Standard Technical 

Specifications

Westinghouse Plants

Revision 4.0

Volume 2, Bases

Office of Nuclear Reactor Regulation

NUREG-1431

Volume 2

Revision 4.0

Standard Technical 

Specifications

Westinghouse Plants

Revision 4.0

Volume 2, Bases

Manuscript Completed: October 2011

Date Published: April 2012

Office of Nuclear Reactor Regulation

NUREG-1431

Volume 2

Revision 4.0
AVAILABILITY OF REFERENCE MATERIALS

IN NRC PUBLICATIONS

NRC Reference Material

As of November 1999, you may electronically access 

NUREG-series publications and other NRC records at 

NRC=s Public Electronic Reading Room at 

http://www.nrc.gov/reading-rm.html.

Publicly released records include, to name a few, 

NUREG-series publications; Federal Register notices; 

applicant, licensee, and vendor documents and 

correspondence; NRC correspondence and internal 

memoranda; bulletins and information notices; 

inspection and investigative reports; licensee event 

reports; and Commission papers and their 

attachments.

NRC publications in the NUREG series, NRC 

regulations, and Title 10, Energy, in the Code of 

Federal Regulations may also be purchased from one 

of these two sources.

1. The Superintendent of Documents

 U.S. Government Printing Office

 Mail Stop SSOP

 Washington, DC 20402B0001

 Internet: bookstore.gpo.gov

 Telephone: 202-512-1800

 Fax: 202-512-2250

2. The National Technical Information Service

 Springfield, VA 22161B0002

 www.ntis.gov 

 1B800B553B6847 or, locally, 703B605B6000

A single copy of each NRC draft report for comment is 

available free, to the extent of supply, upon written 

request as follows:

Address: U.S. Nuclear Regulatory Commission 

 Office of Administration

 Publications Branch

 Washington, DC 20555-0001

E-mail: DISTRIBUTION.SERVICES@NRC.GOV

Facsimile: 301B415B2289 

Some publications in the NUREG series that are 

posted at NRC=s Web site address 

http://www.nrc.gov/reading-rm/doc-collections/nuregs

are updated periodically and may differ from the last 

printed version. Although references to material found 

on a Web site bear the date the material was 

accessed, the material available on the date cited may 

subsequently be removed from the site.

Non-NRC Reference Material

Documents available from public and special technical 

libraries include all open literature items, such as 

books, journal articles, and transactions, Federal 

Register notices, Federal and State legislation, and 

congressional reports. Such documents as theses, 

dissertations, foreign reports and translations, and

non-NRC conference proceedings may be purchased 

from their sponsoring organization.

Copies of industry codes and standards used in a 

substantive manner in the NRC regulatory process are 

maintained atC

The NRC Technical Library 

Two White Flint North

11545 Rockville Pike

Rockville, MD 20852B2738

These standards are available in the library for 

reference use by the public. Codes and standards are 

usually copyrighted and may be purchased from the 

originating organization or, if they are American 

National Standards, fromC

American National Standards Institute

11 West 42nd Street

New York, NY 10036B8002

www.ansi.org 

212B642B4900

Legally binding regulatory requirements are stated only 

in laws; NRC regulations; licenses, including technical 

specifications; or orders, not in 

NUREG-series publications. The views expressed in 

contractor-prepared publications in this series are not 

necessarily those of the NRC.

The NUREG series comprises (1) technical and 

administrative reports and books prepared by the staff 

(NUREGBXXXX) or agency contractors 

(NUREG/CRBXXXX), (2) proceedings of conferences 

(NUREG/CPBXXXX), (3) reports resulting from 

international agreements (NUREG/IABXXXX), (4) 

brochures (NUREG/BRBXXXX), and (5) compilations 

of legal decisions and orders of the Commission and 

Atomic and Safety Licensing Boards and of Directors=

decisions under Section 2.206 of NRC=s regulations 

(NUREGB0750).
Westinghouse STS iii Rev. 4.0

ABSTRACT

This NUREG contains the improved Standard Technical Specifications (STS) for Westinghouse 

plants. The changes reflected in Revision 4 result from the experience gained from plant 

operation using the improved STS and extensive public technical meetings and discussions 

among the Nuclear Regulatory Commission (NRC) staff and various nuclear power plant 

licensees and the Nuclear Steam Supply System (NSSS) Owners Groups.

The improved STS were developed based on the criteria in the Final Commission Policy 

Statement on Technical Specifications Improvements for Nuclear Power Reactors, dated 

July 22, 1993 (58 FR 39132), which was subsequently codified by changes to Section 36 of Part 

50 of Title 10 of the Code of Federal Regulations (10 CFR 50.36) (60 FR 36953). Licensees are 

encouraged to upgrade their technical specifications consistent with those criteria and 

conforming, to the practical extent, to Revision 4 to the improved STS. The Commission 

continues to place the highest priority on requests for complete conversions to the improved 

STS. Licensees adopting portions of the improved STS to existing technical specifications 

should adopt all related requirements, as applicable, to achieve a high degree of standardization 

and consistency.

Users may access the STS NUREGs in the PDF format at (http://www.nrc.gov). Users may 

print or download copies from the NRC Web site.

PAPERWORK REDUCTION ACT STATEMENT

The information collections contained in this NUREG are covered by the requirements of 

10 CFR Part 50, which were approved by the Office of Management and Budget, approval 

number 3150-0011.

PUBLIC PROTECTION NOTIFICATION

If a means used to impose an information collection does not display a currently valid OMB 

control number, the NRC may not conduct or sponsor, and a person is not required to respond 

to, the information collection.

Westinghouse STS v Rev. 4.0

TABLE OF CONTENTS / REVISION SUMMARY Page Rev.

B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Reactor Core SLs...................................................................................B 2.1.1-1 4.0

B 2.1.2 Reactor Coolant System (RCS) Pressure SL.........................................B 2.1.2-1 4.0

B 3.0 LIMITING CONDITION FOR OPERATION APPLICABILITY..........................B 3.0-1 4.0

B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY............................B 3.0-16 4.0

B 3.1 REACTIVITY CONTROL SYSTEMS

B 3.1.1 SHUTDOWN MARGIN (SDM) ...............................................................B 3.1.1-1 4.0

B 3.1.2 Core Reactivity .......................................................................................B 3.1.2-1 4.0

B 3.1.3 Moderator Temperature Coefficient (MTC) ............................................B 3.1.3-1 4.0

B 3.1.4 Rod Group Alignment Limits ..................................................................B 3.1.4-1 4.0

B 3.1.5 Shutdown Bank Insertion Limits .............................................................B 3.1.5-1 4.0

B 3.1.6 Control Bank Insertion Limits .................................................................B 3.1.6-1 4.0

B 3.1.7 Rod Position Indication...........................................................................B 3.1.7-1 4.0

B 3.1.8 PHYSICS TESTS Exceptions - MODE 2 ...............................................B 3.1.8-1 4.0

B 3.2 POWER DISTRIBUTION LIMITS

B 3.2.1A Heat Flux Hot Channel Factor (FQ(Z)) (CAOC-Fxy Methodology)........ B 3.2.1A-1 4.0

B 3.2.1B Heat Flux Hot Channel Factor (FQ(Z)) (RAOC-W(Z) Methodology) .... B 3.2.1B-1 4.0

B 3.2.1C Heat Flux Hot Channel Factor (FQ(Z)) (CAOC-W(Z) Methodology) ....B 3.2.1C-1 4.0

B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (

N FH

)..................................B 3.2.2-1 4.0

B 3.2.3A AXIAL FLUX DIFFERENCE (AFD) (Constant Axial Offset 

Control (CAOC) Methodology) ...................................................... B 3.2.3A-1 4.0

B 3.2.3B AXIAL FLUX DIFFERENCE (AFD) (Relaxed Axial 

Offset Control (RAOC) Methodology)............................................ B 3.2.3B-1 4.0

B 3.2.4 QUADRANT POWER TILT RATIO (QPTR)...........................................B 3.2.4-1 4.0

B 3.3 INSTRUMENTATION

(Section 3.3 Specifications with an "A" suffix include setpoints. Specifications with a "B" suffix 

reflect a Setpoint Control Program.)

B 3.3.1A Reactor Trip System (RTS) Instrumentation ....................................... B 3.3.1A-1 4.0

B 3.3.1B Reactor Trip System (RTS) Instrumentation ....................................... B 3.3.1B-1 4.0

B 3.3.2A Engineered Safety Feature Actuation System (ESFAS) 

Instrumentation.............................................................................. B 3.3.2A-1 4.0

B 3.3.2B Engineered Safety Feature Actuation System (ESFAS) 

Instrumentation.............................................................................. B 3.3.2B-1 4.0

B 3.3.3 Post Accident Monitoring (PAM) Instrumentation...................................B 3.3.3-1 4.0

B 3.3.4 Remote Shutdown System.....................................................................B 3.3.4-1 4.0

B 3.3.5A Loss of Power (LOP) Diesel Generator (DG) Start 

Instrumentation.............................................................................. B 3.3.5A-1 4.0

B 3.3.5B Loss of Power (LOP) Diesel Generator (DG) Start 

Instrumentation.............................................................................. B 3.3.5B-1 4.0

B 3.3.6A Containment Purge and Exhaust Isolation Instrumentation ................ B 3.3.6A-1 4.0

B 3.3.6B Containment Purge and Exhaust Isolation Instrumentation ................ B 3.3.6B-1 4.0

B 3.3.7A Control Room Emergency Filtration System (CREFS) 

Actuation Instrumentation.............................................................. B 3.3.7A-1 4.0
Westinghouse STS vi Rev. 4.0

TABLE OF CONTENTS / REVISION SUMMARY Page Rev.

B 3.3 INSTRUMENTATION (continued)

B 3.3.7B Control Room Emergency Filtration System (CREFS) 

Actuation Instrumentation.............................................................. B 3.3.7B-1 4.0

B 3.3.8A Fuel Building Air Cleanup System (FBACS) Actuation 

Instrumentation.............................................................................. B 3.3.8A-1 4.0

B 3.3.8B Fuel Building Air Cleanup System (FBACS) Actuation 

Instrumentation.............................................................................. B 3.3.8B-1 4.0

B 3.3.9A Boron Dilution Protection System (BDPS) .......................................... B 3.3.9A-1 4.0

B 3.3.9B Boron Dilution Protection System (BDPS) .......................................... B 3.3.9B-1 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from 

Nucleate Boiling (DNB) Limits ..........................................................B 3.4.1-1 4.0

B 3.4.2 RCS Minimum Temperature for Criticality..............................................B 3.4.2-1 4.0

B 3.4.3 RCS Pressure and Temperature (P/T) Limits ........................................B 3.4.3-1 4.0

B 3.4.4 RCS Loops - MODES 1 and 2................................................................B 3.4.4-1 4.0

B 3.4.5 RCS Loops - MODE 3............................................................................B 3.4.5-1 4.0

B 3.4.6 RCS Loops - MODE 4............................................................................B 3.4.6-1 4.0

B 3.4.7 RCS Loops - MODE 5, Loops Filled.......................................................B 3.4.7-1 4.0

B 3.4.8 RCS Loops - MODE 5, Loops Not Filled ................................................B 3.4.8-1 4.0

B 3.4.9 Pressurizer .............................................................................................B 3.4.9-1 4.0

B 3.4.10 Pressurizer Safety Valves ....................................................................B 3.4.10-1 4.0

B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)...........................B 3.4.11-1 4.0

B 3.4.12 Low Temperature Overpressure Protection (LTOP) System ...............B 3.4.12-1 4.0

B 3.4.13 RCS Operational LEAKAGE ................................................................B 3.4.13-1 4.0

B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage ......................................B 3.4.14-1 4.0

B 3.4.15 RCS Leakage Detection Instrumentation .............................................B 3.4.15-1 4.0

B 3.4.16 RCS Specific Activity............................................................................B 3.4.16-1 4.0

B 3.4.17 RCS Loop Isolation Valves...................................................................B 3.4.17-1 4.0

B 3.4.18 RCS Isolated Loop Startup...................................................................B 3.4.18-1 4.0

B 3.4.19 RCS Loops - Test Exceptions ..............................................................B 3.4.19-1 4.0

B 3.4.20 Steam Generator (SG) Tube Integrity ..................................................B 3.4.20-1 4.0

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.1 Accumulators..........................................................................................B 3.5.1-1 4.0

B 3.5.2 ECCS - Operating ..................................................................................B 3.5.2-1 4.0

B 3.5.3 ECCS - Shutdown ..................................................................................B 3.5.3-1 4.0

B 3.5.4 Refueling Water Storage Tank (RWST).................................................B 3.5.4-1 4.0

B 3.5.5 Seal Injection Flow .................................................................................B 3.5.5-1 4.0

B 3.5.6 Boron Injection Tank (BIT) .....................................................................B 3.5.6-1 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.1A Containment (Atmospheric)................................................................. B 3.6.1A-1 4.0

B 3.6.1B Containment (Dual) ............................................................................. B 3.6.1B-1 4.0

B 3.6.1C Containment (Ice Condenser) .............................................................B 3.6.1C-1 4.0

B 3.6.1D Containment (Subatmospheric)...........................................................B 3.6.1D-1 4.0

B 3.6.2 Containment Air Locks (Atmospheric, Subatmospheric, Ice 

Condenser, and Dual) ......................................................................B 3.6.2-1 4.0

B 3.6.3 Containment Isolation Valves (Atmospheric, Subatmospheric, 

Ice Condenser, and Dual) ................................................................B 3.6.3-1 4.0
Westinghouse STS vii Rev. 4.0

TABLE OF CONTENTS / REVISION SUMMARY Page Rev.

B 3.6 CONTAINMENT SYSTEMS (continued)

B 3.6.4A Containment Pressure (Atmospheric, Dual, and Ice Condenser) ....... B 3.6.4A-1 4.0

B 3.6.4B Containment Pressure (Subatmospheric) ........................................... B 3.6.4B-1 4.0

B 3.6.5A Containment Air Temperature (Atmospheric and Dual) ...................... B 3.6.5A-1 4.0

B 3.6.5B Containment Air Temperature (Ice Condenser) .................................. B 3.6.5B-1 4.0

B 3.6.5C Containment Air Temperature (Subatmospheric)................................B 3.6.5C-1 4.0

B 3.6.6A Containment Spray and Cooling Systems (Atmospheric and 

Dual) (Credit taken for iodine removal by the Containment 

Spray System)............................................................................... B 3.6.6A-1 4.0

B 3.6.6B Containment Spray and Cooling Systems (Atmospheric and 

Dual) (Credit not taken for iodine removal by the 

Containment Spray System) ......................................................... B 3.6.6B-1 4.0

B 3.6.6C Containment Spray System (Ice Condenser)......................................B 3.6.6C-1 4.0

B 3.6.6D Quench Spray (QS) System (Subatmospheric) ..................................B 3.6.6D-1 4.0

B 3.6.6E Recirculation Spray (RS) System (Subatmospheric) .......................... B 3.6.6E-1 4.0

B 3.6.7 Spray Additive System (Atmospheric, Subatmospheric, Ice 

Condenser, and Dual) ......................................................................B 3.6.7-1 4.0

B 3.6.8 Shield Building (Dual and Ice Condenser) .............................................B 3.6.8-1 4.0

B 3.6.9 Hydrogen Mixing System (HMS) (Atmospheric, Ice Condenser, 

and Dual)..........................................................................................B 3.6.9-1 4.0

B 3.6.10 Hydrogen Ignition System (HIS) (Ice Condenser)................................B 3.6.10-1 4.0

B 3.6.11 Iodine Cleanup System (ICS) (Atmospheric and 

Subatmospheric) ............................................................................B 3.6.11-1 4.0

B 3.6.12 Vacuum Relief Valves (Atmospheric and Ice Condenser) ...................B 3.6.12-1 4.0

B 3.6.13 Shield Building Air Cleanup System (SBACS) (Dual and Ice 

Condenser).....................................................................................B 3.6.13-1 4.0

B 3.6.14 Air Return System (ARS) (Ice Condenser)...........................................B 3.6.14-1 4.0

B 3.6.15 Ice Bed (Ice Condenser) ......................................................................B 3.6.15-1 4.0

B 3.6.16 Ice Condenser Doors (Ice Condenser).................................................B 3.6.16-1 4.0

B 3.6.17 Divider Barrier Integrity (Ice Condenser)..............................................B 3.6.17-1 4.0

B 3.6.18 Containment Recirculation Drains (Ice Condenser).............................B 3.6.18-1 4.0

B 3.7 PLANT SYSTEMS

B 3.7.1 Main Steam Safety Valves (MSSVs)......................................................B 3.7.1-1 4.0

B 3.7.2 Main Steam Isolation Valves (MSIVs)....................................................B 3.7.2-1 4.0

B 3.7.3 Main Feedwater Isolation Valves (MFIVs) and Main Feedwater 

Regulation Valves (MFRVs) [ and Associated Bypass 

Valves ].............................................................................................B 3.7.3-1 4.0

B 3.7.4 Atmospheric Dump Valves (ADVs) ........................................................B 3.7.4-1 4.0

B 3.7.5 Auxiliary Feedwater (AFW) System .......................................................B 3.7.5-1 4.0

B 3.7.6 Condensate Storage Tank (CST)...........................................................B 3.7.6-1 4.0

B 3.7.7 Component Cooling Water (CCW) System ............................................B 3.7.7-1 4.0

B 3.7.8 Service Water System (SWS) ................................................................B 3.7.8-1 4.0

B 3.7.9 Ultimate Heat Sink (UHS).......................................................................B 3.7.9-1 4.0

B 3.7.10 Control Room Emergency Filtration System (CREFS).........................B 3.7.10-1 4.0

B 3.7.11 Control Room Emergency Air Temperature Control System 

(CREATCS)....................................................................................B 3.7.11-1 4.0

B 3.7.12 Emergency Core Cooling System (ECCS) Pump Room 

Exhaust Air Cleanup System (PREACS)........................................B 3.7.12-1 4.0
Westinghouse STS viii Rev. 4.0

TABLE OF CONTENTS / REVISION SUMMARY Page Rev.

B 3.7 PLANT SYSTEMS (continued)

B 3.7.13 Fuel Building Air Cleanup System (FBACS) ........................................B 3.7.13-1 4.0

B 3.7.14 Penetration Room Exhaust Air Cleanup System (PREACS) ...............B 3.7.14-1 4.0

B 3.7.15 Fuel Storage Pool Water Level ............................................................B 3.7.15-1 4.0

[ B 3.7.16 Fuel Storage Pool Boron Concentration...............................................B 3.7.16-1 4.0 ]

[ B 3.7.17 Spent Fuel Pool Storage ......................................................................B 3.7.17-1 4.0 ]

B 3.7.18 Secondary Specific Activity ..................................................................B 3.7.18-1 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.1 AC Sources - Operating .........................................................................B 3.8.1-1 4.0

B 3.8.2 AC Sources - Shutdown.........................................................................B 3.8.2-1 4.0

B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air..............................................B 3.8.3-1 4.0

B 3.8.4 DC Sources - Operating.........................................................................B 3.8.4-1 4.0

B 3.8.5 DC Sources - Shutdown.........................................................................B 3.8.5-1 4.0

B 3.8.6 Battery Parameters ................................................................................B 3.8.6-1 4.0

B 3.8.7 Inverters - Operating ..............................................................................B 3.8.7-1 4.0

B 3.8.8 Inverters - Shutdown ..............................................................................B 3.8.8-1 4.0

B 3.8.9 Distribution Systems - Operating............................................................B 3.8.9-1 4.0

B 3.8.10 Distribution Systems - Shutdown .........................................................B 3.8.10-1 4.0

B 3.9 REFUELING OPERATIONS

B 3.9.1 Boron Concentration ..............................................................................B 3.9.1-1 4.0

[ B 3.9.2 Unborated Water Source Isolation Valves .............................................B 3.9.2-1 4.0 ]

B 3.9.3 Nuclear Instrumentation .........................................................................B 3.9.3-1 4.0

B 3.9.4 Containment Penetrations......................................................................B 3.9.4-1 4.0

B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation - High 

Water Level ......................................................................................B 3.9.5-1 4.0

B 3.9.6 Residual Heat Removal (RHR) and Coolant Circulation - Low 

Water Level ......................................................................................B 3.9.6-1 4.0

B 3.9.7 Refueling Cavity Water Level .................................................................B 3.9.7-1 4.0
Reactor Core SLs

B 2.1.1

Westinghouse STS B 2.1.1-1 Rev. 4.0

B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Reactor Core 

BASES

BACKGROUND GDC 10 (Ref. 1) requires that specified acceptable fuel design limits are 

not exceeded during steady state operation, normal operational 

transients, and anticipated operational occurrences (AOOs). This is 

accomplished by having a departure from nucleate boiling (DNB) design 

basis, which corresponds to a 95% probability at a 95% confidence level 

(the 95/95 DNB criterion) that DNB will not occur and by requiring that 

fuel centerline temperature stays below the melting temperature.

The restrictions of this SL prevent overheating of the fuel and cladding, as 

well as possible cladding perforation, that would result in the release of 

fission products to the reactor coolant. Overheating of the fuel is 

prevented by maintaining the steady state peak linear heat rate (LHR) 

below the level at which fuel centerline melting occurs. Overheating of 

the fuel cladding is prevented by restricting fuel operation to within the 

nucleate boiling regime, where the heat transfer coefficient is large and 

the cladding surface temperature is slightly above the coolant saturation 

temperature.

Fuel centerline melting occurs when the local LHR, or power peaking, in a 

region of the fuel is high enough to cause the fuel centerline temperature 

to reach the melting point of the fuel. Expansion of the pellet upon 

centerline melting may cause the pellet to stress the cladding to the point 

of failure, allowing an uncontrolled release of activity to the reactor 

coolant.

Operation above the boundary of the nucleate boiling regime could result 

in excessive cladding temperature because of the onset of DNB and the 

resultant sharp reduction in heat transfer coefficient. Inside the steam 

film, high cladding temperatures are reached, and a cladding water 

(zirconium water) reaction may take place. This chemical reaction results 

in oxidation of the fuel cladding to a structurally weaker form. This 

weaker form may lose its integrity, resulting in an uncontrolled release of 

activity to the reactor coolant.

The proper functioning of the Reactor Protection System (RPS) and 

steam generator safety valves prevents violation of the reactor core SLs.
Reactor Core SLs

B 2.1.1

Westinghouse STS B 2.1.1-2 Rev. 4.0

BASES

APPLICABLE The fuel cladding must not sustain damage as a result of normal

SAFETY operation and AOOs. The reactor core SLs are established to preclude

ANALYSES violation of the following fuel design criteria:

a. There must be at least 95% probability at a 95% confidence level (the 

95/95 DNB criterion) that the hot fuel rod in the core does not 

experience DNB and

b. The hot fuel pellet in the core must not experience centerline fuel 

melting.

The Reactor Trip System setpoints (Ref. 2), in combination with all the 

LCOs, are designed to prevent any anticipated combination of transient 

conditions for Reactor Coolant System (RCS) temperature, pressure, 

RCS Flow, ∆I, and THERMAL POWER level that would result in a 

departure from nucleate boiling ratio (DNBR) of less than the DNBR limit 

and preclude the existence of flow instabilities.

Automatic enforcement of these reactor core SLs is provided by the 

appropriate operation of the RPS and the steam generator safety valves.

The SLs represent a design requirement for establishing the RPS trip 

setpoints identified previously. LCO 3.4.1, "RCS Pressure, Temperature, 

and Flow Departure from Nucleate Boiling (DNB) Limits," or the assumed 

initial conditions of the safety analyses (as indicated in the FSAR, Ref. 2) 

provide more restrictive limits to ensure that the SLs are not exceeded.

SAFETY LIMITS The figure provided in the COLR shows the loci of points of THERMAL 

POWER, RCS pressure, and average temperature for which the minimum 

DNBR is not less than the safety analyses limit, that fuel centerline 

temperature remains below melting, that the average enthalpy in the hot 

leg is less than or equal to the enthalpy of saturated liquid, or that the exit 

quality is within the limits defined by the DNBR correlation. 

The reactor core SLs are established to preclude violation of the following 

fuel design criteria:

a. There must be at least a 95% probability at a 95% confidence level 

(the 95/95 DNB criterion) that the hot fuel rod in the core does not 

experience DNB and

b. There must be at least a 95% probability at a 95% confidence level 

that the hot fuel pellet in the core does not experience centerline fuel 

melting.
Reactor Core SLs

B 2.1.1

Westinghouse STS B 2.1.1-3 Rev. 4.0

BASES

SAFETY LIMITS (continued)

The reactor core SLs are used to define the various RPS functions such 

that the above criteria are satisfied during steady state operation, normal 

operational transients, and anticipated operational occurrences (AOOs). 

To ensure that the RPS precludes the violation of the above criteria, 

additional criteria are applied to the Overtemperature and Overpower ∆T 

reactor trip functions. That is, it must be demonstrated that the average 

enthalpy in the hot leg is less than or equal to the saturation enthalpy and 

that the core exit quality is within the limits defined by the DNBR 

correlation. Appropriate functioning of the RPS ensures that for variations 

in the THERMAL POWER, RCS Pressure, RCS average temperature, 

RCS flow rate, and ∆I that the reactor core SLs will be satisfied during 

steady state operation, normal operational transients, and AOOs.

APPLICABILITY SL 2.1.1 only applies in MODES 1 and 2 because these are the only 

MODES in which the reactor is critical. Automatic protection functions are 

required to be OPERABLE during MODES 1 and 2 to ensure operation 

within the reactor core SLs. The steam generator safety valves or 

automatic protection actions serve to prevent RCS heatup to the reactor 

core SL conditions or to initiate a reactor trip function, which forces the 

unit into MODE 3. Setpoints for the reactor trip functions are specified in 

LCO 3.3.1, "Reactor Trip System (RTS) Instrumentation." In MODES 3, 

4, 5, and 6, Applicability is not required since the reactor is not generating 

significant THERMAL POWER.

SAFETY LIMIT The following SL violation responses are applicable to the reactor core

VIOLATIONS SLs. If SL 2.1.1 is violated, the requirement to go to MODE 3 places

the unit in a MODE in which this SL is not applicable.

The allowed Completion Time of 1 hour recognizes the importance of 

bringing the unit to a MODE of operation where this SL is not applicable, 

and reduces the probability of fuel damage.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10.

2. FSAR, Section [7.2].

RCS Pressure SL

B 2.1.2

Westinghouse STS B 2.1.2-1 Rev. 4.0

B 2.0 SAFETY LIMITS (SLs)

B 2.1.2 Reactor Coolant System (RCS) Pressure SL 

BASES

BACKGROUND The SL on RCS pressure protects the integrity of the RCS against 

overpressurization. In the event of fuel cladding failure, fission products 

are released into the reactor coolant. The RCS then serves as the 

primary barrier in preventing the release of fission products into the 

atmosphere. By establishing an upper limit on RCS pressure, the 

continued integrity of the RCS is ensured. According to 10 CFR 50, 

Appendix A, GDC 14, "Reactor Coolant Pressure Boundary," and 

GDC 15, "Reactor Coolant System Design" (Ref. 1), the reactor pressure 

coolant boundary (RCPB) design conditions are not to be exceeded 

during normal operation and anticipated operational occurrences (AOOs). 

Also, in accordance with GDC 28, "Reactivity Limits" (Ref. 1), reactivity 

accidents, including rod ejection, do not result in damage to the RCPB 

greater than limited local yielding.

The design pressure of the RCS is 2500 psia. During normal operation 

and AOOs, RCS pressure is limited from exceeding the design pressure 

by more than 10%, in accordance with Section III of the ASME Code 

(Ref. 2). To ensure system integrity, all RCS components are 

hydrostatically tested at 125% of design pressure, according to the ASME 

Code requirements prior to initial operation when there is no fuel in the 

core. Following inception of unit operation, RCS components shall be 

pressure tested, in accordance with the requirements of ASME Code, 

Section XI (Ref. 3).

Overpressurization of the RCS could result in a breach of the RCPB. If 

such a breach occurs in conjunction with a fuel cladding failure, fission 

products could enter the containment atmosphere, raising concerns 

relative to limits on radioactive releases specified in 10 CFR 100, 

"Reactor Site Criteria" (Ref. 4).

APPLICABLE The RCS pressurizer safety valves, the main steam safety valves

SAFETY (MSSVs), and the reactor high pressure trip have settings established

ANALYSES to ensure that the RCS pressure SL will not be exceeded. 

The RCS pressurizer safety valves are sized to prevent system pressure 

from exceeding the design pressure by more than 10%, as specified in 

Section III of the ASME Code for Nuclear Power Plant Components 

(Ref. 2). The transient that establishes the required relief capacity, and 

hence valve size requirements and lift settings, is a complete loss of 
RCS Pressure SL

B 2.1.2

Westinghouse STS B 2.1.2-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

external load without a direct reactor trip. During the transient, no control 

actions are assumed, except that the safety valves on the secondary 

plant are assumed to open when the steam pressure reaches the 

secondary plant safety valve settings, and nominal feedwater supply is 

maintained.

The Reactor Trip System setpoints (Ref. 5), together with the settings of 

the MSSVs, provide pressure protection for normal operation and AOOs. 

The reactor high pressure trip setpoint is specifically set to provide 

protection against overpressurization (Ref. 5). The safety analyses for 

both the high pressure trip and the RCS pressurizer safety valves are 

performed using conservative assumptions relative to pressure control 

devices.

More specifically, no credit is taken for operation of any of the following:

a. Pressurizer power operated relief valves (PORVs),

b. Steam line relief valve,

c. Steam Dump System,

d. Reactor Control System,

e. Pressurizer Level Control System, or

f. Pressurizer spray valve.

SAFETY LIMITS The maximum transient pressure allowed in the RCS pressure vessel 

under the ASME Code, Section III, is 110% of design pressure. The 

maximum transient pressure allowed in the RCS piping, valves, and 

fittings under [USAS, Section B31.1 (Ref. 6)] is 120% of design pressure. 

The most limiting of these two allowances is the 110% of design 

pressure; therefore, the SL on maximum allowable RCS pressure is 

2735 psig.
RCS Pressure SL

B 2.1.2

Westinghouse STS B 2.1.2-3 Rev. 4.0

BASES

APPLICABILITY SL 2.1.2 applies in MODES 1, 2, 3, 4, and 5 because this SL could be 

approached or exceeded in these MODES due to overpressurization 

events. The SL is not applicable in MODE 6 because the reactor vessel 

head closure bolts are not fully tightened, making it unlikely that the RCS 

can be pressurized.

SAFETY LIMIT If the RCS pressure SL is violated when the reactor is in MODE 1

VIOLATIONS or 2, the requirement is to restore compliance and be in MODE 3 within 

1 hour.

Exceeding the RCS pressure SL may cause immediate RCS failure and 

create a potential for radioactive releases in excess of 10 CFR 100, 

"Reactor Site Criteria," limits (Ref. 4).

The allowable Completion Time of 1 hour recognizes the importance of 

reducing power level to a MODE of operation where the potential for 

challenges to safety systems is minimized.

If the RCS pressure SL is exceeded in MODE 3, 4, or 5, RCS pressure 

must be restored to within the SL value within 5 minutes. Exceeding the 

RCS pressure SL in MODE 3, 4, or 5 is more severe than exceeding this 

SL in MODE 1 or 2, since the reactor vessel temperature may be lower 

and the vessel material, consequently, less ductile. As such, pressure 

must be reduced to less than the SL within 5 minutes. The action does 

not require reducing MODES, since this would require reducing 

temperature, which would compound the problem by adding thermal 

gradient stresses to the existing pressure stress.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 14, GDC 15, and GDC 28.

2. ASME, Boiler and Pressure Vessel Code, Section III, 

Article NB-7000.

3. ASME, Boiler and Pressure Vessel Code, Section XI, 

Article IWX-5000.

4. 10 CFR 100.

5. FSAR, Section [7.2].

6. USAS B31.1, Standard Code for Pressure Piping, American Society 

of Mechanical Engineers, 1967.

LCO Applicability

B 3.0

Westinghouse STS B 3.0-1 Rev. 4.0

B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY

BASES

LCOs LCO 3.0.1 through LCO 3.0.9 establish the general requirements 

applicable to all Specifications and apply at all times, unless otherwise 

stated.

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual 

Specification as the requirement for when the LCO is required to be met 

(i.e., when the unit is in the MODES or other specified conditions of the 

Applicability statement of each Specification).

LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, 

the associated ACTIONS shall be met. The Completion Time of each 

Required Action for an ACTIONS Condition is applicable from the point in 

time that an ACTIONS Condition is entered. The Required Actions 

establish those remedial measures that must be taken within specified 

Completion Times when the requirements of an LCO are not met. This 

Specification establishes that:

a. Completion of the Required Actions within the specified Completion 

Times constitutes compliance with a Specification and

b. Completion of the Required Actions is not required when an LCO is 

met within the specified Completion Time, unless otherwise specified.

There are two basic types of Required Actions. The first type of Required 

Action specifies a time limit in which the LCO must be met. This time limit 

is the Completion Time to restore an inoperable system or component to 

OPERABLE status or to restore variables to within specified limits. If this 

type of Required Action is not completed within the specified Completion 

Time, a shutdown may be required to place the unit in a MODE or 

condition in which the Specification is not applicable. (Whether stated as 

a Required Action or not, correction of the entered Condition is an action 

that may always be considered upon entering ACTIONS.) The second 

type of Required Action specifies the remedial measures that permit 

continued operation of the unit that is not further restricted by the 

Completion Time. In this case, compliance with the Required Actions 

provides an acceptable level of safety for continued operation.

Completing the Required Actions is not required when an LCO is met or

is no longer applicable, unless otherwise stated in the individual 

Specifications.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-2 Rev. 4.0

BASES

LCO 3.0.2 (continued)

The nature of some Required Actions of some Conditions necessitates 

that, once the Condition is entered, the Required Actions must be 

completed even though the associated Conditions no longer exist. The 

individual LCO's ACTIONS specify the Required Actions where this is the 

case. An example of this is in LCO 3.4.3, "RCS Pressure and 

Temperature (P/T) Limits."

The Completion Times of the Required Actions are also applicable when 

a system or component is removed from service intentionally. The 

reasons for intentionally relying on the ACTIONS include, but are not 

limited to, performance of Surveillances, preventive maintenance, 

corrective maintenance, or investigation of operational problems. 

Entering ACTIONS for these reasons must be done in a manner that 

does not compromise safety. Intentional entry into ACTIONS should not 

be made for operational convenience. Additionally, if intentional entry into 

ACTIONS would result in redundant equipment being inoperable, 

alternatives should be used instead. Doing so limits the time both 

subsystems/trains of a safety function are inoperable and limits the time 

conditions exist which may result in LCO 3.0.3 being entered. Individual 

Specifications may specify a time limit for performing an SR when 

equipment is removed from service or bypassed for testing. In this case, 

the Completion Times of the Required Actions are applicable when this 

time limit expires, if the equipment remains removed from service or 

bypassed.

When a change in MODE or other specified condition is required to 

comply with Required Actions, the unit may enter a MODE or other 

specified condition in which another Specification becomes applicable. In 

this case, the Completion Times of the associated Required Actions 

would apply from the point in time that the new Specification becomes 

applicable, and the ACTIONS Condition(s) are entered.

LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an 

LCO is not met and:

a. An associated Required Action and Completion Time is not met and 

no other Condition applies or

b. The condition of the unit is not specifically addressed by the 

associated ACTIONS. This means that no combination of Conditions 

stated in the ACTIONS can be made that exactly corresponds to the 

actual condition of the unit. Sometimes, possible combinations of 

Conditions are such that entering LCO 3.0.3 is warranted; in such 

cases, the ACTIONS specifically state a Condition corresponding to 

such combinations and also that LCO 3.0.3 be entered immediately.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-3 Rev. 4.0

BASES

LCO 3.0.3 (continued)

This Specification delineates the time limits for placing the unit in a safe 

MODE or other specified condition when operation cannot be maintained 

within the limits for safe operation as defined by the LCO and its 

ACTIONS. It is not intended to be used as an operational convenience 

that permits routine voluntary removal of redundant systems or 

components from service in lieu of other alternatives that would not result 

in redundant systems or components being inoperable.

Upon entering LCO 3.0.3, 1 hour is allowed to prepare for an orderly 

shutdown before initiating a change in unit operation. This includes time 

to permit the operator to coordinate the reduction in electrical generation 

with the load dispatcher to ensure the stability and availability of the 

electrical grid. The time limits specified to reach lower MODES of 

operation permit the shutdown to proceed in a controlled and orderly 

manner that is well within the specified maximum cooldown rate and 

within the capabilities of the unit, assuming that only the minimum 

required equipment is OPERABLE. This reduces thermal stresses on 

components of the Reactor Coolant System and the potential for a plant 

upset that could challenge safety systems under conditions to which this 

Specification applies. The use and interpretation of specified times to 

complete the actions of LCO 3.0.3 are consistent with the discussion of 

Section 1.3, Completion Times.

A unit shutdown required in accordance with LCO 3.0.3 may be 

terminated and LCO 3.0.3 exited if any of the following occurs:

a. The LCO is now met,

b. A Condition exists for which the Required Actions have now been 

performed, or

c. ACTIONS exist that do not have expired Completion Times. These 

Completion Times are applicable from the point in time that the 

Condition is initially entered and not from the time LCO 3.0.3 is 

exited.

The time limits of LCO 3.0.3 allow 37 hours for the unit to be in MODE 5 

when a shutdown is required during MODE 1 operation. If the unit is in a 

lower MODE of operation when a shutdown is required, the time limit for 

reaching the next lower MODE applies. If a lower MODE is reached in 

less time than allowed, however, the total allowable time to reach 

MODE 5, or other applicable MODE, is not reduced. For example, if 

MODE 3 is reached in 2 hours, then the time allowed for reaching 

MODE 4 is the next 11 hours, because the total time for reaching 
LCO Applicability

B 3.0

Westinghouse STS B 3.0-4 Rev. 4.0

BASES

LCO 3.0.3 (continued)

MODE 4 is not reduced from the allowable limit of 13 hours. Therefore, if 

remedial measures are completed that would permit a return to MODE 1, 

a penalty is not incurred by having to reach a lower MODE of operation in 

less than the total time allowed.

In MODES 1, 2, 3, and 4, LCO 3.0.3 provides actions for Conditions not 

covered in other Specifications. The requirements of LCO 3.0.3 do not 

apply in MODES 5 and 6 because the unit is already in the most 

restrictive Condition required by LCO 3.0.3. The requirements of 

LCO 3.0.3 do not apply in other specified conditions of the Applicability 

(unless in MODE 1, 2, 3, or 4) because the ACTIONS of individual 

Specifications sufficiently define the remedial measures to be taken.

Exceptions to LCO 3.0.3 are provided in instances where requiring a unit 

shutdown, in accordance with LCO 3.0.3, would not provide appropriate 

remedial measures for the associated condition of the unit. An example 

of this is in LCO 3.7.15, "Fuel Storage Pool Water Level." LCO 3.7.15 

has an Applicability of "During movement of irradiated fuel assemblies in 

the fuel storage pool." Therefore, this LCO can be applicable in any or all 

MODES. If the LCO and the Required Actions of LCO 3.7.15 are not met 

while in MODE 1, 2, or 3, there is no safety benefit to be gained by 

placing the unit in a shutdown condition. The Required Action of 

LCO 3.7.15 of "Suspend movement of irradiated fuel assemblies in the 

fuel storage pool" is the appropriate Required Action to complete in lieu of 

the actions of LCO 3.0.3. These exceptions are addressed in the 

individual Specifications.

LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other 

specified conditions in the Applicability when an LCO is not met. It allows 

placing the unit in a MODE or other specified condition stated in that 

Applicability (e.g., the Applicability desired to be entered) when unit 

conditions are such that the requirements of the LCO would not be met, in 

accordance with LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.

LCO 3.0.4.a allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met when the associated ACTIONS to be 

entered permit continued operation in the MODE or other specified 

condition in the Applicability for an unlimited period of time. Compliance 

with Required Actions that permit continued operation of the unit for an 

unlimited period of time in a MODE or other specified condition provides 

an acceptable level of safety for continued operation. This is without 

regard to the status of the unit before or after the MODE change. 

Therefore, in such cases, entry into a MODE or other specified condition 

in the Applicability may be made in accordance with the provisions of the 

Required Actions.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-5 Rev. 4.0

BASES

LCO 3.0.4 (continued)

LCO 3.0.4.b allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met after performance of a risk assessment 

addressing inoperable systems and components, consideration of the 

results, determination of the acceptability of entering the MODE or other 

specified condition in the Applicability, and establishment of risk 

management actions, if appropriate.

The risk assessment may use quantitative, qualitative, or blended 

approaches, and the risk assessment will be conducted using the plant 

program, procedures, and criteria in place to implement 

10 CFR 50.65(a)(4), which requires that risk impacts of maintenance 

activities to be assessed and managed. The risk assessment, for the 

purposes of LCO 3.0.4.b, must take into account all inoperable Technical 

Specification equipment regardless of whether the equipment is included 

in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk 

assessments will be conducted using the procedures and guidance 

endorsed by Regulatory Guide 1.182, “Assessing and Managing Risk 

Before Maintenance Activities at Nuclear Power Plants.” Regulatory 

Guide 1.182 endorses the guidance in Section 11 of NUMARC 93-01, 

“Industry Guideline for Monitoring the Effectiveness of Maintenance at 

Nuclear Power Plants.” These documents address general guidance for 

conduct of the risk assessment, quantitative and qualitative guidelines for 

establishing risk management actions, and example risk management 

actions. These include actions to plan and conduct other activities in a 

manner that controls overall risk, increased risk awareness by shift and 

management personnel, actions to reduce the duration of the condition, 

actions to minimize the magnitude of risk increases (establishment of 

backup success paths or compensatory measures), and determination 

that the proposed MODE change is acceptable. Consideration should 

also be given to the probability of completing restoration such that the 

requirements of the LCO would be met prior to the expiration of ACTIONS 

Completion Times that would require exiting the Applicability.

LCO 3.0.4.b may be used with single, or multiple systems and 

components unavailable. NUMARC 93-01 provides guidance relative to 

consideration of simultaneous unavailability of multiple systems and 

components. 

The results of the risk assessment shall be considered in determining the 

acceptability of entering the MODE or other specified condition in the 

Applicability, and any corresponding risk management actions. The 

LCO 3.0.4.b risk assessments do not have to be documented.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-6 Rev. 4.0

BASES

LCO 3.0.4 (continued)

The Technical Specifications allow continued operation with equipment 

unavailable in MODE 1 for the duration of the Completion Time. Since 

this is allowable, and since in general the risk impact in that particular 

MODE bounds the risk of transitioning into and through the applicable 

MODES or other specified conditions in the Applicability of the LCO, the 

use of the LCO 3.0.4.b allowance should be generally acceptable, as long 

as the risk is assessed and managed as stated above. However, there is 

a small subset of systems and components that have been determined to 

be more important to risk and use of the LCO 3.0.4.b allowance is 

prohibited. The LCOs governing these systems and components contain 

Notes prohibiting the use of LCO 3.0.4.b by stating that LCO 3.0.4.b is not 

applicable.

LCO 3.0.4.c allows entry into a MODE or other specified condition in the 

Applicability with the LCO not met based on a Note in the Specification 

which states LCO 3.0.4.c is applicable. These specific allowances permit 

entry into MODES or other specified conditions in the Applicability when 

the associated ACTIONS to be entered do not provide for continued 

operation for an unlimited period of time and a risk assessment has not 

been performed. This allowance may apply to all the ACTIONS or to a 

specific Required Action of a Specification. The risk assessments 

performed to justify the use of LCO 3.0.4.b usually only consider systems 

and components. For this reason, LCO 3.0.4.c is typically applied to 

Specifications which describe values and parameters (e.g., [Containment 

Air Temperature, Containment Pressure, MCPR, Moderator Temperature 

Coefficient]), and may be applied to other Specifications based on NRC 

plant specific approval.

The provisions of this Specification should not be interpreted as 

endorsing the failure to exercise the good practice of restoring systems or 

components to OPERABLE status before entering an associated MODE 

or other specified condition in the Applicability.

The provisions of LCO 3.0.4 shall not prevent changes in MODES or 

other specified conditions in the Applicability that are required to comply 

with ACTIONS. In addition, the provisions of LCO 3.0.4 shall not prevent 

changes in MODES or other specified conditions in the Applicability that 

result from any unit shutdown. In this context, a unit shutdown is defined 

as a change in MODE or other specified condition in the Applicability 

associated with transitioning from MODE 1 to MODE 2, MODE 2 to 

MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-7 Rev. 4.0

BASES

LCO 3.0.4 (continued)

Upon entry into a MODE or other specified condition in the Applicability 

with the LCO not met, LCO 3.0.1 and LCO 3.0.2 require entry into the 

applicable Conditions and Required Actions until the Condition is 

resolved, until the LCO is met, or until the unit is not within the 

Applicability of the Technical Specification.

Surveillances do not have to be performed on the associated inoperable 

equipment (or on variables outside the specified limits), as permitted by 

SR 3.0.1. Therefore, utilizing LCO 3.0.4 is not a violation of SR 3.0.1 or 

SR 3.0.4 for any Surveillances that have not been performed on 

inoperable equipment. However, SRs must be met to ensure 

OPERABILITY prior to declaring the associated equipment OPERABLE 

(or variable within limits) and restoring compliance with the affected LCO.

LCO 3.0.5 LCO 3.0.5 establishes the allowance for restoring equipment to service 

under administrative controls when it has been removed from service or 

declared inoperable to comply with ACTIONS. The sole purpose of this 

Specification is to provide an exception to LCO 3.0.2 (e.g., to not comply 

with the applicable Required Action(s)) to allow the performance of 

required testing to demonstrate:

a. The OPERABILITY of the equipment being returned to service or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to 

service in conflict with the requirements of the ACTIONS is limited to the 

time absolutely necessary to perform the required testing to demonstrate 

OPERABILITY. This Specification does not provide time to perform any 

other preventive or corrective maintenance.

An example of demonstrating the OPERABILITY of the equipment being 

returned to service is reopening a containment isolation valve that has 

been closed to comply with Required Actions and must be reopened to 

perform the required testing.

An example of demonstrating the OPERABILITY of other equipment is 

taking an inoperable channel or trip system out of the tripped condition to 

prevent the trip function from occurring during the performance of 

required testing on another channel in the other trip system. A similar 

example of demonstrating the OPERABILITY of other equipment is taking 

an inoperable channel or trip system out of the tripped condition to permit 

the logic to function and indicate the appropriate response during the 

performance of required testing on another channel in the same trip 

system.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-8 Rev. 4.0

BASES

LCO 3.0.6 LCO 3.0.6 establishes an exception to LCO 3.0.2 for supported systems 

that have a support system LCO specified in the Technical Specifications 

(TS). This exception is provided because LCO 3.0.2 would require that 

the Conditions and Required Actions of the associated inoperable 

supported system LCO be entered solely due to the inoperability of the 

support system. This exception is justified because the actions that are 

required to ensure the unit is maintained in a safe condition are specified 

in the support system LCO's Required Actions. These Required Actions 

may include entering the supported system's Conditions and Required 

Actions or may specify other Required Actions.

When a support system is inoperable and there is an LCO specified for it 

in the TS, the supported system(s) are required to be declared inoperable 

if determined to be inoperable as a result of the support system 

inoperability. However, it is not necessary to enter into the supported 

systems' Conditions and Required Actions unless directed to do so by the 

support system's Required Actions. The potential confusion and 

inconsistency of requirements related to the entry into multiple support 

and supported systems' LCOs' Conditions and Required Actions are 

eliminated by providing all the actions that are necessary to ensure the 

unit is maintained in a safe condition in the support system's Required 

Actions.

However, there are instances where a support system's Required Action 

may either direct a supported system to be declared inoperable or direct 

entry into Conditions and Required Actions for the supported system. 

This may occur immediately or after some specified delay to perform 

some other Required Action. Regardless of whether it is immediate or 

after some delay, when a support system's Required Action directs a 

supported system to be declared inoperable or directs entry into 

Conditions and Required Actions for a supported system, the applicable 

Conditions and Required Actions shall be entered in accordance with 

LCO 3.0.2.

