all RHR 

subsystems to be OPERABLE in the LPCI mode of operation. This action 

may restore compliance with the requirements of this Special Operations 

LCO or may result in placing the plant in either MODE 3 or MODE 4. 

SURVEILLANCE SR 3.10.10.1 and SR 3.10.10.2

REQUIREMENTS 

Periodic verification that the THERMAL POWER and reactor coolant 

temperature limits of this Special Operations LCO are satisfied will ensure 

that the stored energy in the reactor core and reactor coolant are 

sufficiently low to preclude the need for all RHR subsystems to be aligned 

in the LPCI mode of operation. The 1 hour Frequency provides frequent 

checks of these LCO requirements during the training startup. 

REFERENCES 1. FSAR, Section [6.3.3.4].