Specification 5.5.15, "Safety Function Determination Program (SFDP)," 

ensures loss of safety function is detected and appropriate actions are 

taken. Upon entry into LCO 3.0.6, an evaluation shall be made to 

determine if loss of safety function exists. Additionally, other limitations, 

remedial actions, or compensatory actions may be identified as a result of 

the support system inoperability and corresponding exception to entering 

supported system Conditions and Required Actions. The SFDP 

implements the requirements of LCO 3.0.6.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-9 Rev. 4.0

BASES

LCO 3.0.6 (continued)

The following examples use Figure B 3.0-1 to illustrate loss of safety 

function conditions that may result when a TS support system is 

inoperable. In this figure, the fifteen systems that comprise Train A are 

independent and redundant to the fifteen systems that comprise Train B. 

To correctly use the figure to illustrate the SFDP provisions for a cross 

train check, the figure establishes a relationship between support and 

supported systems as follows: the figure shows System 1 as a support 

system for System 2 and System 3; System 2 as a support system for 

System 4 and System 5; and System 4 as a support system for System 8 

and System 9. Specifically, a loss of safety function may exist when a 

support system is inoperable and:

a. A system redundant to system(s) supported by the inoperable 

support system is also inoperable (EXAMPLE B 3.0.6-1), 

b. A system redundant to system(s) in turn supported by the inoperable 

supported system is also inoperable (EXAMPLE B 3.0.6-2), or

c. A system redundant to support system(s) for the supported systems 

(a) and (b) above is also inoperable (EXAMPLE B 3.0.6-3).

For the following examples, refer to Figure B 3.0-1.

EXAMPLE B 3.0.6-1

If System 2 of Train A is inoperable and System 5 of Train B is 

inoperable, a loss of safety function exists in Systems 5, 10, and 11.

EXAMPLE B 3.0.6-2

If System 2 of Train A is inoperable, and System 11 of Train B is 

inoperable, a loss of safety function exists in System 11.

EXAMPLE B 3.0.6-3

If System 2 of Train A is inoperable, and System 1 of Train B is 

inoperable, a loss of safety function exists in Systems 2, 4, 5, 8, 9, 10 and 

11.

If an evaluation determines that a loss of safety function exists, the 

appropriate Conditions and Required Actions of the LCO in which the loss 

of safety function exists are required to be entered.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-10 Rev. 4.0

BASES

LCO 3.0.6 (continued)

Figure B 3.0-1

Configuration of Trains and Systems

This loss of safety function does not require the assumption of additional 

single failures or loss of offsite power. Since operations are being 

restricted in accordance with the ACTIONS of the support system, any 

resulting temporary loss of redundancy or single failure protection is taken 

into account. Similarly, the ACTIONS for inoperable offsite circuit(s) and 

inoperable diesel generator(s) provide the necessary restriction for cross 

train inoperabilities. This explicit cross train verification for inoperable AC 

electrical power sources also acknowledges that supported system(s) are 

not declared inoperable solely as a result of inoperability of a normal or 

emergency electrical power source (refer to the definition of 

OPERABILITY).

When loss of safety function is determined to exist, and the SFDP 

requires entry into the appropriate Conditions and Required Actions of the 

LCO in which the loss of safety function exists, consideration must be 

given to the specific type of function affected. Where a loss of function is 

solely due to a single Technical Specification support system (e.g., loss of 

automatic start due to inoperable instrumentation, or loss of pump suction
LCO Applicability

B 3.0

Westinghouse STS B 3.0-11 Rev. 4.0

BASES

LCO 3.0.6 (continued)

source due to low tank level) the appropriate LCO is the LCO for the 

support system. The ACTIONS for a support system LCO adequately 

address the inoperabilities of that system without reliance on entering its 

supported system LCO. When the loss of function is the result of multiple 

support systems, the appropriate LCO is the LCO for the supported 

system.

LCO 3.0.7 There are certain special tests and operations required to be performed at 

various times over the life of the unit. These special tests and operations 

are necessary to demonstrate select unit performance characteristics, to 

perform special maintenance activities, and to perform special evolutions. 

Test Exception LCOs [3.1.8 and 3.4.19] allow specified Technical 

Specification (TS) requirements to be changed to permit performances of 

these special tests and operations, which otherwise could not be 

performed if required to comply with the requirements of these TS. 

Unless otherwise specified, all the other TS requirements remain 

unchanged. This will ensure all appropriate requirements of the MODE or 

other specified condition not directly associated with or required to be 

changed to perform the special test or operation will remain in effect.

The Applicability of a Test Exception LCO represents a condition not 

necessarily in compliance with the normal requirements of the TS. 

Compliance with Test Exception LCOs is optional. A special operation 

may be performed either under the provisions of the appropriate Test 

Exception LCO or under the other applicable TS requirements. If it is 

desired to perform the special operation under the provisions of the Test 

Exception LCO, the requirements of the Test Exception LCO shall be 

followed.

LCO 3.0.8 LCO 3.0.8 establishes conditions under which systems are considered to 

remain capable of performing their intended safety function when 

associated snubbers are not capable of providing their associated support 

function(s). This LCO states that the supported system is not considered 

to be inoperable solely due to one or more snubbers not capable of 

performing their associated support function(s). This is appropriate 

because a limited length of time is allowed for maintenance, testing, or 

repair of one or more snubbers not capable of performing their associated 

support function(s) and appropriate compensatory measures are 

specified in the snubber requirements, which are located outside of the 

Technical Specifications (TS) under licensee control. The snubber 

requirements do not meet the criteria in 10 CFR 50.36(c)(2)(ii), and, as 

such, are appropriate for control by the licensee.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-12 Rev. 4.0

BASES

LCO 3.0.8 (continued)

If the allowed time expires and the snubber(s) are unable to perform their 

associated support function(s), the affected supported system’s LCO(s) 

must be declared not met and the Conditions and Required Actions 

entered in accordance with LCO 3.0.2.

LCO 3.0.8.a applies when one or more snubbers are not capable of 

providing their associated support function(s) to a single train or 

subsystem of a multiple train or subsystem supported system or to a 

single train or subsystem supported system. LCO 3.0.8.a allows 72 hours 

to restore the snubber(s) before declaring the supported system 

inoperable. The 72 hour Completion Time is reasonable based on the 

low probability of a seismic event concurrent with an event that would 

require operation of the supported system occurring while the snubber(s) 

are not capable of performing their associated support function and due 

to the availability of the redundant train of the supported system.

LCO 3.0.8.b applies when one or more snubbers are not capable of 

providing their associated support function(s) to more than one train or 

subsystem of a multiple train or subsystem supported system. 

LCO 3.0.8.b allows 12 hours to restore the snubber(s) before declaring 

the supported system inoperable. The 12 hour Completion Time is 

reasonable based on the low probability of a seismic event concurrent 

with an event that would require operation of the supported system 

occurring while the snubber(s) are not capable of performing their 

associated support function.

LCO 3.0.8 requires that risk be assessed and managed. Industry and 

NRC guidance on the implementation of 10 CFR 50.65(a)(4) (the 

Maintenance Rule) does not address seismic risk. However, use of 

LCO 3.0.8 should be considered with respect to other plant maintenance 

activities, and integrated into the existing Maintenance Rule process to 

the extent possible so that maintenance on any unaffected train or 

subsystem is properly controlled, and emergent issues are properly 

addressed. The risk assessment need not be quantified, but may be a 

qualitative awareness of the vulnerability of systems and components 

when one or more snubbers are not able to perform their associated 

support function.
LCO Applicability

B 3.0

Westinghouse STS B 3.0-13 Rev. 4.0

BASES

-----------------------------------REVIEWER'S NOTE-----------------------------------

Adoption of LCO 3.0.9 requires the licensee to make the following 

commitments:

1. [LICENSEE] commits to the guidance of NUMARC 93–01, 

Revision 3, Section 11, which provides guidance and details on the 

assessment and management of risk during maintenance.

2. [LICENSEE] commits to the guidance of NEI 04–08, "Allowance for 

Non Technical Specification Barrier Degradation on Supported 

System OPERABILITY (TSTF–427) Industry Implementation 

Guidance," March 2006.

--------------------------------------------------------------------------------------------------

LCO 3.0.9 LCO 3.0.9 establishes conditions under which systems described in the 

Technical Specifications are considered to remain OPERABLE when 

required barriers are not capable of providing their related support 

function(s).

Barriers are doors, walls, floor plugs, curbs, hatches, installed structures 

or components, or other devices, not explicitly described in Technical 

Specifications, that support the performance of the safety function of 

systems described in the Technical Specifications. This LCO states that 

the supported system is not considered to be inoperable solely due to 

required barriers not capable of performing their related support 

function(s) under the described conditions. LCO 3.0.9 allows 30 days 

before declaring the supported system(s) inoperable and the LCO(s) 

associated with the supported system(s) not met. A maximum time is 

placed on each use of this allowance to ensure that as required barriers 

are found or are otherwise made unavailable, they are restored. 

However, the allowable duration may be less than the specified maximum 

time based on the risk assessment. 

If the allowed time expires and the barriers are unable to perform their 

related support function(s), the supported system’s LCO(s) must be 

declared not met and the Conditions and Required Actions entered in 

accordance with LCO 3.0.2.

This provision does not apply to barriers which support ventilation 

systems or to fire barriers. The Technical Specifications for ventilation 

systems provide specific Conditions for inoperable barriers. Fire barriers 

are addressed by other regulatory requirements and associated plant 

programs. This provision does not apply to barriers which are not 

required to support system OPERABILITY (see NRC Regulatory Issue 

Summary 2001-09, "Control of Hazard Barriers," dated April 2, 2001).
LCO Applicability

B 3.0

Westinghouse STS B 3.0-14 Rev. 4.0

BASES

LCO 3.0.9 (continued)

The provisions of LCO 3.0.9 are justified because of the low risk 

associated with required barriers not being capable of performing their 

related support function. This provision is based on consideration of the 

following initiating event categories:

-----------------------------------REVIEWER'S NOTE-----------------------------------

LCO 3.0.9 may be expanded to other initiating event categories provided 

plant-specific analysis demonstrates that the frequency of the additional 

initiating events is bounded by the generic analysis or if plant-specific 

approval is obtained from the NRC.

--------------------------------------------------------------------------------------------------

 Loss of coolant accidents;

 High energy line breaks;

 Feedwater line breaks;

 Internal flooding;

 External flooding;

 Turbine missile ejection; and

 Tornado or high wind.

The risk impact of the barriers which cannot perform their related support 

function(s) must be addressed pursuant to the risk assessment and 

management provision of the Maintenance Rule, 10 CFR 50.65 (a)(4), 

and the associated implementation guidance, Regulatory Guide 1.182, 

"Assessing and Managing Risk Before Maintenance Activities at Nuclear 

Power Plants." Regulatory Guide 1.182 endorses the guidance in 

Section 11 of NUMARC 93-01, "Industry Guideline for Monitoring the 

Effectiveness of Maintenance at Nuclear Power Plants." This guidance 

provides for the consideration of dynamic plant configuration issues, 

emergent conditions, and other aspects pertinent to plant operation with 

the barriers unable to perform their related support function(s). These 

considerations may result in risk management and other compensatory 

actions being required during the period that barriers are unable to 

perform their related support function(s).

LCO 3.0.9 may be applied to one or more trains or subsystems of a 

system supported by barriers that cannot provide their related support 

function(s), provided that risk is assessed and managed (including 

consideration of the effects on Large Early Release and from external 

events). If applied concurrently to more than one train or subsystem of a 

multiple train or subsystem supported system, the barriers supporting 

each of these trains or subsystems must provide their related support 

function(s) for different categories of initiating events. For example, 

LCO 3.0.9 may be applied for up to 30 days for more than one train of a 

multiple train supported system if the affected barrier for one train
LCO Applicability

B 3.0

Westinghouse STS B 3.0-15 Rev. 4.0

BASES

LCO 3.0.9 (continued)

protects against internal flooding and the affected barrier for the other 

train protects against tornado missiles. In this example, the affected 

barrier may be the same physical barrier but serve different protection 

functions for each train. 

If during the time that LCO 3.0.9 is being used, the required OPERABLE 

train or subsystem becomes inoperable, it must be restored to 

OPERABLE status within 24 hours. Otherwise, the train(s) or 

subsystem(s) supported by barriers that cannot perform their related 

support function(s) must be declared inoperable and the associated LCOs 

declared not met. This 24 hour period provides time to respond to 

emergent conditions that would otherwise likely lead to entry into 

LCO 3.0.3 and a rapid plant shutdown, which is not justified given the low 

probability of an initiating event which would require the barrier(s) not 

capable of performing their related support function(s). During this 

24 hour period, the plant risk associated with the existing conditions is 

assessed and managed in accordance with 10 CFR 50.65(a)(4).
SR Applicability

B 3.0

Westinghouse STS B 3.0-16 Rev. 4.0 

B 3.0 SURVEILLANCE REQUIREMENT (SR) APPLICABILITY

BASES

SRs SR 3.0.1 through SR 3.0.4 establish the general requirements applicable 

to all Specifications and apply at all times, unless otherwise stated.

SR 3.0.1 SR 3.0.1 establishes the requirement that SRs must be met during the 

MODES or other specified conditions in the Applicability for which the 

requirements of the LCO apply, unless otherwise specified in the 

individual SRs. This Specification is to ensure that Surveillances are 

performed to verify the OPERABILITY of systems and components, and 

that variables are within specified limits. Failure to meet a Surveillance 

within the specified Frequency, in accordance with SR 3.0.2, constitutes a 

failure to meet an LCO. Surveillances may be performed by means of 

any series of sequential, overlapping, or total steps provided the entire 

Surveillance is performed within the specified Frequency. Additionally, 

the definitions related to instrument testing (e.g., CHANNEL 

CALIBRATION) specify that these tests are performed by means of any 

series of sequential, overlapping, or total steps.

Systems and components are assumed to be OPERABLE when the 

associated SRs have been met. Nothing in this Specification, however, is 

to be construed as implying that systems or components are OPERABLE 

when:

a. The systems or components are known to be inoperable, although 

still meeting the SRs; or

b. The requirements of the Surveillance(s) are known not to be met 

between required Surveillance performances.

Surveillances do not have to be performed when the unit is in a MODE or 

other specified condition for which the requirements of the associated 

LCO are not applicable, unless otherwise specified. The SRs associated 

with a test exception are only applicable when the test exception is used 

as an allowable exception to the requirements of a Specification.

Unplanned events may satisfy the requirements (including applicable 

acceptance criteria) for a given SR. In this case, the unplanned event 

may be credited as fulfilling the performance of the SR. This allowance 

includes those SRs whose performance is normally precluded in a given 

MODE or other specified condition.

Surveillances, including Surveillances invoked by Required Actions, do 

not have to be performed on inoperable equipment because the 

ACTIONS define the remedial measures that apply. Surveillances have 

to be met and performed in accordance with SR 3.0.2, prior to returning 

equipment to OPERABLE status.
SR Applicability

B 3.0

Westinghouse STS B 3.0-17 Rev. 4.0 

BASES

SR 3.0.1 (continued)

Upon completion of maintenance, appropriate post maintenance testing is 

required to declare equipment OPERABLE. This includes ensuring 

applicable Surveillances are not failed and their most recent performance 

is in accordance with SR 3.0.2. Post maintenance testing may not be 

possible in the current MODE or other specified conditions in the 

Applicability due to the necessary unit parameters not having been 

established. In these situations, the equipment may be considered 

OPERABLE provided testing has been satisfactorily completed to the 

extent possible and the equipment is not otherwise believed to be 

incapable of performing its function. This will allow operation to proceed 

to a MODE or other specified condition where other necessary post 

maintenance tests can be completed.

Some examples of this process are:

a. Auxiliary feedwater (AFW) pump turbine maintenance during 

refueling that requires testing at steam pressures > 800 psi. 

However, if other appropriate testing is satisfactorily completed, the 

AFW System can be considered OPERABLE. This allows startup 

and other necessary testing to proceed until the plant reaches the 

steam pressure required to perform the testing. 

b. High pressure safety injection (HPI) maintenance during shutdown 

that requires system functional tests at a specified pressure. 

Provided other appropriate testing is satisfactorily completed, startup 

can proceed with HPI considered OPERABLE. This allows operation 

to reach the specified pressure to complete the necessary post 

maintenance testing.

SR 3.0.2 SR 3.0.2 establishes the requirements for meeting the specified 

Frequency for Surveillances and any Required Action with a Completion 

Time that requires the periodic performance of the Required Action on a 

"once per . . ." interval.

SR 3.0.2 permits a 25% extension of the interval specified in the 

Frequency. This extension facilitates Surveillance scheduling and 

considers plant operating conditions that may not be suitable for 

conducting the Surveillance (e.g., transient conditions or other ongoing 

Surveillance or maintenance activities).

The 25% extension does not significantly degrade the reliability that 

results from performing the Surveillance at its specified Frequency. This 

is based on the recognition that the most probable result of any particular 

Surveillance being performed is the verification of conformance with the 

SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 
SR Applicability

B 3.0

Westinghouse STS B 3.0-18 Rev. 4.0 

BASES

SR 3.0.2 (continued)

25% extension of the interval specified in the Frequency does not apply. 

These exceptions are stated in the individual Specifications. The 

requirements of regulations take precedence over the TS. An example of 

where SR 3.0.2 does not apply is in the Containment Leakage Rate 

Testing Program. This program establishes testing requirements and 

Frequencies in accordance with the requirements of regulations. The TS 

cannot in and of themselves extend a test interval specified in the 

regulations. As stated in SR 3.0.2, the 25% extension also does not 

apply to the initial portion of a periodic Completion Time that requires 

performance on a "once per ..." basis. The 25% extension applies to 

each performance after the initial performance. The initial performance of 

the Required Action, whether it is a particular Surveillance or some other 

remedial action, is considered a single action with a single Completion 

Time. One reason for not allowing the 25% extension to this Completion 

Time is that such an action usually verifies that no loss of function has 

occurred by checking the status of redundant or diverse components or 

accomplishes the function of the inoperable equipment in an alternative 

manner.

The provisions of SR 3.0.2 are not intended to be used repeatedly merely 

as an operational convenience to extend Surveillance intervals (other 

than those consistent with refueling intervals) or periodic Completion 

Time intervals beyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment 

inoperable or an affected variable outside the specified limits when a 

Surveillance has not been completed within the specified Frequency. A 

delay period of up to 24 hours or up to the limit of the specified 

Frequency, whichever is greater, applies from the point in time that it is 

discovered that the Surveillance has not been performed in accordance 

with SR 3.0.2, and not at the time that the specified Frequency was not 

met.

This delay period provides adequate time to complete Surveillances that 

have been missed. This delay period permits the completion of a 

Surveillance before complying with Required Actions or other remedial 

measures that might preclude completion of the Surveillance.

The basis for this delay period includes consideration of unit conditions, 

adequate planning, availability of personnel, the time required to perform 

the Surveillance, the safety significance of the delay in completing the 

required Surveillance, and the recognition that the most probable result of 

any particular Surveillance being performed is the verification of 

conformance with the requirements. 
SR Applicability

B 3.0

Westinghouse STS B 3.0-19 Rev. 4.0 

BASES

SR 3.0.3 (continued)

When a Surveillance with a Frequency based not on time intervals, but 

upon specified unit conditions, operating situations, or requirements of 

regulations (e.g., prior to entering MODE 1 after each fuel loading, or in 

accordance with 10 CFR 50, Appendix J, as modified by approved 

exemptions, etc.) is discovered to not have been performed when 

specified, SR 3.0.3 allows for the full delay period of up to the specified 

Frequency to perform the Surveillance. However, since there is not a 

time interval specified, the missed Surveillance should be performed at 

the first reasonable opportunity. 

SR 3.0.3 provides a time limit for, and allowances for the performance of, 

Surveillances that become applicable as a consequence of MODE 

changes imposed by Required Actions.

Failure to comply with specified Frequencies for SRs is expected to be an 

infrequent occurrence. Use of the delay period established by SR 3.0.3 is 

a flexibility which is not intended to be used as an operational 

convenience to extend Surveillance intervals. While up to 24 hours or the 

limit of the specified Frequency is provided to perform the missed 

Surveillance, it is expected that the missed Surveillance will be performed 

at the first reasonable opportunity. The determination of the first 

reasonable opportunity should include consideration of the impact on 

plant risk (from delaying the Surveillance as well as any plant 

configuration changes required or shutting the plant down to perform the 

Surveillance) and impact on any analysis assumptions, in addition to unit 

conditions, planning, availability of personnel, and the time required to 

perform the Surveillance. This risk impact should be managed through 

the program in place to implement 10 CFR 50.65(a)(4) and its 

implementation guidance, NRC Regulatory Guide 1.182, “Assessing and 

Managing Risk Before Maintenance Activities at Nuclear Power Plants.” 

This Regulatory Guide addresses consideration of temporary and 

aggregate risk impacts, determination of risk management action 

thresholds, and risk management action up to and including plant 

shutdown. The missed Surveillance should be treated as an emergent 

condition as discussed in the Regulatory Guide. The risk evaluation may 

use quantitative, qualitative, or blended methods. The degree of depth 

and rigor of the evaluation should be commensurate with the importance 

of the component. Missed Surveillances for important components 

should be analyzed quantitatively. If the results of the risk evaluation 

determine the risk increase is significant, this evaluation should be used 

to determine the safest course of action. All missed Surveillances will be 

placed in the licensee’s Corrective Action Program.
SR Applicability

B 3.0

Westinghouse STS B 3.0-20 Rev. 4.0 

BASES

SR 3.0.3 (continued)

If a Surveillance is not completed within the allowed delay period, then 

the equipment is considered inoperable or the variable is considered 

outside the specified limits and the Completion Times of the Required 

Actions for the applicable LCO Conditions begin immediately upon 

expiration of the delay period. If a Surveillance is failed within the delay 

period, then the equipment is inoperable, or the variable is outside the 

specified limits and the Completion Times of the Required Actions for the 

applicable LCO Conditions begin immediately upon the failure of the 

Surveillance.

Completion of the Surveillance within the delay period allowed by this 

Specification, or within the Completion Time of the ACTIONS, restores 

compliance with SR 3.0.1.

SR 3.0.4 SR 3.0.4 establishes the requirement that all applicable SRs must be met 

before entry into a MODE or other specified condition in the Applicability.

This Specification ensures that system and component OPERABILITY 

requirements and variable limits are met before entry into MODES or 

other specified conditions in the Applicability for which these systems and 

components ensure safe operation of the unit. The provisions of this 

Specification should not be interpreted as endorsing the failure to 

exercise the good practice of restoring systems or components to 

OPERABLE status before entering an associated MODE or other 

specified condition in the Applicability. 

A provision is included to allow entry into a MODE or other specified 

condition in the Applicability when an LCO is not met due to a 

Surveillance not being met in accordance with LCO 3.0.4.

However, in certain circumstances, failing to meet an SR will not result in 

SR 3.0.4 restricting a MODE change or other specified condition change. 

When a system, subsystem, division, component, device, or variable is 

inoperable or outside its specified limits, the associated SR(s) are not 

required to be performed, per SR 3.0.1, which states that surveillances do 

not have to be performed on inoperable equipment. When equipment is 

inoperable, SR 3.0.4 does not apply to the associated SR(s) since the 

requirement for the SR(s) to be performed is removed. Therefore, failing 

to perform the Surveillance(s) within the specified Frequency does not 

result in an SR 3.0.4 restriction to changing MODES or other specified 

conditions of the Applicability. However, since the LCO is not met in this 
SR Applicability

B 3.0

Westinghouse STS B 3.0-21 Rev. 4.0 

BASES

SR 3.0.4 (continued)

instance, LCO 3.0.4 will govern any restrictions that may (or may not) 

apply to MODE or other specified condition changes. SR 3.0.4 does not 

restrict changing MODES or other specified conditions of the Applicability 

when a Surveillance has not been performed within the specified 

Frequency, provided the requirement to declare the LCO not met has 

been delayed in accordance with SR 3.0.3.

The provisions of SR 3.0.4 shall not prevent entry into MODES or other 

specified conditions in the Applicability that are required to comply with 

ACTIONS. In addition, the provisions of SR 3.0.4 shall not prevent 

changes in MODES or other specified conditions in the Applicability that 

result from any unit shutdown. In this context, a unit shutdown is defined 

as a change in MODE or other specified condition in the Applicability 

associated with transitioning from MODE 1 to MODE 2, MODE 2 to 

MODE 3, MODE 3 to MODE 4, and MODE 4 to MODE 5. 

The precise requirements for performance of SRs are specified such that 

exceptions to SR 3.0.4 are not necessary. The specific time frames and 

conditions necessary for meeting the SRs are specified in the Frequency, 

in the Surveillance, or both. This allows performance of Surveillances 

when the prerequisite condition(s) specified in a Surveillance procedure 

require entry into the MODE or other specified condition in the 

Applicability of the associated LCO prior to the performance or completion 

of a Surveillance. A Surveillance that could not be performed until after 

entering the LCO’s Applicability, would have its Frequency specified such 

that it is not "due" until the specific conditions needed are met. 

Alternately, the Surveillance may be stated in the form of a Note, as not 

required (to be met or performed) until a particular event, condition, or 

time has been reached. Further discussion of the specific formats of SRs' 

annotation is found in Section 1.4, Frequency.

SDM

B 3.1.1

Westinghouse STS B 3.1.1-1 Rev. 4.0

B 3.1 REACTIVITY CONTROL SYSTEMS

B 3.1.1 SHUTDOWN MARGIN (SDM)

BASES

BACKGROUND According to GDC 26 (Ref. 1), the reactivity control systems must be 

redundant and capable of holding the reactor core subcritical when shut 

down under cold conditions. Maintenance of the SDM ensures that 

postulated reactivity events will not damage the fuel.

SDM requirements provide sufficient reactivity margin to ensure that 

acceptable fuel design limits will not be exceeded for normal shutdown 

and anticipated operational occurrences (AOOs). As such, the SDM 

defines the degree of subcriticality that would be obtained immediately 

following the insertion or scram of all shutdown and control rods, 

assuming that the single rod cluster assembly of highest reactivity worth 

is fully withdrawn.

The system design requires that two independent reactivity control 

systems be provided, and that one of these systems be capable of 

maintaining the core subcritical under cold conditions. These 

requirements are provided by the use of movable control assemblies and 

soluble boric acid in the Reactor Coolant System (RCS). The Control 

Rod System can compensate for the reactivity effects of the fuel and 

water temperature changes accompanying power level changes over the 

range from full load to no load. In addition, the Control Rod System, 

together with the boration system, provides the SDM during power 

operation and is capable of making the core subcritical rapidly enough to 

prevent exceeding acceptable fuel damage limits, assuming that the rod 

of highest reactivity worth remains fully withdrawn. The soluble boron 

system can compensate for fuel depletion during operation and all xenon 

burnout reactivity changes and maintain the reactor subcritical under cold 

conditions.

During power operation, SDM control is ensured by operating with the 

shutdown banks fully withdrawn and the control banks within the limits of 

LCO 3.1.6, "Control Bank Insertion Limits." When the unit is in the 

shutdown and refueling modes, the SDM requirements are met by means 

of adjustments to the RCS boron concentration.

APPLICABLE The minimum required SDM is assumed as an initial condition in safety

SAFETY analyses. The safety analysis (Ref. 2) establishes an SDM that ensures

ANALYSES specified acceptable fuel design limits are not exceeded for normal 

operation and AOOs, with the assumption of the highest worth rod stuck 

out on scram. For MODE 5, the primary safety analysis that relies on the 

SDM limits is the boron dilution analysis.
SDM

B 3.1.1

Westinghouse STS B 3.1.1-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The acceptance criteria for the SDM requirements are that specified 

acceptable fuel design limits are maintained. This is done by ensuring 

that:

a. The reactor can be made subcritical from all operating conditions, 

transients, and Design Basis Events,

b. The reactivity transients associated with postulated accident 

conditions are controllable within acceptable limits (departure from 

nucleate boiling ratio (DNBR), fuel centerline temperature limits for 

AOOs, and ≤ 280 cal/gm energy deposition for the rod ejection 

accident), and

c. The reactor will be maintained sufficiently subcritical to preclude 

inadvertent criticality in the shutdown condition.

The most limiting accident for the SDM requirements is based on a main 

steam line break (MSLB), as described in the accident analysis (Ref. 2). 

The increased steam flow resulting from a pipe break in the main steam 

system causes an increased energy removal from the affected steam 

generator (SG), and consequently the RCS. This results in a reduction of 

the reactor coolant temperature. The resultant coolant shrinkage causes 

a reduction in pressure. In the presence of a negative moderator 

temperature coefficient, this cooldown causes an increase in core 

reactivity. As RCS temperature decreases, the severity of an MSLB 

decreases until the MODE 5 value is reached. The most limiting MSLB, 

with respect to potential fuel damage before a reactor trip occurs, is a 

guillotine break of a main steam line inside containment initiated at the 

end of core life. The positive reactivity addition from the moderator 

temperature decrease will terminate when the affected SG boils dry, thus 

terminating RCS heat removal and cooldown. Following the MSLB, a 

post trip return to power may occur; however, no fuel damage occurs as a 

result of the post trip return to power, and THERMAL POWER does not 

violate the Safety Limit (SL) requirement of SL 2.1.1.

In addition to the limiting MSLB transient, the SDM requirement must also 

protect against:

a. Inadvertent boron dilution,

b. An uncontrolled rod withdrawal from subcritical or low power 

condition,
SDM

B 3.1.1

Westinghouse STS B 3.1.1-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

c. Startup of an inactive reactor coolant pump (RCP), and

d. Rod ejection.

Each of these events is discussed below.

In the boron dilution analysis, the required SDM defines the reactivity 

difference between an initial subcritical boron concentration and the 

corresponding critical boron concentration. These values, in conjunction 

with the configuration of the RCS and the assumed dilution flow rate, 

directly affect the results of the analysis. This event is most limiting at the 

beginning of core life, when critical boron concentrations are highest.

Depending on the system initial conditions and reactivity insertion rate, 

the uncontrolled rod withdrawal transient is terminated by either a high 

power level trip or a high pressurizer pressure trip. In all cases, power 

level, RCS pressure, linear heat rate, and the DNBR do not exceed 

allowable limits.

The startup of an inactive RCP will not result in a "cold water" criticality, 

even if the maximum difference in temperature exists between the SG 

and the core. The maximum positive reactivity addition that can occur 

due to an inadvertent RCP start is less than half the minimum required 

SDM. Startup of an idle RCP cannot, therefore, produce a return to 

power from the hot standby condition. 

The ejection of a control rod rapidly adds reactivity to the reactor core, 

causing both the core power level and heat flux to increase with 

corresponding increases in reactor coolant temperatures and pressure. 

The ejection of a rod also produces a time dependent redistribution of 

core power.

SDM satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Even though it is not 

directly observed from the control room, SDM is considered an initial 

condition process variable because it is periodically monitored to ensure 

that the unit is operating within the bounds of accident analysis 

assumptions.

LCO SDM is a core design condition that can be ensured during operation 

through control rod positioning (control and shutdown banks) and through 

the soluble boron concentration.
SDM

B 3.1.1

Westinghouse STS B 3.1.1-4 Rev. 4.0

BASES

LCO (continued)

The MSLB (Ref. 2) and the boron dilution (Ref. 3) accidents are the most 

limiting analyses that establish the SDM value of the LCO. For MSLB 

accidents, if the LCO is violated, there is a potential to exceed the DNBR 

limit and to exceed 10 CFR 100, "Reactor Site Criteria," limits (Ref. 4). 

For the boron dilution accident, if the LCO is violated, the minimum 

required time assumed for operator action to terminate dilution may no 

longer be applicable.

APPLICABILITY In MODE 2 with keff < 1.0 and in MODES 3, 4, and 5, the SDM 

requirements are applicable to provide sufficient negative reactivity to 

meet the assumptions of the safety analyses discussed above. In 

MODE 6, the shutdown reactivity requirements are given in LCO 3.9.1, 

"Boron Concentration." In MODES 1 and 2, SDM is ensured by 

complying with LCO 3.1.5, "Shutdown Bank Insertion Limits," and 

LCO 3.1.6.

ACTIONS A.1

If the SDM requirements are not met, boration must be initiated promptly. 

A Completion Time of 15 minutes is adequate for an operator to correctly 

align and start the required systems and components. It is assumed that 

boration will be continued until the SDM requirements are met.

In the determination of the required combination of boration flow rate and 

boron concentration, there is no unique requirement that must be 

satisfied. Since it is imperative to raise the boron concentration of the 

RCS as soon as possible, the boron concentration should be a highly 

concentrated solution, such as that normally found in the boric acid 

storage tank, or the borated water storage tank. The operator should 

borate with the best source available for the plant conditions.

In determining the boration flow rate, the time in core life must be 

considered. For instance, the most difficult time in core life to increase 

the RCS boron concentration is at the beginning of cycle when the boron 

concentration may approach or exceed 2000 ppm. Assuming that a value 

of 1% ∆k/k must be recovered and a boration flow rate of [ ] gpm, it is 

possible to increase the boron concentration of the RCS by 100 ppm in 

approximately 35 minutes. If a boron worth of 10 pcm/ppm is assumed, 

this combination of parameters will increase the SDM by 1% ∆k/k. These 

boration parameters of [ ] gpm and [ ] ppm represent typical values and 

are provided for the purpose of offering a specific example.
SDM

B 3.1.1

Westinghouse STS B 3.1.1-5 Rev. 4.0

BASES

SURVEILLANCE SR 3.1.1.1

REQUIREMENTS

In MODES 1 and 2 with Keff ≥ 1.0, SDM is verified by observing that the 

requirements of LCO 3.1.5 and LCO 3.1.6 are met. In the event that a 

rod is known to be untrippable, however, SDM verification must account 

for the worth of the untrippable rod as well as another rod of maximum 

worth.

In MODES 3, 4, and 5, the SDM is verified by performing a reactivity 

balance calculation, considering the listed reactivity effects:

a. RCS boron concentration,

b. Control bank position,

c. RCS average temperature,

d. Fuel burnup based on gross thermal energy generation,

e. Xenon concentration,

f. Samarium concentration, and

g. Isothermal temperature coefficient (ITC).

Using the ITC accounts for Doppler reactivity in this calculation because 

the reactor is subcritical, and the fuel temperature will be changing at the 

same rate as the RCS.

[ The Frequency of 24 hours is based on the generally slow change in 

required boron concentration and the low probability of an accident 

occurring without the required SDM. This allows time for the operator to 

collect the required data, which includes performing a boron 

concentration analysis, and complete the calculation.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
SDM

B 3.1.1

Westinghouse STS B 3.1.1-6 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. FSAR, Chapter [15].

3. FSAR, Chapter [15].

4. 10 CFR 100.
Core Reactivity

B 3.1.2

WOG B 3.1.2-1 Rev. 4.0

B 3.1 REACTIVITY CONTROL SYSTEMS

B 3.1.2 Core Reactivity

BASES

BACKGROUND According to GDC 26, GDC 28, and GDC 29 (Ref. 1), reactivity shall be 

controllable, such that subcriticality is maintained under cold conditions, 

and acceptable fuel design limits are not exceeded during normal 

operation and anticipated operational occurrences. Therefore, reactivity 

balance is used as a measure of the predicted versus measured core 

reactivity during power operation. The periodic confirmation of core 

reactivity is necessary to ensure that Design Basis Accident (DBA) and 

transient safety analyses remain valid. A large reactivity difference could 

be the result of unanticipated changes in fuel, control rod worth, or 

operation at conditions not consistent with those assumed in the 

predictions of core reactivity, and could potentially result in a loss of SDM 

or violation of acceptable fuel design limits. Comparing predicted versus 

measured core reactivity validates the nuclear methods used in the safety 

analysis and supports the SDM demonstrations (LCO 3.1.1, 

"SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought 

safely to cold, subcritical conditions.

When the reactor core is critical or in normal power operation, a reactivity 

balance exists and the net reactivity is zero. A comparison of predicted 

and measured reactivity is convenient under such a balance, since 

parameters are being maintained relatively stable under steady state 

power conditions. The positive reactivity inherent in the core design is 

balanced by the negative reactivity of the control components, thermal 

feedback, neutron leakage, and materials in the core that absorb 

neutrons, such as burnable absorbers producing zero net reactivity. 

Excess reactivity can be inferred from the boron letdown curve (or critical 

boron curve), which provides an indication of the soluble boron 

concentration in the Reactor Coolant System (RCS) versus cycle burnup. 

Periodic measurement of the RCS boron concentration for comparison 

with the predicted value with other variables fixed (such as rod height, 

temperature, pressure, and power), provides a convenient method of 

ensuring that core reactivity is within design expectations and that the 

calculational models used to generate the safety analysis are adequate.

In order to achieve the required fuel cycle energy output, the uranium 

enrichment, in the new fuel loading and in the fuel remaining from the 

previous cycle, provides excess positive reactivity beyond that required to 

sustain steady state operation throughout the cycle. When the reactor is 

critical at RTP and moderator temperature, the excess positive reactivity 

is compensated by burnable absorbers (if any), control rods, whatever 

neutron poisons (mainly xenon and samarium) are present in the fuel, 

and the RCS boron concentration.
Core Reactivity

B 3.1.2

WOG B 3.1.2-2 Rev. 4.0

BASES

BACKGROUND (continued)

When the core is producing THERMAL POWER, the fuel is being 

depleted and excess reactivity is decreasing. As the fuel depletes, the 

RCS boron concentration is reduced to decrease negative reactivity and 

maintain constant THERMAL POWER. The boron letdown curve is 

based on steady state operation at RTP. Therefore, deviations from the 

predicted boron letdown curve may indicate deficiencies in the design 

analysis, deficiencies in the calculational models, or abnormal core 

conditions, and must be evaluated.

APPLICABLE The acceptance criteria for core reactivity are that the reactivity balance

SAFETY limit ensures plant operation is maintained within the assumptions of

ANALYSES the safety analyses.

Accurate prediction of core reactivity is either an explicit or implicit 

assumption in the accident analysis evaluations. Every accident 

evaluation (Ref. 2) is, therefore, dependent upon accurate evaluation of

core reactivity. In particular, SDM and reactivity transients, such as 

control rod withdrawal accidents or rod ejection accidents, are very 

sensitive to accurate prediction of core reactivity. These accident 

analysis evaluations rely on computer codes that have been qualified 

against available test data, operating plant data, and analytical 

benchmarks. Monitoring reactivity balance additionally ensures that the 

nuclear methods provide an accurate representation of the core reactivity.

Design calculations and safety analyses are performed for each fuel cycle 

for the purpose of predetermining reactivity behavior and the RCS boron 

concentration requirements for reactivity control during fuel depletion.

The comparison between measured and predicted initial core reactivity 

provides a normalization for the calculational models used to predict core 

reactivity. If the measured and predicted RCS boron concentrations for 

identical core conditions at beginning of cycle (BOC) do not agree, then 

the assumptions used in the reload cycle design analysis or the 

calculational models used to predict soluble boron requirements may not 

be accurate. If reasonable agreement between measured and predicted 

core reactivity exists at BOC, then the prediction may be normalized to 

the measured boron concentration. Thereafter, any significant deviations 

in the measured boron concentration from the predicted boron letdown 

curve that develop during fuel depletion may be an indication that the 

calculational model is not adequate for core burnups beyond BOC, or that 

an unexpected change in core conditions has occurred.
Core Reactivity

B 3.1.2

WOG B 3.1.2-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The normalization of predicted RCS boron concentration to the measured 

value is typically performed after reaching RTP following startup from a 

refueling outage, with the control rods in their normal positions for power 

operation. The normalization is performed at BOC conditions, so that 

core reactivity relative to predicted values can be continually monitored 

and evaluated as core conditions change during the cycle.

Core reactivity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO Long term core reactivity behavior is a result of the core physics design 

and cannot be easily controlled once the core design is fixed. During 

operation, therefore, the LCO can only be ensured through measurement 

and tracking, and appropriate actions taken as necessary. Large 

differences between actual and predicted core reactivity may indicate that 

the assumptions of the DBA and transient analyses are no longer valid, or 

that the uncertainties in the Nuclear Design Methodology are larger than 

expected. A limit on the reactivity balance of ± 1% ∆k/k has been 

established based on engineering judgment. A 1% deviation in reactivity 

from that predicted is larger than expected for normal operation and 

should therefore be evaluated.

When measured core reactivity is within 1% ∆k/k of the predicted value at 

steady state thermal conditions, the core is considered to be operating 

within acceptable design limits. Since deviations from the limit are 

normally detected by comparing predicted and measured steady state 

RCS critical boron concentrations, the difference between measured and 

predicted values would be approximately 100 ppm (depending on the 

boron worth) before the limit is reached. These values are well within the 

uncertainty limits for analysis of boron concentration samples, so that 

spurious violations of the limit due to uncertainty in measuring the RCS 

boron concentration are unlikely.

APPLICABILITY The limits on core reactivity must be maintained during MODES 1 and 2 

because a reactivity balance must exist when the reactor is critical or 

producing THERMAL POWER. As the fuel depletes, core conditions are 

changing, and confirmation of the reactivity balance ensures the core is 

operating as designed. This Specification does not apply in MODES 3, 4, 

and 5 because the reactor is shut down and the reactivity balance is not 

changing.

In MODE 6, fuel loading results in a continually changing core reactivity. 

Boron concentration requirements (LCO 3.9.1, "Boron Concentration") 

ensure that fuel movements are performed within the bounds of the safety 

analysis. An SDM demonstration is required during the first startup 

following operations that could have altered core reactivity (e.g., fuel 

movement, control rod replacement, control rod shuffling).
Core Reactivity

B 3.1.2

WOG B 3.1.2-4 Rev. 4.0

BASES

ACTIONS A.1 and A.2

Should an anomaly develop between measured and predicted core 

reactivity, an evaluation of the core design and safety analysis must be 

performed. Core conditions are evaluated to determine their consistency 

with input to design calculations. Measured core and process parameters 

are evaluated to determine that they are within the bounds of the safety 

analysis, and safety analysis calculational models are reviewed to verify 

that they are adequate for representation of the core conditions. The 

required Completion Time of 7 days is based on the low probability of a 

DBA occurring during this period, and allows sufficient time to assess the 

physical condition of the reactor and complete the evaluation of the core 

design and safety analysis.

Following evaluations of the core design and safety analysis, the cause of 

the reactivity anomaly may be resolved. If the cause of the reactivity 

anomaly is a mismatch in core conditions at the time of RCS boron 

concentration sampling, then a recalculation of the RCS boron 

concentration requirements may be performed to demonstrate that core 

reactivity is behaving as expected. If an unexpected physical change in 

the condition of the core has occurred, it must be evaluated and 

corrected, if possible. If the cause of the reactivity anomaly is in the 

calculation technique, then the calculational models must be revised to 

provide more accurate predictions. If any of these results are 

demonstrated, and it is concluded that the reactor core is acceptable for 

continued operation, then the boron letdown curve may be renormalized 

and power operation may continue. If operational restriction or additional 

SRs are necessary to ensure the reactor core is acceptable for continued 

operation, then they must be defined.

The required Completion Time of 7 days is adequate for preparing 

whatever operating restrictions or Surveillances that may be required to 

allow continued reactor operation.

B.1

If the core reactivity cannot be restored to within the 1% ∆k/k limit, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

6 hours. If the SDM for MODE 3 is not met, then the boration required by 

SR 3.1.1.1 would occur. The allowed Completion Time is reasonable, 

based on operating experience, for reaching MODE 3 from full power 

conditions in an orderly manner and without challenging plant systems.
Core Reactivity

B 3.1.2

WOG B 3.1.2-5 Rev. 4.0

BASES

SURVEILLANCE SR 3.1.2.1

REQUIREMENTS

Core reactivity is verified by periodic comparisons of measured and 

predicted RCS boron concentrations. The comparison is made, 

considering that other core conditions are fixed or stable, including control 

rod position, moderator temperature, fuel temperature, fuel depletion, 

xenon concentration, and samarium concentration. The Surveillance is 

performed prior to entering MODE 1 as an initial check on core conditions 

and design calculations at BOC. The SR is modified by a Note. The 

Note indicates that the normalization of predicted core reactivity to the 

measured value must take place within the first 60 effective full power 

days (EFPD) after each fuel loading. This allows sufficient time for core 

conditions to reach steady state, but prevents operation for a large 

fraction of the fuel cycle without establishing a benchmark for the design 

calculations. [ The required subsequent Frequency of 31 EFPD, following 

the initial 60 EFPD after entering MODE 1, is acceptable, based on the 

slow rate of core changes due to fuel depletion and the presence of other 

indicators (QPTR, AFD, etc.) for prompt indication of an anomaly.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 28, and GDC 29.

2. FSAR, Chapter [15].

MTC

B 3.1.3

Westinghouse STS B 3.1.3-1 Rev. 4.0

B 3.1 REACTIVITY CONTROL SYSTEMS

B 3.1.3 Moderator Temperature Coefficient (MTC)

BASES

BACKGROUND According to GDC 11 (Ref. 1), the reactor core and its interaction with the 

Reactor Coolant System (RCS) must be designed for inherently stable 

power operation, even in the possible event of an accident. In particular, 

the net reactivity feedback in the system must compensate for any 

unintended reactivity increases.

The MTC relates a change in core reactivity to a change in reactor 

coolant temperature (a positive MTC means that reactivity increases with 

increasing moderator temperature; conversely, a negative MTC means 

that reactivity decreases with increasing moderator temperature). The 

reactor is designed to operate with a negative MTC over the largest 

possible range of fuel cycle operation. Therefore, a coolant temperature 

increase will cause a reactivity decrease, so that the coolant temperature 

tends to return toward its initial value. Reactivity increases that cause a 

coolant temperature increase will thus be self limiting, and stable power 

operation will result.

MTC values are predicted at selected burnups during the safety 

evaluation analysis and are confirmed to be acceptable by 

measurements. Both initial and reload cores are designed so that the 

beginning of cycle (BOC) MTC is less than zero when THERMAL 

POWER is at RTP. The actual value of the MTC is dependent on core 

characteristics, such as fuel loading and reactor coolant soluble boron 

concentration. The core design may require additional fixed distributed 

poisons to yield an MTC at BOC within the range analyzed in the plant 

accident analysis. The end of cycle (EOC) MTC is also limited by the 

requirements of the accident analysis. Fuel cycles that are designed to 

achieve high burnups or that have changes to other characteristics are 

evaluated to ensure that the MTC does not exceed the EOC limit.

The limitations on MTC are provided to ensure that the value of this 

coefficient remains within the limiting conditions assumed in the FSAR 

accident and transient analyses.
MTC

B 3.1.3

Westinghouse STS B 3.1.3-2 Rev. 4.0

BASES

BACKGROUND (continued)

If the LCO limits are not met, the unit response during transients may not 

be as predicted. The core could violate criteria that prohibit a return to 

criticality, or the departure from nucleate boiling ratio criteria of the 

approved correlation may be violated, which could lead to a loss of the 

fuel cladding integrity.

The SRs for measurement of the MTC at the beginning and near the end 

of the fuel cycle are adequate to confirm that the MTC remains within its 

limits, since this coefficient changes slowly, due principally to the 

reduction in RCS boron concentration associated with fuel burnup.

APPLICABLE The acceptance criteria for the specified MTC are:

SAFETY 

ANALYSES a. The MTC values must remain within the bounds of those used in the 

accident analysis (Ref. 2) and

b. The MTC must be such that inherently stable power operations result 

during normal operation and accidents, such as overheating and 

overcooling events.

The FSAR, Chapter 15 (Ref. 2), contains analyses of accidents that result 

in both overheating and overcooling of the reactor core. MTC is one of 

the controlling parameters for core reactivity in these accidents. Both the 

most positive value and most negative value of the MTC are important to 

safety, and both values must be bounded. Values used in the analyses 

consider worst case conditions to ensure that the accident results are 

bounding (Ref. 3).

The consequences of accidents that cause core overheating must be 

evaluated when the MTC is positive. Such accidents include the rod 

withdrawal transient from either zero (Ref. 4) or RTP, loss of main 

feedwater flow, and loss of forced reactor coolant flow. The 

consequences of accidents that cause core overcooling must be 

evaluated when the MTC is negative. Such accidents include sudden 

feedwater flow increase and sudden decrease in feedwater temperature.
MTC

B 3.1.3

Westinghouse STS B 3.1.3-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

In order to ensure a bounding accident analysis, the MTC is assumed to 

be its most limiting value for the analysis conditions appropriate to each 

accident. The bounding value is determined by considering rodded and 

unrodded conditions, whether the reactor is at full or zero power, and 

whether it is the BOC or EOC life. The most conservative combination 

appropriate to the accident is then used for the analysis (Ref. 2).

MTC values are bounded in reload safety evaluations assuming steady 

state conditions at BOC and EOC. An EOC measurement is conducted 

at conditions when the RCS boron concentration reaches approximately 

300 ppm. The measured value may be extrapolated to project the EOC 

value, in order to confirm reload design predictions.

MTC satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Even though it is not 

directly observed and controlled from the control room, MTC is 

considered an initial condition process variable because of its 

dependence on boron concentration.

LCO LCO 3.1.3 requires the MTC to be within specified limits of the COLR to 

ensure that the core operates within the assumptions of the accident 

analysis. During the reload core safety evaluation, the MTC is analyzed 

to determine that its values remain within the bounds of the original 

accident analysis during operation.

Assumptions made in safety analyses require that the MTC be less 

positive than a given upper bound and more positive than a given lower 

bound. The MTC is most positive at BOC; this upper bound must not be 

exceeded. This maximum upper limit occurs at BOC, all rods out (ARO), 

hot zero power conditions. At EOC the MTC takes on its most negative 

value, when the lower bound becomes important. This LCO exists to 

ensure that both the upper and lower bounds are not exceeded.

During operation, therefore, the conditions of the LCO can only be 

ensured through measurement. The Surveillance checks at BOC and 

EOC on MTC provide confirmation that the MTC is behaving as 

anticipated so that the acceptance criteria are met.
MTC

B 3.1.3

Westinghouse STS B 3.1.3-4 Rev. 4.0

BASES

LCO (continued)

The LCO establishes a maximum positive value that cannot be exceeded. 

The BOC positive limit and the EOC negative limit are established in the 

COLR to allow specifying limits for each particular cycle. This permits the 

unit to take advantage of improved fuel management and changes in unit 

operating schedule.

APPLICABILITY Technical Specifications place both LCO and SR values on MTC, based 

on the safety analysis assumptions described above.

In MODE 1, the limits on MTC must be maintained to ensure that any 

accident initiated from THERMAL POWER operation will not violate the 

design assumptions of the accident analysis. In MODE 2 with the reactor 

critical, the upper limit must also be maintained to ensure that startup and 

subcritical accidents (such as the uncontrolled control rod assembly or 

group withdrawal) will not violate the assumptions of the accident 

analysis. The lower MTC limit must be maintained in MODES 2 and 3, in 

addition to MODE 1, to ensure that cooldown accidents will not violate the 

assumptions of the accident analysis. In MODES 4, 5, and 6, this LCO is 

not applicable, since no Design Basis Accidents using the MTC as an 

analysis assumption are initiated from these MODES.

ACTIONS A.1

If the BOC MTC limit is violated, administrative withdrawal limits for 

control banks must be established to maintain the MTC within its limits. 

The MTC becomes more negative with control bank insertion and

decreased boron concentration. A Completion Time of 24 hours provides 

enough time for evaluating the MTC measurement and computing the 

required bank withdrawal limits.

As cycle burnup is increased, the RCS boron concentration will be 

reduced. The reduced boron concentration causes the MTC to become 

more negative. Using physics calculations, the time in cycle life at which 

the calculated MTC will meet the LCO requirement can be determined. 

At this point in core life Condition A no longer exists. The unit is no longer 

in the Required Action, so the administrative withdrawal limits are no 

longer in effect.
MTC

B 3.1.3

Westinghouse STS B 3.1.3-5 Rev. 4.0

BASES

ACTIONS (continued)

B.1

If the required administrative withdrawal limits at BOC are not established 

within 24 hours, the unit must be brought to MODE 2 with keff < 1.0 to 

prevent operation with an MTC that is more positive than that assumed in 

safety analyses.

The allowed Completion Time of 6 hours is reasonable, based on 

operating experience, for reaching the required MODE from full power 

conditions in an orderly manner and without challenging plant systems.

C.1

Exceeding the EOC MTC limit means that the safety analysis 

assumptions for the EOC accidents that use a bounding negative MTC 

value may be invalid. If the EOC MTC limit is exceeded, the plant must 

be brought to a MODE or condition in which the LCO requirements are 

not applicable. To achieve this status, the unit must be brought to at least 

MODE 4 within 12 hours.

The allowed Completion Time is reasonable, based on operating 

experience, for reaching the required MODE from full power conditions in 

an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.3.1

REQUIREMENTS

This SR requires measurement of the MTC at BOC prior to entering 

MODE 1 in order to demonstrate compliance with the most positive MTC 

LCO. Meeting the limit prior to entering MODE 1 ensures that the limit 

will also be met at higher power levels.

The BOC MTC value for ARO will be inferred from isothermal 

temperature coefficient measurements obtained during the physics tests 

after refueling. The ARO value can be directly compared to the BOC 

MTC limit of the LCO. If required, measurement results and predicted 

design values can be used to establish administrative withdrawal limits for 

control banks.
MTC

B 3.1.3

WOG B 3.1.3-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.1.3.2 

In similar fashion, the LCO demands that the MTC be less negative than 

the specified value for EOC full power conditions. This measurement 

may be performed at any THERMAL POWER, but its results must be 

extrapolated to the conditions of RTP and all banks withdrawn in order to 

make a proper comparison with the LCO value. Because the RTP MTC 

value will gradually become more negative with further core depletion and 

boron concentration reduction, a 300 ppm SR value of MTC should 

necessarily be less negative than the EOC LCO limit. The 300 ppm SR 

value is sufficiently less negative than the EOC LCO limit value to ensure 

that the LCO limit will be met when the 300 ppm Surveillance criterion is 

met.

SR 3.1.3.2 is modified by three Notes that include the following 

requirements:

a. The SR is not required to be performed until 7 effective full power 

days (EFPDs) after reaching the equivalent of an equilibrium RTP all 

rods out (ARO) boron concentration of 300 ppm.

b. If the 300 ppm Surveillance limit is exceeded, it is possible that the 

EOC limit on MTC could be reached before the planned EOC. 

Because the MTC changes slowly with core depletion, the Frequency 

of 14 effective full power days is sufficient to avoid exceeding the 

EOC limit.

c. The Surveillance limit for RTP boron concentration of 60 ppm is 

conservative. If the measured MTC at 60 ppm is more positive than 

the 60 ppm Surveillance limit, the EOC limit will not be exceeded 

because of the gradual manner in which MTC changes with core 

burnup.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 11.

2. FSAR, Chapter [15].

3. WCAP 9273-NP-A, "Westinghouse Reload Safety Evaluation 

Methodology," July 1985.

4. FSAR, Chapter [15].
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.1.4 Rod Group Alignment Limits

BASES

BACKGROUND The OPERABILITY (i.e., trippability) of the shutdown and control rods is 

an initial assumption in all safety analyses that assume rod insertion upon 

reactor trip. Maximum rod misalignment is an initial assumption in the 

safety analysis that directly affects core power distributions and 

assumptions of available SDM.

The applicable criteria for these reactivity and power distribution design 

requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," 

GDC 26, "Reactivity Control System Redundancy and Capability" (Ref. 1), 

and 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling 

Systems for Light Water Nuclear Power Plants" (Ref. 2).

Mechanical or electrical failures may cause a control or shutdown rod to 

become inoperable or to become misaligned from its group. Rod 

inoperability or misalignment may cause increased power peaking, due to 

the asymmetric reactivity distribution and a reduction in the total available 

rod worth for reactor shutdown. Therefore, rod alignment and 

OPERABILITY are related to core operation in design power peaking 

limits and the core design requirement of a minimum SDM.

Limits on rod alignment have been established, and all rod positions are 

monitored and controlled during power operation to ensure that the power 

distribution and reactivity limits defined by the design power peaking and 

SDM limits are preserved.

Rod cluster control assemblies (RCCAs), or rods, are moved by their 

control rod drive mechanisms (CRDMs). Each CRDM moves its RCCA 

one step (approximately e inch) at a time, but at varying rates (steps per 

minute) depending on the signal output from the Rod Control System.

The RCCAs are divided among control banks and shutdown banks. Each 

bank may be further subdivided into two groups to provide for precise 

reactivity control. A group consists of two or more RCCAs that are 

electrically paralleled to step simultaneously. If a bank of RCCAs 

consists of two groups, the groups are moved in a staggered fashion, but 

always within one step of each other. All units have four control banks 

and at least two shutdown banks.

The shutdown banks are maintained either in the fully inserted or fully 

withdrawn position. The control banks are moved in an overlap pattern, 

using the following withdrawal sequence: When control bank A reaches a 

predetermined height in the core, control bank B begins to move out with
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-2 Rev. 4.0

BASES

BACKGROUND (continued)

control bank A. Control bank A stops at the position of maximum 

withdrawal, and control bank B continues to move out. When control 

bank B reaches a predetermined height, control bank C begins to move 

out with control bank B. This sequence continues until control banks A, 

B, and C are at the fully withdrawn position, and control bank D is 

approximately halfway withdrawn. The insertion sequence is the opposite 

of the withdrawal sequence. The control rods are arranged in a radially 

symmetric pattern, so that control bank motion does not introduce radial 

asymmetries in the core power distributions.

The axial position of shutdown rods and control rods is indicated by two 

separate and independent systems, which are the Bank Demand Position 

Indication System (commonly called group step counters) and the Digital 

Rod Position Indication (DRPI) System.

The Bank Demand Position Indication System counts the pulses from the 

rod control system that moves the rods. There is one step counter for 

each group of rods. Individual rods in a group all receive the same signal 

to move and should, therefore, all be at the same position indicated by 

the group step counter for that group. The Bank Demand Position 

Indication System is considered highly precise (± 1 step or ± e inch). If a 

rod does not move one step for each demand pulse, the step counter will 

still count the pulse and incorrectly reflect the position of the rod.

The DRPI System provides a highly accurate indication of actual rod 

position, but at a lower precision than the step counters. This system is 

based on inductive analog signals from a series of coils spaced along a 

hollow tube. To increase the reliability of the system, the inductive coils 

are connected alternately to data system A or B. Thus, if one data 

system fails, the DRPI will go on half accuracy. The DRPI System is 

capable of monitoring rod position within at least ± 12 steps with either full 

accuracy or half accuracy.

APPLICABLE Control rod misalignment accidents are analyzed in the safety analysis

SAFETY (Ref. 3). The acceptance criteria for addressing control rod inoperability

ANALYSES or misalignment are that:

a. There be no violations of:

1. Specified acceptable fuel design limits or

2. Reactor Coolant System (RCS) pressure boundary integrity and

b. The core remains subcritical after accident transients.
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

Two types of misalignment are distinguished. During movement of a 

control rod group, one rod may stop moving, while the other rods in the 

group continue. This condition may cause excessive power peaking. 

The second type of misalignment occurs if one rod fails to insert upon a 

reactor trip and remains stuck fully withdrawn. This condition requires an 

evaluation to determine that sufficient reactivity worth is held in the control 

rods to meet the SDM requirement, with the maximum worth rod stuck 

fully withdrawn.

Two types of analysis are performed in regard to static rod misalignment 

(Ref. 4). With control banks at their insertion limits, one type of analysis 

considers the case when any one rod is completely inserted into the core. 

The second type of analysis considers the case of a completely 

withdrawn single rod from a bank inserted to its insertion limit. Satisfying 

limits on departure from nucleate boiling ratio in both of these cases 

bounds the situation when a rod is misaligned from its group by 12 steps.

Another type of misalignment occurs if one RCCA fails to insert upon a 

reactor trip and remains stuck fully withdrawn. This condition is assumed 

in the evaluation to determine that the required SDM is met with the 

maximum worth RCCA also fully withdrawn (Ref. 5).

The Required Actions in this LCO ensure that either deviations from the 

alignment limits will be corrected or that THERMAL POWER will be 

adjusted so that excessive local linear heat rates (LHRs) will not occur, 

and that the requirements on SDM and ejected rod worth are preserved.

Continued operation of the reactor with a misaligned control rod is

allowed if the heat flux hot channel factor ( FQ(Z)) and the nuclear 

enthalpy hot channel factor (

H

N

F

) are verified to be within their limits in 

the COLR and the safety analysis is verified to remain valid. When a 

control rod is misaligned, the assumptions that are used to determine the 

rod insertion limits, AFD limits, and quadrant power tilt limits are not 

preserved. Therefore, the limits may not preserve the design peaking 

factors, and FQ(Z) and 

H

N

F

must be verified directly by incore mapping. 

Bases Section 3.2 (Power Distribution Limits) contains more complete 

discussions of the relation of FQ(Z) and 

H

N

F

to the operating limits.

Shutdown and control rod OPERABILITY and alignment are directly 

related to power distributions and SDM, which are initial conditions 

assumed in safety analyses. Therefore they satisfy Criterion 2 of 

10 CFR 50.36(c)(2)(ii).
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-4 Rev. 4.0

BASES

LCO The limits on shutdown or control rod alignments ensure that the 

assumptions in the safety analysis will remain valid. The requirements on 

control rod OPERABILITY ensure that upon reactor trip, the assumed 

reactivity will be available and will be inserted. The control rod 

OPERABILITY requirements (i.e., trippability) are separate from the 

alignment requirements, which ensure that the RCCAs and banks 

maintain the correct power distribution and rod alignment. The rod 

OPERABILITY requirement is satisfied provided the rod will fully insert in 

the required rod drop time assumed in the safety analysis. Rod control 

malfunctions that result in the inability to move a rod (e.g., rod lift coil 

failures), but that do not impact trippability, do not result in rod 

inoperability.

The requirement to maintain the rod alignment to within plus or minus 

12 steps is conservative. The minimum misalignment assumed in safety 

analysis is 24 steps (15 inches), and in some cases a total misalignment 

from fully withdrawn to fully inserted is assumed.

Failure to meet the requirements of this LCO may produce unacceptable 

power peaking factors and LHRs, or unacceptable SDMs, all of which 

may constitute initial conditions inconsistent with the safety analysis.

APPLICABILITY The requirements on RCCA OPERABILITY and alignment are applicable 

in MODES 1 and 2 because these are the only MODES in which neutron 

(or fission) power is generated, and the OPERABILITY (i.e., trippability) 

and alignment of rods have the potential to affect the safety of the plant. 

In MODES 3, 4, 5, and 6, the alignment limits do not apply because the 

control rods are bottomed and the reactor is shut down and not producing 

fission power. In the shutdown MODES, the OPERABILITY of the 

shutdown and control rods has the potential to affect the required SDM, 

but this effect can be compensated for by an increase in the boron 

concentration of the RCS. See LCO 3.1.1, "SHUTDOWN MARGIN 

(SDM)," for SDM in MODES 3, 4, and 5 and LCO 3.9.1, "Boron 

Concentration," for boron concentration requirements during refueling.

ACTIONS A.1.1 and A.1.2

When one or more rods are inoperable (i.e., untrippable), there is a 

possibility that the required SDM may be adversely affected. Under these 

conditions, it is important to determine the SDM, and if it is less than the 

required value, initiate boration until the required SDM is recovered. The 

Completion Time of 1 hour is adequate for determining SDM and, if 

necessary, for initiating emergency boration and restoring SDM.

In this situation, SDM verification must include the worth of the 

untrippable rod, as well as a rod of maximum worth.
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-5 Rev. 4.0

BASES

ACTIONS (continued)

A.2

If the inoperable rod(s) cannot be restored to OPERABLE status, the 

plant must be brought to a MODE or condition in which the LCO 

requirements are not applicable. To achieve this status, the unit must be 

brought to at least MODE 3 within 6 hours.

The allowed Completion Time is reasonable, based on operating 

experience, for reaching MODE 3 from full power conditions in an orderly 

manner and without challenging plant systems.

B.1

When a rod becomes misaligned, it can usually be moved and is still 

trippable. If the rod can be realigned within the Completion Time of 

1 hour, local xenon redistribution during this short interval will not be 

significant, and operation may proceed without further restriction.

An alternative to realigning a single misaligned RCCA to the group 

average position is to align the remainder of the group to the position of 

the misaligned RCCA. However, this must be done without violating the 

bank sequence, overlap, and insertion limits specified in LCO 3.1.5, 

"Shutdown Bank Insertion Limits," and LCO 3.1.6, "Control Bank Insertion 

Limits." The Completion Time of 1 hour gives the operator sufficient time 

to adjust the rod positions in an orderly manner.

B.2.1.1 and B.2.1.2

With a misaligned rod, SDM must be verified to be within limit or boration 

must be initiated to restore SDM to within limit.

In many cases, realigning the remainder of the group to the misaligned 

rod may not be desirable. For example, realigning control bank B to a rod 

that is misaligned 15 steps from the top of the core would require a 

significant power reduction, since control bank D must be moved fully in 

and control bank C must be moved in to approximately 100 to 115 steps.

Power operation may continue with one RCCA trippable but misaligned, 

provided that SDM is verified within 1 hour. The Completion Time of 

1 hour represents the time necessary for determining the actual unit SDM 

and, if necessary, aligning and starting the necessary systems and 

components to initiate boration.
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-6 Rev. 4.0

BASES

ACTIONS (continued)

B.2.2, B.2.3, B.2.4, B.2.5, and B.2.6

For continued operation with a misaligned rod, RTP must be reduced,

SDM must periodically be verified within limits, hot channel factors (FQ(Z) 

and 

H

N

F

) must be verified within limits, and the safety analyses must be 

re-evaluated to confirm continued operation is permissible.

Reduction of power to 75% RTP ensures that local LHR increases due to 

a misaligned RCCA will not cause the core design criteria to be exceeded 

(Ref. 7). The Completion Time of 2 hours gives the operator sufficient 

time to accomplish an orderly power reduction without challenging the 

Reactor Protection System.

When a rod is known to be misaligned, there is a potential to impact the 

SDM. Since the core conditions can change with time, periodic 

verification of SDM is required. A Frequency of 12 hours is sufficient to 

ensure this requirement continues to be met.

Verifying that FQ(Z), as approximated by 

F (Z)

C

Q

and 

F (Z)

W

Q

, and 

H

N

F

are 

within the required limits ensures that current operation at 75% RTP with 

a rod misaligned is not resulting in power distributions that may invalidate 

safety analysis assumptions at full power. The Completion Time of 

72 hours allows sufficient time to obtain flux maps of the core power 

distribution using the incore flux mapping system and to calculate FQ(Z) 

and 

H

N

F .

Once current conditions have been verified acceptable, time is available 

to perform evaluations of accident analysis to determine that core limits 

will not be exceeded during a Design Basis Event for the duration of 

operation under these conditions. The accident analyses presented in 

FSAR Chapter 15 (Ref. 5) that may be adversely affected will be 

evaluated to ensure that the analysis results remain valid for the duration 

of continued operation under these conditions. A Completion Time of 

5 days is sufficient time to obtain the required input data and to perform 

the analysis.

C.1

When Required Actions cannot be completed within their Completion 

Time, the unit must be brought to a MODE or Condition in which the 

LCO requirements are not applicable. To achieve this status, the unit 

must be brought to at least MODE 2 with Keff < 1.0 within 6 hours, which 
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-7 Rev. 4.0

BASES

ACTIONS (continued)

obviates concerns about the development of undesirable xenon or power 

distributions. The allowed Completion Time of 6 hours is reasonable, 

based on operating experience, for reaching MODE 3 from full power 

conditions in an orderly manner and without challenging the plant 

systems.

D.1.1 and D.1.2

More than one control rod becoming misaligned from its group average 

position is not expected, and has the potential to reduce SDM. Therefore, 

SDM must be evaluated. One hour allows the operator adequate time to 

determine SDM. Restoration of the required SDM, if necessary, requires 

increasing the RCS boron concentration to provide negative reactivity, as 

described in the Bases or LCO 3.1.1. The required Completion Time of 

1 hour for initiating boration is reasonable, based on the time required for 

potential xenon redistribution, the low probability of an accident occurring, 

and the steps required to complete the action. This allows the operator 

sufficient time to align the required valves and start the boric acid pumps. 

Boration will continue until the required SDM is restored.

D.2

If more than one rod is found to be misaligned or becomes misaligned 

because of bank movement, the unit conditions fall outside of the 

accident analysis assumptions. Since automatic bank sequencing would 

continue to cause misalignment, the unit must be brought to a MODE or 

Condition in which the LCO requirements are not applicable. To achieve 

this status, the unit must be brought to at least MODE 2 with Keff < 1.0 

within 6 hours.

The allowed Completion Time is reasonable, based on operating 

experience, for reaching MODE 2 with Keff < 1.0 from full power 

conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.4.1

REQUIREMENTS

[ Verification that individual rod positions are within alignment limits at a 

Frequency of 12 hours provides a history that allows the operator to 

detect a rod that is beginning to deviate from its expected position. The 

specified Frequency takes into account other rod position information that 

is continuously available to the operator in the control room, so that 

during actual rod motion, deviations can immediately be detected.

OR
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.1.4.2

Verifying each control rod is OPERABLE would require that each rod be 

tripped. However, in MODES 1 and 2 with Keff ≥ 1.0, tripping each control 

rod would result in radial or axial power tilts, or oscillations. Exercising 

each individual control rod provides increased confidence that all rods 

continue to be OPERABLE without exceeding the alignment limit, even if 

they are not regularly tripped. Moving each control rod by 10 steps will 

not cause radial or axial power tilts, or oscillations, to occur. [ The 92 day 

Frequency takes into consideration other information available to the 

operator in the control room and SR 3.1.4.1, which is performed more 

frequently and adds to the determination of OPERABILITY of the rods. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

Between required performances of SR 3.1.4.2 (determination of control 

rod OPERABILITY by movement), if a control rod(s) is discovered to be 

immovable, but remains trippable, the control rod(s) is considered to be 

OPERABLE. At any time, if a control rod(s) is immovable, a 

determination of the trippability (OPERABILITY) of the control rod(s) must 

be made, and appropriate action taken.
Rod Group Alignment Limits

B 3.1.4

Westinghouse STS B 3.1.4-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.1.4.3

Verification of rod drop times allows the operator to determine that the 

maximum rod drop time permitted is consistent with the assumed rod 

drop time used in the safety analysis. Measuring rod drop times prior to

reactor criticality, after reactor vessel head removal, ensures that the 

reactor internals and rod drive mechanism will not interfere with rod 

motion or rod drop time, and that no degradation in these systems has 

occurred that would adversely affect control rod motion or drop time. This 

testing is performed with all RCPs operating and the average moderator 

temperature ≥ 500°F to simulate a reactor trip under actual conditions.

This Surveillance is performed during a plant outage, due to the plant 

conditions needed to perform the SR and the potential for an unplanned 

plant transient if the Surveillance were performed with the reactor at 

power.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10 and GDC 26.

2. 10 CFR 50.46.

3. FSAR, Chapter [15].

4. FSAR, Chapter [15].

5. FSAR, Chapter [15].

6. FSAR, Chapter [15].

7. FSAR, Chapter [15].

Shutdown Bank Insertion Limits

B 3.1.5

Westinghouse STS B 3.1.5-1 Rev. 4.0

B 3.1 REACTIVITY CONTROL SYSTEMS

B 3.1.5 Shutdown Bank Insertion Limits

BASES

BACKGROUND The insertion limits of the shutdown and control rods are initial 

assumptions in all safety analyses that assume rod insertion upon reactor 

trip. The insertion limits directly affect core power and fuel burnup 

distributions and assumptions of available ejected rod worth, SDM and 

initial reactivity insertion rate.

The applicable criteria for these reactivity and power distribution design 

requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," 

GDC 26, "Reactivity Control System Redundancy and Protection," GDC 

28, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria 

for Emergency Core Cooling Systems for Light Water Nuclear Power 

Reactors" (Ref. 2). Limits on control rod insertion have been established, 

and all rod positions are monitored and controlled during power operation 

to ensure that the power distribution and reactivity limits defined by the 

design power peaking and SDM limits are preserved.

The rod cluster control assemblies (RCCAs) are divided among control 

banks and shutdown banks. Each bank may be further subdivided into 

two groups to provide for precise reactivity control. A group consists of 

two or more RCCAs that are electrically paralleled to step simultaneously. 

A bank of RCCAs consists of two groups that are moved in a staggered 

fashion, but always within one step of each other. All plants have four 

control banks and at least two shutdown banks. See LCO 3.1.4, "Rod 

Group Alignment Limits," for control and shutdown rod OPERABILITY 

and alignment requirements, and LCO 3.1.7, "Rod Position Indication," for 

position indication requirements.

The control banks are used for precise reactivity control of the reactor. 

The positions of the control banks are normally automatically controlled 

by the Rod Control System, but they can also be manually controlled. 

They are capable of adding negative reactivity very quickly (compared to 

borating). The control banks must be maintained above designed 

insertion limits and are typically near the fully withdrawn position during 

normal full power operations.

Hence, they are not capable of adding a large amount of positive 

reactivity. Boration or dilution of the Reactor Coolant System (RCS) 

compensates for the reactivity changes associated with large changes in 

RCS temperature. The design calculations are performed with the 

assumption that the shutdown banks are withdrawn first. The shutdown 

banks can be fully withdrawn without the core going critical. This 

provides available negative reactivity in the event of boration errors. The
Shutdown Bank Insertion Limits

B 3.1.5

Westinghouse STS B 3.1.5-2 Rev. 4.0

BASES

BACKGROUND (continued)

shutdown banks are controlled manually by the control room operator. 

During normal unit operation, the shutdown banks are either fully 

withdrawn or fully inserted. The shutdown banks must be completely 

withdrawn from the core, prior to withdrawing any control banks during an 

approach to criticality. The shutdown banks are then left in this position 

until the reactor is shut down. They affect core power and burnup 

distribution, and add negative reactivity to shut down the reactor upon 

receipt of a reactor trip signal.

APPLICABLE On a reactor trip, all RCCAs (shutdown banks and control banks), except

SAFETY the most reactive RCCA, are assumed to insert into the core. The

ANALYSES shutdown banks shall be at or above their insertion limits and available to 

insert the maximum amount of negative reactivity on a reactor trip signal. 

The control banks may be partially inserted in the core, as allowed by 

LCO 3.1.6, "Control Bank Insertion Limits." The shutdown bank and 

control bank insertion limits are established to ensure that a sufficient 

amount of negative reactivity is available to shut down the reactor and 

maintain the required SDM (see LCO 3.1.1, "SHUTDOWN MARGIN 

(SDM)") following a reactor trip from full power. The combination of 

control banks and shutdown banks (less the most reactive RCCA, which 

is assumed to be fully withdrawn) is sufficient to take the reactor from full 

power conditions at rated temperature to zero power, and to maintain the 

required SDM at rated no load temperature (Ref. 3). The shutdown bank 

insertion limit also limits the reactivity worth of an ejected shutdown rod.

The acceptance criteria for addressing shutdown and control rod bank 

insertion limits and inoperability or misalignment is that:

a. There be no violations of:

1. Specified acceptable fuel design limits or

2. RCS pressure boundary integrity and

b. The core remains subcritical after accident transients.

As such, the shutdown bank insertion limits affect safety analysis 

involving core reactivity and SDM (Ref. 3).

The shutdown bank insertion limits preserve an initial condition assumed 

in the safety analyses and, as such, satisfy Criterion 2 of 

10 CFR 50.36(c)(2)(ii).
Shutdown Bank Insertion Limits

B 3.1.5

Westinghouse STS B 3.1.5-3 Rev. 4.0

BASES

LCO The shutdown banks must be within their insertion limits any time the 

reactor is critical or approaching criticality. This ensures that a sufficient 

amount of negative reactivity is available to shut down the reactor and 

maintain the required SDM following a reactor trip.

The shutdown bank insertion limits are defined in the COLR.

APPLICABILITY The shutdown banks must be within their insertion limits, with the reactor 

in MODES 1 and 2. This ensures that a sufficient amount of negative 

reactivity is available to shut down the reactor and maintain the required 

SDM following a reactor trip. The shutdown banks do not have to be 

within their insertion limits in MODE 3, unless an approach to criticality is 

being made. In MODE 3, 4, 5, or 6, the shutdown banks are fully inserted 

in the core and contribute to the SDM. Refer to LCO 3.1.1 for SDM 

requirements in MODES 3, 4, and 5. LCO 3.9.1, "Boron Concentration," 

ensures adequate SDM in MODE 6.

The Applicability requirements have been modified by a Note indicating 

the LCO requirement is suspended during SR 3.1.4.2. This SR verifies 

the freedom of the rods to move, and requires the shutdown bank to 

move below the LCO limits, which would normally violate the LCO.

ACTIONS A.1.1, A.1.2, and A.2

When one or more shutdown banks is not within insertion limits, 2 hours 

is allowed to restore the shutdown banks to within the insertion limits. 

This is necessary because the available SDM may be significantly 

reduced, with one or more of the shutdown banks not within their insertion 

limits. Also, verification of SDM or initiation of boration within 1 hour is 

required, since the SDM in MODES 1 and 2 is ensured by adhering to the 

control and shutdown bank insertion limits (see LCO 3.1.1). If shutdown 

banks are not within their insertion limits, then SDM will be verified by 

performing a reactivity balance calculation, considering the effects listed 

in the BASES for SR 3.1.1.1.

The allowed Completion Time of 2 hours provides an acceptable time for 

evaluating and repairing minor problems without allowing the plant to 

remain in an unacceptable condition for an extended period of time.

B.1

If the shutdown banks cannot be restored to within their insertion limits 

within 2 hours, the unit must be brought to a MODE where the LCO is not 

applicable. The allowed Completion Time of 6 hours is reasonable, 

based on operating experience, for reaching the required MODE from full 

power conditions in an orderly manner and without challenging plant 

systems.
Shutdown Bank Insertion Limits

B 3.1.5

Westinghouse STS B 3.1.5-4 Rev. 4.0

BASES

SURVEILLANCE SR 3.1.5.1

REQUIREMENTS

Verification that the shutdown banks are within their insertion limits prior 

to an approach to criticality ensures that when the reactor is critical, or 

being taken critical, the shutdown banks will be available to shut down the 

reactor, and the required SDM will be maintained following a reactor trip. 

This SR and Frequency ensure that the shutdown banks are withdrawn 

before the control banks are withdrawn during a unit startup.

[ Since the shutdown banks are positioned manually by the control room 

operator, a verification of shutdown bank position at a Frequency of 

12 hours, after the reactor is taken critical, is adequate to ensure that they 

are within their insertion limits. Also, the 12 hour Frequency takes into 

account other information available in the control room for the purpose of 

monitoring the status of shutdown rods.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10, GDC 26, and GDC 28.

2. 10 CFR 50.46.

3. FSAR, Chapter [15].
Control Bank Insertion Limits

B 3.1.6

Westinghouse STS B 3.1.6-1 Rev. 4.0

B 3.1 REACTIVITY CONTROL SYSTEMS

B 3.1.6 Control Bank Insertion Limits

BASES

BACKGROUND The insertion limits of the shutdown and control rods are initial 

assumptions in all safety analyses that assume rod insertion upon reactor 

trip. The insertion limits directly affect core power and fuel burnup 

distributions and assumptions of available SDM, and initial reactivity 

insertion rate.

The applicable criteria for these reactivity and power distribution design

requirements are 10 CFR 50, Appendix A, GDC 10, "Reactor Design," 

GDC 26, "Reactivity Control System Redundancy and Protection," GDC 

28, "Reactivity Limits" (Ref. 1), and 10 CFR 50.46, "Acceptance Criteria 

for Emergency Core Cooling Systems for Light Water Nuclear Power 

Reactors" (Ref. 2). Limits on control rod insertion have been established, 

and all rod positions are monitored and controlled during power operation 

to ensure that the power distribution and reactivity limits defined by the 

design power peaking and SDM limits are preserved.

The rod cluster control assemblies (RCCAs) are divided among control 

banks and shutdown banks. Each bank may be further subdivided into 

two groups to provide for precise reactivity control. A group consists of 

two or more RCCAs that are electrically paralleled to step simultaneously. 

A bank of RCCAs consists of two groups that are moved in a staggered 

fashion, but always within one step of each other. All plants have four 

control banks and at least two shutdown banks. See LCO 3.1.4, "Rod 

Group Alignment Limits," for control and shutdown rod OPERABILITY 

and alignment requirements, and LCO 3.1.7, "Rod Position Indication," for 

position indication requirements.

The control bank insertion limits are specified in the COLR. An example 

is provided for information only in Figure B 3.1.6-1. The control banks are 

required to be at or above the insertion limit lines.

Figure B 3.1.6-1 also indicates how the control banks are moved in an 

overlap pattern. Overlap is the distance travelled together by two control 

banks. The predetermined position of control bank C, at which control 

bank D will begin to move with bank C on a withdrawal, will be at 

118 steps for a fully withdrawn position of 231 steps. The fully withdrawn 

position is defined in the COLR.
Control Bank Insertion Limits

B 3.1.6

Westinghouse STS B 3.1.6-2 Rev. 4.0

BASES

BACKGROUND (continued)

The control banks are used for precise reactivity control of the reactor. 

The positions of the control banks are normally controlled automatically 

by the Rod Control System, but can also be manually controlled. They 

are capable of adding reactivity very quickly (compared to borating or 

diluting).

The power density at any point in the core must be limited, so that the fuel 

design criteria are maintained. Together, LCO 3.1.4, LCO 3.1.5, 

"Shutdown Bank Insertion Limits," LCO 3.1.6, LCO 3.2.3, "AXIAL FLUX 

DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT 

RATIO (QPTR)," provide limits on control component operation and on 

monitored process variables, which ensure that the core operates within 

the fuel design criteria.

The shutdown and control bank insertion and alignment limits, AFD, and 

QPTR are process variables that together characterize and control the 

three dimensional power distribution of the reactor core. Additionally, the 

control bank insertion limits control the reactivity that could be added in 

the event of a rod ejection accident, and the shutdown and control bank 

insertion limits ensure the required SDM is maintained.

Operation within the subject LCO limits will prevent fuel cladding failures 

that would breach the primary fission product barrier and release fission 

products to the reactor coolant in the event of a loss of coolant accident 

(LOCA), loss of flow, ejected rod, or other accident requiring termination 

by a Reactor Trip System (RTS) trip function.

APPLICABLE The shutdown and control bank insertion limits, AFD, and QPTR LCOs

SAFETY are required to prevent power distributions that could result in fuel

ANALYSES cladding failures in the event of a LOCA, loss of flow, ejected rod, or other 

accident requiring termination by an RTS trip function.

The acceptance criteria for addressing shutdown and control bank 

insertion limits and inoperability or misalignment are that:

a. There be no violations of:

1. Specified acceptable fuel design limits or

2. Reactor Coolant System pressure boundary integrity and

b. The core remains subcritical after accident transients.
Control Bank Insertion Limits

B 3.1.6

Westinghouse STS B 3.1.6-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

As such, the shutdown and control bank insertion limits affect safety 

analysis involving core reactivity and power distributions (Ref. 3).

The SDM requirement is ensured by limiting the control and shutdown 

bank insertion limits so that allowable inserted worth of the RCCAs is 

such that sufficient reactivity is available in the rods to shut down the 

reactor to hot zero power with a reactivity margin that assumes the 

maximum worth RCCA remains fully withdrawn upon trip (Ref. 4).

Operation at the insertion limits or AFD limits may approach the maximum 

allowable linear heat generation rate or peaking factor with the allowed 

QPTR present. Operation at the insertion limit may also indicate the 

maximum ejected RCCA worth could be equal to the limiting value in fuel 

cycles that have sufficiently high ejected RCCA worths.

The control and shutdown bank insertion limits ensure that safety 

analyses assumptions for SDM, ejected rod worth, and power distribution 

peaking factors are preserved (Ref. 5).

The insertion limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii), in that 

they are initial conditions assumed in the safety analysis.

LCO The limits on control banks sequence, overlap, and physical insertion, as 

defined in the COLR, must be maintained because they serve the 

function of preserving power distribution, ensuring that the SDM is 

maintained, ensuring that ejected rod worth is maintained, and ensuring 

adequate negative reactivity insertion is available on trip. The overlap 

between control banks provides more uniform rates of reactivity insertion 

and withdrawal and is imposed to maintain acceptable power peaking 

during control bank motion.

APPLICABILITY The control bank sequence, overlap, and physical insertion limits shall be 

maintained with the reactor in MODES 1 and 2 with keff ≥ 1.0. These 

limits must be maintained, since they preserve the assumed power 

distribution, ejected rod worth, SDM, and reactivity rate insertion 

assumptions. Applicability in MODES 3, 4, and 5 is not required, since 

neither the power distribution nor ejected rod worth assumptions would be 

exceeded in these MODES.

The applicability requirements have been modified by a Note indicating 

the LCO requirements are suspended during the performance of 

SR 3.1.4.2. This SR verifies the freedom of the rods to move, and 

requires the control bank to move below the LCO limits, which would 

violate the LCO.
Control Bank Insertion Limits

B 3.1.6

Westinghouse STS B 3.1.6-4 Rev. 4.0

BASES

ACTIONS A.1.1, A.1.2, A.2, B.1.1, B.1.2, and B.2

When the control banks are outside the acceptable insertion limits, they 

must be restored to within those limits. This restoration can occur in two 

ways:

a. Reducing power to be consistent with rod position or

b. Moving rods to be consistent with power.

Also, verification of SDM or initiation of boration to regain SDM is required 

within 1 hour, since the SDM in MODES 1 and 2 normally ensured by 

adhering to the control and shutdown bank insertion limits (see 

LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") has been upset. If control 

banks are not within their insertion limits, then SDM will be verified by 

performing a reactivity balance calculation, considering the effects listed 

in the BASES for SR 3.1.1.1.

Similarly, if the control banks are found to be out of sequence or in the 

wrong overlap configuration, they must be restored to meet the limits.

Operation beyond the LCO limits is allowed for a short time period in 

order to take conservative action because the simultaneous occurrence of 

either a LOCA, loss of flow accident, ejected rod accident, or other 

accident during this short time period, together with an inadequate power 

distribution or reactivity capability, has an acceptably low probability.

The allowed Completion Time of 2 hours for restoring the banks to within 

the insertion, sequence, and overlaps limits provides an acceptable time

for evaluating and repairing minor problems without allowing the plant to 

remain in an unacceptable condition for an extended period of time.

C.1

If Required Actions A.1 and A.2, or B.1 and B.2 cannot be completed 

within the associated Completion Times, the plant must be brought to 

MODE 2 with keff < 1.0, where the LCO is not applicable. The allowed 

Completion Time of 6 hours is reasonable, based on operating 

experience, for reaching the required MODE from full power conditions in 

an orderly manner and without challenging plant systems.
Control Bank Insertion Limits

B 3.1.6

Westinghouse STS B 3.1.6-5 Rev. 4.0

BASES

SURVEILLANCE SR 3.1.6.1

REQUIREMENTS

This Surveillance is required to ensure that the reactor does not achieve 

criticality with the control banks below their insertion limits.

The estimated critical position (ECP) depends upon a number of factors, 

one of which is xenon concentration. If the ECP was calculated long 

before criticality, xenon concentration could change to make the ECP 

substantially in error. Conversely, determining the ECP immediately 

before criticality could be an unnecessary burden. There are a number of 

unit parameters requiring operator attention at that point. Performing the 

ECP calculation within 4 hours prior to criticality avoids a large error from 

changes in xenon concentration, but allows the operator some flexibility to 

schedule the ECP calculation with other startup activities.

SR 3.1.6.2

[ Verification of the control bank insertion limits at a Frequency of 12 hours 

is sufficient to detect control banks that may be approaching the insertion 

limits since, normally, very little rod motion occurs in 12 hours.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.1.6.3

When control banks are maintained within their insertion limits as 

checked by SR 3.1.6.2 above, it is unlikely that their sequence and 

overlap will not be in accordance with requirements provided in the 

COLR. [ A Frequency of 12 hours is consistent with the insertion limit 

check above in SR 3.1.6.2.
Control Bank Insertion Limits

B 3.1.6

Westinghouse STS B 3.1.6-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 10, GDC 26, GDC 28.

2. 10 CFR 50.46.

3. FSAR, Chapter [15].

4. FSAR, Chapter [15].

5. FSAR, Chapter [15].
Control Bank Insertion Limits

B 3.1.6

Westinghouse STS B 3.1.6-7 Rev. 4.0

Figure B 3.1.6 (page 1 of 1)

Control Bank Insertion vs. Percent RTP

Rod Position Indication

B 3.1.7

Westinghouse STS B 3.1.7-1 Rev. 4.0

B 3.1 REACTIVITY CONTROL SYSTEMS

B 3.1.7 Rod Position Indication

BASES

BACKGROUND According to GDC 13 (Ref. 1), instrumentation to monitor variables and 

systems over their operating ranges during normal operation, anticipated 

operational occurrences, and accident conditions must be OPERABLE. 

LCO 3.1.7 is required to ensure OPERABILITY of the control rod position 

indicators to determine control rod positions and thereby ensure 

compliance with the control rod alignment and insertion limits.

The OPERABILITY, including position indication, of the shutdown and 

control rods is an initial assumption in all safety analyses that assume rod 

insertion upon reactor trip. Maximum rod misalignment is an initial 

assumption in the safety analysis that directly affects core power 

distributions and assumptions of available SDM. Rod position indication 

is required to assess OPERABILITY and misalignment.

Mechanical or electrical failures may cause a control rod to become 

inoperable or to become misaligned from its group. Control rod 

inoperability or misalignment may cause increased power peaking, due to 

the asymmetric reactivity distribution and a reduction in the total available 

rod worth for reactor shutdown. Therefore, control rod alignment and 

OPERABILITY are related to core operation in design power peaking 

limits and the core design requirement of a minimum SDM.

Limits on control rod alignment and OPERABILITY have been 

established, and all rod positions are monitored and controlled during 

power operation to ensure that the power distribution and reactivity limits 

defined by the design power peaking and SDM limits are preserved.

Rod cluster control assemblies (RCCAs), or rods, are moved out of the 

core (up or withdrawn) or into the core (down or inserted) by their control 

rod drive mechanisms. The RCCAs are divided among control banks and 

shutdown banks. Each bank may be further subdivided into two groups 

to provide for precise reactivity control.

The axial position of shutdown rods and control rods are determined by 

two separate and independent systems: the Bank Demand Position 

Indication System (commonly called group step counters) and the [Digital] 

Rod Position Indication ([D]RPI) System.
Rod Position Indication

B 3.1.7

Westinghouse STS B 3.1.7-2 Rev. 4.0

BASES

BACKGROUND (continued)

The Bank Demand Position Indication System counts the pulses from the 

Rod Control System that move the rods. There is one step counter for 

each group of rods. Individual rods in a group all receive the same signal 

to move and should, therefore, all be at the same position indicated by 

the group step counter for that group. The Bank Demand Position 

Indication System is considered highly precise (± 1 step or ± e inch). If a 

rod does not move one step for each demand pulse, the step counter will 

still count the pulse and incorrectly reflect the position of the rod.

The [D]RPI System provides a highly accurate indication of actual control 

rod position, but at a lower precision than the step counters. This system 

is based on inductive analog signals from a series of coils spaced along a 

hollow tube with a center to center distance of 3.75 inches, which is 

6 steps. To increase the reliability of the system, the inductive coils are 

connected alternately to data system A or B. Thus, if one system fails, 

the [D]RPI will go on half accuracy with an effective coil spacing of 

7.5 inches, which is 12 steps. Therefore, the normal indication accuracy 

of the [D]RPI System is ± 6 steps (± 3.75 inches), and the maximum 

uncertainty is ± 12 steps (± 7.5 inches). With an indicated deviation of 

12 steps between the group step counter and [D]RPI, the maximum 

deviation between actual rod position and the demand position could be 

24 steps, or 15 inches.

APPLICABLE Control and shutdown rod position accuracy is essential during power

SAFETY operation. Power peaking, ejected rod worth, or SDM limits may be

ANALYSES violated in the event of a Design Basis Accident (Ref. 2), with control or 

shutdown rods operating outside their limits undetected. Therefore, the 

acceptance criteria for rod position indication is that rod positions must be 

known with sufficient accuracy in order to verify the core is operating 

within the group sequence, overlap, design peaking limits, ejected rod 

worth, and with minimum SDM (LCO 3.1.5, "Shutdown Bank Insertion 

Limits," and LCO 3.1.6, "Control Bank Insertion Limits"). The rod 

positions must also be known in order to verify the alignment limits are 

preserved (LCO 3.1.4, "Rod Group Alignment Limits"). Control rod 

positions are continuously monitored to provide operators with information 

that ensures the plant is operating within the bounds of the accident 

analysis assumptions.

The control rod position indicator channels satisfy Criterion 2 of 

10 CFR 50.36(c)(2)(ii). The control rod position indicators monitor control 

rod position, which is an initial condition of the accident.
Rod Position Indication

B 3.1.7

Westinghouse STS B 3.1.7-3 Rev. 4.0

BASES

LCO LCO 3.1.7 specifies that one [D]RPI System and one Bank Demand

Position Indication System be OPERABLE for each control rod. For the 

control rod position indicators to be OPERABLE requires meeting the SR 

of the LCO and the following:

a. The [D]RPI System indicates within 12 steps of the group step 

counter demand position as required by LCO 3.1.4, "Rod Group 

Alignment Limits,"

b. For the [D]RPI System there are no failed coils, and

c. The Bank Demand Indication System has been calibrated either in 

the fully inserted position or to the [D]RPI System.

The 12 step agreement limit between the Bank Demand Position 

Indication System and the [D]RPI System indicates that the Bank 

Demand Position Indication System is adequately calibrated, and can be 

used for indication of the measurement of control rod bank position.

A deviation of less than the allowable limit, given in LCO 3.1.4, in position 

indication for a single control rod, ensures high confidence that the 

position uncertainty of the corresponding control rod group is within the 

assumed values used in the analysis (that specified control rod group 

insertion limits).

These requirements ensure that control rod position indication during 

power operation and PHYSICS TESTS is accurate, and that design 

assumptions are not challenged.

OPERABILITY of the position indicator channels ensures that inoperable, 

misaligned, or mispositioned control rods can be detected. Therefore, 

power peaking, ejected rod worth, and SDM can be controlled within 

acceptable limits.

APPLICABILITY The requirements on the [D]RPI and step counters are only applicable in 

MODES 1 and 2 (consistent with LCO 3.1.4, LCO 3.1.5, and LCO 3.1.6), 

because these are the only MODES in which power is generated, and the 

OPERABILITY and alignment of rods have the potential to affect the 

safety of the plant. In the shutdown MODES, the OPERABILITY of the 

shutdown and control banks has the potential to affect the required SDM, 

but this effect can be compensated for by an increase in the boron 

concentration of the Reactor Coolant System.
Rod Position Indication

B 3.1.7

Westinghouse STS B 3.1.7-4 Rev. 4.0

BASES

ACTIONS The ACTIONS Table is modified by a Note indicating that a separate 

Condition entry is allowed for each inoperable rod position indicator and 

each demand position indicator. This is acceptable because the 

Required Actions for each Condition provide appropriate compensatory 

actions for each inoperable position indicator.

A.1

When one [D]RPI channel per group fails, the position of the rod may still 

be determined indirectly by use of the movable incore detectors. The 

Required Action may also be satisfied by ensuring at least once per 

8 hours that FQ satisfies LCO 3.2.1, 

H

N

F

satisfies LCO 3.2.2, and 

SHUTDOWN MARGIN is within the limits provided in the COLR, provided 

the nonindicating rods have not been moved. Based on experience, 

normal power operation does not require excessive movement of banks. 

If a bank has been significantly moved, the Required Action of C.1 or C.2 

below is required. Therefore, verification of RCCA position within the 

Completion Time of 8 hours is adequate for allowing continued full power 

operation, since the probability of simultaneously having a rod 

significantly out of position and an event sensitive to that rod position is 

small.

A.2

Reduction of THERMAL POWER to ≤ 50% RTP puts the core into a 

condition where rod position is not significantly affecting core peaking 

factors (Ref. 3).

The allowed Completion Time of 8 hours is reasonable, based on 

operating experience, for reducing power to ≤ 50% RTP from full power 

conditions without challenging plant systems and allowing for rod position 

determination by Required Action A.1 above.

B.1, B.2, B.3, and B.4

When more than one [D]RPI per group fail, additional actions are 

necessary to ensure that acceptable power distribution limits are 

maintained, minimum SDM is maintained, and the potential effects of rod 

misalignment on associated accident analyses are limited. Placing the 

Rod Control System in manual assures unplanned rod motion will not 

occur. Together with the indirect position determination available via 
Rod Position Indication

B 3.1.7

Westinghouse STS B 3.1.7-5 Rev. 4.0

BASES

ACTIONS (continued)

movable incore detectors will minimize the potential for rod misalignment. 

The immediate Completion Time for placing the Rod Control System in 

manual reflects the urgency with which unplanned rod motion must be 

prevented while in this Condition.

Monitoring and recording reactor coolant Tavg help assure that significant 

changes in power distribution and SDM are avoided. The once per hour 

Completion Time is acceptable because only minor fluctuations in RCS 

temperature are expected at steady state plant operating conditions.

The position of the rods may be determined indirectly by use of the 

movable incore detectors. The Required Action may also be satisfied by 

ensuring at least once per 8 hours that FQ satisfies LCO 3.2.1, 

H

N

F

satisfies LCO 3.2.2, and SHUTDOWN MARGIN is within the limits 

provided in the COLR, provided the nonindicating rods have not been 

moved. Verification of control rod position once per 8 hours is adequate 

for allowing continued full power operation for a limited, 24 hour period, 

since the probability of simultaneously having a rod significantly out of 

position and an event sensitive to that rod position is small. The 24 hour 

Completion Time provides sufficient time to troubleshoot and restore the 

[D]RPI system to operation while avoiding the plant challenges 

associated with the shutdown without full rod position indication.

Based on operating experience, normal power operation does not require 

excessive rod movement. If one or more rods has been significantly 

moved, the Required Action of C.1 or C.2 below is required.

C.1 and C.2

These Required Actions clarify that when one or more rods with 

inoperable position indicators have been moved in excess of 24 steps in 

one direction, since the position was last determined, the Required 

Actions of A.1 and A.2, [or B.1, as applicable] are still appropriate but 

must be initiated promptly under Required Action C.1 to begin verifying 

that these rods are still properly positioned, relative to their group 

positions.

If, within [4] hours, the rod positions have not been determined, 

THERMAL POWER must be reduced to ≤ 50% RTP within 8 hours to 

avoid undesirable power distributions that could result from continued 

operation at > 50% RTP, if one or more rods are misaligned by more than 

24 steps. The allowed Completion Time of [4] hours provides an 

acceptable period of time to verify the rod positions.
Rod Position Indication

B 3.1.7

Westinghouse STS B 3.1.7-6 Rev. 4.0

BASES

ACTIONS (continued)

D.1.1 and D.1.2

With one demand position indicator per bank inoperable, the rod positions 

can be determined by the [D]RPI System. Since normal power operation 

does not require excessive movement of rods, verification by 

administrative means that the rod position indicators are OPERABLE and 

the most withdrawn rod and the least withdrawn rod are ≤ 12 steps apart 

within the allowed Completion Time of once every 8 hours is adequate.

D.2

Reduction of THERMAL POWER to ≤ 50% RTP puts the core into a 

condition where rod position is not significantly affecting core peaking 

factor limits (Ref. 3). The allowed Completion Time of 8 hours provides 

an acceptable period of time to verify the rod positions per Required 

Actions C.1.1 and C.1.2 or reduce power to ≤ 50% RTP.

E.1

If the Required Actions cannot be completed within the associated 

Completion Time, the plant must be brought to a MODE in which the 

requirement does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours. The allowed Completion Time 

is reasonable, based on operating experience, for reaching the required 

MODE from full power conditions in an orderly manner and without 

challenging plant systems.

SURVEILLANCE SR 3.1.7.1

REQUIREMENTS

Verification that the [D]RPI agrees with the demand position within 

[12] steps ensures that the [D]RPI is operating correctly. Since the 

[D]RPI does not display the actual shutdown rod positions between 18 

and 210 steps, only points within the indicated ranges are required in 

comparison.

This Surveillance is performed prior to reactor criticality after each 

removal of the reactor head, as there is the potential for unnecessary 

plant transients if the SR were performed with the reactor at power.
Rod Position Indication

B 3.1.7

Westinghouse STS B 3.1.7-7 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50, Appendix A, GDC 13.

2. FSAR, Chapter [15].

3. FSAR, Chapter [15].

PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-1 Rev. 4.0

B 3.1 REACTIVITY CONTROL SYSTEMS

B 3.1.8 PHYSICS TESTS Exceptions - MODE 2

BASES

BACKGROUND The primary purpose of the MODE 2 PHYSICS TESTS exceptions is to 

permit relaxations of existing LCOs to allow certain PHYSICS TESTS to 

be performed.

Section XI of 10 CFR 50, Appendix B (Ref. 1), requires that a test 

program be established to ensure that structures, systems, and 

components will perform satisfactorily in service. All functions necessary 

to ensure that the specified design conditions are not exceeded during 

normal operation and anticipated operational occurrences must be tested. 

This testing is an integral part of the design, construction, and operation 

of the plant. Requirements for notification of the NRC, for the purpose of 

conducting tests and experiments, are specified in 10 CFR 50.59 (Ref. 2).

The key objectives of a test program are to (Ref. 3):

a. Ensure that the facility has been adequately designed,

b. Validate the analytical models used in the design and analysis,

c. Verify the assumptions used to predict unit response,

d. Ensure that installation of equipment in the facility has been 

accomplished in accordance with the design, and

e. Verify that the operating and emergency procedures are adequate.

To accomplish these objectives, testing is performed prior to initial 

criticality, during startup, during low power operations, during power 

ascension, at high power, and after each refueling. The PHYSICS 

TESTS requirements for reload fuel cycles ensure that the operating 

characteristics of the core are consistent with the design predictions and 

that the core can be operated as designed (Ref. 4).

PHYSICS TESTS procedures are written and approved in accordance 

with established formats. The procedures include all information 

necessary to permit a detailed execution of the testing required to ensure 

that the design intent is met. PHYSICS TESTS are performed in 

accordance with these procedures and test results are approved prior to 

continued power escalation and long term power operation.
PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-2 Rev. 4.0

BASES

BACKGROUND (continued)

The PHYSICS TESTS required for reload fuel cycles (Ref. 4) in MODE 2 

are listed below:

a. Critical Boron Concentration - Control Rods Withdrawn,

b. Critical Boron Concentration - Control Rods Inserted,

c. Control Rod Worth,

d. Isothermal Temperature Coefficient (ITC), and

e. Neutron Flux Symmetry.

The first four tests are performed in MODE 2, and the last test can be 

performed in either MODE 1 or 2. These and other supplementary tests 

may be required to calibrate the nuclear instrumentation or to diagnose 

operational problems. These tests may cause the operating controls and 

process variables to deviate from their LCO requirements during their 

performance.

[ a. The Critical Boron Concentration - Control Rods Withdrawn Test 

measures the critical boron concentration at hot zero power (HZP). 

With all rods out, the lead control bank is at or near its fully withdrawn 

position. HZP is where the core is critical (keff = 1.0), and the Reactor 

Coolant System (RCS) is at design temperature and pressure for 

zero power. Performance of this test should not violate any of the 

referenced LCOs.

b. The Critical Boron Concentration - Control Rods Inserted Test 

measures the critical boron concentration at HZP, with a bank having 

a worth of at least 1% ∆k/k when fully inserted into the core. This test 

is used to measure the boron reactivity coefficient. With the core at 

HZP and all banks fully withdrawn, the boron concentration of the 

reactor coolant is gradually lowered in a continuous manner. The 

selected bank is then inserted to make up for the decreasing boron 

concentration until the selected bank has been moved over its entire 

range of travel. The reactivity resulting from each incremental bank 

movement is measured with a reactivity computer. The difference 

between the measured critical boron concentration with all rods fully 

withdrawn and with the bank inserted is determined. The boron

reactivity coefficient is determined by dividing the measured bank 

worth by the measured boron concentration difference. Performance 

of this test could violate LCO 3.1.4, "Rod Group Alignment Limits," 

LCO 3.1.5, "Shutdown Bank Insertion Limit," or LCO 3.1.6, "Control 

Bank Insertion Limits."
PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-3 Rev. 4.0

BASES

BACKGROUND (continued)

c. The Control Rod Worth Test is used to measure the reactivity worth 

of selected control banks. This test is performed at HZP and has 

three alternative methods of performance. The first method, the 

Boron Exchange Method, varies the reactor coolant boron 

concentration and moves the selected control bank in response to 

the changing boron concentration. The reactivity changes are 

measured with a reactivity computer. This sequence is repeated for 

the remaining control banks. The second method, the Rod Swap 

Method, measures the worth of a predetermined reference bank 

using the Boron Exchange Method above. The reference bank is 

then nearly fully inserted into the core. The selected bank is then 

inserted into the core as the reference bank is withdrawn. The HZP 

critical conditions are then determined with the selected bank fully 

inserted into the core. The worth of the selected bank is inferred, 

based on the position of the reference bank with respect to the 

selected bank. This sequence is repeated as necessary for the 

remaining control banks. The third method, the Boron Endpoint 

Method, moves the selected control bank over its entire length of 

travel and then varies the reactor coolant boron concentration to 

achieve HZP criticality again. The difference in boron concentration 

is the worth of the selected control bank. This sequence is repeated 

for the remaining control banks. Performance of this test could 

violate LCO 3.1.4, LCO 3.1.5, or LCO 3.1.6.

d. The ITC Test measures the ITC of the reactor. This test is performed 

at HZP and has two methods of performance. The first method, the 

Slope Method, varies RCS temperature in a slow and continuous 

manner. The reactivity change is measured with a reactivity 

computer as a function of the temperature change. The ITC is the 

slope of the reactivity versus the temperature plot. The test is 

repeated by reversing the direction of the temperature change, and 

the final ITC is the average of the two calculated ITCs. The second 

method, the Endpoint Method, changes the RCS temperature and 

measures the reactivity at the beginning and end of the temperature 

change. The ITC is the total reactivity change divided by the total 

temperature change. The test is repeated by reversing the direction 

of the temperature change, and the final ITC is the average of the 

two calculated ITCs. Performance of this test could violate 

LCO 3.4.2, "RCS Minimum Temperature for Criticality."

e. The Flux Symmetry Test measures the degree of azimuthal 

symmetry of the neutron flux at as low a power level as practical, 

depending on the test method employed. This test can be performed 

at HZP (Control Rod Worth Symmetry Method) or at ≤ 30% RTP 

(Flux Distribution Method). The Control Rod Worth Symmetry
PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-4 Rev. 4.0

BASES

BACKGROUND (continued)

Method inserts a control bank, which can then be withdrawn to 

compensate for the insertion of a single control rod from a symmetric 

set. The symmetric rods of each set are then tested to evaluate the 

symmetry of the control rod worth and neutron flux (power 

distribution). A reactivity computer is used to measure the control rod 

worths. Performance of this test could violate LCO 3.1.4, LCO 3.1.5, 

or LCO 3.1.6. The Flux Distribution Method uses the incore flux 

detectors to measure the azimuthal flux distribution at selected 

locations with the core at ≤ 30% RTP. ]

APPLICABLE The fuel is protected by LCOs that preserve the initial conditions of the

SAFETY core assumed during the safety analyses. The methods for development

ANALYSES of the LCOs that are excepted by this LCO are described in the 

Westinghouse Reload Safety Evaluation Methodology Report (Ref. 5). 

The above mentioned PHYSICS TESTS, and other tests that may be 

required to calibrate nuclear instrumentation or to diagnose operational 

problems, may require the operating control or process variables to 

deviate from their LCO limitations.

The FSAR defines requirements for initial testing of the facility, including 

PHYSICS TESTS. Tables [14.1-1 and 14.1-2] summarize the zero, low 

power, and power tests. Requirements for reload fuel cycle PHYSICS 

TESTS are defined in ANSI/ANS-19.6.1-1985 (Ref. 4). Although these 

PHYSICS TESTS are generally accomplished within the limits for all 

LCOs, conditions may occur when one or more LCOs must be suspended 

to make completion of PHYSICS TESTS possible or practical. This is 

acceptable as long as the fuel design criteria are not violated. When one 

or more of the requirements specified in LCO 3.1.3, "Moderator 

Temperature Coefficient (MTC)," LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, and 

LCO 3.4.2 are suspended for PHYSICS TESTS, the fuel design criteria 

are preserved as long as the power level is limited to ≤ 5% RTP, the 

reactor coolant temperature is kept ≥ 531°F, and SDM is within the limits 

provided in the COLR.

The PHYSICS TESTS include measurement of core nuclear parameters 

or the exercise of control components that affect process variables. 

Among the process variables involved are AFD and QPTR, which 

represent initial conditions of the unit safety analyses. Also involved are 

the movable control components (control and shutdown rods), which are 

required to shut down the reactor. The limits for these variables are 

specified for each fuel cycle in the COLR.
PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-5 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

As described in LCO 3.0.7, compliance with Test Exception LCOs is 

optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test 

Exception LCOs provide flexibility to perform certain operations by 

appropriately modifying requirements of other LCOs. A discussion of the 

criteria satisfied for the other LCOs is provided in their respective Bases.

Reference 6 allows special test exceptions (STEs) to be included as part 

of the LCO that they affect. It was decided, however, to retain this STE 

as a separate LCO because it was less cumbersome and provided 

additional clarity.

LCO This LCO allows the reactor parameters of MTC and minimum 

temperature for criticality to be outside their specified limits. In addition, it 

allows selected control and shutdown rods to be positioned outside of 

their specified alignment and insertion limits. One power range neutron 

flux channel may be bypassed, reducing the number of required channels 

from 4 to 3. Operation beyond specified limits is permitted for the 

purpose of performing PHYSICS TESTS and poses no threat to fuel 

integrity, provided the SRs are met.

The requirements of LCO 3.1.3, LCO 3.1.4, LCO 3.1.5, LCO 3.1.6, 

and LCO 3.4.2 may be suspended and the number of required channels 

for LCO 3.3.1, "RTS Instrumentation," Functions 2, 3, 6 and 18.e may be 

reduced to 3 required channels during the performance of PHYSICS 

TESTS provided:

a. RCS lowest loop average temperature is ≥ [531]°F,

b. SDM is within the limits provided in the COLR, and 

c. THERMAL POWER is  5% RTP.

APPLICABILITY This LCO is applicable when performing low power PHYSICS TESTS. 

The Applicability is stated as "during PHYSICS TESTS initiated in 

MODE 2" to ensure that the 5% RTP maximum power level is not 

exceeded. Should the THERMAL POWER exceed 5% RTP, and 

consequently the unit enter MODE 1, this Applicability statement prevents 

exiting this Specification and its Required Actions.
PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-6 Rev. 4.0

BASES

ACTIONS A.1 and A.2

If the SDM requirement is not met, boration must be initiated promptly. A 

Completion Time of 15 minutes is adequate for an operator to correctly 

align and start the required systems and components. The operator 

should begin boration with the best source available for the plant 

conditions. Boration will be continued until SDM is within limit.

Suspension of PHYSICS TESTS exceptions requires restoration of each 

of the applicable LCOs to within specification.

B.1

When THERMAL POWER is > 5% RTP, the only acceptable action is to 

open the reactor trip breakers (RTBs) to prevent operation of the reactor 

beyond its design limits. Immediately opening the RTBs will shut down 

the reactor and prevent operation of the reactor outside of its design 

limits.

C.1

When the RCS lowest Tavg is < 531°F, the appropriate action is to restore 

Tavg to within its specified limit. The allowed Completion Time of 

15 minutes provides time for restoring Tavg to within limits without allowing 

the plant to remain in an unacceptable condition for an extended period of 

time. Operation with the reactor critical and with temperature below 

531°F could violate the assumptions for accidents analyzed in the safety 

analyses.

D.1

If the Required Actions cannot be completed within the associated 

Completion Time, the plant must be brought to a MODE in which the 

requirement does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within an additional 15 minutes. The 

Completion Time of 15 additional minutes is reasonable, based on 

operating experience, for reaching MODE 3 in an orderly manner and 

without challenging plant systems.
PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-7 Rev. 4.0

BASES

SURVEILLANCE SR 3.1.8.1

REQUIREMENTS

The power range and intermediate range neutron detectors must be 

verified to be OPERABLE in MODE 2 by LCO 3.3.1, "Reactor Trip 

System (RTS) Instrumentation." A CHANNEL OPERATIONAL TEST is 

performed on each power range and intermediate range channel prior to 

initiation of the PHYSICS TESTS. This will ensure that the RTS is 

properly aligned to provide the required degree of core protection during 

the performance of the PHYSICS TESTS.

SR 3.1.8.2

Verification that the RCS lowest loop Tavg is ≥ 531°F will ensure that the 

unit is not operating in a condition that could invalidate the safety 

analyses. [ Verification of the RCS temperature at a Frequency of 

30 minutes during the performance of the PHYSICS TESTS will ensure 

that the initial conditions of the safety analyses are not violated.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.1.8.3

Verification that the THERMAL POWER is  5% RTP will ensure that the 

plant is not operating in a condition that could invalidate the safety 

analyses. [ Verification of the THERMAL POWER at a Frequency of 

30 minutes during the performance of the PHYSICS TESTS will ensure 

that the initial conditions of the safety analyses are not violated.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.1.8.4

The SDM is verified by performing a reactivity balance calculation, 

considering the following reactivity effects:

a. RCS boron concentration,

b. Control bank position,

c. RCS average temperature,

d. Fuel burnup based on gross thermal energy generation,

e. Xenon concentration,

f. Samarium concentration,

g. Isothermal temperature coefficient (ITC), when below the point of 

adding heat (POAH),

h. Moderate defect, when above the POAH, and

i. Doppler defect, when above the POAH.

Using the ITC accounts for Doppler reactivity in this calculation when the 

reactor is subcritical or critical but below the POAH, and the fuel 

temperature will be changing at the same rate as the RCS.

[ The Frequency of 24 hours is based on the generally slow change in 

required boron concentration and on the low probability of an accident 

occurring without the required SDM.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
PHYSICS TESTS Exceptions - MODE 2

B 3.1.8

Westinghouse STS B 3.1.8-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix B, Section XI.

2. 10 CFR 50.59.

3. Regulatory Guide 1.68, Revision 2, August, 1978.

4. ANSI/ANS-19.6.1-1985, December 13, 1985.

5. WCAP-9273-NP-A, "Westinghouse Reload Safety Evaluation 

Methodology Report," July 1985.

6. WCAP-11618, including Addendum 1, April 1989.

FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-1 Rev. 4.0

B 3.2 POWER DISTRIBUTION LIMITS

B 3.2.1A Heat Flux Hot Channel Factor (FQ(Z)) (CAOC-Fxy Methodology)

BASES

BACKGROUND The purpose of the limits on the values of FQ(Z) is to limit the local (i.e., 

pellet) peak power density. The value of FQ(Z) varies along the axial 

height of the core (Z).

FQ(Z) is defined as the maximum local fuel rod linear power density 

divided by the average fuel rod linear power density, assuming nominal 

fuel pellet and fuel rod dimensions. Therefore, FQ(Z) is a measure of the 

peak fuel pellet power within the reactor core.

During power operation, the global power distribution is limited by 

LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, 

"QUADRANT POWER TILT RATIO (QPTR)," which are directly and 

continuously measured process variables. These LCOs, along with 

LCO 3.1.7, "Control Bank Insertion Limits," maintain core limits on power 

distributions on a continuous basis.

FQ(Z) varies with fuel loading patterns, control bank insertion, fuel burnup, 

and changes in axial power distribution.

FQ(Z) is measured periodically using the incore detector system. These 

measurements are generally taken with the core at or near steady state 

conditions.

Using the measured three dimensional power distributions, it is possible 

to determine a measured value for FQ(Z). However, because this value 

represents a steady state condition, it does not include variations in the 

value of FQ(Z), which are present during a nonequilibrium situation such 

as load following or during power ascension.

The steady state value of the fundamental radial peaking factor (Fxy) is 

adjusted by an elevation dependent factor to account for the variations in 

FQ(Z) due to transient conditions.

Core monitoring and control under nonsteady state conditions are 

accomplished by operating the core within the limits of the appropriate 

LCOs, including the limits on AFD, QPTR, and control rod insertion.
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-2 Rev. 4.0

BASES

APPLICABLE This LCO precludes core power distributions that violate the following fuel

SAFETY design criteria:

ANALYSES

a. During a large break loss of coolant accident (LOCA), the peak 

cladding temperature must not exceed 2200°F (Ref. 1),

b. During a loss of forced reactor coolant flow accident, there must be at 

least 95% probability at the 95% confidence level (the 95/95 DNB 

criterion) that the hot fuel rod in the core does not experience a 

departure from nucleate boiling (DNB) condition,

c. During an ejected rod accident, the energy deposition to the fuel 

must not exceed 280 cal/gm (Ref. 2), and

d. The control rods must be capable of shutting down the reactor with a 

minimum required SDM with the highest worth control rod stuck fully 

withdrawn (Ref. 3).

Limits on FQ(Z) ensure that the value of the initial total peaking factor 

assumed in the accident analyses remains valid. Other criteria must also 

be met (e.g., maximum cladding oxidation, maximum hydrogen 

generation, coolable geometry, and long term cooling). However, the 

peak cladding temperature is typically most limiting.

FQ(Z) limits assumed in the LOCA analysis are typically limiting relative to 

(i.e., lower than) the FQ(Z) assumed in safety analyses for other 

postulated accidents. Therefore, this LCO provides conservative limits for 

other postulated accidents.

FQ(Z) satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The Heat Flux Hot Channel Factor FQ(Z) shall be limited by the following 

relationships:

FQ(Z) ≤ ( CFQ / P) K(Z) for P > 0.5

FQ(Z) ≤ ( CFQ / 0.5) K(Z) for P ≤ 0.5

where: CFQ is the FQ limit at RTP provided in the COLR,

K(Z) is the normalized FQ(Z) as a function of core height 

provided in the COLR, and

P = THERMAL POWER / RTP
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-3 Rev. 4.0

BASES

LCO (continued)

For this facility, the actual values of CFQ and K(Z) are given in the COLR; 

however, CFQ is normally a number on the order of [2.32], and K(Z) is a 

function that looks like the one provided in Figure B 3.2.1A-1.

The FQ(Z) limits define limiting values for core power peaking that 

precludes peak cladding temperatures above 2200°F during either a large 

or small break LOCA.

This LCO requires operation within the bounds assumed in the safety 

analyses. Calculations are performed in the core design process to 

confirm that the core can be controlled in such a manner during operation 

that it can stay within the LOCA FQ(Z) limits. If FQ(Z) cannot be 

maintained within the LCO limits, reduction of the core power is required.

Violating the LCO limits for FQ(Z) may produce unacceptable 

consequences if a design basis event occurs while FQ(Z) is outside its 

specified limits.

APPLICABILITY The FQ(Z) limits must be maintained while in MODE 1 to prevent core 

power distributions from exceeding the limits assumed in the safety 

analyses. Applicability in other MODES is not required because there is 

insufficient stored energy in the fuel or energy being transferred to the 

reactor coolant to require a limit on the distribution of core power.

ACTIONS A.1

Reducing THERMAL POWER by ≥ 1% for each 1% by which FQ(Z) 

exceeds its limit maintains an acceptable absolute power density. The 

Completion Time of 15 minutes provides an acceptable time to reduce 

power in an orderly manner and without allowing the plant to remain in an 

unacceptable condition for an extended period of time. The maximum 

allowable power level initially determined by Required Action A.1 may be 

affected by subsequent determinations of FQ(Z) and would require power 

reductions within 15 minutes of the FQ(Z) determination, if necessary to 

comply with the decreased maximum allowable power level. Decreases 

in FQ(Z) would allow increasing the maximum allowable power level and 

increasing power up to this revised limit.
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-4 Rev. 4.0

BASES

ACTIONS (continued)

A.2

A reduction of the Power Range Neutron - High trip setpoints by ≥ 1% for 

each 1% by which FQ(Z) exceeds its specified limit, is a conservative 

action for protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient, considering the small likelihood of a severe transient in this 

period, and the preceding prompt reduction in THERMAL POWER in 

accordance with Required Action A.1. The maximum allowable Power 

Range Neutron Flux – High trip setpoints initially determined by Required 

Action A.2 may be affected by subsequent determinations of FQ(Z) and 

would require Power Range Neutron Flux – High trip setpoint reductions 

within 72 hours of the FQ(Z) determination, if necessary to comply with the 

decreased maximum allowable Power Range Neutron Flux – High trip 

setpoints. Decreases in FQ(Z) would allow increasing the maximum 

allowable Power Range Neutron Flux – High trip setpoints.

A.3

Reduction in the Overpower ∆T trip setpoints (value of K4) by ≥ 1% for

each 1% by which FQ(Z) exceeds its limit, is a conservative action for 

protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient considering the small likelihood of a severe transient in this 

period, and the preceding prompt reduction in THERMAL POWER in 

accordance with Required Action A.1. The maximum allowable 

Overpower T trip setpoints initially determined by Required Action A.3 

may be affected by subsequent determinations of FQ(Z) and would 

require Overpower T trip setpoint reductions within 72 hours of the FQ(Z) 

determination, if necessary to comply with the decreased maximum 

allowable Overpower T trip setpoints. Decreases in FQ(Z) would allow 

increasing the maximum allowable Overpower T trip setpoints.

A.4

Verification that FQ(Z) has been restored to within its limit by performing 

SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above 

the limit imposed by Required Action A.1 ensures that core conditions 

during operation at higher power levels and future operation are 

consistent with safety analyses assumptions. 
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-5 Rev. 4.0

BASES

ACTIONS (continued)

Condition A is modified by a Note that requires Required Action A.4 to be 

performed whenever the Condition is entered. This ensures that 

SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing 

THERMAL POWER above the limit of Required Action A.1, even when 

Condition A is exited prior to performing Required Action A.4. 

Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) 

is properly evaluated prior to increasing THERMAL POWER.

B.1

If the Required Actions of A.1 through A.4 cannot be met within their 

associated Completion Times, the plant must be placed in a MODE or 

condition in which the LCO requirements are not applicable. This is done 

by placing the plant in at least MODE 2 within 6 hours.

This allowed Completion Time is reasonable based on operating 

experience regarding the amount of time it takes to reach MODE 2 from 

full power operation in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.2.1.1

REQUIREMENTS

Verification that FQ(Z) is within its limit involves increasing the measured 

values of FQ(Z) to allow for manufacturing tolerance and measurement 

uncertainties and then making a comparison with the limits. These limits 

are provided in the COLR. Specifically, the measured value of the Heat 

Flux Hot Channel Factor 

(F )

M

Q

is increased by 3% to account for fuel 

manufacturing tolerances and by 5% for flux map measurement 

uncertainty for a full core flux map using the moveable incore detector flux 

mapping system. This procedure is equivalent to multiplying the directly 

measured values of FQ(Z) by 1.0815 before comparing with LCO limits 

(Ref. 4).

Performing the Surveillance in MODE 1 prior to THERMAL POWER 

exceeding 75% RTP after each refueling ensures that FQ(Z) is within limit 

when RTP is achieved, because peaking factors generally decrease as 

power level is increased. The surveillance also provides confirmation of 

the nuclear design and the fuel loading pattern.
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency of 31 EFPD is adequate for monitoring the change of 

power distribution with core burnup because the power distribution 

changes relatively slowly for this amount of fuel burnup. The Surveillance 

may be done more frequently if required by the results of SR 3.2.1.2.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.2.1.2

The nuclear design process includes calculations performed to determine 

that the core can be operated within the FQ(Z) limits. Because flux maps 

are taken at steady state conditions, the axial variations in power 

distribution for normal operation maneuvers such as load following are 

not present in the flux map data. These axial variations are, however, 

conservatively calculated by considering, in the nuclear design process, a 

wide range of unit maneuvers in normal operation. Fxy(Z) is the radial 

peaking factor, which is one component of FQ(Z) and should be consistent 

between the nuclear design values and the measured values. (Fxy(Z) 

multiplied by the normalized average axial power at elevation Z gives 

FQ(Z).)

The core plane regions applicable to an Fxy evaluation exclude the 

following, measured in percent of core height:

a. Lower core region, from 0% to 15% inclusive,

b. Upper core region, from 85% to 100% inclusive,

c. Grid plane regions, ± 2% inclusive, and

d. Core plane regions, within ± 2% of the bank demand position of the 

control banks.
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The following terms are used in the Fxy evaluation:

M FXY = The measured value of Fxy obtained directly from the flux 

map results.

C FXY = The measured value, 

M FXY

, multiplied by 1.0815 to account 

for fuel manufacturing tolerances and flux map 

measurement uncertainty (Ref. 2).

RTP FXY = The limit of Fxy at RTP.

L FXY =

RTP FXY

[(1 + PFXY)(1 - P)] (the limit of Fxy at the current 

THERMAL POWER level).

PFXY = The power factor multiplier for Fxy.

P = [ The Fraction of RTP at which Fxy was measured. ]

PR FQ = The predicted value of the Heat Flux Hot Channel Factor. 

The predicted value is a maximum value which includes 

load follow impacts.

RTP FXY

and PFXY are provided in the COLR. 

M FXY

and 

C FXY

are measured 

and calculated at discrete core elevations. Note that Fxy can be rewritten 

as Fxy(Z) to indicate that Fxy varies along the axial height of the core. Flux 

map data are typically taken for 30 to 75 core elevations.

The top and bottom regions of the core are excluded from the Fxy

evaluation because of the difficulty of making precise and meaningful 

measurements in these regions and also because of the low probability 

that these regions would be more limiting than the central 70% of the core 

in the accident analyses.

Grid plane regions and rod tip regions are also excluded because the flux 

data may give spurious values because of the difficulty in lining up flux 

traces accurately in regions of rapidly varying flux. In addition, these 

small portions of the core are reduced in local power density because of 

neutron absorption in the grids and control rods and, therefore, cannot be 

regions of peak linear power. 
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

An evaluation of Fxy(Z) is used to confirm that FQ(Z) is within its limits. If 

C FXY

is <

F ,

RTP

XY

it is concluded that the LCO limit on FQ(Z) is met. This 

result is true for flux maps taken at reduced power because the Fxy(Z) 

value is inherently decreased as THERMAL POWER is increased. The 

feedback from the Doppler coefficient and moderator effects flattens the 

power distribution with increased THERMAL POWER.

The first Note of this Surveillance provides the action to be taken if 

C FXY

is 

>

RTP FXY

In this case, the FQ(Z) limit may be exceeded. Proportionally 

increasing the predicted 

F (Z)

PR

Q

by the amount that 

L FXY

is exceeded gives 

an adjusted FQ(Z), which is compared with the FQ(Z) limit. If the adjusted 

FQ(Z) exceeds the LCO limit, the operator must perform Required 

Actions A.1 through A.5.

The second Note in this Surveillance states that if 

C FXY

is >

RTP FXY

but <

L FXY

then this Surveillance shall be repeated within 24 hours after exceeding 

by ≥ 20% RTP the THERMAL POWER at which 

C FXY

was last determined, 

so as to demonstrate that Fxy(Z) is being sufficiently reduced as power 

increases. This reduction, because of feedback from the Doppler 

coefficient and moderator effects, ensures that when RTP is attained, the 

computed 

F (Z)

C

XY

is <

RTP FXY

.

Performing the Surveillance in MODE 1 prior to exceeding 75% RTP after 

each refueling ensures that the FQ(Z) limit is met when RTP is achieved.

[ The Surveillance Frequency of 31 EFPD is adequate to monitor the 

change of power distribution with core burnup because the power 

distribution changes relatively slowly for this amount of fuel burnup. The 

Surveillance may be done more frequently if required by the results of Fxy

evaluations. Specifically, the Fxy evaluation is required by this 

Surveillance if the evaluation shows that 

RTP FXY

<

C FXY

and to demonstrate 

that the LCO is met after its limit has been exceeded.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50.46.

2. Regulatory Guide 1.77, Rev. [ ].

3. 10 CFR 50.46, GDC 26.

[ 4. WCAP-7308-L-P-A, "Evaluation of Nuclear Hot Channel Factor 

Uncertainties," June 1988. ]
FQ(Z) (CAOC-Fxy Methodology)

B 3.2.1A

Westinghouse STS B 3.2.1A-10 Rev. 4.0
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-1 Rev. 4.0

B 3.2 POWER DISTRIBUTION LIMITS

B 3.2.1B Heat Flux Hot Channel Factor (FQ(Z) (RAOC-W(Z) Methodology)

BASES

BACKGROUND The purpose of the limits on the values of FQ(Z) is to limit the local 

(i.e., pellet) peak power density. The value of FQ(Z) varies along the axial 

height (Z) of the core.

FQ(Z) is defined as the maximum local fuel rod linear power density 

divided by the average fuel rod linear power density, assuming nominal 

fuel pellet and fuel rod dimensions. Therefore, FQ(Z) is a measure of the 

peak fuel pellet power within the reactor core.

During power operation, the global power distribution is limited by 

LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, 

"QUADRANT POWER TILT RATIO(QPTR)," which are directly and 

continuously measured process variables. These LCOs, along with 

LCO 3.1.6, "Control Bank Insertion Limits," maintain the core limits on 

power distributions on a continuous basis.

FQ(Z) varies with fuel loading patterns, control bank insertion, fuel burnup, 

and changes in axial power distribution.

FQ(Z) is measured periodically using the incore detector system. These 

measurements are generally taken with the core at or near equilibrium 

conditions.

Using the measured three dimensional power distributions, it is possible 

to derive a measured value for FQ(Z). However, because this value 

represents an equilibrium condition, it does not include the variations in 

the value of FQ(Z) which are present during nonequilibrium situations 

such as load following or power ascension.

To account for these possible variations, the equilibrium value of FQ(Z) is 

adjusted as 

F (Z)

W

Q

by an elevation dependent factor that accounts for the 

calculated worst case transient conditions.

Core monitoring and control under non-equilibrium conditions are 

accomplished by operating the core within the limits of the appropriate 

LCOs, including the limits on AFD, QPTR, and control rod insertion.
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-2 Rev. 4.0

BASES

APPLICABLE This LCO precludes core power distributions that violate the following

SAFETY fuel design criteria:

ANALYSES

a. During a large break loss of coolant accident (LOCA), the peak 

cladding temperature must not exceed 2200°F (Ref. 1),

b. During a loss of forced reactor coolant flow accident, there must be at 

least 95% probability at the 95% confidence level (the 95/95 DNB 

criterion) that the hot fuel rod in the core does not experience a 

departure from nucleate boiling (DNB) condition,

c. During an ejected rod accident, the energy deposition to the fuel 

must not exceed 280 cal/gm (Ref. 2), and

d. The control rods must be capable of shutting down the reactor with a 

minimum required SDM with the highest worth control rod stuck fully 

withdrawn (Ref. 3).

Limits on FQ(Z) ensure that the value of the initial total peaking factor 

assumed in the accident analyses remains valid. Other criteria must also 

be met (e.g., maximum cladding oxidation, maximum hydrogen 

generation, coolable geometry, and long term cooling). However, the 

peak cladding temperature is typically most limiting.

FQ(Z) limits assumed in the LOCA analysis are typically limiting relative to 

(i.e., lower than) the FQ(Z) limit assumed in safety analyses for other 

postulated accidents. Therefore, this LCO provides conservative limits for 

other postulated accidents

FQ(Z) satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The Heat Flux Hot Channel Factor, FQ(Z), shall be limited by the following 

relationships:

FQ(Z) ≤ (CFQ / P) K(Z) for P > 0.5

FQ(Z) ≤ (CFQ / 0.5) K(Z) for P ≤ 0.5

where: CFQ is the FQ(Z) limit at RTP provided in the COLR,

K(Z) is the normalized FQ(Z) as a function of core height 

provided in the COLR, and

P = THERMAL POWER / RTP
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-3 Rev. 4.0

BASES

LCO (continued)

For this facility, the actual values of CFQ and K(Z) are given in the COLR; 

however, CFQ is normally a number on the order of [2.32], and K(Z) is a 

function that looks like the one provided in Figure B 3.2.1B-1.

For Relaxed Axial Offset Control operation, FQ(Z) is approximated by 

F (Z)

C

Q

and 

F (Z)

W

Q

. Thus, both 

F (Z)

C

Q

and 

F (Z)

W

Q

must meet the preceding 

limits on FQ(Z).

An 

F (Z)

C

Q

evaluation requires obtaining an incore flux map in MODE 1. 

From the incore flux map results we obtain the measured value (

F (Z)

M

Q

) of 

FQ(Z). Then,

F (Z)

C

Q = F (Z)

M

Q

[1.0815]

where [1.0815] is a factor that accounts for fuel manufacturing tolerances 

and flux map measurement uncertainty.

F (Z)

C

Q

is an excellent approximation for FQ(Z) when the reactor is at the 

steady state power at which the incore flux map was taken.

The expression for 

F (Z)

W

Q

is:

F (Z)

W

Q = F (Z)

C

Q

W(Z)

where W(Z) is a cycle dependent function that accounts for power 

distribution transients encountered during normal operation. W(Z) is 

included in the COLR. The

F (Z)

C

Q

is calculated at equilibrium conditions.

The FQ(Z) limits define limiting values for core power peaking that 

precludes peak cladding temperatures above 2200°F during either a large 

or small break LOCA.

This LCO requires operation within the bounds assumed in the safety 

analyses. Calculations are performed in the core design process to 

confirm that the core can be controlled in such a manner during operation 

that it can stay within the LOCA FQ(Z) limits. If 

F (Z)

C

Q

cannot be 

maintained within the LCO limits, reduction of the core power is required 

and if 

F (Z)

W

Q

cannot be maintained within the LCO limits, reduction of the 

AFD limits is required. Note that sufficient reduction of the AFD limits will 

also result in a reduction of the core power.

Violating the LCO limits for FQ(Z) produces unacceptable consequences if 

a design basis event occurs while FQ(Z) is outside its specified limits.
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-4 Rev. 4.0

BASES

APPLICABILITY The FQ(Z) limits must be maintained in MODE 1 to prevent core power 

distributions from exceeding the limits assumed in the safety analyses. 

Applicability in other MODES is not required because there is either 

insufficient stored energy in the fuel or insufficient energy being 

transferred to the reactor coolant to require a limit on the distribution of 

core power.

ACTIONS A.1

Reducing THERMAL POWER by ≥ 1% RTP for each 1% by which 

F (Z)

C

Q

exceeds its limit, maintains an acceptable absolute power density. 

F (Z)

C

Q

is 

F (Z)

M

Q

multiplied by a factor accounting for manufacturing tolerances 

and measurement uncertainties. 

F (Z)

M

Q

is the measured value of FQ(Z). 

The Completion Time of 15 minutes provides an acceptable time to 

reduce power in an orderly manner and without allowing the plant to 

remain in an unacceptable condition for an extended period of time. The 

maximum allowable power level initially determined by Required Action 

A.1 may be affected by subsequent determinations of 

F (Z)

C

Q

and would 

require power reductions within 15 minutes of the 

F (Z)

C

Q

determination, if 

necessary to comply with the decreased maximum allowable power level. 

Decreases in 

F (Z)

C

Q

would allow increasing the maximum allowable 

power level and increasing power up to this revised limit.

A.2

A reduction of the Power Range Neutron Flux - High trip setpoints by 

≥ 1% for each 1% by which 

F (Z)

C

Q

exceeds its limit, is a conservative 

action for protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient considering the small likelihood of a severe transient in this time 

period and the preceding prompt reduction in THERMAL POWER in 

accordance with Required Action A.1. The maximum allowable Power 

Range Neutron Flux - High trip setpoints initially determined by Required 

Action A.2 may be affected by subsequent determinations of 

F (Z)

C

Q

and 

would require Power Range Neutron Flux - High trip setpoint reductions 

within 72 hours of the 

F (Z)

C

Q

determination, if necessary to comply with 

the decreased maximum allowable Power Range Neutron Flux - High trip 

setpoints. Decreases in 

F (Z)

C

Q

would allow increasing the maximum 

allowable Power Range Neutron Flux - High trip setpoints.
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-5 Rev. 4.0

BASES

ACTIONS (continued)

A.3

Reduction in the Overpower ∆T trip setpoints (value of K4) by ≥ 1% for 

each 1% by which 

F (Z)

C

Q

exceeds its limit, is a conservative action for 

protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient considering the small likelihood of a severe transient in this time 

period, and the preceding prompt reduction in THERMAL POWER in 

accordance with Required Action A.1. The maximum allowable 

Overpower ∆T trip setpoints initially determined by Required Action A.3 

may be affected by subsequent determinations of 

F (Z)

C

Q

and would 

require Overpower ∆T trip setpoint reductions within 72 hours of the 

F (Z)

C

Q

determination, if necessary to comply with the decreased maximum 

allowable Overpower ∆T trip setpoints. Decreases in 

F (Z)

C

Q

would allow 

increasing the maximum allowable Overpower ∆T trip setpoints.

A.4

Verification that 

F (Z)

C

Q

has been restored to within its limit, by performing 

SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above 

the limit imposed by Required Action A.1, ensures that core conditions 

during operation at higher power levels and future operation are 

consistent with safety analyses assumptions.

Condition A is modified by a Note that requires Required Action A.4 to be 

performed whenever the Condition is entered. This ensures that 

SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing 

THERMAL POWER above the limit of Required Action A.1, even when 

Condition A is exited prior to performing Required Action A.4. 

Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) 

is properly evaluated prior to increasing THERMAL POWER.

B.1

If it is found that the maximum calculated value of FQ(Z) that can occur 

during normal maneuvers, 

F (Z)

W

Q

, exceeds its specified limits, there exists 

a potential for 

F (Z)

C

Q

to become excessively high if a normal operational 

transient occurs. Reducing the AFD by ≥ 1% for each 1% by which 

F (Z)

W

Q

exceeds its limit within the allowed Completion Time of 4 hours, 

restricts the axial flux distribution such that even if a transient occurred, 

core peaking factors are not exceeded.
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-6 Rev. 4.0

BASES

ACTIONS (continued)

The implicit assumption is that if W(Z) values were recalculated 

(consistent with the reduced AFD limits), then 

F (Z)

C

Q

times the 

recalculated W(Z) values would meet the FQ(Z) limit. Note that complying 

with this action (of reducing AFD limits) may also result in a power 

reduction. Hence the need for Required Actions B.2, B.3 and B.4.

B.2

A reduction of the Power Range Neutron Flux-High trip setpoints by ≥ 1% 

for each 1% by which the maximum allowable power is reduced, is a 

conservative action for protection against the consequences of severe 

transients with unanalyzed power distributions. The Completion Time of 

72 hours is sufficient considering the small likelihood of a severe transient 

in this time period and the preceding prompt reduction in THERMAL 

POWER as a result of reducing AFD limits in accordance with Required 

Action B.1.

B.3

Reduction in the Overpower ∆T trip setpoints value of K4 by ≥ 1% for each 

1% by which the maximum allowable power is reduced, is a conservative 

action for protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient considering the small likelihood of a severe transient in this time 

period, and the preceding prompt reduction in THERMAL POWER as a 

result of reducing AFD limits in accordance with Required Action B.1.

B.4

Verification that 

F (Z)

W

Q

has been restored to within its limit, by performing 

SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above 

the maximum allowable power limit imposed by Required Action B.1 

ensures that core conditions during operation at higher power levels and 

future operation are consistent with safety analyses assumptions.

Condition B is modified by a Note that requires Required Action B.4 to be 

performed whenever the Condition is entered. This ensures that 

SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing 

THERMAL POWER above the limit of Required Action B.1, even when 

Condition A is exited prior to performing Required Action B.4. 

Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) 

is properly evaluated prior to increasing THERMAL POWER.
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-7 Rev. 4.0

BASES

ACTIONS (continued)

C.1

If Required Actions A.1 through A.4 or B.1 through B.4 are not met within 

their associated Completion Times, the plant must be placed in a mode or 

condition in which the LCO requirements are not applicable. This is done 

by placing the plant in at least MODE 2 within 6 hours.

This allowed Completion Time is reasonable based on operating 

experience regarding the amount of time it takes to reach MODE 2 from 

full power operation in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.2.1.1 and SR 3.2.1.2 are modified by a Note. The Note applies

REQUIREMENTS during the first power ascension after a refueling. It states that

THERMAL POWER may be increased until an equilibrium power level 

has been achieved at which a power distribution map can be obtained. 

This allowance is modified, however, by one of the Frequency conditions 

that requires verification that 

F (Z)

C

Q

and 

F (Z)

W

Q

are within their specified 

limits after a power rise of more than 10% RTP over the THERMAL 

POWER at which they were last verified to be within specified limits. 

Because 

F (Z)

C

Q

and 

F (Z)

W

Q

could not have previously been measured in 

this reload core, there is a second Frequency condition, applicable only 

for reload cores, that requires determination of these parameters before 

exceeding 75% RTP. This ensures that some determination of 

F (Z)

C

Q

and 

F (Z)

W

Q

are made at a lower power level at which adequate margin is 

available before going to 100% RTP. Also, this Frequency condition, 

together with the Frequency condition requiring verification of 

F (Z)

C

Q

and 

F (Z)

W

Q

following a power increase of more than 10%, ensures that they 

are verified as soon as RTP (or any other level for extended operation) is 

achieved. In the absence of these Frequency conditions, it is possible to 

increase power to RTP and operate for 31 days without verification of 

F (Z)

C

Q

and 

F (Z)

W

Q

. The Frequency condition is not intended to require 

verification of these parameters after every 10% increase in power level 

above the last verification. It only requires verification after a power level 

is achieved for extended operation that is 10% higher than that power at 

which FQ(Z) was last measured.
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.2.1.1

Verification that 

F (Z)

C

Q

is within its specified limits involves 

increasing

F (Z)

M

Q

to allow for manufacturing tolerance and measurement 

uncertainties in order to obtain 

F (Z)

C

Q

. Specifically, 

F (Z)

M

Q

is the 

measured value of FQ(Z) obtained from incore flux map results and 

F (Z)

C

Q

= 

F (Z)

M

Q

[1.0815] (Ref. 4). 

F (Z)

C

Q

is then compared to its specified 

limits.

The limit with which 

F (Z)

C

Q

is compared varies inversely with power above 

50% RTP and directly with a function called K(Z) provided in the COLR.

Performing this Surveillance in MODE 1 prior to exceeding 75% RTP 

ensures that the 

F (Z)

C

Q

limit is met when RTP is achieved, because 

peaking factors generally decrease as power level is increased.

If THERMAL POWER has been increased by ≥ 10% RTP since the last 

determination of 

F (Z)

C

Q

, another evaluation of this factor is required 

[12] hours after achieving equilibrium conditions at this higher power level 

(to ensure that 

F (Z)

C

Q

values are being reduced sufficiently with power 

increase to stay within the LCO limits).

[ The Frequency of 31 EFPD is adequate to monitor the change of power 

distribution with core burnup because such changes are slow and well 

controlled when the plant is operated in accordance with the Technical 

Specifications (TS).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.2.1.2

The nuclear design process includes calculations performed to determine 

that the core can be operated within the FQ(Z) limits. Because flux maps 

are taken in steady state conditions, the variations in power distribution 

resulting from normal operational maneuvers are not present in the flux 

map data. These variations are, however, conservatively calculated by 

considering a wide range of unit maneuvers in normal operation. The 

maximum peaking factor increase over steady state values, calculated as 

a function of core elevation, Z, is called W(Z). Multiplying the measured 

total peaking factor, 

F (Z)

C

Q

, by W(Z) gives the maximum FQ(Z) calculated 

to occur in normal operation, 

F (Z)

W

Q

.

The limit with which 

F (Z)

W

Q

is compared varies inversely with power above 

50% RTP and directly with the function K(Z) provided in the COLR.

The W(Z) curve is provided in the COLR for discrete core elevations. 

Flux map data are typically taken for 30 to 75 core elevations. 

F (Z)

W

Q

evaluations are not applicable for the following axial core regions, 

measured in percent of core height:

a. Lower core region, from 0 to 15% inclusive and

b. Upper core region, from 85 to 100% inclusive.

The top and bottom 15% of the core are excluded from the evaluation 

because of the low probability that these regions would be more limiting in 

the safety analyses and because of the difficulty of making a precise 

measurement in these regions.

This Surveillance has been modified by a Note that may require that more 

frequent surveillances be performed. If 

F (Z)

W

Q

is evaluated, an evaluation 

of the expression below is required to account for any increase to 

F (Z)

M

Q

that may occur and cause the FQ(Z) limit to be exceeded before the next 

required FQ(Z) evaluation.

If the two most recent FQ(Z) evaluations show an increase in the 

expression maximum over z [

F (Z)

C

Q

/ K(Z) ], it is required to meet the 

FQ(Z) limit with the last 

F (Z)

W

Q

increased by the greater of a factor of 

[1.02] or by an appropriate factor specified in the COLR (Ref. 5)
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

WCAP-10216-P-A, Rev. 1A, "Relaxation of Constant Axial Offset Control 

and FQ Surveillance Technical Specification," February 1994, or other 

appropriate plant specific methodology, is to be listed in the COLR 

description in the Administrative Controls Section 5.0 to address the 

methodology used to derive this factor.

--------------------------------------------------------------------------------------------------

or to evaluate FQ(Z) more frequently, each 7 EFPD. These alternative 

requirements prevent FQ(Z) from exceeding its limit for any significant 

period of time without detection.

Performing the Surveillance in MODE 1 prior to exceeding 75% RTP 

ensures that the FQ(Z) limit is met when RTP is achieved, because 

peaking factors are generally decreased as power level is increased.

FQ(Z) is verified at power levels ≥ 10% RTP above the THERMAL 

POWER of its last verification, [12] hours after achieving equilibrium 

conditions to ensure that FQ(Z) is within its limit at higher power levels.

[ The Surveillance Frequency of 31 EFPD is adequate to monitor the 

change of power distribution with core burnup. The Surveillance may be 

done more frequently if required by the results of FQ(Z) evaluations.

 The Frequency of 31 EFPD is adequate to monitor the change of power 

distribution because such a change is sufficiently slow, when the plant is 

operated in accordance with the TS, to preclude adverse peaking factors 

between 31 day surveillances.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-11 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50.46, 1974.

2. Regulatory Guide 1.77, Rev. 0, May 1974.

3. 10 CFR 50, Appendix A, GDC 26.

4. WCAP-7308-L-P-A, "Evaluation of Nuclear Hot Channel Factor 

Uncertainties," June 1988.

5. WCAP-10216-P-A, Rev. 1A, "Relaxation of Constant Axial Offset 

Control (and) FQ Surveillance Technical Specification," February 

1994.
FQ(Z) (RAOC-W(Z) Methodology)

B 3.2.1B

Westinghouse STS B 3.2.1B-12 Rev. 4.0
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-1 Rev. 4.0

B 3.2 POWER DISTRIBUTION LIMITS

B 3.2.1C Heat Flux Hot Channel Factor (FQ(Z) (CAOC-W(Z) Methodology)

BASES

BACKGROUND The purpose of the limits on the values of FQ(Z) is to limit the local 

(i.e., pellet) peak power density. The value of FQ(Z) varies along the axial 

height (Z) of the core.

FQ(Z) is defined as the maximum local fuel rod linear power density 

divided by the average fuel rod linear power density, assuming nominal 

fuel pellet and fuel rod dimensions. Therefore, FQ(Z) is a measure of the 

peak fuel pellet power within the reactor core.

During power operation, the global power distribution is limited by 

LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and LCO 3.2.4, 

"QUADRANT POWER TILT RATIO (QPTR)," which are directly and 

continuously measured process variables. These LCOs, along with 

LCO 3.1.6, "Control Bank Insertion Limits," maintain the core limits on 

power distributions on a continuous basis.

FQ(Z) varies with fuel loading patterns, control bank insertion, fuel burnup, 

and changes in axial power distribution.

FQ(Z) is measured periodically using the incore detector system. These 

measurements are generally taken with the core at or near equilibrium 

conditions.

Using the measured three dimensional power distributions, it is possible 

to derive a measured value for FQ(Z). However, because this value 

represents a equilibrium condition, it does not include the variations in the 

value of FQ(Z) which are present during nonequilibrium situations such as 

load following or power ascension.

To account for these possible variations, the equilibrium value of FQ(Z) is 

adjusted as 

F (Z)

W

Q

by an elevation dependent factor that accounts for the 

calculated worst case transient conditions.

Core monitoring and control under non-equilibrium conditions are 

accomplished by operating the core within the limits of the appropriate 

LCOs, including the limits on AFD, QPTR, and control rod insertion.
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-2 Rev. 4.0

BASES

APPLICABLE This LCO precludes core power distributions that violate the following

SAFETY fuel design criteria:

ANALYSES

a. During a large break loss of coolant accident (LOCA), the peak 

cladding temperature must not exceed 2200°F (Ref. 1),

b. During a loss of forced reactor coolant flow accident, there must be at 

least 95% probability at the 95% confidence level (the 95/95 DNB 

criterion) that the hot fuel rod in the core does not experience a 

departure from nucleate boiling (DNB) condition,

c. During an ejected rod accident, the energy deposition to the fuel 

must not exceed 280 cal/gm (Ref. 2), and

d. The control rods must be capable of shutting down the reactor with a 

minimum required SDM with the highest worth control rod stuck fully 

withdrawn (Ref. 3).

Limits on FQ(Z) ensure that the value of the initial total peaking factor 

assumed in the accident analyses remains valid. Other criteria must also 

be met (e.g., maximum cladding oxidation, maximum hydrogen 

generation, coolable geometry, and long term cooling). However, the 

peak cladding temperature is typically most limiting.

FQ(Z) limits assumed in the LOCA analysis are typically limiting relative to 

(i.e., lower than) the FQ(Z) limit assumed in safety analyses for other 

postulated accidents. Therefore, this LCO provides conservative limits for 

other postulated accidents.

FQ(Z) satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The Heat Flux Hot Channel Factor, FQ(Z), shall be limited by the following 

relationships:

FQ(Z) ≤ ( CFQ/P ) K(Z) for P > 0.5

FQ(Z) ≤ ( CFQ/0.5 ) K(Z) for P ≤ 0.5

where: CFQ is the FQ(Z) limit at RTP provided in the COLR,

K(Z) is the normalized FQ(Z) as a function of core height 

provided in the COLR, and

P = THERMAL POWER/RTP
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-3 Rev. 4.0

BASES

LCO (continued)

For this facility, the actual values of CFQ and K(Z) are given in the COLR; 

however, CFQ is normally a number on the order of [2.32], and K(Z) is a 

function that looks like the one provided in Figure B 3.2.1C-1.

For Constant Axial Offset Control operation, FQ(Z) is approximated by 

F (Z)

C

Q

and 

F (Z)

W

Q

. Thus, both 

F (Z)

C

Q

and 

F (Z)

W

Q

must meet the preceding 

limits on FQ(Z).

An 

F (Z)

C

Q

evaluation requires obtaining an incore flux map in MODE 1. 

From the incore flux map results we obtain the measured value (

F (Z)

M

Q

) of 

FQ(Z). Then,

F (Z)

C

Q = F (Z)

M

Q

[1.0815]

where [1.0815] is a factor that accounts for fuel manufacturing tolerances 

and flux map measurement uncertainty.

F (Z)

C

Q

is an excellent approximation for FQ(Z) when the reactor is at the 

steady state power at which the incore flux map was taken.

The expression for 

F (Z)

W

Q

is:

F (Z)

W

Q = F (Z)

C

Q

W(Z)

where W(Z) is a cycle dependent function that accounts for power 

distribution transients encountered during normal operation. W(Z) is 

included in the COLR. The 

F (Z)

C

Q

is calculated at equilibrium conditions.

The FQ(Z) limits define limiting values for core power peaking that 

precludes peak cladding temperatures above 2200°F during either a large 

or small break LOCA.

This LCO requires operation within the bounds assumed in the safety 

analyses. Calculations are performed in the core design process to 

confirm that the core can be controlled in such a manner during operation 

that it can stay within the LOCA FQ(Z) limits. If 

F (Z)

C

Q

cannot be 

maintained within the LCO limits, reduction of the core power is required.

Violating the LCO limits for FQ(Z) produces unacceptable consequences if 

a design basis event occurs while FQ(Z) is outside its specified limits.
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-4 Rev. 4.0

BASES

APPLICABILITY The FQ(Z) limits must be maintained in MODE 1 to prevent core power 

distributions from exceeding the limits assumed in the safety analyses. 

Applicability in other MODES is not required because there is either 

insufficient stored energy in the fuel or insufficient energy being 

transferred to the reactor coolant to require a limit on the distribution of 

core power.

ACTIONS A.1

Reducing THERMAL POWER by ≥ 1% RTP for each 1% by which 

F (Z)

C

Q

exceeds its limit, maintains an acceptable absolute power density. 

F (Z)

C

Q

is 

F (Z)

M

Q

multiplied by a factor accounting for manufacturing tolerances 

and measurement uncertainties. 

F (Z)

M

Q

is the measured value of FQ(Z). 

The Completion Time of 15 minutes provides an acceptable time to 

reduce power in an orderly manner and without allowing the plant to 

remain in an unacceptable condition for an extended period of time. The 

maximum allowable power level initially determined by Required Action 

A.1 may be affected by subsequent determinations of 

F (Z)

C

Q

and would 

require power reductions within 15 minutes of the 

F (Z)

C

Q

determination, if 

necessary to comply with the decreased maximum allowable power level. 

Decreases in 

F (Z)

C

Q

would allow increasing the maximum allowable 

power level and increasing power up to this revised limit.

A.2

A reduction of the Power Range Neutron Flux - High trip setpoints by 

≥ 1% for each 1% by which 

F (Z)

C

Q

exceeds its limit, is a conservative 

action for protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient considering the small likelihood of a severe transient in this time 

period and the preceding prompt reduction in THERMAL POWER in 

accordance with Required Action A.1. The maximum allowable Power 

Range Neutron Flux – High trip setpoints initially determined by Required 

Action A.2 may be affected by subsequent determinations of 

F (Z)

C

Q

and 

would require Power Range Neutron Flux – High trip setpoint reductions 

within 72 hours of the 

F (Z)

C

Q

determination, if necessary to comply with 

the decreased maximum allowable Power Range Neutron Flux – High trip 

setpoints. Decreases in 

F (Z)

C

Q

would allow increasing the maximum 

allowable Power Range Neutron Flux – High trip setpoints.
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-5 Rev. 4.0

BASES

ACTIONS (continued)

A.3

Reduction in the Overpower ∆T trip setpoints (value of K4) by ≥ 1% for 

each 1% by which 

F (Z)

C

Q

exceeds its limit, is a conservative action for 

protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient considering the small likelihood of a severe transient in this time 

period, and the preceding prompt reduction in THERMAL POWER in 

accordance with Required Action A.1. The maximum allowable 

Overpower T trip setpoints initially determined by Required Action A.3 

may be affected by subsequent determinations of 

F (Z)

C

Q

and would 

require Overpower T trip setpoint reductions within 72 hours of the 

F (Z)

C

Q

determination, if necessary to comply with the decreased maximum 

allowable Overpower T trip setpoints. Decreases in 

F (Z)

C

Q

would allow 

increasing the maximum Overpower T trip setpoints. 

A.4

Verification that 

F (Z)

C

Q

has been restored to within its limit, by performing 

SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above 

the limit imposed by Required Action A.1, ensures that core conditions 

during operation at higher power levels and future operation are 

consistent with safety analyses assumptions.

Condition A is modified by a Note that requires Required Action A.4 to be 

performed whenever the Condition is entered. This ensures that 

SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing 

THERMAL POWER above the limit of Required Action A.1, even when 

Condition A is exited prior to performing Required Action A.4. 

Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) 

is properly evaluated prior to increasing THERMAL POWER.

B.1

If it is found that the maximum calculated value of FQ(Z) that can occur 

during normal maneuvers, 

F (Z)

W

Q

, exceeds its specified limits, there exists 

a potential for 

F (Z)

C

Q

to become excessively high if a normal operational 
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-6 Rev. 4.0

BASES

ACTIONS (continued)

transient occurs. Reducing the THERMAL POWER by ≥ 1% RTP for 

each 1% by which 

F (Z)

W

Q

exceeds its limit within the allowed Completion 

Time of 4 hours, maintains an acceptable absolute power density such 

that even if a transient occurred, core peaking factors are not exceeded.

B.2

A reduction of the Power Range Neutron Flux-High trip setpoints by ≥ 1% 

for each 1% by which 

F (Z)

W

Q

exceeds its limit, is a conservative action for 

protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient considering the small likelihood of a severe transient in this time 

period and the preceding prompt reduction in THERMAL POWER in 

accordance with Required Action B.1.

B.3

Reduction in the Overpower ∆T trip setpoints value of K4 by ≥ 1% for each 

1% by which 

F (Z)

W

Q

exceeds its limit, is a conservative action for 

protection against the consequences of severe transients with 

unanalyzed power distributions. The Completion Time of 72 hours is 

sufficient considering the small likelihood of a severe transient in this time 

period, and the preceding prompt reduction in THERMAL POWER in 

accordance with Required Action B.1.

B.4

Verification that 

F (Z)

W

Q

has been restored to within its limit, by performing 

SR 3.2.1.1 and SR 3.2.1.2 prior to increasing THERMAL POWER above 

the limit imposed by Required Action B.1 ensures that core conditions 

during operation at higher power levels and future operation are 

consistent with safety analyses assumptions.

Condition B is modified by a Note that requires Required Action B.4 to be 

performed whenever the Condition is entered. This ensures that 

SR 3.2.1.1 and SR 3.2.1.2 will be performed prior to increasing 

THERMAL POWER above the limit of Required Action B.1, even when 

Condition A is exited prior to performing Required Action B.4. 

Performance of SR 3.2.1.1 and SR 3.2.1.2 are necessary to assure FQ(Z) 

is properly evaluated prior to increasing THERMAL POWER.
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-7 Rev. 4.0

BASES

ACTIONS (continued)

C.1

If Required Actions A.1 through A.4 or B.1 through B.4 are not met within 

their associated Completion Times, the plant must be placed in a mode or 

condition in which the LCO requirements are not applicable. This is done 

by placing the plant in at least MODE 2 within 6 hours.

This allowed Completion Time is reasonable based on operating 

experience regarding the amount of time it takes to reach MODE 2 from 

full power operation in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.2.1.1 and SR 3.2.1.2 are modified by a Note. The Note applies

REQUIREMENTS during the first power ascension after a refueling. It states that

THERMAL POWER may be increased until an equilibrium power level 

has been achieved at which a power distribution map can be obtained. 

This allowance is modified, however, by one of the Frequency conditions 

that requires verification that

F (Z)

C

Q

and 

F (Z)

W

Q

are within their specified 

limits after a power rise of more than 10% RTP over the THERMAL 

POWER at which they were last verified to be within specified limits. 

Because 

F (Z)

C

Q

and 

F (Z)

W

Q

could not have previously been measured in 

this reload core, there is a second Frequency condition, applicable only 

for reload cores, that requires determination of these parameters before 

exceeding 75% RTP. This ensures that some determination of 

F (Z)

C

Q

and 

F (Z)

W

Q

are made at a lower power level at which adequate margin is 

available before going to 100% RTP. Also, this Frequency condition, 

together with the Frequency condition requiring verification of 

F (Z)

C

Q

and 

F (Z)

W

Q

following a power increase of more than 10%, ensures that they 

are verified as soon as RTP (or any other level for extended operation) is 

achieved. In the absence of these Frequency conditions, it is possible to 

increase power to RTP and operate for 31 days without verification of 

F (Z)

C

Q

and 

F (Z)

W

Q

. The Frequency condition is not intended to require 

verification of these parameters after every 10% increase in power level 

above the last verification. It only requires verification after a power level 

is achieved for extended operation that is 10% higher than that power at 

which FQ(Z) was last measured.
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.2.1.1

Verification that 

F (Z)

C

Q

is within its specified limits involves increasing 

F (Z)

M

Q

to allow for manufacturing tolerance and measurement 

uncertainties in order to obtain 

F (Z)

C

Q

. Specifically,

F (Z)

M

Q

is the 

measured value of FQ(Z) obtained from incore flux map results and 

F (Z)

C

Q = F (Z)

M

Q

[1.0815] (Ref. 4). 

F (Z)

C

Q

is then compared to its specified 

limits.

The limit with which 

F (Z)

C

Q

is compared varies inversely with power above 

50% RTP and directly with a function called K(Z) provided in the COLR.

Performing this Surveillance in MODE 1 prior to exceeding 75% RTP 

ensures that the 

F (Z)

C

Q

limit is met when RTP is achieved, because 

peaking factors generally decrease as power level is increased.

If THERMAL POWER has been increased by ≥ 10% RTP since the last 

determination of 

F (Z)

C

Q

, another evaluation of this factor is required 

[12] hours after achieving equilibrium conditions at this higher power level 

(to ensure that 

F (Z)

C

Q

values are being reduced sufficiently with power 

increase to stay within the LCO limits).

[ The Frequency of 31 EFPD is adequate to monitor the change of power 

distribution with core burnup because such changes are slow and well 

controlled when the plant is operated in accordance with the Technical 

Specifications (TS).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.2.1.2

The nuclear design process includes calculations performed to determine 

that the core can be operated within the FQ(Z) limits. Because flux maps 

are taken in steady state conditions, the variations in power distribution 

resulting from normal operational maneuvers are not present in the flux 

map data. These variations are, however, conservatively calculated by 

considering a wide range of unit maneuvers in normal operation. The 

maximum peaking factor increase over steady state values, calculated as 

a function of core elevation, Z, is called W(Z). Multiplying the measured 

total peaking factor, 

F (Z)

C

Q

, by W(Z) gives the maximum FQ(Z) calculated 

to occur in normal operation, 

F (Z)

W

Q

.

The limit with which 

F (Z)

W

Q

is compared varies inversely with power above 

50% RTP and directly with the function K(Z) provided in the COLR.

The W(Z) curve is provided in the COLR for discrete core elevations. 

Flux map data are typically taken for 30 to 75 core elevations. 

F (Z)

W

Q

evaluations are not applicable for the following axial core regions, 

measured in percent of core height:

a. Lower core region, from 0 to 15% inclusive and

b. Upper core region, from 85 to 100% inclusive.

The top and bottom 15% of the core are excluded from the evaluation 

because of the low probability that these regions would be more limiting in 

the safety analyses and because of the difficulty of making a precise 

measurement in these regions. 

This Surveillance has been modified by a Note that may require that more 

frequent surveillances be performed. If 

F (Z)

W

Q

is evaluated, an evaluation 

of the expression below is required to account for any increase to 

F (Z)

M

Q

that may occur and cause the FQ(Z) limit to be exceeded before the next 

required FQ(Z) evaluation.

If the two most recent FQ(Z) evaluations show an increase in the 

expression

maximum over z [

F (Z)

C

Q

/K(Z) ],

it is required to meet the FQ(Z) limit with the last 

F (Z)

W

Q

increased by the 

greater of a factor of [1.02] or by an appropriate factor specified in the 

COLR (Ref. 5)
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

WCAP-10216-P-A, Rev. 1A, Relaxation of Constant Axial Offset Control 

and FQ Surveillance Technical Specification, February 1994, or other 

appropriate plant specific methodology, is to be listed in the COLR 

description in the Administrative Controls Section 5.0 to address the 

methodology used to derive this factor.

--------------------------------------------------------------------------------------------------

or to evaluate FQ(Z) more frequently, each 7 EFPD. These alternative 

requirements prevent FQ(Z) from exceeding its limit for any significant 

period of time without detection.

Performing the Surveillance in MODE 1 prior to exceeding 75% RTP 

ensures that the FQ(Z) limit is met when RTP is achieved, because 

peaking factors are generally decreased as power level is increased.

FQ(Z) is verified at power levels ≥ 10% RTP above the THERMAL 

POWER of its last verification, [12] hours after achieving equilibrium 

conditions to ensure that FQ(Z) is within its limit at higher power levels.

[ The Surveillance Frequency of 31 EFPD is adequate to monitor the 

change of power distribution with core burnup. The Surveillance may be 

done more frequently if required by the results of FQ(Z) evaluations.

 The Frequency of 31 EFPD is adequate to monitor the change of power 

distribution because such a change is sufficiently slow, when the plant is 

operated in accordance with the TS, to preclude adverse peaking factors 

between 31 day surveillances.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-11 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50.46, 1974.

2. Regulatory Guide 1.77, Rev. 0, May 1974.

3. 10 CFR 50, Appendix A, GDC 26.

4. WCAP-7308-L-P-A, "Evaluation of Nuclear Hot Channel Factor 

Uncertainties," June 1988.

5. WCAP-10216-P-A, Rev. 1A, "Relaxation of Constant Axial Offset 

Control (and) FQ Surveillance Technical Specification," 

February 1994.
FQ(Z) (CAOC-W(Z) Methodology)

B 3.2.1C

Westinghouse STS B 3.2.1C-12 Rev. 4.0
H

N

F

B 3.2.2 

Westinghouse STS B 3.2.2-1 Rev. 4.0

B 3.2 POWER DISTRIBUTION LIMITS

B 3.2.2 Nuclear Enthalpy Rise Hot Channel Factor (

H

N

F

)

BASES

BACKGROUND The purpose of this LCO is to establish limits on the power density at any 

point in the core so that the fuel design criteria are not exceeded and the 

accident analysis assumptions remain valid. The design limits on local 

(pellet) and integrated fuel rod peak power density are expressed in terms 

of hot channel factors. Control of the core power distribution with respect 

to these factors ensures that local conditions in the fuel rods and coolant 

channels do not challenge core integrity at any location during either 

normal operation or a postulated accident analyzed in the safety 

analyses.

H

N

F

is defined as the ratio of the integral of the linear power along the fuel 

rod with the highest integrated power to the average integrated fuel rod 

power. Therefore, 

H

N

F

is a measure of the maximum total power 

produced in a fuel rod.

H

N

F

is sensitive to fuel loading patterns, bank insertion, and fuel burnup. 

H

N

F

typically increases with control bank insertion and typically decreases 

with fuel burnup.

H

N

F

is not directly measurable but is inferred from a power distribution 

map obtained with the movable incore detector system. Specifically, the 

results of the three dimensional power distribution map are analyzed by a 

computer to determine 

H

N

F

. This factor is calculated at least every 

31 EFPD. However, during power operation, the global power distribution 

is monitored by LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)," and 

LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)," which address 

directly and continuously measured process variables.

The COLR provides peaking factor limits that ensure that the design basis 

value of the departure from nucleate boiling (DNB) is met for normal 

operation, operational transients, and any transient condition arising from 

events of moderate frequency. The DNB design basis precludes DNB 

and is met by limiting the minimum local DNB heat flux ratio to [1.3] using 

the [W3] CHF correlation. All DNB limited transient events are assumed 

to begin with an 

H

N

F

value that satisfies the LCO requirements.

Operation outside the LCO limits may produce unacceptable 

consequences if a DNB limiting event occurs. The DNB design basis 

ensures that there is no overheating of the fuel that results in possible 

cladding perforation with the release of fission products to the reactor 

coolant.
H

N

F

B 3.2.2 

Westinghouse STS B 3.2.2-2 Rev. 4.0

BASES

APPLICABLE Limits on 

H

N

F

preclude core power distributions that exceed the following

SAFETY fuel design limits:

ANALYSES

a. There must be at least 95% probability at the 95% confidence level 

(the 95/95 DNB criterion) that the hottest fuel rod in the core does not 

experience a DNB condition,

b. During a large break loss of coolant accident (LOCA), peak cladding 

temperature (PCT) must not exceed 2200°F,

c. During an ejected rod accident, the energy deposition to the fuel 

must not exceed 280 cal/gm [Ref. 1], and

d. Fuel design limits required by GDC 26 (Ref. 2) for the condition when 

control rods must be capable of shutting down the reactor with a 

minimum required SDM with the highest worth control rod stuck fully 

withdrawn.

For transients that may be DNB limited, the Reactor Coolant System flow 

and 

H

N

F

are the core parameters of most importance. The limits on 

H

N

F

ensure that the DNB design basis is met for normal operation, operational 

transients, and any transients arising from events of moderate frequency. 

The DNB design basis is met by limiting the minimum DNBR to the 

95/95 DNB criterion of [1.3] using the [W3] CHF correlation. This value 

provides a high degree of assurance that the hottest fuel rod in the core 

does not experience a DNB.

The allowable 

H

N

F

limit increases with decreasing power level. This

functionality in 

H

N

F

is included in the analyses that provide the Reactor 

Core Safety Limits (SLs) of SL 2.1.1. Therefore, any DNB events in 

which the calculation of the core limits is modeled implicitly use this 

variable value of 

H

N

F

in the analyses. Likewise, all transients that may be 

DNB limited are assumed to begin with an initial 

H

N

F

as a function of 

power level defined by the COLR limit equation.

The LOCA safety analysis indirectly models 

H

N

F

as an input parameter. 

The Nuclear Heat Flux Hot Channel Factor (FQ(Z)) and the axial peaking 

factors are inserted directly into the LOCA safety analyses that verify the 

acceptability of the resulting peak cladding temperature [Ref. 3].

The fuel is protected in part by Technical Specifications, which ensure 

that the initial conditions assumed in the safety and accident analyses 

remain valid. The following LCOs ensure this: LCO 3.2.3, "AXIAL FLUX 

DIFFERENCE (AFD)," LCO 3.2.4, "QUADRANT POWER TILT RATIO
H

N

F

B 3.2.2 

Westinghouse STS B 3.2.2-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

(QPTR)," LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.2, "Nuclear 

Enthalpy Rise Hot Channel Factor 

(F H )

N



," and LCO 3.2.1, "Heat Flux Hot 

Channel Factor (FQ(Z))."

H

N

F

and FQ(Z) are measured periodically using the movable incore 

detector system. Measurements are generally taken with the core at, or 

near, steady state conditions. Core monitoring and control under 

transient conditions (Condition 1 events) are accomplished by operating 

the core within the limits of the LCOs on AFD, QPTR, and Bank Insertion 

Limits.

H

N

F

satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO

H

N

F

shall be maintained within the limits of the relationship provided in 

the COLR.

The 

H

N

F

limit identifies the coolant flow channel with the maximum 

enthalpy rise. This channel has the least heat removal capability and 

thus the highest probability for a DNB.

The limiting value of 

H

N

F

, described by the equation contained in the 

COLR, is the design radial peaking factor used in the unit safety 

analyses.

A power multiplication factor in this equation includes an additional

margin for higher radial peaking from reduced thermal feedback and 

greater control rod insertion at low power levels. The limiting value of is 

H

N

F

allowed to increase 0.3% for every 1% RTP reduction in THERMAL 

POWER.

APPLICABILITY The 

H

N

F

limits must be maintained in MODE 1 to preclude core power 

distributions from exceeding the fuel design limits for DNBR and PCT. 

Applicability in other modes is not required because there is either 

insufficient stored energy in the fuel or insufficient energy being 

transferred to the coolant to require a limit on the distribution of core 

power. Specifically, the design bases events that are sensitive to 

H

N

F

in 

other modes (MODES 2 through 5) have significant margin to DNB, and 

therefore, there is no need to restrict 

H

N

F

in these modes.
H

N

F

B 3.2.2 

Westinghouse STS B 3.2.2-4 Rev. 4.0

BASES

ACTIONS A.1.1

With 

H

N

F

exceeding its limit, the unit is allowed 4 hours to restore

H

N

F

to 

within its limits. This restoration may, for example, involve realigning any 

misaligned rods or reducing power enough to bring 

H

N

F

within its power 

dependent limit. When the 

H

N

F

limit is exceeded, the DNBR limit is not 

likely violated in steady state operation, because events that could 

significantly perturb the 

H

N

F

value (e.g., static control rod misalignment) 

are considered in the safety analyses. However, the DNBR limit may be 

violated if a DNB limiting event occurs. Thus, the allowed Completion 

Time of 4 hours provides an acceptable time to restore 

H

N

F

to within its 

limits without allowing the plant to remain in an unacceptable condition for 

an extended period of time.

Condition A is modified by a Note that requires that Required Actions A.2 

and A.3 must be completed whenever Condition A is entered. Thus, if 

power is not reduced because this Required Action is completed within 

the 4 hour time period, Required Action A.2 nevertheless requires another 

measurement and calculation of 

H

N

F

within 24 hours in accordance with 

SR 3.2.2.1.

However, if power is reduced below 50% RTP, Required Action A.3 

requires that another determination of 

H

N

F

must be done prior to 

exceeding 50% RTP, prior to exceeding 75% RTP, and within 24 hours 

after reaching or exceeding 95% RTP. In addition, Required Action A.2 is 

performed if power ascension is delayed past 24 hours.

A.1.2.1 and A.1.2.2

If the value of 

H

N

F

is not restored to within its specified limit either by 

adjusting a misaligned rod or by reducing THERMAL POWER, the 

alternative option is to reduce THERMAL POWER to < 50% RTP in 

accordance with Required Action A.1.2.1 and reduce the Power Range 

Neutron Flux - High to ≤ 55% RTP in accordance with Required 

Action A.1.2.2. Reducing RTP to < 50% RTP increases the DNB margin 

and does not likely cause the DNBR limit to be violated in steady state 

operation. The reduction in trip setpoints ensures that continuing 

operation remains at an acceptable low power level with adequate DNBR 

margin. The allowed Completion Time of 4 hours for Required 

Action A.1.2.1 is consistent with those allowed for in Required 

Action A.1.1 and provides an acceptable time to reach the required power 

level from full power operation without allowing the plant to remain in an 

unacceptable condition for an extended period of time. The Completion 

Times of 4 hours for Required Actions A.1.1 and A.1.2.1 are not additive.
H

N

F

B 3.2.2 

Westinghouse STS B 3.2.2-5 Rev. 4.0

BASES

ACTIONS (continued)

The allowed Completion Time of 72 hours to reset the trip setpoints per 

Required Action A.1.2.2 recognizes that, once power is reduced, the 

safety analysis assumptions are satisfied and there is no urgent need to 

reduce the trip setpoints. This is a sensitive operation that may 

inadvertently trip the Reactor Protection System.

A.2

Once the power level has been reduced to < 50% RTP per Required 

Action A.1.2.1, an incore flux map (SR 3.2.2.1) must be obtained and the 

measured value of 

H

N

F

verified not to exceed the allowed limit at the 

lower power level. The unit is provided 20 additional hours to perform this 

task over and above the 4 hours allowed by either Action A.1.1 or 

Action A.1.2.1. The Completion Time of 24 hours is acceptable because 

of the increase in the DNB margin, which is obtained at lower power 

levels, and the low probability of having a DNB limiting event within this 

24 hour period. Additionally, operating experience has indicated that this 

Completion Time is sufficient to obtain the incore flux map, perform the 

required calculations, and evaluate 

H

N

F .

A.3

Verification that 

H

N

F

is within its specified limits after an out of limit 

occurrence ensures that the cause that led to the 

H

N

F

exceeding its limit 

is corrected, and that subsequent operation proceeds within the LCO 

limit. This Action demonstrates that the 

H

N

F

limit is within the LCO limits 

prior to exceeding 50% RTP, again prior to exceeding 75% RTP, and 

within 24 hours after THERMAL POWER is ≥ 95% RTP.

This Required Action is modified by a Note that states that THERMAL 

POWER does not have to be reduced prior to performing this Action.

B.1

When Required Actions A.1.1 through A.3 cannot be completed within 

their required Completion Times, the plant must be placed in a mode in 

which the LCO requirements are not applicable. This is done by placing 

the plant in at least MODE 2 within 6 hours. The allowed Completion 

Time of 6 hours is reasonable, based on operating experience regarding 

the time required to reach MODE 2 from full power conditions in an 

orderly manner and without challenging plant systems.
H

N

F

B 3.2.2 

Westinghouse STS B 3.2.2-6 Rev. 4.0

BASES

SURVEILLANCE SR 3.2.2.1

REQUIREMENTS

The value of 

H

N

F

is determined by using the movable incore detector 

system to obtain a flux distribution map. A data reduction computer 

program then calculates the maximum value of 

H

N

F

from the measured 

flux distributions. The measured value of 

H

N

F

must be multiplied by 1.04 

to account for measurement uncertainty before making comparisons to 

the 

H

N

F

limit.

After each refueling, 

H

N

F

must be determined in MODE 1 prior to 

exceeding 75% RTP. This requirement ensures that 

H

N

F

limits are met at 

the beginning of each fuel cycle.

[ The 31 EFPD Frequency is acceptable because the power distribution 

changes relatively slowly over this amount of fuel burnup. Accordingly, 

this Frequency is short enough that the 

H

N

F

limit cannot be exceeded for 

any significant period of operation.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. Regulatory Guide 1.77, Rev. [0], May 1974.

2. 10 CFR 50, Appendix A, GDC 26.

3. 10 CFR 50.46.
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-1 Rev. 4.0

B 3.2 POWER DISTRIBUTION LIMITS

B 3.2.3A AXIAL FLUX DIFFERENCE (AFD) (Constant Axial Offset Control (CAOC)

 Methodology)

BASES

BACKGROUND The purpose of this LCO is to establish limits on the values of the AFD in 

order to limit the axial power distribution skewing to either the top or 

bottom of the core. By limiting the amount of power distribution skewing, 

core peaking factors are consistent with the assumptions used in the 

safety analyses. Limiting power distribution skewing over time also 

minimizes the xenon distribution skewing, which is a significant factor in 

axial power distribution control.

The operating scheme used to control the axial power distribution, CAOC, 

involves maintaining the AFD within a tolerance band around a burnup 

dependent target, known as the target flux difference, to minimize the 

variation of the axial peaking factor and axial xenon distribution during 

unit maneuvers.

The target flux difference is determined at equilibrium xenon conditions. 

The control banks must be positioned within the core in accordance with 

their insertion limits and Control Bank D should be inserted near its 

normal position (i.e., ≥ 210 steps withdrawn) for steady state operation at 

high power levels. The power level should be as near RTP as practical. 

The value of the target flux difference obtained under these conditions 

divided by the Fraction of RTP is the target flux difference at RTP for the 

associated core burnup conditions. Target flux differences for other 

THERMAL POWER levels are obtained by multiplying the RTP value by 

the appropriate fractional THERMAL POWER level.

The AFD is monitored on an automatic basis using the unit process 

computer that has an AFD monitor alarm. The frequency of monitoring 

the AFD by the computer is once per minute providing an essentially 

continuous accumulation of penalty deviation time that allows the 

operator to assess the status of the penalty deviation time. The computer 

determines the 1 minute average of each of the OPERABLE excore 

detector outputs and provides an alarm message immediately if the AFDs 

for two or more OPERABLE excore channels are outside the target band 

and the THERMAL POWER is > 90% RTP. During operation at 

THERMAL POWER levels < 90% RTP but > 15% RTP, the computer 

sends an alarm message when the cumulative penalty deviation time is 

> 1 hour in the previous 24 hours.
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-2 Rev. 4.0

BASES

BACKGROUND (continued)

Periodic updating of the target flux difference value is necessary to follow 

the change of the flux difference at steady state conditions with burnup.

The Nuclear Enthalpy Rise Hot Channel Factor (F

N

H) and QPTR LCOs 

limit the radial component of the peaking factors.

APPLICABLE The AFD is a measure of axial power distribution skewing to the top or

SAFETY bottom half of the core. The AFD is sensitive to many core related

ANALYSES parameters such as control bank positions, core power level, axial 

burnup, axial xenon distribution and, to a lesser extent, reactor coolant 

temperature and boron concentrations. The allowed range of the AFD is 

used in the nuclear design process to confirm that operation within these 

limits produces core peaking factors and axial power distributions that 

meet safety analysis requirements.

The CAOC methodology (Refs. 1, 2, and 3) entails:

a. Establishing an envelope of allowed power shapes and power 

densities,

b. Devising an operating strategy for the cycle that maximizes unit 

flexibility (maneuvering) and minimizes axial power shape changes,

c. Demonstrating that this strategy does not result in core conditions 

that violate the envelope of permissible core power characteristics, 

and

d. Demonstrating that this power distribution control scheme can be 

effectively supervised with excore detectors.

The limits on the AFD ensure that the Heat Flux Hot Channel Factor 

(FQ(Z)) is not exceeded during either normal operation or in the event of 

xenon redistribution following power changes. The limits on the AFD also 

limit the range of power distributions that are assumed as initial conditions 

in analyzing Condition 2, 3, and 4 events. This ensures that fuel cladding 

integrity is maintained for these postulated accidents. The most important 

Condition 4 event is the loss of coolant accident. The most significant 

Condition 3 event is the loss of flow accident. The most significant 

Condition 2 events are uncontrolled bank withdrawal and boration or 

dilution accidents. Condition 2 accidents, assumed to begin from within 

the AFD limits, are used to confirm the adequacy of Overpower ∆T and 

Overtemperature ∆T trip setpoints.

The limits on the AFD satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-3 Rev. 4.0

BASES

LCO The shape of the power profile in the axial (i.e., the vertical) direction is 

largely under the control of the operator, through either the manual 

operation of the control banks, or automatic motion of control banks 

responding to temperature deviations resulting from either manual 

operation of the Chemical and Volume Control System to change boron 

concentration, or from power level changes.

Signals are available to the operator from the Nuclear Instrumentation 

System (NIS) excore neutron detectors (Ref. 4). Separate signals are 

taken from the top and bottom detectors. The AFD is defined as the 

difference in normalized flux signals between the top and bottom excore 

detector in each detector well. For convenience, this flux difference is 

converted to provide flux difference units expressed as a percentage and 

labeled as %∆ flux or %∆I.

The required target band varies with axial burnup distribution, which in 

turn varies with the core average accumulated burnup. The target band 

defined in the COLR may provide one target band for the entire cycle or 

more than one band, each to be followed for a specific range of cycle 

burnup. With THERMAL POWER ≥ 90% RTP, the AFD must be kept 

within the target band. With the AFD outside the target band with 

THERMAL POWER ≥ 90% RTP, the assumptions of the accident 

analyses may be violated.

Violating the LCO on the AFD could produce unacceptable consequences 

if a Condition 2, 3, or 4 event occurs while the AFD is outside its limits.

Figure B 3.2.3A-1 shows a typical target band and typical AFD acceptable 

operation limits.

The LCO is modified by four Notes. Note 1 states the conditions 

necessary for declaring the AFD outside of the target band. Notes 2 and 

3 describe how the cumulative penalty deviation time is calculated. It is 

intended that the unit is operated with the AFD within the target band 

about the target flux difference. However, during rapid THERMAL 

POWER reductions, control bank motion may cause the AFD to deviate 

outside of the target band at reduced THERMAL POWER levels. This 

deviation does not affect the xenon distribution sufficiently to change the 

envelope of peaking factors that may be reached on a subsequent return 

to RTP with the AFD within the target band, provided the time duration of 

the deviation is limited. Accordingly, while THERMAL POWER is 

≥ 50% RTP and < 90% RTP (i.e., Part b of this LCO), a 1 hour cumulative 

penalty deviation time limit, cumulative during the preceding 24 hours, is 
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-4 Rev. 4.0

BASES

LCO (continued)

allowed during which the unit may be operated outside of the target band 

but within the acceptable operation limits provided in the COLR (Note 2). 

This penalty time is accumulated at the rate of 1 minute for each 1 minute 

of operating time within the power range of Part b of this LCO (i.e., 

THERMAL POWER ≥ 50% RTP). The cumulative penalty time is the sum 

of penalty times from Parts b and c of this LCO.

For THERMAL POWER levels > 15% RTP and < 50% RTP (i.e., Part c of 

this LCO), deviations of the AFD outside of the target band are less 

significant. Note 3 allows the accumulation of 1/2 minute penalty 

deviation time per 1 minute of actual time outside the target band and 

reflects this reduced significance. With THERMAL POWER < 15% RTP, 

AFD is not a significant parameter in the assumptions used in the safety 

analysis and, therefore, requires no limits. Because the xenon 

distribution produced at THERMAL POWER levels less than RTP does 

affect the power distribution as power is increased, unanalyzed xenon 

and power distribution is prevented by limiting the accumulated penalty 

deviation time.

For surveillance of the power range channels performed according to 

SR 3.3.1.6, Note 4 allows deviation outside the target band for 16 hours 

and no penalty deviation time accumulated. Some deviation in the AFD is 

required for doing the NIS calibration with the incore detector system. 

This calibration is performed every 92 days

APPLICABILITY AFD requirements are applicable in MODE 1 above 15% RTP. Above 

50% RTP, the combination of THERMAL POWER and core peaking 

factors are the core parameters of primary importance in safety analyses 

(Ref. 1).

Between 15% RTP and 90% RTP, this LCO is applicable to ensure that 

the distributions of xenon are consistent with safety analysis assumptions.

At or below 15% RTP and for lower operating MODES, the stored energy 

in the fuel and the energy being transferred to the reactor coolant are low. 

The value of the AFD in these conditions does not affect the 

consequences of the design basis events.

Low signal levels in the excore channels may preclude obtaining valid 

AFD signals below 15% RTP.
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-5 Rev. 4.0

BASES

ACTIONS A.1

With the AFD outside the target band and THERMAL POWER 

≥ 90% RTP, the assumptions used in the accident analyses may be 

violated with respect to the maximum heat generation. Therefore, a 

Completion Time of 15 minutes is allowed to restore the AFD to within the 

target band because xenon distributions change little in this relatively 

short time.

B.1

If the AFD cannot be restored within the target band, then reducing 

THERMAL POWER to < 90% RTP places the core in a condition that has 

been analyzed and found to be acceptable, provided that the AFD is 

within the acceptable operation limits provided in the COLR.

The allowed Completion Time of 15 minutes provides an acceptable time 

to reduce power to < 90% RTP without allowing the plant to remain in an 

unanalyzed condition for an extended period of time.

C.1

With THERMAL POWER < 90% RTP but ≥ 50% RTP, operation with the 

AFD outside the target band is allowed for up to 1 hour if the AFD is 

within the acceptable operation limits provided in the COLR. With the 

AFD within these limits, the resulting axial power distribution is acceptable 

as an initial condition for accident analyses assuming the then existing 

xenon distributions. The 1 hour cumulative penalty deviation time 

restricts the extent of xenon redistribution. Without this limitation, 

unanalyzed xenon axial distributions may result from a different pattern of 

xenon buildup and decay. The reduction to a power level < 50% RTP 

puts the reactor at a THERMAL POWER level at which the AFD is not a 

significant accident analysis parameter.

If the indicated AFD is outside the target band and outside the acceptable 

operation limits provided in the COLR, the peaking factors assumed in 

accident analysis may be exceeded with the existing xenon condition. 

(Any AFD within the target band is acceptable regardless of its 

relationship to the acceptable operation limits.) The Completion Time of 

30 minutes allows for a prompt, yet orderly, reduction in power.

Condition C is modified by a Note that requires that Required Actions C.1 

and C.2 must be completed whenever this Condition is entered.
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-6 Rev. 4.0

BASES

ACTIONS (continued)

D.1

If Required Action C.1 is not completed within its required Completion 

Time of 30 minutes, the axial xenon distribution starts to become 

significantly skewed with the THERMAL POWER ≥ 50% RTP. In this 

situation, the assumption that a cumulative penalty deviation time of 

1 hour or less during the previous 24 hours while the AFD is outside its 

target band is acceptable at < 50% RTP, is no longer valid.

Reducing the power level to < 15% RTP within the Completion Time of 

9 hours and complying with LCO penalty deviation time requirements for 

subsequent increases in THERMAL POWER ensure that acceptable 

xenon conditions are restored.

This Required Action must also be implemented either if the cumulative 

penalty deviation time is > 1 hour during the previous 24 hours, or the 

AFD is not within the target band and not within the acceptable operation 

limits.

SURVEILLANCE SR 3.2.3.1

REQUIREMENTS

This Surveillance verifies that the AFD as indicated by the NIS excore 

channels is within the target band. [ The Surveillance Frequency of 

7 days is adequate because the AFD is controlled by the operator and 

monitored by the process computer. Furthermore, any deviations of the 

AFD from the target band that is not alarmed should be readily noticed.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The AFD should be monitored and logged more frequently in periods of 

operation for which the power level or control bank positions are changing 

to allow corrective measures when the AFD is more likely to move outside 

the target band.
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.2.3.2

[ This Surveillance requires that the target flux difference is updated at a 

Frequency of 31 effective full power days (EFPD) to account for small 

changes that may occur in the target flux differences in that period due to 

burnup by performing SR 3.2.3.3.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

Alternatively, linear interpolation between the most recent measurement 

of the target flux differences and a predicted end of cycle value provides a 

reasonable update because the AFD changes due to burnup tend toward 

0% AFD. When the predicted end of cycle AFD from the cycle nuclear 

design is different from 0%, it may be a better value for the interpolation.

SR 3.2.3.3

Measurement of the target flux difference is accomplished by taking a flux 

map when the core is at equilibrium xenon conditions, preferably at high 

power levels with the control banks nearly withdrawn. This flux map 

provides the equilibrium xenon axial power distribution from which the 

target value can be determined. The target flux difference varies slowly 

with core burnup.

[ A Frequency of 31 EFPD after each refueling and 92 EFPD thereafter for 

remeasuring the target flux differences adjusts the target flux difference 

for each excore channel to the value measured at steady state conditions. 

This is the basis for the CAOC. Remeasurement at this Surveillance 

interval also establishes the AFD target flux difference values that 

account for changes in incore excore calibrations that may have occurred 

in the interim.
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

A Note modifies this SR to allow the predicted end of cycle AFD from the 

cycle nuclear design to be used to determine the initial target flux 

difference after each refueling.

REFERENCES 1. WCAP-8403 (nonproprietary), "Power Distribution Control and Load 

Following Procedures," Westinghouse Electric Corporation,

September 1974.

2. T. M. Anderson to K. Kniel (Chief of Core Performance Branch, 

NRC), Attachment: "Operation and Safety Analysis Aspects of an 

Improved Load Follow Package," January 31, 1980.

3. C. Eicheldinger to D. B. Vassallo (Chief of Light Water Reactors 

Branch, NRC), Letter NS-CE-687, July 16, 1975.

4. FSAR, Chapter [15].
AFD (CAOC Methodology)

B 3.2.3A

Westinghouse STS B 3.2.3A-9 Rev. 4.0

AFD (RAOC Methodology)

B 3.2.3B

Westinghouse STS B 3.2.3B-1 Rev. 4.0

B 3.2 POWER DISTRIBUTION LIMITS

B 3.2.3B AXIAL FLUX DIFFERENCE (AFD) (Relaxed Axial Offset Control (RAOC

 Methodology)

BASES

BACKGROUND The purpose of this LCO is to establish limits on the values of the AFD in 

order to limit the amount of axial power distribution skewing to either the 

top or bottom of the core. By limiting the amount of power distribution 

skewing, core peaking factors are consistent with the assumptions used 

in the safety analyses. Limiting power distribution skewing over time also 

minimizes the xenon distribution skewing, which is a significant factor in 

axial power distribution control.

RAOC is a calculational procedure that defines the allowed operational 

space of the AFD versus THERMAL POWER. The AFD limits are 

selected by considering a range of axial xenon distributions that may 

occur as a result of large variations of the AFD. Subsequently, power 

peaking factors and power distributions are examined to ensure that the 

loss of coolant accident (LOCA), loss of flow accident, and anticipated 

transient limits are met. Violation of the AFD limits invalidate the 

conclusions of the accident and transient analyses with regard to fuel 

cladding integrity.

The AFD is monitored on an automatic basis using the unit process 

computer, which has an AFD monitor alarm. The computer determines 

the 1 minute average of each of the OPERABLE excore detector outputs 

and provides an alarm message immediately if the AFD for two or more 

OPERABLE excore channels is outside its specified limits.

Although the RAOC defines limits that must be met to satisfy safety 

analyses, typically an operating scheme, Constant Axial Offset Control 

(CAOC), is used to control axial power distribution in day to day operation 

(Ref. 1). CAOC requires that the AFD be controlled within a narrow 

tolerance band around a burnup dependent target to minimize the 

variation of axial peaking factors and axial xenon distribution during unit 

maneuvers.

The CAOC operating space is typically smaller and lies within the RAOC 

operating space. Control within the CAOC operating space constrains 

the variation of axial xenon distributions and axial power distributions. 

RAOC calculations assume a wide range of xenon distributions and then 

confirm that the resulting power distributions satisfy the requirements of 

the accident analyses.
AFD (RAOC Methodology)

B 3.2.3B

Westinghouse STS B 3.2.3B-2 Rev. 4.0

BASES

APPLICABLE The AFD is a measure of the axial power distribution skewing to either the

SAFETY top or bottom half of the core. The AFD is sensitive to many core related

ANALYSES parameters such as control bank positions, core power level, axial 

burnup, axial xenon distribution, and, to a lesser extent, reactor coolant 

temperature and boron concentration.

The allowed range of the AFD is used in the nuclear design process to 

confirm that operation within these limits produces core peaking factors 

and axial power distributions that meet safety analysis requirements.

The RAOC methodology (Ref. 2) establishes a xenon distribution library 

with tentatively wide AFD limits. One dimensional axial power distribution 

calculations are then performed to demonstrate that normal operation 

power shapes are acceptable for the LOCA and loss of flow accident, and 

for initial conditions of anticipated transients. The tentative limits are 

adjusted as necessary to meet the safety analysis requirements.

The limits on the AFD ensure that the Heat Flux Hot Channel Factor 

(FQ(Z)) is not exceeded during either normal operation or in the event of 

xenon redistribution following power changes. The limits on the AFD also 

restrict the range of power distributions that are used as initial conditions 

in the analyses of Condition 2, 3, or 4 events. This ensures that the fuel 

cladding integrity is maintained for these postulated accidents. The most 

important Condition 4 event is the LOCA. The most important Condition 3 

event is the loss of flow accident. The most important Condition 2 events 

are uncontrolled bank withdrawal and boration or dilution accidents. 

Condition 2 accidents simulated to begin from within the AFD limits are 

used to confirm the adequacy of the Overpower ∆T and Overtemperature 

∆T trip setpoints.

The limits on the AFD satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The shape of the power profile in the axial (i.e., the vertical) direction is 

largely under the control of the operator through the manual operation of 

the control banks or automatic motion of control banks. The automatic 

motion of the control banks is in response to temperature deviations 

resulting from manual operation of the Chemical and Volume Control 

System to change boron concentration or from power level changes.

Signals are available to the operator from the Nuclear Instrumentation 

System (NIS) excore neutron detectors (Ref. 3). Separate signals are 

taken from the top and bottom detectors. The AFD is defined as the 

difference in normalized flux signals between the top and bottom excore 

detectors in each detector well. For convenience, this flux difference is 

converted to provide flux difference units expressed as a percentage and 

labeled as %∆ flux or %∆I.
AFD (RAOC Methodology)

B 3.2.3B

Westinghouse STS B 3.2.3B-3 Rev. 4.0

BASES

LCO (continued)

The AFD limits are provided in the COLR. Figure B 3.2.3B-1 shows 

typical RAOC AFD limits. The AFD limits for RAOC do not depend on the 

target flux difference. However, the target flux difference may be used to 

minimize changes in the axial power distribution.

Violating this LCO on the AFD could produce unacceptable 

consequences if a Condition 2, 3, or 4 event occurs while the AFD is 

outside its specified limits.

APPLICABILITY The AFD requirements are applicable in MODE 1 greater than or equal to 

50% RTP when the combination of THERMAL POWER and core peaking 

factors are of primary importance in safety analysis.

For AFD limits developed using RAOC methodology, the value of the 

AFD does not affect the limiting accident consequences with THERMAL 

POWER < 50% RTP and for lower operating power MODES.

ACTIONS A.1

As an alternative to restoring the AFD to within its specified limits, 

Required Action A.1 requires a THERMAL POWER reduction to 

< 50% RTP. This places the core in a condition for which the value of the 

AFD is not important in the applicable safety analyses. A Completion 

Time of 30 minutes is reasonable, based on operating experience, to 

reach 50% RTP without challenging plant systems.

SURVEILLANCE SR 3.2.3.1

REQUIREMENTS

This Surveillance verifies that the AFD, as indicated by the NIS excore 

channel, is within its specified limits. [ The Surveillance Frequency of 

7 days is adequate considering that the AFD is monitored by a computer 

and any deviation from requirements is alarmed.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
AFD (RAOC Methodology)

B 3.2.3B

Westinghouse STS B 3.2.3B-4 Rev. 4.0

BASES

REFERENCES 1. WCAP-8403 (nonproprietary), "Power Distribution Control and Load 

Following Procedures," Westinghouse Electric Corporation, 

September 1974.

2. R. W. Miller et al., "Relaxation of Constant Axial Offset Control: FQ

Surveillance Technical Specification," WCAP-10217(NP), June 1983.

3. FSAR, Chapter [15].
AFD (RAOC Methodology)

B 3.2.3B

Westinghouse STS B 3.2.3B-5 Rev. 4.0

QPTR

B 3.2.4

Westinghouse STS B 3.2.4-1 Rev. 4.0

B 3.2 POWER DISTRIBUTION LIMITS

B 3.2.4 QUADRANT POWER TILT RATIO (QPTR)

BASES

BACKGROUND The QPTR limit ensures that the gross radial power distribution remains 

consistent with the design values used in the safety analyses. Precise 

radial power distribution measurements are made during startup testing, 

after refueling, and periodically during power operation.

The power density at any point in the core must be limited so that the fuel 

design criteria are maintained. Together, LCO 3.2.3, "AXIAL FLUX 

DIFFERENCE (AFD)," LCO 3.2.4, and LCO 3.1.6, "Control Rod Insertion 

Limits," provide limits on process variables that characterize and control 

the three dimensional power distribution of the reactor core. Control of 

these variables ensures that the core operates within the fuel design 

criteria and that the power distribution remains within the bounds used in 

the safety analyses.

APPLICABLE This LCO precludes core power distributions that violate the following fuel 

SAFETY design criteria:

ANALYSES

a. During a large break loss of coolant accident, the peak cladding 

temperature must not exceed 2200°F (Ref. 1),

b. During a loss of forced reactor coolant flow accident, there must be at 

least 95% probability at the 95% confidence level (the 95/95 

departure from nucleate boiling (DNB) criterion) that the hot fuel rod 

in the core does not experience a DNB condition,

c. During an ejected rod accident, the energy deposition to the fuel 

must not exceed 280 cal/gm (Ref. 2), and

d. The control rods must be capable of shutting down the reactor with a 

minimum required SDM with the highest worth control rod stuck fully 

withdrawn (Ref. 3).

The LCO limits on the AFD, the QPTR, the Heat Flux Hot Channel Factor 

(FQ(Z)), the Nuclear Enthalpy Rise Hot Channel Factor 

(F H )

N



, and control 

bank insertion are established to preclude core power distributions that 

exceed the safety analyses limits.

The QPTR limits ensure that 

H

N

F

and FQ(Z) remain below their limiting 

values by preventing an undetected change in the gross radial power 

distribution.
QPTR

B 3.2.4

Westinghouse STS B 3.2.4-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

In MODE 1, the 

H

N

F

and FQ(Z) limits must be maintained to preclude core 

power distributions from exceeding design limits assumed in the safety 

analyses.

The QPTR satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The QPTR limit of 1.02, at which corrective action is required, provides a 

margin of protection for both the DNB ratio and linear heat generation rate 

contributing to excessive power peaks resulting from X-Y plane power 

tilts. A limiting QPTR of 1.02 can be tolerated before the margin for 

uncertainty in FQ(Z) and 

(F H )

N



is possibly challenged.

APPLICABILITY The QPTR limit must be maintained in MODE 1 with THERMAL POWER 

> 50% RTP to prevent core power distributions from exceeding the design 

limits.

Applicability in MODE 1 ≤ 50% RTP and in other MODES is not required 

because there is either insufficient stored energy in the fuel or insufficient 

energy being transferred to the reactor coolant to require the 

implementation of a QPTR limit on the distribution of core power. The 

QPTR limit in these conditions is, therefore, not important. Note that the 

H

N

F

and FQ(Z) LCOs still apply, but allow progressively higher peaking 

factors at 50% RTP or lower.

ACTIONS A.1

With the QPTR exceeding its limit, a power level reduction of 3% RTP for 

each 1% by which the QPTR exceeds 1.00 is a conservative tradeoff of 

total core power with peak linear power. The Completion Time of 2 hours 

allows sufficient time to identify the cause and correct the tilt. Note that 

the power reduction itself may cause a change in the tilted condition.

The maximum allowable power level initially determined by Required 

Action A.1 may be affected by subsequent determinations of QPTR. 

Increases in QPTR would require power reduction within 2 hours of 

QPTR determination, if necessary to comply with the decreased 

maximum allowable power level. Decreases in QPTR would allow 

increasing the maximum allowable power level and increasing power up 

to this revised limit.
QPTR

B 3.2.4

Westinghouse STS B 3.2.4-3 Rev. 4.0

BASES

ACTIONS (continued)

A.2

After completion of Required Action A.1, the QPTR alarm may still be in 

its alarmed state. As such, any additional changes in the QPTR are 

detected by requiring a check of the QPTR once per 12 hours thereafter. 

A 12 hour Completion Time is sufficient because any additional change in 

QPTR would be relatively slow.

A.3

The peaking factors FQ(Z), as approximated by 

F (Z)

C

Q

and 

F (Z)

W

Q

, and 

H

N

F

are of primary importance in ensuring that the power distribution 

remains consistent with the initial conditions used in the safety analyses. 

Performing SRs on 

H

N

F

and FQ(Z) within the Completion Time of 

24 hours after achieving equilibrium conditions from a Thermal Power 

reduction per Required Action A.1 ensures that these primary indicators 

of power distribution are within their respective limits. Equilibrium 

conditions are achieved when the core is sufficiently stable at intended 

operating conditions to support flux mapping. A Completion Time of 

24 hours after achieving equilibrium conditions from Thermal Power 

reduction per Required Action A.1 takes into consideration the rate at 

which peaking factors are likely to change, and the time required to 

stabilize the plant and perform a flux map. If these peaking factors are 

not within their limits, the Required Actions of these Surveillances provide 

an appropriate response for the abnormal condition. If the QPTR remains 

above its specified limit, the peaking factor surveillances are required 

each 7 days thereafter to evaluate 

H

N

F

and FQ(Z) with changes in power 

distribution. Relatively small changes are expected due to either burnup 

and xenon redistribution or correction of the cause for exceeding the 

QPTR limit.

A.4

Although 

H

N

F

and FQ(Z) are of primary importance as initial conditions in 

the safety analyses, other changes in the power distribution may occur as 

the QPTR limit is exceeded and may have an impact on the validity of the 

safety analysis. A change in the power distribution can affect such 

reactor parameters as bank worths and peaking factors for rod 
QPTR

B 3.2.4

Westinghouse STS B 3.2.4-4 Rev. 4.0

BASES

ACTIONS (continued)

malfunction accidents. When the QPTR exceeds its limit, it does not 

necessarily mean a safety concern exists. It does mean that there is an 

indication of a change in the gross radial power distribution that requires 

an investigation and evaluation that is accomplished by examining the 

incore power distribution. Specifically, the core peaking factors and the 

quadrant tilt must be evaluated because they are the factors that best 

characterize the core power distribution. This re-evaluation is required to 

ensure that, before increasing THERMAL POWER to above the limit of 

Required Action A.1, the reactor core conditions are consistent with the 

assumptions in the safety analyses.

A.5

If the QPTR has exceeded the 1.02 limit and a re-evaluation of the safety 

analysis is completed and shows that safety requirements are met, the 

excore detectors are normalized to restore QPTR to within limits prior to 

increasing THERMAL POWER to above the limit of Required Action A.1. 

Normalization is accomplished in such a manner that the indicated QPTR 

following normalization is near 1.00. This is done to detect any 

subsequent significant changes in QPTR.

Required Action A.5 is modified by two Notes. Note 1 states that the 

QPTR is not restored to within limits until after the re-evaluation of the 

safety analysis has determined that core conditions at RTP are within the 

safety analysis assumptions (i.e., Required Action A.4). Note 2 states 

that if Required Action A.5 is performed, then Required Action A.6 shall 

be performed. Required Action A.5 normalizes the excore detectors to 

restore QPTR to within limits, which restores compliance with LCO 3.2.4. 

Thus, Note 2 prevents exiting the Actions prior to completing flux mapping 

to verify peaking factors, per Required Action A.6. These Notes are 

intended to prevent any ambiguity about the required sequence of

actions.

A.6

Once the flux tilt is restored to within limits (i.e., Required Action A.5 is 

performed), it is acceptable to return to full power operation. However, as 

an added check that the core power distribution is consistent with the 

safety analysis assumptions, Required Action A.6 requires verification
QPTR

B 3.2.4

Westinghouse STS B 3.2.4-5 Rev. 4.0

BASES

ACTIONS (continued)

that FQ(Z), as approximated by 

F (Z)

C

Q

and 

F (Z)

W

Q

, and 

H

N

F

are within their 

specified limits within 24 hours of achieving equilibrium conditions at RTP. 

As an added precaution, if the core power does not reach equilibrium 

conditions at RTP within 24 hours, but is increased slowly, then the 

peaking factor surveillances must be performed within 48 hours after 

increasing THERMAL POWER above the limit of Required Action A.1. 

These Completion Times are intended to allow adequate time to increase 

THERMAL POWER to above the limit of Required Action A.1, while not 

permitting the core to remain with unconfirmed power distributions for 

extended periods of time.

Required Action A.6 is modified by a Note that states that the peaking 

factor surveillances may only be done after the excore detectors have 

been normalized to restore QPTR to within limits (i.e., Required 

Action A.5). The intent of this Note is to have the peaking factor 

surveillances performed at operating power levels, which can only be 

accomplished after the excore detectors are normalized to restore QPTR 

to within limits and the core returned to power.

B.1

If Required Actions A.1 through A.6 are not completed within their 

associated Completion Times, the unit must be brought to a MODE or 

condition in which the requirements do not apply. To achieve this status, 

THERMAL POWER must be reduced to < 50% RTP within 4 hours. The 

allowed Completion Time of 4 hours is reasonable, based on operating 

experience regarding the amount of time required to reach the reduced 

power level without challenging plant systems.

SURVEILLANCE SR 3.2.4.1

REQUIREMENTS

SR 3.2.4.1 is modified by two Notes. Note 1 allows QPTR to be 

calculated with three power range channels if THERMAL POWER is 

≤ 75% RTP and the input from one Power Range Neutron Flux channel is 

inoperable. Note 2 allows performance of SR 3.2.4.2 in lieu of 

SR 3.2.4.1.

This Surveillance verifies that the QPTR, as indicated by the Nuclear 

Instrumentation System (NIS) excore channels, is within its limits. [ The 

Frequency of 7 days takes into account other information and alarms 

available to the operator in the control room.
QPTR

B 3.2.4

Westinghouse STS B 3.2.4-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

For those causes of QPT that occur quickly (e.g., a dropped rod), there 

typically are other indications of abnormality that prompt a verification of 

core power tilt.

SR 3.2.4.2

This Surveillance is modified by a Note, which states that it is not required 

until 12 hours after the input from one or more Power Range Neutron Flux 

channels are inoperable and the THERMAL POWER is > 75% RTP.

With an NIS power range channel inoperable, tilt monitoring for a portion 

of the reactor core becomes degraded. Large tilts are likely detected with 

the remaining channels, but the capability for detection of small power tilts 

in some quadrants is decreased. [ Performing SR 3.2.4.2 at a Frequency 

of 12 hours provides an accurate alternative means for ensuring that any 

tilt remains within its limits.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
QPTR

B 3.2.4

Westinghouse STS B 3.2.4-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

For purposes of monitoring the QPTR when one power range channel is 

inoperable, the moveable incore detectors are used to confirm that the 

normalized symmetric power distribution is consistent with the indicated 

QPTR and any previous data indicating a tilt. The incore detector 

monitoring is performed with a full incore flux map or two sets of four 

thimble locations with quarter core symmetry. The two sets of four 

symmetric thimbles is a set of eight unique detector locations. These 

locations are C-8, E-5, E-11, H-3, H-13, L-5, L-11, and N-8 for three and 

four loop cores.

The symmetric thimble flux map can be used to generate symmetric 

thimble "tilt." This can be compared to a reference symmetric thimble tilt, 

from the most recent full core flux map, to generate an incore QPTR. 

Therefore, incore monitoring of QPTR can be used to confirm that QPTR 

is within limits.

With one NIS channel inoperable, the indicated tilt may be changed from 

the value indicated with all four channels OPERABLE. To confirm that no 

change in tilt has actually occurred, which might cause the QPTR limit to 

be exceeded, the incore result may be compared against previous flux 

maps either using the symmetric thimbles as described above or a 

complete flux map. Nominally, quadrant tilt from the Surveillance should 

be within 2% of the tilt shown by the most recent flux map data.

REFERENCES 1. 10 CFR 50.46.

2. Regulatory Guide 1.77, Rev [0], May 1974.

3. 10 CFR 50, Appendix A, GDC 26.

RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.1A Reactor Trip System (RTS) Instrumentation (Without Setpoint Control Program)

BASES

BACKGROUND The RTS initiates a unit shutdown, based on the values of selected unit 

parameters, to protect against violating the core fuel design limits and 

Reactor Coolant System (RCS) pressure boundary during anticipated 

operational occurrences (AOOs) and to assist the Engineered Safety 

Features (ESF) Systems in mitigating accidents.

The protection and monitoring systems have been designed to assure 

safe operation of the reactor. This is achieved by specifying limiting 

safety system settings (LSSS) in terms of parameters directly monitored 

by the RTS, as well as specifying LCOs on other reactor system 

parameters and equipment performance.

Technical Specifications are required by 10 CFR 50.36 to include LSSS 

for variables that have significant safety functions. LSSS are defined by 

the regulation as "Where a LSSS is specified for a variable on which a 

safety limit has been placed, the setting must be chosen so that

automatic protective actions will correct the abnormal situation before a 

Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the 

process variable at which a protective action is initiated, as established by 

the safety analysis, to ensure that a SL is not exceeded. Any automatic 

protection action that occurs on reaching the Analytical Limit therefore 

ensures that the SL is not exceeded. However, in practice, the actual 

settings for automatic protection channels must be chosen to be more 

conservative than the Analytical Limit to account for instrument loop 

uncertainties related to the setting at which the automatic protective 

action would actually occur.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The term "[Limiting Trip Setpoint (LTSP)]" is generic terminology for the 

calculated field setting (setpoint) value calculated by means of the plant

specific setpoint methodology documented in a document controlled 

under 10 CFR 50.59. The term [LTSP] indicates that no additional margin 

has been added between the Analytical Limit and the calculated trip 

setting. 

For most Westinghouse plants the term [Nominal Trip Setpoint (NTSP)] is 

used in place of the term [LTSP] and [NTSP] will replace [LTSP] in the 

Bases descriptions. "Field setting" is the suggested terminology for the 

actual setpoint implemented in the plant surveillance procedures where
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-2 Rev. 4.0

BASES

BACKGROUND (continued)

margin has been added to the calculated field setting. The as-found and 

as-left tolerances will apply to the field setting implemented in the 

Surveillance procedures to confirm channel performance. 

Licensees are to insert the name of the document(s) controlled under 

10 CFR 50.59 that contain the methodology for calculating the as-left and 

as-found tolerances, in Note c of Table 3.3.1-1 for the phrase "[insert the 

name of a document controlled under 10 CFR 50.59 such as the 

Technical Requirements Manual or any document incorporated into the 

facility FSAR]" throughout these Bases.

Where the [NTSP] is not included in Table 3.3.1-1, the plant specific 

location for the [NTSP] must be cited in Note c of Table 3.3.1-1. The 

brackets indicate plant specific terms may apply, as reviewed and 

approved by the NRC.

--------------------------------------------------------------------------------------------------

The [Nominal Trip Setpoint (NTSP)] specified in Table 3.3.1-1 is a 

predetermined setting for a protection channel chosen to ensure 

automatic actuation prior to the process variable reaching the Analytical

Limit and thus ensuring that the SL would not be exceeded. As such, the 

[NTSP] accounts for uncertainties in setting the channel (e.g., calibration), 

uncertainties in how the channel might actually perform (e.g., 

repeatability), changes in the point of action of the channel over time 

(e.g., drift during surveillance intervals), and any other factors which may 

influence its actual performance (e.g., harsh accident environments). In 

this manner, the [NTSP] ensures that SLs are not exceeded. Therefore, 

the [NTSP] meets the definition of an LSSS (Ref. 1).

Technical Specifications contain values related to the OPERABILITY of 

equipment required for safe operation of the facility. OPERABLE is 

defined in Technical Specifications as "...being capable of performing its 

safety functions(s)." Relying solely on the [NTSP] to define 

OPERABILITY in Technical Specifications would be an overly restrictive 

requirement if it were applied as an OPERABILITY limit for the "as-found" 

value of a protection channel setting during a surveillance. This would 

result in Technical Specification compliance problems, as well as reports 

and corrective actions required by the rule which are not necessary to 

ensure safety. For example, an automatic protection channel with a 

setting that has been found to be different from the [NTSP] due to some 

drift of the setting may still be OPERABLE since drift is to be expected. 

This expected drift would have been specifically accounted for in the 

setpoint methodology for calculating the [NTSP] and thus the automatic 

protective action would still have ensured that the SL would not be 

exceeded with the "as-found" setting of the protection channel. 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-3 Rev. 4.0

BASES

BACKGROUND (continued)

Therefore, the channel would still be OPERABLE since it would have 

performed its safety function and the only corrective action required would 

be to reset the channel within the established as-left tolerance around the 

[NTSP] to account for further drift during the next surveillance interval.

[ Note: Alternatively, a Technical Specification format incorporating an 

Allowable Value only column may be proposed by a licensee. In this, 

case, the [NTSP] value and the methodologies used to calculate the asfound and as-left tolerances must be specified in [insert the name of a 

document controlled under 10 CFR 50.59 such as the Technical 

Requirements Manual or any document incorporated into the facility 

FSAR]. Changes to the actual plant trip setpoint or [NTSP] value would 

be controlled by 10 CFR 50.59 or administratively as appropriate, and 

adjusted per the setpoint methodology and applicable surveillance 

requirements. ]

During AOOs, which are those events expected to occur one or more 

times during the unit life, the acceptable limits are:

1. The Departure from Nucleate Boiling Ratio (DNBR) shall be 

maintained above the Safety Limit (SL) value to prevent departure 

from nucleate boiling (DNB),

2. Fuel centerline melt shall not occur, and

3. The RCS pressure SL of [2735] psig shall not be exceeded.

Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also 

maintains the above values and assures that offsite dose will be within 

the 10 CFR 50 and 10 CFR 100 criteria during AOOs.

Accidents are events that are analyzed even though they are not 

expected to occur during the unit life. The acceptable limit during 

accidents is that offsite dose shall be maintained within an acceptable 

fraction of 10 CFR 100 limits. Different accident categories are allowed a 

different fraction of these limits, based on probability of occurrence. 

Meeting the acceptable dose limit for an accident category is considered 

having acceptable consequences for that event.

The RTS instrumentation is segmented into four distinct but 

interconnected modules as illustrated in Figure [ ], FSAR, Chapter [7] 

(Ref. 2), and as identified below:

1. Field transmitters or process sensors: provide a measurable 

electronic signal based upon the physical characteristics of the 

parameter being measured,
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-4 Rev. 4.0

BASES

BACKGROUND (continued)

2. Signal Process Control and Protection System, including Analog 

Protection System, Nuclear Instrumentation System (NIS), field 

contacts, and protection channel sets: provides signal conditioning, 

bistable setpoint comparison, process algorithm actuation, 

compatible electrical signal output to protection system channels, and 

control board/control room/miscellaneous indications,

3. Solid State Protection System (SSPS), including input, logic, and 

output bays: initiates proper unit shutdown and/or ESF actuation in 

accordance with the defined logic, which is based on the bistable 

outputs from the signal process control and protection system, and

4. Reactor trip switchgear, including reactor trip breakers (RTBs) and 

bypass breakers: provides the means to interrupt power to the 

control rod drive mechanisms (CRDMs) and allows the rod cluster 

control assemblies (RCCAs), or "rods," to fall into the core and shut 

down the reactor. The bypass breakers allow testing of the RTBs at 

power.

Field Transmitters or Sensors

To meet the design demands for redundancy and reliability, more than 

one, and often as many as four, field transmitters or sensors are used to 

measure unit parameters. To account for the calibration tolerances and 

instrument drift, which are assumed to occur between calibrations, 

statistical allowances are provided in the [NTSP] and Allowable Value. 

The OPERABILITY of each transmitter or sensor is determined by either 

"as-found" calibration data evaluated during the CHANNEL 

CALIBRATION or by qualitative assessment of field transmitter or sensor 

as related to the channel behavior observed during performance of the 

CHANNEL CHECK.

Signal Process Control and Protection System

Generally, three or four channels of process control equipment are used 

for the signal processing of unit parameters measured by the field 

instruments. The process control equipment provides signal conditioning, 

comparable output signals for instruments located on the main control 

board, and comparison of measured input signals with [NTSPs] derived 

from Analytical Limits established by the safety analyses. Analytical 

Limits are defined in FSAR, Chapter [7] (Ref. 2), Chapter [6] (Ref. 3), and 

Chapter [15] (Ref. 4). If the measured value of a unit parameter exceeds 

the predetermined setpoint, an output from a bistable is forwarded to the 

SSPS for decision evaluation. Channel separation is maintained up to 

and through the input bays. However, not all unit parameters require four 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-5 Rev. 4.0

BASES

BACKGROUND (continued)

channels of sensor measurement and signal processing. Some unit 

parameters provide input only to the SSPS, while others provide input to 

the SSPS, the main control board, the unit computer, and one or more 

control systems.

Generally, if a parameter is used only for input to the protection circuits, 

three channels with a two-out-of-three logic are sufficient to provide the 

required reliability and redundancy. If one channel fails in a direction that 

would not result in a partial Function trip, the Function is still OPERABLE 

with a two-out-of-two logic. If one channel fails, such that a partial 

Function trip occurs, a trip will not occur and the Function is still 

OPERABLE with a one-out-of-two logic.

Generally, if a parameter is used for input to the SSPS and a control 

function, four channels with a two-out-of-four logic are sufficient to provide 

the required reliability and redundancy. The circuit must be able to 

withstand both an input failure to the control system, which may then 

require the protection function actuation, and a single failure in the other 

channels providing the protection function actuation. Again, a single 

failure will neither cause nor prevent the protection function actuation. 

These requirements are described in IEEE-279-1971 (Ref. 5). The actual 

number of channels required for each unit parameter is specified in 

Reference 2.

Two logic channels are required to ensure no single random failure of a 

logic channel will disable the RTS. The logic channels are designed such 

that testing required while the reactor is at power may be accomplished 

without causing trip. Provisions to allow removing logic channels from 

service during maintenance are unnecessary because of the logic 

system's designed reliability.

Allowable Values and Nominal Trip Setpoints

The trip setpoints used in the bistables are based on the analytical limits

stated in Reference 2. The calculation of the [NTSP] specified in 

Table 3.3.1-1 is such that adequate protection is provided when all sensor 

and processing time delays are taken into account. To allow for 

calibration tolerances, instrumentation uncertainties, instrument drift, and 

severe environment errors for those RTS channels that must function in 

harsh environments as defined by 10 CFR 50.49 (Ref. 6), the Allowable 

Values specified in Table 3.3.1-1 in the accompanying LCO are 

conservative with respect to the analytical limits. A detailed description of 

the methodology used to calculate the Allowable Values and [NTSP], 

including their explicit uncertainties, is provided in the "RTS/ESFAS 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-6 Rev. 4.0

BASES

BACKGROUND (continued)

Setpoint Methodology Study" (Ref. 7) which incorporates all of the known 

uncertainties applicable to each channel. The as-left tolerance and asfound tolerance band methodology is provided in "[insert the name of a 

document controlled under 10 CFR 50.59 such as the Technical 

Requirements Manual or any document incorporated into the facility 

FSAR]." The magnitudes of these uncertainties are factored into the 

determination of each [NTSP] and corresponding Allowable Value. The 

trip setpoint entered into the bistable is more conservative than that 

specified by the Allowable Value to account for measurement errors 

detectable by the CHANNEL OPERATIONAL TEST (COT). The 

Allowable Value serves as the as-found Technical Specification 

OPERABILITY limit for the purpose of the COT. 

The [NTSP] is the value at which the bistable is set and is the expected 

value to be achieved during calibration. The [NTSP] value is the LSSS 

and ensures the safety analysis limits are met for the surveillance interval 

selected when a channel is adjusted based on stated channel 

uncertainties. Any bistable is considered to be properly adjusted when

the "as-left" [NTSP] value is within the as-left tolerance band for 

CHANNEL CALIBRATION uncertainty allowance (i.e., ± rack calibration 

and comparator setting uncertainties). The [NTSP] value is therefore 

considered a "nominal" value (i.e., expressed as a value without 

inequalities) for the purposes of COT and CHANNEL CALIBRATION.

[NTSPs ], in conjunction with the use of as-found and as-left tolerances, 

together with the requirements of the Allowable Value ensure that SLs are 

not violated during AOOs (and that the consequences of DBAs will be 

acceptable, providing the unit is operated from within the LCOs at the 

onset of the AOO or DBA and the equipment functions as designed).

Note that the Allowable Values listed in Table 3.3.1-1 are the least 

conservative value of the as-found setpoint that a channel can have 

during a periodic CHANNEL CALIBRATION, COTs, or a TRIP 

ACTUATING DEVICE OPERATIONAL TEST that requires trip setpoint 

verification

Each channel of the process control equipment can be tested on line to 

verify that the signal or setpoint accuracy is within the specified allowance 

requirements of Reference 3. Once a designated channel is taken out of 

service for testing, a simulated signal is injected in place of the field 

instrument signal. The process equipment for the channel in test is then 

tested, verified, and calibrated. SRs for the channels are specified in the 

SRs section.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-7 Rev. 4.0

BASES

BACKGROUND (continued)

Solid State Protection System

The SSPS equipment is used for the decision logic processing of outputs 

from the signal processing equipment bistables. To meet the redundancy 

requirements, two trains of SSPS, each performing the same functions, 

are provided. If one train is taken out of service for maintenance or test 

purposes, the second train will provide reactor trip and/or ESF actuation 

for the unit. If both trains are taken out of service or placed in test, a 

reactor trip will result. Each train is packaged in its own cabinet for 

physical and electrical separation to satisfy separation and independence 

requirements. The system has been designed to trip in the event of a 

loss of power, directing the unit to a safe shutdown condition.

The SSPS performs the decision logic for actuating a reactor trip or ESF 

actuation, generates the electrical output signal that will initiate the 

required trip or actuation, and provides the status, permissive, and 

annunciator output signals to the main control room of the unit.

The bistable outputs from the signal processing equipment are sensed by 

the SSPS equipment and combined into logic matrices that represent 

combinations indicative of various unit upset and accident transients. If a 

required logic matrix combination is completed, the system will initiate a 

reactor trip or send actuation signals via master and slave relays to those 

components whose aggregate Function best serves to alleviate the 

condition and restore the unit to a safe condition. Examples are given in 

the Applicable Safety Analyses, LCO, and Applicability sections of this 

Bases.

Reactor Trip Switchgear

The RTBs are in the electrical power supply line from the control rod drive 

motor generator set power supply to the CRDMs. Opening of the RTBs 

interrupts power to the CRDMs, which allows the shutdown rods and 

control rods to fall into the core by gravity. Each RTB is equipped with a 

bypass breaker to allow testing of the RTB while the unit is at power. 

During normal operation the output from the SSPS is a voltage signal that 

energizes the undervoltage coils in the RTBs and bypass breakers, if in 

use. When the required logic matrix combination is completed, the SSPS 

output voltage signal is removed, the undervoltage coils are deenergized, the breaker trip lever is actuated by the de-energized 

undervoltage coil, and the RTBs and bypass breakers are tripped open. 

This allows the shutdown rods and control rods to fall into the core. In 

addition to the de-energization of the undervoltage coils, each breaker is 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-8 Rev. 4.0

BASES

BACKGROUND (continued)

also equipped with a shunt trip device that is energized to trip the breaker 

open upon receipt of a reactor trip signal from the SSPS. Either the 

undervoltage coil or the shunt trip mechanism is sufficient by itself, thus 

providing a diverse trip mechanism.

The decision logic matrix Functions are described in the functional 

diagrams included in Reference 3. In addition to the reactor trip or ESF, 

these diagrams also describe the various "permissive interlocks" that are 

associated with unit conditions. Each train has a built in testing device 

that can automatically test the decision logic matrix Functions and the 

actuation channels while the unit is at power. When any one train is 

taken out of service for testing, the other train is capable of providing unit 

monitoring and protection until the testing has been completed. The 

testing device is semiautomatic to minimize testing time.

APPLICABLE The RTS functions to preserve the SLs during all AOOs and mitigates

SAFETY the consequences of DBAs in all MODES in which the Rod Control 

ANALYSES, LCO, System is capable of rod withdrawal or one or more rods are not fully 

and APPLICABILITY inserted.

Each of the analyzed accidents and transients can be detected by one or 

more RTS Functions. The accident analysis described in Reference 4 

takes credit for most RTS trip Functions. RTS trip Functions that are 

retained yet not specifically credited in the accident analysis are implicitly

credited in the safety analysis and the NRC staff approved licensing basis 

for the unit. These RTS trip Functions may provide protection for 

conditions that do not require dynamic transient analysis to demonstrate 

Function performance. They may also serve as backups to RTS trip 

Functions that were credited in the accident analysis.

Permissive and interlock setpoints allow the blocking of trips during plant 

startups, and restoration of trips when the permissive conditions are not 

satisfied, but they are not explicitly modeled in the Safety Analyses. 

These permissives and interlocks ensure that the starting conditions are 

consistent with the safety analysis, before preventive or mitigating actions 

occur. Because these permissives or interlocks are only one of multiple 

conservative starting assumptions for the accident analysis, they are 

generally considered as nominal values without regard to measurement 

accuracy. 

The LCO requires all instrumentation performing an RTS Function, listed 

in Table 3.3.1-1 to be OPERABLE. The Allowable Value specified in 

Table 3.3.1-1 is the least conservative value of the as-found setpoint that 

the channel can have when tested, such that a channel is OPERABLE if 

the as-found setpoint is within the as-found tolerance and is conservative 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-9 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

with respect to the Allowable Value during a CHANNEL CALIBRATION or 

COT. As such, the Allowable Value differs from the [NTSP] by an amount 

[greater than or] equal to the expected instrument channel uncertainties, 

such as drift, during the surveillance interval. In this manner, the actual 

setting of the channel [NTSP] will ensure that a SL is not exceeded at any 

given point of time as long as the channel has not drifted beyond 

expected tolerances during the surveillance interval. Note that, although 

the channel is OPERABLE under these circumstances, the trip setpoint 

must be left adjusted to a value within the as-left tolerance, in accordance 

with uncertainty assumptions stated in the referenced setpoint 

methodology (as-left criteria), and confirmed to be operating within the 

statistical allowances of the uncertainty terms assigned (as-found 

criteria). 

If the actual setting of the channel is found to be conservative with 

respect to the Allowable Value but is beyond the as-found tolerance band, 

the channel is OPERABLE but degraded. The degraded condition of the 

channel will be further evaluated during performance of the SR. This 

evaluation will consist of resetting the channel setpoint to the [NTSP]

(within the allowed tolerance), and evaluating the channel's response. If 

the channel is functioning as required and is expected to pass the next 

surveillance, then the channel is OPERABLE and can be restored to 

service at the completion of the surveillance. After the surveillance is 

completed, the channel as-found condition will be entered into the 

Corrective Action Program for further evaluation.

A trip setpoint may be set more conservative than the [NTSP] as 

necessary in response to plant conditions. However, in this case, the 

OPERABILITY of this instrument must be verified based on the [field 

setting] and not the [NTSP]. Failure of any instrument renders the 

affected channel(s) inoperable and reduces the reliability of the affected 

Functions.

The LCO generally requires OPERABILITY of four or three channels in 

each instrumentation Function, two channels of Manual Reactor Trip in 

each logic Function, and two trains in each Automatic Trip Logic Function. 

Four OPERABLE instrumentation channels in a two-out-of-four 

configuration are required when one RTS channel is also used as a 

control system input. This configuration accounts for the possibility of the 

shared channel failing in such a manner that it creates a transient that 

requires RTS action. In this case, the RTS will still provide protection, 

even with random failure of one of the other three protection channels. 

Three OPERABLE instrumentation channels in a two-out-of-three 

configuration are generally required when there is no potential for control 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-10 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

system and protection system interaction that could simultaneously create 

a need for RTS trip and disable one RTS channel. The two-out-of-three 

and two-out-of-four configurations allow one channel to be tripped during 

maintenance or testing without causing a reactor trip. Specific exceptions 

to the above general philosophy exist and are discussed below.

Reactor Trip System Functions

The safety analyses and OPERABILITY requirements applicable to each 

RTS Function are discussed below:

1. Manual Reactor Trip

The Manual Reactor Trip ensures that the control room operator can 

initiate a reactor trip at any time by using either of two reactor trip 

switches in the control room. A Manual Reactor Trip accomplishes 

the same results as any one of the automatic trip Functions. It is 

used by the reactor operator to shut down the reactor whenever any 

parameter is rapidly trending toward its Trip Setpoint.

The LCO requires two Manual Reactor Trip channels to be 

OPERABLE. Each channel is controlled by a manual reactor trip 

switch. Each channel activates the reactor trip breaker in both trains. 

Two independent channels are required to be OPERABLE so that no 

single random failure will disable the Manual Reactor Trip Function.

In MODE 1 or 2, manual initiation of a reactor trip must be 

OPERABLE. These are the MODES in which the shutdown rods 

and/or control rods are partially or fully withdrawn from the core. In 

MODE 3, 4, or 5, the manual initiation Function must also be 

OPERABLE if one or more shutdown rods or control rods are 

withdrawn or the Rod Control System is capable of withdrawing the 

shutdown rods or the control rods. In this condition, inadvertent 

control rod withdrawal is possible. In MODE 3, 4, or 5, manual 

initiation of a reactor trip does not have to be OPERABLE if the Rod 

Control System is not capable of withdrawing the shutdown rods or 

control rods and if all rods are fully inserted. If the rods cannot be 

withdrawn from the core, or all of the rods are inserted, there is no 

need to be able to trip the reactor. In MODE 6, neither the shutdown 

rods nor the control rods are permitted to be withdrawn and the 

CRDMs are disconnected from the control rods and shutdown rods. 

Therefore, the manual initiation Function is not required.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-11 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

2. Power Range Neutron Flux

The NIS power range detectors are located external to the reactor 

vessel and measure neutrons leaking from the core. The NIS power 

range detectors provide input to the Rod Control System and the 

Steam Generator (SG) Water Level Control System. Therefore, the 

actuation logic must be able to withstand an input failure to the 

control system, which may then require the protection function 

actuation, and a single failure in the other channels providing the 

protection function actuation. Note that this Function also provides a 

signal to prevent automatic and manual rod withdrawal prior to 

initiating a reactor trip. Limiting further rod withdrawal may terminate 

the transient and eliminate the need to trip the reactor.

a. Power Range Neutron Flux - High

The Power Range Neutron Flux - High trip Function ensures that 

protection is provided, from all power levels, against a positive 

reactivity excursion leading to DNB during power operations. 

These can be caused by rod withdrawal or reductions in RCS 

temperature.

The LCO requires all four of the Power Range Neutron Flux -

High channels to be OPERABLE.

In MODE 1 or 2, when a positive reactivity excursion could 

occur, the Power Range Neutron Flux - High trip must be 

OPERABLE. This Function will terminate the reactivity excursion 

and shut down the reactor prior to reaching a power level that 

could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power 

range detectors cannot detect neutron levels in this range. In 

these MODES, the Power Range Neutron Flux - High does not 

have to be OPERABLE because the reactor is shut down and 

reactivity excursions into the power range are extremely unlikely. 

Other RTS Functions and administrative controls provide 

protection against reactivity additions when in MODE 3, 4, 5, 

or 6.

b. Power Range Neutron Flux - Low

The LCO requirement for the Power Range Neutron Flux - Low 

trip Function ensures that protection is provided against a 

positive reactivity excursion from low power or subcritical 

conditions.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-12 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The LCO requires all four of the Power Range Neutron Flux -

Low channels to be OPERABLE.

In MODE 1, below the Power Range Neutron Flux (P-10 

setpoint), and in MODE 2, the Power Range Neutron Flux - Low 

trip must be OPERABLE. This Function may be manually 

blocked by the operator when two out of four power range 

channels are greater than approximately 10% RTP (P-10 

setpoint). This Function is automatically unblocked when three 

out of four power range channels are below the P-10 setpoint. 

Above the P-10 setpoint, positive reactivity additions are 

mitigated by the Power Range Neutron Flux - High trip Function.

In MODE 3, 4, 5, or 6, the Power Range Neutron Flux - Low trip 

Function does not have to be OPERABLE because the reactor is 

shut down and the NIS power range detectors cannot detect 

neutron levels in this range. Other RTS trip Functions and 

administrative controls provide protection against positive 

reactivity additions or power excursions in MODE 3, 4, 5, or 6.

3. Power Range Neutron Flux Rate

The Power Range Neutron Flux Rate trips use the same channels as 

discussed for Function 2 above.

a. Power Range Neutron Flux - High Positive Rate

The Power Range Neutron Flux - High Positive Rate trip 

Function ensures that protection is provided against rapid 

increases in neutron flux that are characteristic of an RCCA drive 

rod housing rupture and the accompanying ejection of the 

RCCA. This Function compliments the Power Range Neutron 

Flux - High and Low Setpoint trip Functions to ensure that the 

criteria are met for a rod ejection from the power range.

The LCO requires all four of the Power Range Neutron Flux -

High Positive Rate channels to be OPERABLE.

In MODE 1 or 2, when there is a potential to add a large amount 

of positive reactivity from a rod ejection accident (REA), the 

Power Range Neutron Flux - High Positive Rate trip must be 

OPERABLE. In MODE 3, 4, 5, or 6, the Power Range Neutron 

Flux - High Positive Rate trip Function does not have to be 

OPERABLE because other RTS trip Functions and 

administrative controls will provide protection against positive 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-13 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

reactivity additions. Also, since only the shutdown banks may be 

withdrawn in MODE 3, 4, or 5, the remaining complement of 

control bank worth ensures a sufficient degree of SDM in the 

event of an REA. In MODE 6, no rods are withdrawn and the 

SDM is increased during refueling operations. The reactor 

vessel head is also removed or the closure bolts are detensioned 

preventing any pressure buildup. In addition, the NIS power 

range detectors cannot detect neutron levels present in this 

mode.

b. Power Range Neutron Flux - High Negative Rate

The Power Range Neutron Flux - High Negative Rate trip 

Function ensures that protection is provided for multiple rod drop 

accidents. At high power levels, a multiple rod drop accident 

could cause local flux peaking that would result in a

nonconservative local DNBR. DNBR is defined as the ratio of 

the heat flux required to cause a DNB at a particular location in 

the core to the local heat flux. The DNBR is indicative of the 

margin to DNB. No credit is taken for the operation of this 

Function for those rod drop accidents in which the local DNBRs 

will be greater than the limit.

The LCO requires all four Power Range Neutron Flux - High 

Negative Rate channels to be OPERABLE.

In MODE 1 or 2, when there is potential for a multiple rod drop 

accident to occur, the Power Range Neutron Flux - High 

Negative Rate trip must be OPERABLE. In MODE 3, 4, 5, or 6, 

the Power Range Neutron Flux - High Negative Rate trip 

Function does not have to be OPERABLE because the core is 

not critical and DNB is not a concern. Also, since only the 

shutdown banks may be withdrawn in MODE 3, 4, or 5, the 

remaining complement of control bank worth ensures a sufficient 

degree of SDM in the event of an REA. In MODE 6, no rods are 

withdrawn and the required SDM is increased during refueling 

operations. In addition, the NIS power range detectors cannot 

detect neutron levels present in this MODE.

4. Intermediate Range Neutron Flux

The Intermediate Range Neutron Flux trip Function ensures that 

protection is provided against an uncontrolled RCCA bank rod 

withdrawal accident from a subcritical condition during startup. This

trip Function provides redundant protection to the Power Range 

Neutron Flux - Low Setpoint trip Function. The NIS intermediate 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-14 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

range detectors are located external to the reactor vessel and 

measure neutrons leaking from the core. The NIS intermediate 

range detectors do not provide any input to control systems. Note 

that this Function also provides a signal to prevent automatic and 

manual rod withdrawal prior to initiating a reactor trip. Limiting further 

rod withdrawal may terminate the transient and eliminate the need to 

trip the reactor.

The LCO requires two channels of Intermediate Range Neutron Flux 

to be OPERABLE. Two OPERABLE channels are sufficient to 

ensure no single random failure will disable this trip Function.

Because this trip Function is important only during startup, there is 

generally no need to disable channels for testing while the Function 

is required to be OPERABLE. Therefore, a third channel is 

unnecessary.

In MODE 1 below the P-10 setpoint, and in MODE 2 above the P-6 

setpoint, when there is a potential for an uncontrolled RCCA bank rod 

withdrawal accident during reactor startup, the Intermediate Range 

Neutron Flux trip must be OPERABLE. Above the P-10 setpoint, the 

Power Range Neutron Flux - High Setpoint trip and the Power Range 

Neutron Flux - High Positive Rate trip provide core protection for a 

rod withdrawal accident. In MODE 2 below the P-6 setpoint, the 

Source Range Neutron Flux Trip provides the core protection for 

reactivity accidents. In MODE 3, 4, or 5, the Intermediate Range 

Neutron Flux trip does not have to be OPERABLE because the 

control rods must be fully inserted and only the shutdown rods may 

be withdrawn. The reactor cannot be started up in this condition. 

The core also has the required SDM to mitigate the consequences of 

a positive reactivity addition accident. In MODE 6, all rods are fully 

inserted and the core has a required increased SDM. Also, the NIS 

intermediate range detectors cannot detect neutron levels present in 

this MODE.

5. Source Range Neutron Flux

The LCO requirement for the Source Range Neutron Flux trip 

Function ensures that protection is provided against an uncontrolled 

RCCA bank rod withdrawal accident from a subcritical condition 

during startup. This trip Function provides redundant protection to 

the Power Range Neutron Flux - Low trip Function. In MODES 3, 4, 

and 5, administrative controls also prevent the uncontrolled 

withdrawal of rods. The NIS source range detectors are located 

external to the reactor vessel and measure neutrons leaking from the 

core. The NIS source range detectors do not provide any inputs to 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-15 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

control systems. The source range trip is the only RTS automatic 

protection function required in MODES 3, 4, and 5 when rods are 

capable of withdrawal or one or more rods are not fully inserted. 

Therefore, the functional capability at the specified Trip Setpoint is 

assumed to be available.

The Source Range Neutron Flux Function provides protection for 

control rod withdrawal from subcritical, boron dilution and control rod 

ejection events.

In MODE 2 when below the P-6 setpoint and in MODES 3, 4, and 5 

when there is a potential for an uncontrolled RCCA bank rod 

withdrawal accident, the Source Range Neutron Flux trip must be 

OPERABLE. Two OPERABLE channels are sufficient to ensure no 

single random failure will disable this trip Function. Above the P-6 

setpoint, the Intermediate Range Neutron Flux trip and the Power 

Range Neutron Flux - Low trip will provide core protection for 

reactivity accidents. Above the P-6 setpoint, the NIS source range 

detectors are de-energized.

In MODES 3, 4, and 5 with all rods fully inserted and the Rod Control 

System not capable of rod withdrawal, and in MODE 6, the outputs of 

the Function to RTS logic are not required OPERABLE. The 

requirements for the NIS source range detectors to monitor core 

neutron levels and provide indication of reactivity changes that may 

occur as a result of events like a boron dilution are addressed in 

LCO 3.3.9 "Boron Dilution Protection System (BDPS)," for MODE 3, 

4, or 5 and LCO 3.9.3, "Nuclear Instrumentation," for MODE 6.

6. Overtemperature ∆T

The Overtemperature ∆T trip Function is provided to ensure that the 

design limit DNBR is met. This trip Function also limits the range 

over which the Overpower ∆T trip Function must provide protection. 

The inputs to the Overtemperature ∆T trip include all pressure, 

coolant temperature, axial power distribution, and reactor power as 

indicated by loop ∆T assuming full reactor coolant flow. Protection 

from violating the DNBR limit is assured for those transients that are 

slow with respect to delays from the core to the measurement 

system. The Function monitors both variation in power and flow 

since a decrease in flow has the same effect on ∆T as a power 

increase. The Overtemperature ∆T trip Function uses each loop's ∆T 

as a measure of reactor power and is compared with a setpoint that 

is automatically varied with the following parameters:
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-16 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

 reactor coolant average temperature - the Trip Setpoint is varied 

to correct for changes in coolant density and specific heat 

capacity with changes in coolant temperature,

 pressurizer pressure - the Trip Setpoint is varied to correct for 

changes in system pressure, and

 axial power distribution - f(∆I), the Trip Setpoint is varied to 

account for imbalances in the axial power distribution as 

detected by the NIS upper and lower power range detectors. If 

axial peaks are greater than the design limit, as indicated by the 

difference between the upper and lower NIS power range 

detectors, the Trip Setpoint is reduced in accordance with Note 1 

of Table 3.3.1-1.

Dynamic compensation is included for system piping delays from the 

core to the temperature measurement system.

The Overtemperature ∆T trip Function is calculated for each loop as 

described in Note 1 of Table 3.3.1-1. Trip occurs if Overtemperature 

∆T is indicated in two loops. At some units, the pressure and 

temperature signals are used for other control functions. For those 

units, the actuation logic must be able to withstand an input failure to 

the control system, which may then require the protection function 

actuation, and a single failure in the other channels providing the 

protection function actuation. Note that this Function also provides a 

signal to generate a turbine runback prior to reaching the Trip 

Setpoint. A turbine runback will reduce turbine power and reactor 

power. A reduction in power will normally alleviate the 

Overtemperature ∆T condition and may prevent a reactor trip.

The LCO requires all four channels of the Overtemperature ∆T trip 

Function to be OPERABLE for two and four loop units (the LCO 

requires all three channels on the Overtemperature ∆T trip Function 

to be OPERABLE for three loop units). Note that the 

Overtemperature ∆T Function receives input from channels shared 

with other RTS Functions. Failures that affect multiple Functions 

require entry into the Conditions applicable to all affected Functions.

In MODE 1 or 2, the Overtemperature ∆T trip must be OPERABLE to 

prevent DNB. In MODE 3, 4, 5, or 6, this trip Function does not have 

to be OPERABLE because the reactor is not operating and there is 

insufficient heat production to be concerned about DNB.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-17 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

7. Overpower ∆T

The Overpower ∆T trip Function ensures that protection is provided 

to ensure the integrity of the fuel (i.e., no fuel pellet melting and less 

than 1% cladding strain) under all possible overpower conditions. 

This trip Function also limits the required range of the

Overtemperature ∆T trip Function and provides a backup to the 

Power Range Neutron Flux - High Setpoint trip. The Overpower ∆T 

trip Function ensures that the allowable heat generation rate (kW/ft)

of the fuel is not exceeded. It uses the ∆T of each loop as a measure 

of reactor power with a setpoint that is automatically varied with the 

following parameters:

 reactor coolant average temperature - the Trip Setpoint is varied 

to correct for changes in coolant density and specific heat 

capacity with changes in coolant temperature, and

 rate of change of reactor coolant average temperature - including 

dynamic compensation for the delays between the core and the 

temperature measurement system.

The Overpower ∆T trip Function is calculated for each loop as per 

Note 2 of Table 3.3.1-1. Trip occurs if Overpower ∆T is indicated in 

two loops. At some units, the temperature signals are used for other 

control functions. At those units, the actuation logic must be able to 

withstand an input failure to the control system, which may then 

require the protection function actuation and a single failure in the 

remaining channels providing the protection function actuation. Note 

that this Function also provides a signal to generate a turbine 

runback prior to reaching the Allowable Value. A turbine runback will 

reduce turbine power and reactor power. A reduction in power will 

normally alleviate the Overpower ∆T condition and may prevent a 

reactor trip.

The LCO requires four channels for two and four loop units (three 

channels for three loop units) of the Overpower ∆T trip Function to be 

OPERABLE. Note that the Overpower ∆T trip Function receives 

input from channels shared with other RTS Functions. Failures that 

affect multiple Functions require entry into the Conditions applicable 

to all affected Functions.

In MODE 1 or 2, the Overpower ∆T trip Function must be 

OPERABLE. These are the only times that enough heat is generated 

in the fuel to be concerned about the heat generation rates and 

overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function does 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-18 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

not have to be OPERABLE because the reactor is not operating and 

there is insufficient heat production to be concerned about fuel 

overheating and fuel damage.

8. Pressurizer Pressure

The same sensors provide input to the Pressurizer Pressure - High 

and - Low trips and the Overtemperature ∆T trip. At some units, the 

Pressurizer Pressure channels are also used to provide input to the 

Pressurizer Pressure Control System. For those units, the actuation

logic must be able to withstand an input failure to the control system, 

which may then require the protection function actuation, and a single 

failure in the other channels providing the protection function 

actuation.

a. Pressurizer Pressure - Low

The Pressurizer Pressure - Low trip Function ensures that 

protection is provided against violating the DNBR limit due to low 

pressure.

The LCO requires four channels for two and four loop units 

(three channels for three loop units) of Pressurizer Pressure -

Low to be OPERABLE.

In MODE 1, when DNB is a major concern, the Pressurizer 

Pressure - Low trip must be OPERABLE. This trip Function is 

automatically enabled on increasing power by the P-7 interlock 

(NIS power range P-10 or turbine impulse pressure greater than 

approximately 10% of full power equivalent (P-13)). On 

decreasing power, this trip Function is automatically blocked 

below P-7. Below the P-7 setpoint, no conceivable power 

distributions can occur that would cause DNB concerns.

b. Pressurizer Pressure - High

The Pressurizer Pressure - High trip Function ensures that 

protection is provided against overpressurizing the RCS. This 

trip Function operates in conjunction with the pressurizer relief 

and safety valves to prevent RCS overpressure conditions.

The LCO requires four channels for two and four loop units 

(three channels for three loop units) of the Pressurizer Pressure -

High to be OPERABLE.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-19 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The Pressurizer Pressure - High LSSS is selected to be below 

the pressurizer safety valve actuation pressure and above the 

power operated relief valve (PORV) setting. This setting 

minimizes challenges to safety valves while avoiding 

unnecessary reactor trip for those pressure increases that can 

be controlled by the PORVs.

In MODE 1 or 2, the Pressurizer Pressure - High trip must be 

OPERABLE to help prevent RCS overpressurization and 

minimize challenges to the relief and safety valves. In MODE 3, 

4, 5, or 6, the Pressurizer Pressure - High trip Function does not 

have to be OPERABLE because transients that could cause an 

overpressure condition will be slow to occur. Therefore, the 

operator will have sufficient time to evaluate unit conditions and 

take corrective actions. Additionally, low temperature 

overpressure protection systems provide overpressure protection 

when below MODE 4.

9. Pressurizer Water Level - High

The Pressurizer Water Level - High trip Function provides a backup 

signal for the Pressurizer Pressure - High trip and also provides 

protection against water relief through the pressurizer safety valves. 

These valves are designed to pass steam in order to achieve their 

design energy removal rate. A reactor trip is actuated prior to the 

pressurizer becoming water solid. The LCO requires three channels 

of Pressurizer Water Level - High to be OPERABLE. The pressurizer 

level channels are used as input to the Pressurizer Level Control 

System. A fourth channel is not required to address 

control/protection interaction concerns. The level channels do not 

actuate the safety valves, and the high pressure reactor trip is set 

below the safety valve setting. Therefore, with the slow rate of 

charging available, pressure overshoot due to level channel failure 

cannot cause the safety valve to lift before reactor high pressure trip.

In MODE 1, when there is a potential for overfilling the pressurizer, 

the Pressurizer Water Level - High trip must be OPERABLE. This 

trip Function is automatically enabled on increasing power by the P-7 

interlock. On decreasing power, this trip Function is automatically 

blocked below P-7. Below the P-7 setpoint, transients that could 

raise the pressurizer water level will be slow and the operator will 

have sufficient time to evaluate unit conditions and take corrective 

actions.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-20 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

10. Reactor Coolant Flow - Low

The Reactor Coolant Flow - Low trip Function ensures that protection 

is provided against violating the DNBR limit due to low flow in one or 

more RCS loops, while avoiding reactor trips due to normal 

variations in loop flow. Above the P-7 setpoint, the reactor trip on 

low flow in two or more RCS loops is automatically enabled. Above 

the P-8 setpoint, which is approximately 48% RTP, a loss of flow in 

any RCS loop will actuate a reactor trip. Each RCS loop has three 

flow detectors to monitor flow. The flow signals are not used for any 

control system input.

The LCO requires three Reactor Coolant Flow - Low channels per 

loop to be OPERABLE in MODE 1 above P-7.

In MODE 1 above the P-8 setpoint, a loss of flow in one RCS loop 

could result in DNB conditions in the core because of the higher 

power level. In MODE 1 below the P-8 setpoint and above the P-7 

setpoint, a loss of flow in two or more loops is required to actuate a 

reactor trip because of the lower power level and the greater margin 

to the design limit DNBR. Below the P-7 setpoint, all reactor trips on 

low flow are automatically blocked since there is insufficient heat 

production to generate DNB conditions.

11. Reactor Coolant Pump (RCP) Breaker Position

Both RCP Breaker Position trip Functions operate together on two 

sets of auxiliary contacts, with one set on each RCP breaker. These 

Functions anticipate the Reactor Coolant Flow - Low trips to avoid 

RCS heatup that would occur before the low flow trip actuates.

a. Reactor Coolant Pump Breaker Position (Single Loop)

The RCP Breaker Position (Single Loop) trip Function ensures 

that protection is provided against violating the DNBR limit due to 

a loss of flow in one RCS loop. The position of each RCP 

breaker is monitored. If one RCP breaker is open above the P-8 

setpoint, a reactor trip is initiated. This trip Function will generate 

a reactor trip before the Reactor Coolant Flow - Low (Single 

Loop) Trip Setpoint is reached.

The LCO requires one RCP Breaker Position channel per RCP 

to be OPERABLE. One OPERABLE channel is sufficient for this 

trip Function because the RCS Flow - Low trip alone provides 

sufficient protection of unit SLs for loss of flow events. The RCP 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-21 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Breaker Position trip serves only to anticipate the low flow trip, 

minimizing the thermal transient associated with loss of a pump.

This Function measures only the discrete position (open or 

closed) of the RCP breaker, using a position switch. Therefore, 

the Function has no adjustable trip setpoint with which to 

associate an LSSS.

In MODE 1 above the P-8 setpoint, when a loss of flow in any 

RCS loop could result in DNB conditions in the core, the RCP 

Breaker Position (Single Loop) trip must be OPERABLE. In 

MODE 1 below the P-8 setpoint, a loss of flow in two or more 

loops is required to actuate a reactor trip because of the lower 

power level and the greater margin to the design limit DNBR.

b. Reactor Coolant Pump Breaker Position (Two Loops)

The RCP Breaker Position (Two Loops) trip Function ensures 

that protection is provided against violating the DNBR limit due to 

a loss of flow in two or more RCS loops. The position of each 

RCP breaker is monitored. Above the P-7 setpoint and below 

the P-8 setpoint, a loss of flow in two or more loops will initiate a 

reactor trip. This trip Function will generate a reactor trip before 

the Reactor Coolant Flow - Low (Two Loops) Trip Setpoint is 

reached.

The LCO requires one RCP Breaker Position channel per RCP 

to be OPERABLE. One OPERABLE channel is sufficient for this 

Function because the RCS Flow - Low trip alone provides 

sufficient protection of unit SLs for loss of flow events. The RCP 

Breaker Position trip serves only to anticipate the low flow trip, 

minimizing the thermal transient associated with loss of an RCP.

This Function measures only the discrete position (open or 

closed) of the RCP breaker, using a position switch. Therefore, 

the Function has no adjustable trip setpoint with which to 

associate an LSSS.

In MODE 1 above the P-7 setpoint and below the P-8 setpoint, 

the RCP Breaker Position (Two Loops) trip must be OPERABLE. 

Below the P-7 setpoint, all reactor trips on loss of flow are

automatically blocked since no conceivable power distributions 

could occur that would cause a DNB concern at this low power 

level. Above the P-7 setpoint, the reactor trip on loss of flow in 

two RCS loops is automatically enabled. Above the P-8 setpoint, 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-22 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

a loss of flow in any one loop will actuate a reactor trip because 

of the higher power level and the reduced margin to the design 

limit DNBR.

12. Undervoltage Reactor Coolant Pumps

The Undervoltage RCPs reactor trip Function ensures that protection 

is provided against violating the DNBR limit due to a loss of flow in 

two or more RCS loops. The voltage to each RCP is monitored. 

Above the P-7 setpoint, a loss of voltage detected on two or more 

RCP buses will initiate a reactor trip. This trip Function will generate 

a reactor trip before the Reactor Coolant Flow - Low (Two Loops) 

Trip Setpoint is reached. Time delays are incorporated into the 

Undervoltage RCPs channels to prevent reactor trips due to 

momentary electrical power transients.

The LCO requires three Undervoltage RCPs channels (one per 

phase) per bus to be OPERABLE.

In MODE 1 above the P-7 setpoint, the Undervoltage RCP trip must 

be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of 

flow are automatically blocked since no conceivable power 

distributions could occur that would cause a DNB concern at this low

power level. Above the P-7 setpoint, the reactor trip on loss of flow in 

two or more RCS loops is automatically enabled. This Function uses 

the same relays as the ESFAS Function 6.f, "Undervoltage Reactor 

Coolant Pump (RCP)" start of the auxiliary feedwater (AFW) pumps.

13. Underfrequency Reactor Coolant Pumps

The Underfrequency RCPs reactor trip Function ensures that 

protection is provided against violating the DNBR limit due to a loss 

of flow in two or more RCS loops from a major network frequency 

disturbance. An underfrequency condition will slow down the pumps, 

thereby reducing their coastdown time following a pump trip. The 

proper coastdown time is required so that reactor heat can be 

removed immediately after reactor trip. The frequency of each RCP 

bus is monitored. Above the P-7 setpoint, a loss of frequency 

detected on two or more RCP buses will initiate a reactor trip. This 

trip Function will generate a reactor trip before the Reactor Coolant 

Flow - Low (Two Loops) Trip Setpoint is reached. Time delays are 

incorporated into the Underfrequency RCPs channels to prevent 

reactor trips due to momentary electrical power transients.

The LCO requires three Underfrequency RCPs channels per bus to 

be OPERABLE.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-23 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

In MODE 1 above the P-7 setpoint, the Underfrequency RCPs trip 

must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss 

of flow are automatically blocked since no conceivable power 

distributions could occur that would cause a DNB concern at this low 

power level. Above the P-7 setpoint, the reactor trip on loss of flow in 

two or more RCS loops is automatically enabled.

14. Steam Generator Water Level - Low Low

The SG Water Level - Low Low trip Function ensures that protection 

is provided against a loss of heat sink and actuates the AFW System 

prior to uncovering the SG tubes. The SGs are the heat sink for the 

reactor. In order to act as a heat sink, the SGs must contain a 

minimum amount of water. A narrow range low low level in any SG is 

indicative of a loss of heat sink for the reactor. The level transmitters 

provide input to the SG Level Control System. Therefore, the 

actuation logic must be able to withstand an input failure to the 

control system, which may then require the protection function 

actuation, and a single failure in the other channels providing the 

protection function actuation. This Function also performs the 

ESFAS function of starting the AFW pumps on low low SG level.

The LCO requires four channels of SG Water Level - Low Low per 

SG to be OPERABLE for four loop units in which these channels are 

shared between protection and control. In two, three, and four loop 

units where three SG Water Levels are dedicated to the RTS, only 

three channels per SG are required to be OPERABLE.

In MODE 1 or 2, when the reactor requires a heat sink, the SG Water 

Level - Low Low trip must be OPERABLE. The normal source of 

water for the SGs is the Main Feedwater (MFW) System (not safety 

related). The MFW System is only in operation in MODE 1 or 2. The 

AFW System is the safety related backup source of water to ensure 

that the SGs remain the heat sink for the reactor. During normal 

startups and shutdowns, the AFW System provides feedwater to 

maintain SG level. In MODE 3, 4, 5, or 6, the SG Water Level - Low 

Low Function does not have to be OPERABLE because the MFW 

System is not in operation and the reactor is not operating or even 

critical. Decay heat removal is accomplished by the AFW System in 

MODE 3 and by the Residual Heat Removal (RHR) System in 

MODE 4, 5, or 6.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-24 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

15. Steam Generator Water Level - Low, Coincident With Steam 

Flow/Feedwater Flow Mismatch

SG Water Level - Low, in conjunction with the Steam Flow/Feedwater 

Flow Mismatch, ensures that protection is provided against a loss of 

heat sink and actuates the AFW System prior to uncovering the SG 

tubes. In addition to a decreasing water level in the SG, the 

difference between feedwater flow and steam flow is evaluated to 

determine if feedwater flow is significantly less than steam flow. With 

less feedwater flow than steam flow, SG level will decrease at a rate 

dependent upon the magnitude of the difference in flow rates. There 

are two SG level channels and two Steam Flow/Feedwater Flow 

Mismatch channels per SG. One narrow range level channel sensing 

a low level coincident with one Steam Flow/Feedwater Flow 

Mismatch channel sensing flow mismatch (steam flow greater than 

feed flow) will actuate a reactor trip.

The LCO requires two channels of SG Water Level - Low coincident 

with Steam Flow/Feedwater Flow Mismatch.

In MODE 1 or 2, when the reactor requires a heat sink, the SG Water 

Level - Low coincident with Steam Flow/Feedwater Flow Mismatch 

trip must be OPERABLE. The normal source of water for the SGs is 

the MFW System (not safety related). The MFW System is only in 

operation in MODE 1 or 2. The AFW System is the safety related 

backup source of water to ensure that the SGs remain the heat sink 

for the reactor. During normal startups and shutdowns, the AFW 

System provides feedwater to maintain SG level. In MODE 3, 4, 5, 

or 6, the SG Water Level - Low coincident with Steam 

Flow/Feedwater Flow Mismatch Function does not have to be 

OPERABLE because the MFW System is not in operation and the 

reactor is not operating or even critical. Decay heat removal is 

accomplished by the AFW System in MODE 3 and by the RHR 

System in MODE 4, 5, or 6. The MFW System is in operation only in 

MODE 1 or 2 and, therefore, this trip Function need only be 

OPERABLE in these MODES.

16. Turbine Trip

a. Turbine Trip - Low Fluid Oil Pressure

The Turbine Trip - Low Fluid Oil Pressure trip Function 

anticipates the loss of heat removal capabilities of the secondary 

system following a turbine trip. This trip Function acts to 

minimize the pressure/temperature transient on the reactor. Any 

turbine trip from a power level below the P-9 setpoint, 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-25 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

approximately 50% power, will not actuate a reactor trip. Three 

pressure switches monitor the control oil pressure in the Turbine 

Electrohydraulic Control System. A low pressure condition 

sensed by two-out-of-three pressure switches will actuate a 

reactor trip. These pressure switches do not provide any input to 

the control system. The unit is designed to withstand a complete 

loss of load and not sustain core damage or challenge the RCS 

pressure limitations. Core protection is provided by the 

Pressurizer Pressure - High trip Function and RCS integrity is 

ensured by the pressurizer safety valves.

The LCO requires three channels of Turbine Trip - Low Fluid Oil 

Pressure to be OPERABLE in MODE 1 above P-9.

Below the P-9 setpoint, a turbine trip does not actuate a reactor 

trip. In MODE 2, 3, 4, 5, or 6, there is no potential for a turbine 

trip, and the Turbine Trip - Low Fluid Oil Pressure trip Function 

does not need to be OPERABLE.

b. Turbine Trip - Turbine Stop Valve Closure

The Turbine Trip - Turbine Stop Valve Closure trip Function 

anticipates the loss of heat removal capabilities of the secondary 

system following a turbine trip from a power level below the P-9 

setpoint, approximately 50% power. This action will not actuate 

a reactor trip. The trip Function anticipates the loss of secondary 

heat removal capability that occurs when the stop valves close. 

Tripping the reactor in anticipation of loss of secondary heat 

removal acts to minimize the pressure and temperature transient 

on the reactor. This trip Function will not and is not required to 

operate in the presence of a single channel failure. The unit is 

designed to withstand a complete loss of load and not sustain 

core damage or challenge the RCS pressure limitations. Core 

protection is provided by the Pressurizer Pressure - High trip 

Function, and RCS integrity is ensured by the pressurizer safety 

valves. This trip Function is diverse to the Turbine Trip - Low 

Fluid Oil Pressure trip Function. Each turbine stop valve is 

equipped with one limit switch that inputs to the RTS. If all four 

limit switches indicate that the stop valves are all closed, a 

reactor trip is initiated.

The LSSS for this Function is set to assure channel trip occurs 

when the associated stop valve is completely closed.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-26 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The LCO requires four Turbine Trip - Turbine Stop Valve Closure 

channels, one per valve, to be OPERABLE in MODE 1 above 

P-9. All four channels must trip to cause reactor trip.

Below the P-9 setpoint, a load rejection can be accommodated 

by the Steam Dump System. In MODE 2, 3, 4, 5, or 6, there is 

no potential for a load rejection, and the Turbine Trip - Stop 

Valve Closure trip Function does not need to be OPERABLE.

17. Safety Injection Input from Engineered Safety Feature Actuation 

System

The SI Input from ESFAS ensures that if a reactor trip has not 

already been generated by the RTS, the ESFAS automatic actuation 

logic will initiate a reactor trip upon any signal that initiates SI. This is 

a condition of acceptability for the LOCA. However, other transients 

and accidents take credit for varying levels of ESF performance and 

rely upon rod insertion, except for the most reactive rod that is 

assumed to be fully withdrawn, to ensure reactor shutdown. 

Therefore, a reactor trip is initiated every time an SI signal is present.

Trip Setpoint and Allowable Values are not applicable to this 

Function. The SI Input is provided by relay in the ESFAS. Therefore, 

there is no measurement signal with which to associate an LSSS.

The LCO requires two trains of SI Input from ESFAS to be 

OPERABLE in MODE 1 or 2.

A reactor trip is initiated every time an SI signal is present. 

Therefore, this trip Function must be OPERABLE in MODE 1 or 2, 

when the reactor is critical, and must be shut down in the event of an 

accident. In MODE 3, 4, 5, or 6, the reactor is not critical, and this 

trip Function does not need to be OPERABLE.

18. Reactor Trip System Interlocks

Reactor protection interlocks are provided to ensure reactor trips are 

in the correct configuration for the current unit status. They back up 

operator actions to ensure protection system Functions are not 

bypassed during unit conditions under which the safety analysis 

assumes the Functions are not bypassed. Therefore, the interlock 

Functions do not need to be OPERABLE when the associated 

reactor trip functions are outside the applicable MODES. These are:
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-27 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

a. Intermediate Range Neutron Flux, P-6

The Intermediate Range Neutron Flux, P-6 interlock is actuated 

when any NIS intermediate range channel goes approximately 

one decade above the minimum channel reading. If both 

channels drop below the setpoint, the permissive will 

automatically be defeated. The LCO requirement for the P-6 

interlock ensures that the following Functions are performed:

 on increasing power, the P-6 interlock allows the manual 

block of the NIS Source Range, Neutron Flux reactor trip. 

This prevents a premature block of the source range trip and 

allows the operator to ensure that the intermediate range is 

OPERABLE prior to leaving the source range. When the 

source range trip is blocked, the high voltage to the detectors 

is also removed,

 on decreasing power, the P-6 interlock automatically 

energizes the NIS source range detectors and enables the 

NIS Source Range Neutron Flux reactor trip, and

 on increasing power, the P-6 interlock provides a backup 

block signal to the source range flux doubling circuit. 

Normally, this Function is manually blocked by the control 

room operator during the reactor startup.

The LCO requires two channels of Intermediate Range Neutron 

Flux, P-6 interlock to be OPERABLE in MODE 2 when below the 

P-6 interlock setpoint.

Above the P-6 interlock setpoint, the NIS Source Range Neutron 

Flux reactor trip will be blocked, and this Function will no longer 

be necessary.

In MODE 3, 4, 5, or 6, the P-6 interlock does not have to be 

OPERABLE because the NIS Source Range is providing core 

protection.

b. Low Power Reactor Trips Block, P-7

The Low Power Reactor Trips Block, P-7 interlock is actuated by 

input from either the Power Range Neutron Flux, P-10, or the 

Turbine Impulse Pressure, P-13 interlock. The LCO requirement 

for the P-7 interlock ensures that the following Functions are 

performed:
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-28 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

(1) on increasing power, the P-7 interlock automatically enables 

reactor trips on the following Functions:

 Pressurizer Pressure - Low,

 Pressurizer Water Level - High,

 Reactor Coolant Flow - Low (low flow in two or more 

RCS loops),

 RCPs Breaker Open (Two Loops),

 Undervoltage RCPs, and

 Underfrequency RCPs.

These reactor trips are only required when operating above 

the P-7 setpoint (approximately 10% power). The reactor 

trips provide protection against violating the DNBR limit. 

Below the P-7 setpoint, the RCS is capable of providing 

sufficient natural circulation without any RCP running.

(2) on decreasing power, the P-7 interlock automatically blocks 

reactor trips on the following Functions:

 Pressurizer Pressure - Low,

 Pressurizer Water Level - High,

 Reactor Coolant Flow - Low (low flow in two or more 

RCS loops),

 RCP Breaker Position (Two Loops),

 Undervoltage RCPs, and

 Underfrequency RCPs.

Trip Setpoint and Allowable Value are not applicable to the P-7 

interlock because it is a logic Function and thus has no 

parameter with which to associate an LSSS.

The P-7 interlock is a logic Function with train and not channel 

identity. Therefore, the LCO requires one channel per train of 

Low Power Reactor Trips Block, P-7 interlock to be OPERABLE 

in MODE 1.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-29 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The low power trips are blocked below the P-7 setpoint and 

unblocked above the P-7 setpoint. In MODE 2, 3, 4, 5, or 6, this 

Function does not have to be OPERABLE because the interlock 

performs its Function when power level drops below 10% power, 

which is in MODE 1.

c. Power Range Neutron Flux, P-8

The Power Range Neutron Flux, P-8 interlock is actuated at 

approximately 48% power as determined by two-out-of-four NIS 

power range detectors. The P-8 interlock automatically enables 

the Reactor Coolant Flow - Low and RCP Breaker Position 

(Single Loop) reactor trips on low flow in one or more RCS loops 

on increasing power. The LCO requirement for this trip Function 

ensures that protection is provided against a loss of flow in any 

RCS loop that could result in DNB conditions in the core when 

greater than approximately 48% power. On decreasing power, 

the reactor trip on low flow in any loop is automatically blocked.

The LCO requires four channels of Power Range Neutron Flux, 

P-8 interlock to be OPERABLE in MODE 1.

In MODE 1, a loss of flow in one RCS loop could result in DNB 

conditions, so the Power Range Neutron Flux, P-8 interlock must 

be OPERABLE. In MODE 2, 3, 4, 5, or 6, this Function does not 

have to be OPERABLE because the core is not producing 

sufficient power to be concerned about DNB conditions.

d. Power Range Neutron Flux, P-9

The Power Range Neutron Flux, P-9 interlock is actuated at 

approximately 50% power as determined by two-out-of-four NIS 

power range detectors. The LCO requirement for this Function 

ensures that the Turbine Trip - Low Fluid Oil Pressure and 

Turbine Trip - Turbine Stop Valve Closure reactor trips are 

enabled above the P-9 setpoint. Above the P-9 setpoint, a 

turbine trip will cause a load rejection beyond the capacity of the 

Steam Dump System. A reactor trip is automatically initiated on 

a turbine trip when it is above the P-9 setpoint, to minimize the 

transient on the reactor.

The LCO requires four channels of Power Range Neutron Flux, 

P-9 interlock to be OPERABLE in MODE 1.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-30 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

In MODE 1, a turbine trip could cause a load rejection beyond 

the capacity of the Steam Dump System, so the Power Range 

Neutron Flux interlock must be OPERABLE. In MODE 2, 3, 4, 5, 

or 6, this Function does not have to be OPERABLE because the 

reactor is not at a power level sufficient to have a load rejection 

beyond the capacity of the Steam Dump System.

e. Power Range Neutron Flux, P-10

The Power Range Neutron Flux, P-10 interlock is actuated at 

approximately 10% power, as determined by two-out-of-four NIS 

power range detectors. If power level falls below 10% RTP on 3 

of 4 channels, the nuclear instrument trips will be automatically 

unblocked. The LCO requirement for the P-10 interlock ensures 

that the following Functions are performed:

 on increasing power, the P-10 interlock allows the operator 

to manually block the Intermediate Range Neutron Flux 

reactor trip. Note that blocking the reactor trip also blocks 

the signal to prevent automatic and manual rod withdrawal,

 on increasing power, the P-10 interlock allows the operator 

to manually block the Power Range Neutron Flux - Low 

reactor trip,

 on increasing power, the P-10 interlock automatically 

provides a backup signal to block the Source Range 

Neutron Flux reactor trip, and also to de-energize the NIS 

source range detectors,

 the P-10 interlock provides one of the two inputs to the P-7 

interlock, and

 on decreasing power, the P-10 interlock automatically 

enables the Power Range Neutron Flux - Low reactor trip 

and the Intermediate Range Neutron Flux reactor trip (and 

rod stop).

The LCO requires four channels of Power Range Neutron 

Flux, P-10 interlock to be OPERABLE in MODE 1 or 2.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-31 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

OPERABILITY in MODE 1 ensures the Function is available to 

perform its decreasing power Functions in the event of a reactor 

shutdown. This Function must be OPERABLE in MODE 2 to 

ensure that core protection is provided during a startup or 

shutdown by the Power Range Neutron Flux - Low and 

Intermediate Range Neutron Flux reactor trips. In MODE 3, 4, 5, 

or 6, this Function does not have to be OPERABLE because the 

reactor is not at power and the Source Range Neutron Flux 

reactor trip provides core protection.

f. Turbine Impulse Pressure, P-13

The Turbine Impulse Pressure, P-13 interlock is actuated when 

the pressure in the first stage of the high pressure turbine is 

greater than approximately 10% of the rated full power pressure. 

This is determined by one-out-of-two pressure detectors. The 

LCO requirement for this Function ensures that one of the inputs 

to the P-7 interlock is available.

The LCO requires two channels of Turbine Impulse Pressure, 

P-13 interlock to be OPERABLE in MODE 1.

The Turbine Impulse Chamber Pressure, P-13 interlock must be 

OPERABLE when the turbine generator is operating. The 

interlock Function is not required OPERABLE in MODE 2, 3, 4, 

5, or 6 because the turbine generator is not operating.

19. Reactor Trip Breakers

This trip Function applies to the RTBs exclusive of individual trip 

mechanisms. The LCO requires two OPERABLE trains of trip 

breakers. A trip breaker train consists of all trip breakers associated 

with a single RTS logic train that are racked in, closed, and capable 

of supplying power to the Rod Control System. Thus, the train may 

consist of the main breaker, bypass breaker, or main breaker and 

bypass breaker, depending upon the system configuration. Two 

OPERABLE trains ensure no single random failure can disable the 

RTS trip capability.

These trip Functions must be OPERABLE in MODE 1 or 2 when the 

reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must 

be OPERABLE when the Rod Control System is capable of rod 

withdrawal or one or more rods are not fully inserted.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-32 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

20. Reactor Trip Breaker Undervoltage and Shunt Trip Mechanisms

The LCO requires both the Undervoltage and Shunt Trip 

Mechanisms to be OPERABLE for each RTB that is in service. The 

trip mechanisms are not required to be OPERABLE for trip breakers 

that are open, racked out, incapable of supplying power to the Rod 

Control System, or declared inoperable under Function 19 above. 

OPERABILITY of both trip mechanisms on each breaker ensures that 

no single trip mechanism failure will prevent opening any breaker on 

a valid signal.

These trip Functions must be OPERABLE in MODE 1 or 2 when the 

reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must 

be OPERABLE when the Rod Control System is capable of rod 

withdrawal or one or more rods are not fully inserted.

21. Automatic Trip Logic

The LCO requirement for the RTBs (Functions 19 and 20) and 

Automatic Trip Logic (Function 21) ensures that means are provided 

to interrupt the power to allow the rods to fall into the reactor core. 

Each RTB is equipped with an undervoltage coil and a shunt trip coil 

to trip the breaker open when needed. Each RTB is equipped with a 

bypass breaker to allow testing of the trip breaker while the unit is at 

power. The reactor trip signals generated by the RTS Automatic Trip 

Logic cause the RTBs and associated bypass breakers to open and 

shut down the reactor.

The LCO requires two trains of RTS Automatic Trip Logic to be 

OPERABLE. Having two OPERABLE channels ensures that random 

failure of a single logic channel will not prevent reactor trip.

These trip Functions must be OPERABLE in MODE 1 or 2 when the 

reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must 

be OPERABLE when the Rod Control System is capable of rod 

withdrawal or one or more rods are not fully inserted.

The RTS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-33 Rev. 4.0

BASES

ACTIONS -----------------------------------REVIEWER’S NOTE-----------------------------------

In Table 3.3.1-1, Functions 11.a and 11.b were not included in the generic 

evaluations approved in either WCAP-10271, as supplemented, 

WCAP-15376, or WCAP-14333. In order to apply the WCAP-10271, as 

supplemented, and WCAP-15376 or WCAP-14333 TS relaxations to plant 

specific Functions not evaluated generically, licensees must submit plant 

specific evaluations for NRC review and approval.

--------------------------------------------------------------------------------------------------

A Note has been added to the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed in Table 3.3.1-1.

In the event a channel's [NTSP] is found nonconservative with respect to 

the Allowable Value, or the channel is not functioning as required, or the 

transmitter, instrument loop, signal processing electronics, or bistable is 

found inoperable, then all affected Functions provided by that channel 

must be declared inoperable and the LCO Condition(s) entered for the 

protection Function(s) affected.

When the number of inoperable channels in a trip Function exceed those 

specified in one or other related Conditions associated with a trip 

Function, then the unit is outside the safety analysis. Therefore, 

LCO 3.0.3 must be immediately entered if applicable in the current MODE 

of operation.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use these times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report.

--------------------------------------------------------------------------------------------------

A.1

Condition A applies to all RTS protection Functions. Condition A 

addresses the situation where one or more required channels or trains for 

one or more Functions are inoperable at the same time. The Required 

Action is to refer to Table 3.3.1-1 and to take the Required Actions for the 

protection functions affected. The Completion Times are those from the 

referenced Conditions and Required Actions.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-34 Rev. 4.0

BASES

ACTIONS (continued)

B.1 and B.2

Condition B applies to the Manual Reactor Trip in MODE 1 or 2. This 

action addresses the train orientation of the SSPS for this Function. With 

one channel inoperable, the inoperable channel must be restored to 

OPERABLE status within 48 hours. In this Condition, the remaining 

OPERABLE channel is adequate to perform the safety function.

The Completion Time of 48 hours is reasonable considering that there are 

two automatic actuation trains and another manual initiation channel 

OPERABLE, and the low probability of an event occurring during this 

interval.

If the Manual Reactor Trip Function cannot be restored to OPERABLE 

status within the allowed 48 hour Completion Time, the unit must be 

brought to a MODE in which the requirement does not apply. To achieve 

this status, the unit must be brought to at least MODE 3 within 

6 additional hours (54 hours total time). The 6 additional hours to reach 

MODE 3 is reasonable, based on operating experience, to reach MODE 3 

from full power operation in an orderly manner and without challenging 

unit systems. With the unit in MODE 3, ACTION C would apply to any 

inoperable Manual Reactor Trip Function if the Rod Control System is 

capable of rod withdrawal or one or more rods are not fully inserted.

C.1, C.2.1, and C.2.2

Condition C applies to the following reactor trip Functions in MODE 3, 4, 

or 5 with the Rod Control System capable of rod withdrawal or one or 

more rods not fully inserted:

 Manual Reactor Trip,

 RTBs,

 RTB Undervoltage and Shunt Trip Mechanisms, and

 Automatic Trip Logic.

This action addresses the train orientation of the SSPS for these 

Functions. With one channel or train inoperable, the inoperable channel 

or train must be restored to OPERABLE status within 48 hours. If the 

affected Function(s) cannot be restored to OPERABLE status within the 

allowed 48 hour Completion Time, the unit must be placed in a MODE in 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-35 Rev. 4.0

BASES

ACTIONS (continued)

which the requirement does not apply. To achieve this status, action 

must be initiated within the same 48 hours to ensure that all rods are fully 

inserted, and the Rod Control System must be placed in a condition 

incapable of rod withdrawal within the next hour. The additional hour 

provides sufficient time to accomplish the action in an orderly manner. 

With rods fully inserted and the Rod Control System incapable of rod 

withdrawal, these Functions are no longer required.

The Completion Time is reasonable considering that in this Condition, the 

remaining OPERABLE train is adequate to perform the safety function, 

and given the low probability of an event occurring during this interval.

D.1.1, D.1.2, D.2.1, D.2.2, and D.3

Condition D applies to the Power Range Neutron Flux - High Function.

The NIS power range detectors provide input to the Rod Control System 

and the SG Water Level Control System and, therefore, have a two-outof-four trip logic. A known inoperable channel must be placed in the 

tripped condition. This results in a partial trip condition requiring only 

one-out-of-three logic for actuation. The 72 hours allowed to place the 

inoperable channel in the tripped condition is justified in 

WCAP-14333-P-A (Ref. 8).

In addition to placing the inoperable channel in the tripped condition, 

THERMAL POWER must be reduced to  75% RTP within 78 hours. 

Reducing the power level prevents operation of the core with radial power 

distributions beyond the design limits. With one of the NIS power range 

detectors inoperable, 1/4 of the radial power distribution monitoring 

capability is lost.

As an alternative to the above actions, the inoperable channel can be 

placed in the tripped condition within 72 hours and the QPTR monitored 

once every 12 hours as per SR 3.2.4.2, QPTR verification. Calculating 

QPTR every 12 hours compensates for the lost monitoring capability due 

to the inoperable NIS power range channel and allows continued unit 

operation at power levels > 75% RTP. The 12 hour Frequency is 

consistent with LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-36 Rev. 4.0

BASES

ACTIONS (continued)

As an alternative to the above Actions, the plant must be placed in a 

MODE where this Function is no longer required OPERABLE. Seventyeight hours are allowed to place the plant in MODE 3. The 78 hour 

Completion Time includes 72 hours for channel corrective maintenance, 

and an additional 6 hours for the MODE reduction as required by 

Required Action D.3. This is a reasonable time, based on operating 

experience, to reach MODE 3 from full power in an orderly manner and 

without challenging plant systems. If Required Actions cannot be 

completed within their allowed Completion Times, LCO 3.0.3 must be 

entered.

[ The Required Actions have been modified by a Note that allows placing

the inoperable channel in the bypass condition for up to 12 hours while 

performing routine surveillance testing of other channels. The Note also 

allows placing the inoperable channel in the bypass condition to allow 

setpoint adjustments of other channels when required to reduce the 

setpoint in accordance with other Technical Specifications. The 12 hour 

time limit is justified in Reference 8. ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for 12 hours while performing routine surveillance 

testing, and setpoint adjustments when a setpoint reduction is required by 

other Technical Specifications. The 12 hour time limit is justified in 

Reference 8.

--------------------------------------------------------------------------------------------------

Required Action D.2.2 has been modified by a Note which only requires 

SR 3.2.4.2 to be performed if the Power Range Neutron Flux input to 

QPTR becomes inoperable. Failure of a component in the Power Range 

Neutron Flux Channel which renders the High Flux Trip Function 

inoperable may not affect the capability to monitor QPTR. As such, 

determining QPTR using this movable incore detectors once per 12 hours 

may not be necessary.

E.1 and E.2

Condition E applies to the following reactor trip Functions:

 Power Range Neutron Flux - Low,

 Overtemperature ∆T,
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-37 Rev. 4.0

BASES

ACTIONS (continued)

 Overpower ∆T,

 Power Range Neutron Flux - High Positive Rate,

 Power Range Neutron Flux - High Negative Rate,

 Pressurizer Pressure - High,

 SG Water Level - Low Low, and

 SG Water Level - Low coincident with Steam Flow/Feedwater Flow

Mismatch.

A known inoperable channel must be placed in the tripped condition 

within 72 hours. Placing the channel in the tripped condition results in a 

partial trip condition requiring only one-out-of-two logic for actuation of the 

two-out-of-three trips and one-out-of-three logic for actuation of the twoout-of-four trips. The 72 hours allowed to place the inoperable channel in 

the tripped condition is justified in Reference 8.

If the inoperable channel cannot be placed in the trip condition within the 

specified Completion Time, the unit must be placed in a MODE where 

these Functions are not required OPERABLE. An additional 6 hours is 

allowed to place the unit in MODE 3. Six hours is a reasonable time, 

based on operating experience, to place the unit in MODE 3 from full 

power in an orderly manner and without challenging unit systems.

[ The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to 12 hours while 

performing routine surveillance testing of the other channels. The 

12 hour time limit is justified in Reference 8. ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should be used for plants with installed bypass test 

capability:

--------------------------------------------------------------------------------------------------

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 9.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-38 Rev. 4.0

BASES

ACTIONS (continued)

F.1 and F.2

Condition F applies to the Intermediate Range Neutron Flux trip when 

THERMAL POWER is above the P-6 setpoint and below the P-10 

setpoint and one channel is inoperable. Above the P-6 setpoint and 

below the P-10 setpoint, the NIS intermediate range detector performs 

the monitoring Functions. If THERMAL POWER is greater than the P-6 

setpoint but less than the P-10 setpoint, 24 hours is allowed to reduce 

THERMAL POWER below the P-6 setpoint or increase to THERMAL 

POWER above the P-10 setpoint. The NIS Intermediate Range Neutron 

Flux channels must be OPERABLE when the power level is above the 

capability of the source range, P-6, and below the capability of the power 

range, P-10. If THERMAL POWER is greater than the P-10 setpoint, the 

NIS power range detectors perform the monitoring and protection 

functions and the intermediate range is not required. The Completion 

Times allow for a slow and controlled power adjustment above P-10 or 

below P-6 and take into account the redundant capability afforded by the 

redundant OPERABLE channel, and the low probability of its failure 

during this period. This action does not require the inoperable channel to 

be tripped because the Function uses one-out-of-two logic. Tripping one 

channel would trip the reactor. Thus, the Required Actions specified in 

this Condition are only applicable when channel failure does not result in 

reactor trip.

G.1 and G.2

Condition G applies to two inoperable Intermediate Range Neutron Flux 

trip channels in MODE 2 when THERMAL POWER is above the P-6 

setpoint and below the P-10 setpoint. Required Actions specified in this 

Condition are only applicable when channel failures do not result in 

reactor trip. Above the P-6 setpoint and below the P-10 setpoint, the NIS 

intermediate range detector performs the monitoring Functions. With no 

intermediate range channels OPERABLE, the Required Actions are to 

suspend operations involving positive reactivity additions immediately. 

This will preclude any power level increase since there are no 

OPERABLE Intermediate Range Neutron Flux channels. The operator 

must also reduce THERMAL POWER below the P-6 setpoint within two 

hours. Below P-6, the Source Range Neutron Flux channels will be able 

to monitor the core power level. The Completion Time of 2 hours will 

allow a slow and controlled power reduction to less than the P-6 setpoint 

and takes into account the low probability of occurrence of an event 

during this period that may require the protection afforded by the NIS 

Intermediate Range Neutron Flux trip.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-39 Rev. 4.0

BASES

ACTIONS (continued)

Required Action G.1 is modified by a Note to indicate that normal plant 

control operations that individually add limited positive reactivity (e.g., 

temperature or boron fluctuations associated with RCS inventory 

management or temperature control) are not precluded by this Action, 

provided they are accounted for in the calculated SDM.

H.1

Condition H applies to one inoperable Source Range Neutron Flux trip 

channel when in MODE 2, below the P-6 setpoint, and performing a 

reactor startup. With the unit in this Condition, below P-6, the NIS source 

range performs the monitoring and protection functions. With one of the

two channels inoperable, operations involving positive reactivity additions 

shall be suspended immediately.

This will preclude any power escalation. With only one source range 

channel OPERABLE, core protection is severely reduced and any actions 

that add positive reactivity to the core must be suspended immediately.

Required Action H.1 is modified by a Note to indicate that normal plant 

control operations that individually add limited positive reactivity (e.g., 

temperature or boron fluctuations associated with RCS inventory 

management or temperature control) are not precluded by this Action, 

provided they are accounted for in the calculated SDM.

I.1

Condition I applies to two inoperable Source Range Neutron Flux trip 

channels when in MODE 2, below the P-6 setpoint, and in MODE 3, 4, 

or 5 with the Rod Control System capable of rod withdrawal or one or 

more rods not fully inserted. With the unit in this Condition, below P-6, 

the NIS source range performs the monitoring and protection functions. 

With both source range channels inoperable, the RTBs must be opened 

immediately. With the RTBs open, the core is in a more stable condition.

J.1, J.2.1, and J.2.2

Condition J applies to one inoperable source range channel in MODE 3, 

4, or 5 with the Rod Control System capable of rod withdrawal or one or 

more rods not fully inserted. With the unit in this Condition, below P-6, 

the NIS source range performs the monitoring and protection functions. 

With one of the source range channels inoperable, 48 hours is allowed to
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-40 Rev. 4.0

BASES

ACTIONS (continued)

restore it to an OPERABLE status. If the channel cannot be returned to 

an OPERABLE status, action must be initiated within the same 48 hours 

to ensure that all rods are fully inserted, and the Rod Control System 

must be placed in a condition incapable of rod withdrawal within the next 

hour.

K.1 and K.2

Condition K applies to the following reactor trip Functions:

 Pressurizer Pressure - Low,

 Pressurizer Water Level - High,

 Reactor Coolant Flow – Low,

 Undervoltage RCPs, and

 Underfrequency RCPs.

With one channel inoperable, the inoperable channel must be placed in 

the tripped condition within 72 hours (Ref. 8). For the Pressurizer 

Pressure - Low, Pressurizer Water Level - High, Undervoltage RCPs, and 

Underfrequency RCPs trip Functions, placing the channel in the tripped 

condition when above the P-7 setpoint results in a partial trip condition 

requiring only one additional channel to initiate a reactor trip. For the 

Reactor Coolant Flow - Low trip Function, placing the channel in the 

tripped condition when above the P-8 setpoint results in a partial trip 

condition requiring only one additional channel in the same loop to initiate 

a reactor trip. For the latter trip Function, two tripped channels in two 

RCS loops are required to initiate a reactor trip when below the P-8 

setpoint and above the P-7 setpoint. These Functions do not have to be 

OPERABLE below the P-7 setpoint because there are no loss of flow trips 

below the P-7 setpoint. There is insufficient heat production to generate 

DNB conditions below the P-7 setpoint. The 72 hours allowed to place 

the channel in the tripped condition is justified in Reference 8. An 

additional 6 hours is allowed to reduce THERMAL POWER to below P-7 

if the inoperable channel cannot be restored to OPERABLE status or 

placed in trip within the specified Completion Time.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-41 Rev. 4.0

BASES

ACTIONS (continued)

Allowance of this time interval takes into consideration the redundant 

capability provided by the remaining redundant OPERABLE channel, and 

the low probability of occurrence of an event during this period that may 

require the protection afforded by the Functions associated with 

Condition K.

[ The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to 12 hours while 

performing routine surveillance testing of the other channels. The 

12 hour time limit is justified in Reference 8. ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 8.

--------------------------------------------------------------------------------------------------

L.1 and L.2

Condition L applies to the RCP Breaker Position (Single Loop) reactor trip 

Function. There is one breaker position device per RCP breaker. With 

one channel inoperable, the inoperable channel must be restored to 

OPERABLE status within [6] hours. If the channel cannot be restored to 

OPERABLE status within the [6] hours, then THERMAL POWER must be 

reduced below the P-8 setpoint within the next 4 hours.

This places the unit in a MODE where the LCO is no longer applicable. 

This Function does not have to be OPERABLE below the P-8 setpoint 

because other RTS Functions provide core protection below the P-8 

setpoint. The [6] hours allowed to restore the channel to OPERABLE

status and the 4 additional hours allowed to reduce THERMAL POWER 

to below the P-8 setpoint are justified in Reference 11.

The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to [4] hours while 

performing routine surveillance testing of the other channels. The 

[4] hour time limit is justified in Reference 11.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-42 Rev. 4.0

BASES

ACTIONS (continued)

M.1 and M.2

Condition M applies to the RCP Breaker Position (Two Loops) reactor trip 

Function. There is one breaker position device per RCP breaker. With 

one channel inoperable, the inoperable channel must be placed in trip 

within [6] hours. If the channel cannot be placed in trip within the 

[6] hours, then THERMAL POWER must be reduced below the P-7 

setpoint within the next 6 hours.

This places the unit in a MODE where the LCO is no longer applicable.

This Function does not have to be OPERABLE below the P-7 setpoint 

because other RTS Functions provide core protection below the P-7 

setpoint. The [6] hours allowed to place the channel in trip and the 6

additional hours allowed to reduce THERMAL POWER to below the P-7 

setpoint are justified in Reference 11.

The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to [4] hours while 

performing routine surveillance testing of the other channels. The 

[4] hour time limit is justified in Reference 11.

N.1 and N.2

Condition N applies to Turbine Trip on Low Fluid Oil Pressure or on 

Turbine Stop Valve Closure. With one channel inoperable, the inoperable 

channel must be placed in the trip condition within 72 hours. If placed in 

the tripped condition, this results in a partial trip condition requiring only 

one additional channel to initiate a reactor trip. If the channel cannot be 

restored to OPERABLE status or placed in the trip condition, then power 

must be reduced below the P-9 setpoint within the next 4 hours. The 

72 hours allowed to place the inoperable channel in the tripped condition

is justified in Reference 8. Four hours is allowed for reducing power.

[ The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to 12 hours while 

performing routine surveillance testing of the other channels. The 

12 hour time limit is justified in Reference 8. ]
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-43 Rev. 4.0

BASES

ACTIONS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 8.

--------------------------------------------------------------------------------------------------

O.1 and O.2

Condition O applies to the SI Input from ESFAS reactor trip and the RTS 

Automatic Trip Logic in MODES 1 and 2. These actions address the train 

orientation of the RTS for these Functions. With one train inoperable, 

24 hours are allowed to restore the train to OPERABLE status (Required 

Action O.1) or the unit must be placed in MODE 3 within the next 6 hours. 

The Completion Time of 24 hours (Required Action O.1) is reasonable 

considering that in this Condition, the remaining OPERABLE train is 

adequate to perform the safety function and given the low probability of 

an event during this interval. The 24 hours allowed to restore the 

inoperable RTS Automatic Trip Logic train to OPERABLE status is 

justified in Reference 8. The Completion Time of 6 hours (Required 

Action O.2) is reasonable, based on operating experience, to reach 

MODE 3 from full power in an orderly manner and without challenging 

unit systems.

The Required Actions have been modified by a Note that allows 

bypassing one train up to [4] hours for surveillance testing, provided the 

other train is OPERABLE. [The [4] hour time limit for testing the RTS 

Automatic Trip logic train may include testing the RTB also, if both the 

Logic test and RTB test are conducted within the [4] hour time limit. The 

[4] hour time limit is justified in Reference 8.]

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should replace the bracketed information in the previous 

paragraph if WCAP-14333 and WCAP-15376 are being incorporated:

The [4] hour time limit for the RTS Automatic Trip Logic train testing is 

greater than the 2 hour time limit for the RTBs, which the logic train

supports. The longer time limit for the logic train ([4] hours) is acceptable 

based on Reference 12.

--------------------------------------------------------------------------------------------------
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-44 Rev. 4.0

BASES

ACTIONS (continued)

P.1 and P.2

-----------------------------------REVIEWER’S NOTE-----------------------------------

WCAP-14333-P-A, Rev. 1, "Probabilistic Risk Analysis of the RPS and 

ESFAS Test Times and Completion Times," and the associated TSTF 

(TSTF-418) and WCAP-15376-P, "Risk-Informed Assessment of the RTS 

and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test 

and Completion Times," and the associated TSTF (TSTF-411) both 

modify Condition P. 

WCAP-14333-P-A, Rev. 1 and the associated TSTF-418 provide a 

Completion Time for Required Action P.1 of 1 hour and Required 

Action P.2 of 7 hours. WCAP-14333-P-A, Rev. 1 contains three Notes to 

TS 3.3.1 Condition P. Note 1 states, "One train may be bypassed for up 

to 2 hours for surveillance testing, provided the other train is 

OPERABLE." Note 2 states, "One RTB may be bypassed for up to 

2 hours for maintenance on undervoltage or shunt trip mechanisms, 

provided the other train is OPERABLE." WCAP-14333-P-A, Rev. 1 also 

adds a third Note, which states: "One RTB train may be bypassed for up 

to [4] hours for concurrent surveillance testing of the RTB and automatic 

trip logic, provided the other train is OPERABLE."

WCAP-15376-P and the associated TSTF-411 provide a Completion 

Time for Required Action P.1 of 24 hours and Required Action P.2 of 

30 hours. WCAP-15376-P relaxes the time that an RTB train may be 

bypassed for surveillance testing from 2 hours to 4 hours, and deletes 

Notes 2 and 3 that are added by WCAP-14333-P-A, Rev. 1.

Implementation of TS 3.3.1, Condition P:

1. If WCAP-14333-P-A, Rev. 1 is implemented without implementing 

WCAP-15376-P, the Completion Time for Required Action P.1 will be 

1 hour and for Required Action P.2 will be 7 hours. Condition P will 

contain the three Notes as discussed above, with 2 hours to bypass 

an RTB train for surveillance testing in Note 1.

2. If WCAP-15376-P is implemented without implementing 

WCAP-14333-P-A, Rev. 1, the Completion Time for Required 

Action P.1 will be 24 hours and for Required Action P.2 will be 

30 hours. Condition P will only contain one Note (Note 1 as 

discussed in the first paragraph above), with 4 hours to bypass an 

RTB train for surveillance testing in the Note.

3. If WCAP-14333-P-A, Rev. 1, and WCAP-15376-P are both 

implemented, follow the direction for Item 2, above.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-45 Rev. 4.0

BASES

ACTIONS (continued)

Use the following Bases if WCAP-14333-P-A, Rev. 1 is adopted without 

adopting WCAP-15376-P:

Condition P applies to the RTBs in MODES 1 and 2. These actions 

address the train orientation of the RTS for the RTBs. With one train 

inoperable, 1 hour is allowed to restore the train to OPERABLE 

status or the unit must be placed in MODE 3 within the next 6 hours. 

The Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power in an orderly manner 

and without challenging unit systems. The 1 hour and 6 hour 

Completion Times are equal to the time allowed by LCO 3.0.3 for 

shutdown actions in the event of a complete loss of RTS Function. 

Placing the unit in MODE 3 results in Condition C entry while an RTB

is inoperable.

The Required Actions have been modified by three Notes. Note 1 

allows one channel to be bypassed for up to 2 hours for surveillance 

testing, provided the other train is OPERABLE. Note 1 applies to 

RTB testing that is performed independently from the corresponding 

automatic trip logic testing. Note 2 allows one RTB to be bypassed 

for up to 2 hours for maintenance if the other RTP train is 

OPERABLE. The 2 hour time limit is justified in Reference 9. Note 3 

applies to RTB testing that is performed concurrently with the 

corresponding automatic trip logic test. For concurrent testing of the 

automatic trip logic and RTB, one RTB train may be bypassed for up 

to [4] hours provided the other train is OPERABLE. The [4] hour time 

limit is approved by Reference 8.

Use the following Bases if WCAP-15376-P is adopted without adopting 

WCAP-14333-P-A, Rev. 1 or if both are adopted:

Condition P applies to the RTBs in MODES 1 and 2. These actions 

address the train orientation of the RTS for the RTBs. With one train 

inoperable, 24 hours is allowed for train corrective maintenance to 

restore the train to OPERABLE status or the unit must be placed in 

MODE 3 within the next 6 hours. The 24 hour Completion Time is 

justified in Reference 13. The Completion Time of 6 hours is 

reasonable, based on operating experience, to reach MODE 3 from 

full power in an orderly manner and without challenging unit systems.

Placing the unit in MODE 3 results in Condition C entry while an RTB 

is inoperable.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-46 Rev. 4.0

BASES

ACTIONS (continued)

The Required Actions have been modified by a Note. The Note 

allows one train to be bypassed for up to 4 hours for surveillance 

testing, provided the other train is OPERABLE. The 4 hour time limit 

is justified in Reference 13.

--------------------------------------------------------------------------------------------------

Q.1 and Q.2

Condition Q applies to the P-6 and P-10 interlocks. With one or more 

channels inoperable for one-out-of-two or two-out-of-four coincidence 

logic, the associated interlock must be verified to be in its required state 

for the existing unit condition within 1 hour or the unit must be placed in 

MODE 3 within the next 6 hours. Verifying the interlock status manually 

accomplishes the interlock's Function. The Completion Time of 1 hour is 

based on operating experience and the minimum amount of time allowed 

for manual operator actions. The Completion Time of 6 hours is 

reasonable, based on operating experience, to reach MODE 3 from full 

power in an orderly manner and without challenging unit systems. The 

1 hour and 6 hour Completion Times are equal to the time allowed by 

LCO 3.0.3 for shutdown actions in the event of a complete loss of RTS 

Function.

R.1 and R.2

Condition R applies to the P-7, P-8, P-9, and P-13 interlocks. With one or 

more channels inoperable for one-out-of-two or two-out-of-four 

coincidence logic, the associated interlock must be verified to be in its 

required state for the existing unit condition within 1 hour or the unit must 

be placed in MODE 2 within the next 6 hours. These actions are 

conservative for the case where power level is being raised. Verifying the 

interlock status manually accomplishes the interlock's Function. The 

Completion Time of 1 hour is based on operating experience and the 

minimum amount of time allowed for manual operator actions. The 

Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 2 from full power in an orderly manner and 

without challenging unit systems.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-47 Rev. 4.0

BASES

ACTIONS (continued)

S.1 and S.2

Condition S applies to the RTB Undervoltage and Shunt Trip 

Mechanisms, or diverse trip features, in MODES 1 and 2. With one of the 

diverse trip features inoperable, it must be restored to an OPERABLE 

status within 48 hours or the unit must be placed in a MODE where the 

requirement does not apply. This is accomplished by placing the unit in 

MODE 3 within the next 6 hours (54 hours total time). The Completion 

Time of 6 hours is a reasonable time, based on operating experience, to 

reach MODE 3 from full power in an orderly manner and without 

challenging unit systems. With the unit in MODE 3, ACTION C would 

apply to any inoperable RTB trip mechanism. The affected RTB shall not 

be bypassed while one of the diverse features is inoperable except for the 

time required to perform maintenance to one of the diverse features. The 

allowable time for performing maintenance of the diverse features is 

2 hours for the reasons stated under Condition P.

The Completion Time of 48 hours for Required Action S.1 is reasonable 

considering that in this Condition there is one remaining diverse feature 

for the affected RTB, and one OPERABLE RTB capable of performing the 

safety function and given the low probability of an event occurring during 

this interval.

SURVEILLANCE -----------------------------------REVIEWER’S NOTE-----------------------------------

REQUIREMENTS In Table 3.3.1-1, Functions 11.a and 11.b were not included in the generic 

evaluations approved in either WCAP-10271, as supplemented, or 

WCAP-14333. In order to apply the WCAP-10271, as supplemented, and 

WCAP-14333 TS relaxations to plant specific Functions not evaluated 

generically, licensees must submit plant specific evaluations for NRC 

review and approval.

--------------------------------------------------------------------------------------------------

-------------------------------- REVIEWER’S NOTE ------------------------------------

Notes b and c are applied to the setpoint verification Surveillances for 

each RTS instrumentation Function in Table 3.3.1-1 unless one or more 

of the following exclusions apply:

1. Manual actuation circuits, automatic actuation logic circuits or 

instrument functions that derive input from contacts which have no 

associated sensor or adjustable device, e.g., limit switches, breaker 

position switches, manual actuation switches, float switches, proximity 

detectors, etc. are excluded. In addition, those permissives and 

interlocks that derive input from a sensor or adjustable device that is 

tested as part of another TS function are excluded.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-48 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

2. Settings associated with safety relief valves are excluded. The 

performance of these components is already controlled (i.e., trended 

with as-left and as-found limits) under the ASME Code for Operation 

and Maintenance of Nuclear Power Plants testing program. 

3. Functions and Surveillance Requirements which test only digital

components are normally excluded. There is no expected change in 

result between SR performances for these components. Where 

separate as-left and as-found tolerance is established for digital 

component SRs, the requirements would apply.

--------------------------------------------------------------------------------------------------

The SRs for each RTS Function are identified by the SRs column of 

Table 3.3.1-1 for that Function.

A Note has been added to the SR Table stating that Table 3.3.1-1 

determines which SRs apply to which RTS Functions.

Note that each channel of process protection supplies both trains of the 

RTS. When testing Channel I, Train A and Train B must be examined. 

Similarly, Train A and Train B must be examined when testing Channel II, 

Channel III, and Channel IV (if applicable). The CHANNEL 

CALIBRATION and COTs are performed in a manner that is consistent 

with the assumptions used in analytically calculating the required channel 

accuracies.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Certain Frequencies are based on approval topical reports. In order for a 

licensee to use these times, the licensee must justify the Frequencies as 

required by the staff SER for the topical report.

--------------------------------------------------------------------------------------------------

SR 3.3.1.1

Performance of the CHANNEL CHECK ensures that gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-49 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Agreement criteria are determined by the unit staff based on a 

combination of the channel instrument uncertainties, including indication

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.2

SR 3.3.1.2 compares the calorimetric heat balance calculation to the 

power range channel output. If the calorimetric heat balance calculation 

results exceed the power range channel output by more than 2% RTP, 

the power range channel is not declared inoperable, but must be 

adjusted. The power range channel output shall be adjusted consistent 

with the calorimetric heat balance calculation results if the calorimetric 

calculation exceed the power range channel output by more than + 2% 

RTP. If the power range channel output cannot be properly adjusted, the 

channel is declared inoperable.

If the calorimetric is performed at part power (< [70]% RTP), adjusting the 

power range channel indication in the increasing power direction will 

assure a reactor trip below the safety analysis limit (< [118]% RTP). 

Making no adjustment to the power range channel in the decreasing 

power direction due to a part power calorimetric assures a reactor trip 

consistent with the safety analyses.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-50 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This allowance does not preclude making indicated power adjustments, if 

desired, when the calorimetric heat balance calculation is less than the 

power range channel output. To provide close agreement between 

indicated power and to preserve operating margin, the power range 

channels are normally adjusted when operating at or near full power 

during steady-state conditions. However, discretion must be exercised if 

the power range channel output is adjusted in the decreasing power 

direction due to a part power calorimetric ( [70]% RTP). This action may 

introduce a nonconservative bias at higher power levels which may result 

in an NIS reactor trip above the safety analysis limit ( > [118]% RTP). 

The cause of the potential nonconservative bias is the decreased

accuracy of the calorimetric at reduced power conditions. The primary 

error contributor to the instrument uncertainty for a secondary side power 

calorimetric measurement is the feedwater flow measurement, which is 

typically a P measurement across a feedwater venturi. While the 

measurement uncertainty remains constant in P as power decreases, 

when translated into flow, the uncertainty increases as a square term. 

Thus a 1% flow error at 100% power can approach a 10% flow error at 

30% RTP even though the P error has not changed. An evaluation of 

extended operation at part power conditions would conclude that it is 

prudent to administratively adjust the setpoint of the Power Range 

Neutron Flux - High bistables to ≤ [85]% RTP when: 1) the power range 

channel output is adjusted in the decreasing power direction due to a part 

power calorimetric below [70]% RTP; or 2) for a post refueling startup. 

The evaluation of extended operation at part power conditions would also 

conclude that the potential need to adjust the indication of the Power 

Range Neutron Flux in the decreasing power direction is quite small, 

primarily to address operation in the intermediate range about P-10 

(nominally 10% RTP) to allow enabling of the Power Range Neutron Flux 

- Low setpoint and the Intermediate Range Neutron Flux reactor trips. 

Before the Power Range Neutron Flux - High bistables are reset to 

≤ [109]% RTP, the power range channel adjustment must be confirmed 

based on a calorimetric performed at ≥ [70]% RTP.

-----------------------------------REVIEWER’S NOTE-----------------------------------

A plant specific evaluation based on the guidance in Westinghouse 

Technical Bulletin ESBU-TB-92-14 is required to determine the power 

level below which power range channel adjustments in a decreasing 

power direction become a concern. This evaluation must reflect the plant 

specific RTS setpoint study. In addition, this evaluation should determine 

if additional administrative controls are required for Power Range Neutron 

Flux-High trip setpoint setting changes

--------------------------------------------------------------------------------------------------
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-51 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Note clarifies that this Surveillance is required only if reactor power is 

≥ 15% RTP and that 12 hours are allowed for performing the first 

Surveillance after reaching 15% RTP. A power level of 15% RTP is 

chosen based on plant stability, i.e., automatic rod control capability and 

turbine generator synchronized to the grid.

[ The Frequency of every 24 hours is adequate. It is based on unit 

operating experience, considering instrument reliability and operating 

history data for instrument drift. Together these factors demonstrate that 

a difference between the calorimetric heat balance calculation and the 

power range channel output of more than +2% RTP is not expected in 

any 24 hour period.

In addition, control room operators periodically monitor redundant 

indications and alarms to detect deviations in channel outputs.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.3

SR 3.3.1.3 compares the incore system to the NIS channel output. If the 

absolute difference is ≥ 3%, the NIS channel is still OPERABLE, but must 

be readjusted. The excore NIS channel shall be adjusted if the absolute 

difference between the incore and excore AFD is ≥ 3%.

If the NIS channel cannot be properly readjusted, the channel is declared 

inoperable. This Surveillance is performed to verify the f(∆I) input to the 

overtemperature ∆T Function.

A Note clarifies that the Surveillance is required only if reactor power is 

≥ [15%] RTP and that 24 hours is allowed for performing the first 

Surveillance after reaching [15%] RTP.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-52 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency of every 31 EFPD is adequate. It is based on unit 

operating experience, considering instrument reliability and operating 

history data for instrument drift. Also, the slow changes in neutron flux 

during the fuel cycle can be detected during this interval.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.4

SR 3.3.1.4 is the performance of a TADOT. This test shall verify 

OPERABILITY by actuation of the end devices. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

The RTB test shall include separate verification of the undervoltage and 

shunt trip mechanisms. Independent verification of RTB undervoltage 

and shunt trip Function is not required for the bypass breakers. No 

capability is provided for performing such a test at power. The 

independent test for bypass breakers is included in SR 3.3.1.14. The 

bypass breaker test shall include a local shunt trip. A Note has been 

added to indicate that this test must be performed on the bypass breaker 

prior to placing it in service.

[ The Frequency of every 62 days on a STAGGERED TEST BASIS is 

justified in Reference 13.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-53 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.5

SR 3.3.1.5 is the performance of an ACTUATION LOGIC TEST. The 

SSPS is tested using the semiautomatic tester. The train being tested is 

placed in the bypass condition, thus preventing inadvertent actuation. 

Through the semiautomatic tester, all possible logic combinations, with 

and without applicable permissives, are tested for each protection 

function, including operation of the P-7 permissive which is a logic 

function only. [ The Frequency of every 92 days on a STAGGERED 

TEST BASIS is justified in Reference 13.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.6

SR 3.3.1.6 is a calibration of the excore channels to the incore channels. 

If the measurements do not agree, the excore channels are not declared 

inoperable but must be calibrated to agree with the incore detector 

measurements. If the excore channels cannot be adjusted, the channels 

are declared inoperable. This Surveillance is performed to verify the f(∆I) 

input to the overtemperature ∆T Function.

A Note modifies SR 3.3.1.6. The Note states that this Surveillance is 

required only if reactor power is > 50% RTP and that [24] hours is allowed 

for performing the first surveillance after reaching 50% RTP.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-54 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency of 92 EFPD is adequate. It is based on industry operating 

experience, considering instrument reliability and operating history data 

for instrument drift.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.7

SR 3.3.1.7 is the performance of a COT.

A COT is performed on each required channel to ensure the entire 

channel will perform the intended Function. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

Setpoints must be conservative with respect to the Allowable Values 

specified in Table 3.3.1-1.

The difference between the current "as found" values and the previous 

test "as left" values must be consistent with the drift allowance used in the 

setpoint methodology. The setpoint shall be left set consistent with the 

assumptions of the current unit specific setpoint methodology.

The "as-found" [and "as-left"] values must also be recorded and reviewed 

for consistency with the assumptions of Reference 9.

SR 3.3.1.7 is modified by a Note that provides a 4 hours delay in the 

requirement to perform this Surveillance for source range instrumentation 

when entering MODE 3 from MODE 2. This Note allows a normal 

shutdown to proceed without a delay for testing in MODE 2 and for a 

short time in MODE 3 until the RTBs are open and SR 3.3.1.7 is no 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-55 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

longer required to be performed. If the unit is to be in MODE 3 with the 

RTBs closed for > 4 hours this Surveillance must be performed prior to 

4 hours after entry into MODE 3.

[ The Frequency of 184 days is justified in Reference 9.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.7 is modified by two Notes as identified in Table 3.3.1-1. The 

first Note requires evaluation of channel performance for the condition 

where the as-found setting for the channel setpoint is outside its as-found 

tolerance but conservative with respect to the Allowable Value. 

Evaluation of channel performance will verify that the channel will 

continue to behave in accordance with safety analysis assumptions and 

the channel performance assumptions in the setpoint methodology. The 

purpose of the assessment is to ensure confidence in the channel 

performance prior to returning the channel to service. For channels 

determined to be OPERABLE but degraded, after returning the channel to 

service the channels will be evaluated under the plant Corrective Action 

Program. Entry into the Corrective Action Program will ensure required 

review and documentation of the condition. The second Note requires 

that the as-left setting for the channel be returned to within the as-left 

tolerance of the [NTSP]. Where a setpoint more conservative than the 

[NTSP] is used in the plant surveillance procedures (field setting), the asleft and as-found tolerances, as applicable, will be applied to the 

surveillance procedure setpoint. This will ensure that sufficient margin to 

the Safety Limit and/or Analytical Limit is maintained. If the as-left 

channel setting cannot be returned to a setting within the as-left tolerance 

of the [NTSP], then the channel shall be declared inoperable.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed section '[NTSP and the]' of the sentence in Note (c) in 

Table 3.3.1-1 is not required in plant specific Technical Specifications 

which include a [Nominal Trip Setpoint] column in Table 3.3.1-1.

--------------------------------------------------------------------------------------------------
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-56 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The second Note also requires that the [NTSP and the] methodologies for 

calculating the as-left and the as-found tolerances be in [insert the facility 

FSAR reference or the name of any document incorporated into the 

facility FSAR by reference]. 

SR 3.3.1.8

SR 3.3.1.8 is the performance of a COT as described in SR 3.3.1.7, 

except it is modified by a Note that this test shall include verification that 

the P-6 and P-10 interlocks are in their required state for the existing unit 

condition. A successful test of the required contact(s) of a channel relay 

may be performed by the verification of the change of state of a single 

contact of the relay. This clarifies what is an acceptable COT of a relay. 

This is acceptable because all of the other required contacts of the relay 

are verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. The Frequency is modified by a Note that allows this 

surveillance to be satisfied if it has been performed within [the Frequency 

specified in the Surveillance Frequency Control Program OR 184 days] of 

the Frequencies prior to reactor startup and four hours after reducing 

power below P-10 and P-6. The Frequency of "prior to startup" ensures 

this surveillance is performed prior to critical operations and applies to the 

source, intermediate and power range low instrument channels. The 

Frequency of [12] hours after reducing power below P-10 (applicable to 

intermediate and power range low channels) and 4 hours after reducing 

power below P-6 (applicable to source range channels) allows a normal 

shutdown to be completed and the unit removed from the MODE of 

Applicability for this surveillance without a delay to perform the testing 

required by this surveillance. The Frequency thereafter applies if the 

plant remains in the MODE of Applicability after the initial performances of 

prior to reactor startup and [12] and four hours after reducing power 

below P-10 or P-6, respectively. The MODE of Applicability for this 

surveillance is < P-10 for the power range low and intermediate range 

channels and < P-6 for the source range channels. Once the unit is in 

MODE 3, this surveillance is no longer required. If power is to be 

maintained < P-10 for more than [12] hours or < P-6 for more than 

4 hours, then the testing required by this surveillance must be performed 

prior to the expiration of the time limit. [Twelve] hours and four hours are 

reasonable times to complete the required testing or place the unit in a 

MODE where this surveillance is no longer required. This test ensures 

that the NIS source, intermediate, and power range low channels are 

OPERABLE prior to taking the reactor critical and after reducing power 

into the applicable MODE (< P-10 or < P-6) for periods > [12] and 

4 hours, respectively. [ The Frequency of 184 days is justified in 

Reference 13.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-57 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.8 is modified by two Notes as identified in Table 3.3.1-1. The 

first Note requires evaluation of channel performance for the condition 

where the as-found setting for the channel setpoint is outside its as-found 

tolerance but conservative with respect to the Allowable Value. 

Evaluation of channel performance will verify that the channel will 

continue to behave in accordance with safety analysis assumptions and 

the channel performance assumptions in the setpoint methodology. The 

purpose of the assessment is to ensure confidence in the channel 

performance prior to returning the channel to service. For channels 

determined to be OPERABLE but degraded, after returning the channel to 

service the performance of these channels will be evaluated under the 

plant Corrective Action Program. Entry into the Corrective Action 

Program will ensure required review and documentation of the condition. 

The second Note requires that the as-left setting for the channel be 

returned to within the as-left tolerance of the [NTSP]. Where a setpoint 

more conservative than the [NTSP] is used in the plant surveillance 

procedures (field setting), the as-left and as-found tolerances, as 

applicable, will be applied to the surveillance procedure setpoint. This will 

ensure that sufficient margin to the Safety Limit and/or Analytical Limit is 

maintained. If the as-left channel setting cannot be returned to a setting 

within the as-left tolerance of the [NTSP], then the channel shall be 

declared inoperable.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed section '[NTSP and the]' of the sentence in Note (c) in 

Table 3.3.1-1 is not required in plant specific Technical Specifications 

which include a [Nominal Trip Setpoint] column in Table 3.3.1-1.

--------------------------------------------------------------------------------------------------

The second Note also requires that the [NTSP and the] methodologies for 

calculating the as-left and the as-found tolerances be in [insert the facility 

FSAR reference or the name of any document incorporated into the 

facility FSAR by reference]. 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-58 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.1.9

SR 3.3.1.9 is the performance of a TADOT and [ is performed every 

[92] days, as justified in Reference 9. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

A successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable TADOT of a relay. This is 

acceptable because all of the other required contacts of the relay are 

verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions.

The SR is modified by a Note that excludes verification of setpoints from 

the TADOT. Since this SR applies to RCP undervoltage and 

underfrequency relays, setpoint verification requires elaborate bench 

calibration and is accomplished during the CHANNEL CALIBRATION.

SR 3.3.1.10

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATIONS must be performed consistent with the 

assumptions of the unit specific setpoint methodology. The difference 

between the current "as-found" values and [NTSP or the previous test 

"as-left" values] must be consistent with the drift allowance used in the 

setpoint methodology.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-59 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency of 18 months is based on the assumption of an 18 month 

calibration interval in the determination of the magnitude of equipment 

drift in the setpoint methodology.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.10 is modified by a Note stating that this test shall include 

verification that the time constants are adjusted to the prescribed values 

where applicable.

SR 3.3.1.10 is modified by two Notes as identified in Table 3.3.1-1. The 

first Note requires evaluation of channel performance for the condition 

where the as-found setting for the channel setpoint is outside its as-found 

tolerance but conservative with respect to the Allowable Value. 

Evaluation of channel performance will verify that the channel will 

continue to behave in accordance with safety analysis assumptions and 

the channel performance assumptions in the setpoint methodology. The 

purpose of the assessment is to ensure confidence in the channel 

performance prior to returning the channel to service. For channels 

determined to be OPERABLE but degraded, after returning the channel to 

service the performance of these channels will be evaluated under the 

plant Corrective Action Program. Entry into the Corrective Action 

Program will ensure required review and documentation of the condition. 

The second Note requires that the as-left setting for the channel be 

returned to within the as-left tolerance of the [NTSP]. Where a setpoint 

more conservative than the [NTSP] is used in the plant surveillance 

procedures (field setting), the as-left and as-found tolerances, as 

applicable, will be applied to the surveillance procedure setpoint. This will 

ensure that sufficient margin to the Safety Limit and/or Analytical Limit is 

maintained. If the as-left channel setting cannot be returned to a setting 

within the as-left tolerance of the [NTSP], then the channel shall be 

declared inoperable.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-60 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed section '[NTSP and the]' of the sentence in Note (c) in 

Table 3.3.1-1 is not required in plant specific Technical Specifications 

which include a [Nominal Trip Setpoint] column in Table 3.3.1-1.

--------------------------------------------------------------------------------------------------

The second Note also requires that the [NTSP and the] methodologies for 

calculating the as-left and the as-found tolerances be in [insert the facility 

FSAR reference or the name of any document incorporated into the 

facility FSAR by reference]. 

SR 3.3.1.11

SR 3.3.1.11 is the performance of a CHANNEL CALIBRATION, as 

described in SR 3.3.1.10. This SR is modified by a Note stating that 

neutron detectors are excluded from the CHANNEL CALIBRATION. The 

CHANNEL CALIBRATION for the power range neutron detectors consists 

of a normalization of the detectors based on a power calorimetric and flux 

map performed above 15% RTP. The CHANNEL CALIBRATION for the 

source range and intermediate range neutron detectors consists of 

obtaining the detector plateau or preamp discriminator curves, evaluating 

those curves, and comparing the curves to the manufacturer's data. This 

Surveillance is not required for the NIS power range detectors for entry

into MODE 2 or 1, and is not required for the NIS intermediate range 

detectors for entry into MODE 2, because the unit must be in at least 

MODE 2 to perform the test for the intermediate range detectors and 

MODE 1 for the power range detectors. [ The [18] month Frequency is 

based on the need to perform this Surveillance under the conditions that 

apply during a plant outage and the potential for an unplanned transient if 

the Surveillance were performed with the reactor at power. Operating 

experience has shown these components usually pass the Surveillance 

when performed on the [18] month Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-61 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.1.11 is modified by two Notes as identified in Table 3.3.1-1. The 

first Note requires evaluation of channel performance for the condition 

where the as-found setting for the channel setpoint is outside its as-found 

tolerance but conservative with respect to the Allowable Value. 

Evaluation of channel performance will verify that the channel will 

continue to behave in accordance with safety analysis assumptions and 

the channel performance assumptions in the setpoint methodology. The 

purpose of the assessment is to ensure confidence in the channel 

performance prior to returning the channel to service. For channels 

determined to be OPERABLE but degraded, after returning the channel to 

service the performance of these channels will be evaluated under the 

plant Corrective Action Program. Entry into the Corrective Action 

Program will ensure required review and documentation of the condition. 

The second Note requires that the as-left setting for the channel be 

returned to within the as-left tolerance of the [NTSP]. Where a setpoint 

more conservative than the [NTSP] is used in the plant surveillance 

procedures (field setting), the as-left and as-found tolerances, as 

applicable, will be applied to the surveillance procedure setpoint. This will 

ensure that sufficient margin to the Safety Limit and/or Analytical Limit is 

maintained. If the as-left channel setting cannot be returned to a setting 

within the as-left tolerance of the [NTSP], then the channel shall be 

declared inoperable.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed section '[NTSP and the]' of the sentence in Note (c) in 

Table 3.3.1-1 is not required in plant specific Technical Specifications 

which include a [Nominal Trip Setpoint] column in Table 3.3.1-1.

--------------------------------------------------------------------------------------------------

The second Note also requires that the [NTSP and the] methodologies for 

calculating the as-left and the as-found tolerances be in [insert the facility 

FSAR reference or the name of any document incorporated into the 

facility FSAR by reference]. 

SR 3.3.1.12

SR 3.3.1.12 is the performance of a CHANNEL CALIBRATION, as 

described in SR 3.3.1.10. This SR is modified by a Note stating that this 

test shall include verification of the RCS resistance temperature detector 

(RTD) bypass loop flow rate. Whenever a sensing element is replaced, 

the next required CHANNEL CALIBRATION of the resistance 

temperature detectors (RTD) sensors is accomplished by an inplace 

cross calibration that compares the other sensing elements with the 

recently installed sensing element.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-62 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This test will verify the rate lag compensation for flow from the core to the 

RTDs.

[ The Frequency is justified by the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.12 is modified by two Notes as identified in Table 3.3.1-1. The 

first Note requires evaluation of channel performance for the condition 

where the as-found setting for the channel setpoint is outside its as-found 

tolerance but conservative with respect to the Allowable Value. 

Evaluation of channel performance will verify that the channel will 

continue to behave in accordance with safety analysis assumptions and 

the channel performance assumptions in the setpoint methodology. The 

purpose of the assessment is to ensure confidence in the channel 

performance prior to returning the channel to service. For channels 

determined to be OPERABLE but degraded, after returning the channel to 

service the performance of these channels will be evaluated under the 

plant Corrective Action Program. Entry into the Corrective Action 

Program will ensure required review and documentation of the condition. 

The second Note requires that the as-left setting for the channel be 

returned to within the as-left tolerance of the [NTSP]. Where a setpoint 

more conservative than the [NTSP] is used in the plant surveillance 

procedures (field setting), the as-left and as-found tolerances, as 

applicable, will be applied to the surveillance procedure setpoint. This will 

ensure that sufficient margin to the Safety Limit and/or Analytical Limit is 

maintained. If the as-left channel setting cannot be returned to a setting 

within the as-left tolerance of the [NTSP], then the channel shall be 

declared inoperable.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-63 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed section '[NTSP and the]' of the sentence in Note (c) in 

Table 3.3.1-1 is not required in plant specific Technical Specifications 

which include a [Nominal Trip Setpoint] column in Table 3.3.1-1.

--------------------------------------------------------------------------------------------------

The second Note also requires that the [NTSP and the] methodologies for 

calculating the as-left and the as-found tolerances be in [insert the facility 

FSAR reference or the name of any document incorporated into the 

facility FSAR by reference]. 

SR 3.3.1.13

SR 3.3.1.13 is the performance of a COT of RTS interlocks. A successful 

test of the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

[ The Frequency of 18 months is based on the known reliability of the 

interlocks and the multichannel redundancy available, and has been 

shown to be acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.14

SR 3.3.1.14 is the performance of a TADOT of the Manual Reactor Trip, 

RCP Breaker Position, and the SI Input from ESFAS. A successful test of 

the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-64 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The test shall 

independently verify the OPERABILITY of the undervoltage and shunt trip 

mechanisms for the Manual Reactor Trip Function for the Reactor Trip 

Breakers and Reactor Trip Bypass Breakers. The Reactor Trip Bypass 

Breaker test shall include testing of the automatic undervoltage trip.

[ The Frequency of 18 months is based on the known reliability of the 

Functions and the multichannel redundancy available, and has been 

shown to be acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note that excludes verification of setpoints from 

the TADOT. The Functions affected have no setpoints associated with 

them.

SR 3.3.1.15

SR 3.3.1.15 is the performance of a TADOT of Turbine Trip Functions. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable TADOT of a relay. This is 

acceptable because all of the other required contacts of the relay are 

verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. This TADOT is as described in SR 3.3.1.4, except that this 

test is performed prior to exceeding the [P-9] interlock whenever the unit 

has been in MODE 3. This Surveillance is not required if it has been 

performed within the previous 31 days. Verification of the Trip Setpoint 

does not have to be performed for this Surveillance. Performance of this 

test will ensure that the turbine trip Function is OPERABLE prior to 

exceeding the [P-9] interlock.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-65 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.1.16

SR 3.3.1.16 verifies that the individual channel/train actuation response 

times are less than or equal to the maximum values assumed in the 

accident analysis. Response time testing acceptance criteria are 

included in Technical Requirements Manual, Section 15 (Ref. 14). 

Individual component response times are not modeled in the analyses.

The analyses model the overall or total elapsed time, from the point at 

which the parameter exceeds the trip setpoint value at the sensor to the 

point at which the equipment reaches the required functional state (i.e., 

control and shutdown rods fully inserted in the reactor core).

For channels that include dynamic transfer Functions (e.g., lag, lead/lag, 

rate/lag, etc.), the response time test may be performed with the transfer 

Function set to one, with the resulting measured response time compared 

to the appropriate FSAR response time. Alternately, the response time 

test can be performed with the time constants set to their nominal value, 

provided the required response time is analytically calculated assuming 

the time constants are set at their nominal values. The response time 

may be measured by a series of overlapping tests such that the entire 

response time is measured.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Applicable portions of the following Bases are applicable for plants 

adopting WCAP-13632-P-A and/or WCAP-14036-P.

--------------------------------------------------------------------------------------------------

Response time may be verified by actual response time tests in any 

series of sequential, overlapping or total channel measurements, or by 

the summation of allocated sensor, signal processing and actuation logic 

response times with actual response time tests on the remainder of the 

channel. Allocations for sensor response times may be obtained from: 

(1) historical records based on acceptable response time tests (hydraulic, 

noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g., 

vendor) test measurements, or (3) utilizing vendor engineering 

specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure 

Sensor Response Time Testing Requirements," (Ref. 10) provides the 

basis and methodology for using allocated sensor response times in the 

overall verification of the channel response time for specific sensors 

identified in the WCAP. Response time verification for other sensor types 

must be demonstrated by test.
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-66 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel 

Response Time Tests," (Ref. 15) provides the basis and methodology for 

using allocated signal processing and actuation logic response times in 

the overall verification of the protection system channel response time. ] 

The allocations for sensor, signal conditioning, and actuation logic 

response times must be verified prior to placing the component in 

operational service and re-verified following maintenance that may 

adversely affect response time. In general, electrical repair work does not 

impact response time provided the parts used for repair are of the same 

type and value. Specific components identified in the WCAP may be 

replaced without verification testing. One example where response time 

could be affected is replacing the sensing assembly of a transmitter.

[ As appropriate, each channel's response must be verified every 

[18] months on a STAGGERED TEST BASIS. Testing of the final 

actuation devices is included in the testing. Response times cannot be 

determined during unit operation because equipment operation is 

required to measure response times. Experience has shown that these 

components usually pass this surveillance when performed at the 

18 months Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.16 is modified by a Note stating that neutron detectors are 

excluded from RTS RESPONSE TIME testing. This Note is necessary 

because of the difficulty in generating an appropriate detector input 

signal. Excluding the detectors is acceptable because the principles of 

detector operation ensure a virtually instantaneous response.

REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety Related 

Instrumentation." 

2. FSAR, Chapter [7].

3. FSAR, Chapter [6].
RTS Instrumentation (Without Setpoint Control Program)

B 3.3.1A

Westinghouse STS B 3.3.1A-67 Rev. 4.0

BASES

REFERENCES (continued)

4. FSAR, Chapter [15].

5. IEEE-279-1971.

6. 10 CFR 50.49.

7. Plant specific setpoint methodology study.

8. WCAP-14333-P-A, Rev. 1, October 1998.

9. WCAP-10271-P-A, Supplement 1, May 1986.

10. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor 

Response Time Testing Requirements," January 1996.

11. [ Plant specific evaluation reference.]

12. WCAP-10271-P-A, Supplement 2, June 1990.

13. WCAP-15376, Rev. 0, October 2000.

14. Technical Requirements Manual, Section 15, "Response Times."

15. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection 

Channel Response Time Tests," December 1995.

RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.1B Reactor Trip System (RTS) Instrumentation (With Setpoint Control Program)

BASES

BACKGROUND The RTS initiates a unit shutdown, based on the values of selected unit 

parameters, to protect against violating the core fuel design limits and 

Reactor Coolant System (RCS) pressure boundary during anticipated 

operational occurrences (AOOs) and to assist the Engineered Safety 

Features (ESF) Systems in mitigating accidents.

The protection and monitoring systems have been designed to assure 

safe operation of the reactor. This is achieved by specifying limiting 

safety system settings (LSSS) in terms of parameters directly monitored 

by the RTS, as well as specifying LCOs on other reactor system 

parameters and equipment performance.

Technical Specifications are required by 10 CFR 50.36 to include LSSS 

for variables that have significant safety functions. LSSS are defined by 

the regulation as "Where a LSSS is specified for a variable on which a 

safety limit has been placed, the setting must be chosen so that

automatic protective actions will correct the abnormal situation before a 

Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the 

process variable at which a protective action is initiated, as established by 

the safety analysis, to ensure that a SL is not exceeded. Any automatic 

protection action that occurs on reaching the Analytical Limit therefore 

ensures that the SL is not exceeded. However, in practice, the actual 

settings for automatic protection channels must be chosen to be more 

conservative than the Analytical Limit to account for instrument loop 

uncertainties related to the setting at which the automatic protective 

action would actually occur. The LSSS values are identified and 

maintained in the Setpoint Control Program (SCP) and controlled by 

10 CFR 50.59.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The term "[Limiting Trip Setpoint (LTSP)]" is generic terminology for the 

calculated field setting (setpoint) value calculated by means of the plantspecific setpoint methodology documented in a document controlled 

under 10 CFR 50.59. The term [LTSP] indicates that no additional margin 

has been added between the Analytical Limit and the calculated trip 

setting. 

For most Westinghouse plants the term [Nominal Trip Setpoint (NTSP)] is 

in place of the term [LTSP] and [NTSP] will replace [LTSP] in the Bases 

descriptions. "Field setting" is the suggested terminology for the actual
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-2 Rev. 4.0

BASES

BACKGROUND (continued)

setpoint where margin has been added to the calculated field setting. 

The as-found and as-left tolerances will apply to the field setting 

implemented in the Surveillance procedures to confirm channel 

performance. 

The [NTSP] and field setting are located in the SCP 

--------------------------------------------------------------------------------------------------

The [Nominal Trip Setpoint (NTSP)] specified in the SCP is a 

predetermined setting for a protection channel chosen to ensure 

automatic actuation prior to the process variable reaching the Analytical

Limit and thus ensuring that the SL would not be exceeded. As such, the 

[NTSP] accounts for uncertainties in setting the channel (e.g., calibration), 

uncertainties in how the channel might actually perform (e.g., 

repeatability), changes in the point of action of the channel over time 

(e.g., drift during surveillance intervals), and any other factors which may 

influence its actual performance (e.g., harsh accident environments). In 

this manner, the [NTSP] ensures that SLs are not exceeded. Therefore, 

the [NTSP] meets the definition of an LSSS (Ref. 1).

Technical Specifications contain values related to the OPERABILITY of 

equipment required for safe operation of the facility. OPERABLE is 

defined in Technical Specifications as "...being capable of performing its 

safety functions(s)." Relying solely on the [NTSP] to define 

OPERABILITY in Technical Specifications would be an overly restrictive 

requirement if it were applied as an OPERABILITY limit for the "as-found" 

value of a protection channel setting during a surveillance. This would 

result in Technical Specification compliance problems, as well as reports 

and corrective actions required by the rule which are not necessary to 

ensure safety. For example, an automatic protection channel with a 

setting that has been found to be different from the [NTSP] due to some 

drift of the setting may still be OPERABLE since drift is to be expected. 

This expected drift would have been specifically accounted for in the 

setpoint methodology for calculating the [NTSP] and thus the automatic 

protective action would still have ensured that the SL would not be 

exceeded with the "as-found" setting of the protection channel. 

Therefore, the channel would still be OPERABLE since it would have 

performed its safety function and the only corrective action required would 

be to reset the channel within the established as-left tolerance around the 

[NTSP] to account for further drift during the next surveillance interval.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-3 Rev. 4.0

BASES

BACKGROUND (continued)

During AOOs, which are those events expected to occur one or more 

times during the unit life, the acceptable limits are:

1. The Departure from Nucleate Boiling Ratio (DNBR) shall be 

maintained above the Safety Limit (SL) value to prevent departure 

from nucleate boiling (DNB),

2. Fuel centerline melt shall not occur, and

3. The RCS pressure SL of [2735] psig shall not be exceeded.

Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also 

maintains the above values and assures that offsite dose will be within 

the 10 CFR 50 and 10 CFR 100 criteria during AOOs.

Accidents are events that are analyzed even though they are not 

expected to occur during the unit life. The acceptable limit during 

accidents is that offsite dose shall be maintained within an acceptable 

fraction of 10 CFR 100 limits. Different accident categories are allowed a 

different fraction of these limits, based on probability of occurrence. 

Meeting the acceptable dose limit for an accident category is considered 

having acceptable consequences for that event.

The RTS instrumentation is segmented into four distinct but 

interconnected modules as illustrated in Figure [ ], FSAR, Chapter [7] 

(Ref. 2), and as identified below:

1. Field transmitters or process sensors: provide a measurable 

electronic signal based upon the physical characteristics of the 

parameter being measured,

2. Signal Process Control and Protection System, including Analog 

Protection System, Nuclear Instrumentation System (NIS), field 

contacts, and protection channel sets: provides signal conditioning, 

bistable setpoint comparison, process algorithm actuation, 

compatible electrical signal output to protection system channels, and 

control board/control room/miscellaneous indications,

3. Solid State Protection System (SSPS), including input, logic, and 

output bays: initiates proper unit shutdown and/or ESF actuation in 

accordance with the defined logic, which is based on the bistable 

outputs from the signal process control and protection system, and
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-4 Rev. 4.0

BASES

BACKGROUND (continued)

4. Reactor trip switchgear, including reactor trip breakers (RTBs) and 

bypass breakers: provides the means to interrupt power to the 

control rod drive mechanisms (CRDMs) and allows the rod cluster 

control assemblies (RCCAs), or "rods," to fall into the core and shut 

down the reactor. The bypass breakers allow testing of the RTBs at 

power.

Field Transmitters or Sensors

To meet the design demands for redundancy and reliability, more than 

one, and often as many as four, field transmitters or sensors are used to 

measure unit parameters. To account for the calibration tolerances and 

instrument drift, which are assumed to occur between calibrations, 

statistical allowances are provided in the [NTSP] and Allowable Value. 

The OPERABILITY of each transmitter or sensor is determined by either 

"as-found" calibration data evaluated during the CHANNEL 

CALIBRATION or by qualitative assessment of field transmitter or sensor 

as related to the channel behavior observed during performance of the 

CHANNEL CHECK.

Signal Process Control and Protection System

Generally, three or four channels of process control equipment are used 

for the signal processing of unit parameters measured by the field 

instruments. The process control equipment provides signal conditioning, 

comparable output signals for instruments located on the main control 

board, and comparison of measured input signals with [NTSPs] derived 

from Analytical Limits established by the safety analyses. These 

Analytical Limits are defined in FSAR, Chapter [7] (Ref. 2), Chapter [6] 

(Ref. 3), and Chapter [15] (Ref. 4). If the measured value of a unit 

parameter exceeds the predetermined setpoint, an output from a bistable 

is forwarded to the SSPS for decision evaluation. Channel separation is 

maintained up to and through the input bays. However, not all unit 

parameters require four channels of sensor measurement and signal 

processing. Some unit parameters provide input only to the SSPS, while 

others provide input to the SSPS, the main control board, the unit 

computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, 

three channels with a two-out-of-three logic are sufficient to provide the 

required reliability and redundancy. If one channel fails in a direction that 

would not result in a partial Function trip, the Function is still OPERABLE 

with a two-out-of-two logic. If one channel fails, such that a partial 

Function trip occurs, a trip will not occur and the Function is still 

OPERABLE with a one-out-of-two logic.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-5 Rev. 4.0

BASES

BACKGROUND (continued)

Generally, if a parameter is used for input to the SSPS and a control 

function, four channels with a two-out-of-four logic are sufficient to provide 

the required reliability and redundancy. The circuit must be able to 

withstand both an input failure to the control system, which may then 

require the protection function actuation, and a single failure in the other 

channels providing the protection function actuation. Again, a single 

failure will neither cause nor prevent the protection function actuation. 

These requirements are described in IEEE-279-1971 (Ref. 5). The actual 

number of channels required for each unit parameter is specified in 

Reference 2.

Two logic channels are required to ensure no single random failure of a 

logic channel will disable the RTS. The logic channels are designed such 

that testing required while the reactor is at power may be accomplished 

without causing trip. Provisions to allow removing logic channels from 

service during maintenance are unnecessary because of the logic 

system's designed reliability.

Allowable Values and Nominal Trip Setpoints

The trip setpoints used in the bistables are based on the analytical limits 

stated in Reference 2. The calculation of the [NTSP] is such that 

adequate protection is provided when all sensor and processing time 

delays are taken into account. To allow for calibration tolerances, 

instrumentation uncertainties, instrument drift, and severe environment 

errors for those RTS channels that must function in harsh environments 

as defined by 10 CFR 50.49 (Ref. 6), the Allowable Values specified in 

the SCP are conservative with respect to the analytical limits. A detailed 

description of the methodology used to calculate the Allowable Values 

and [NTSP], including their explicit uncertainties, is provided in the 

"RTS/ESFAS Setpoint Methodology Study" (Ref. 7) which incorporates all 

of the known uncertainties applicable to each channel. The as-left 

tolerance and as-found tolerance band methodology is provided in the 

SCP. The magnitudes of these uncertainties are factored into the 

determination of each [NTSP] and corresponding Allowable Value. The 

trip setpoint entered into the bistable is more conservative than that 

specified by the Allowable Value to account for measurement errors 

detectable by the CHANNEL OPERATIONAL TEST (COT). The 

Allowable Value serves as the as-found Technical Specification 

OPERABILITY limit for the purpose of the COT. 

The [NTSP] is the value at which the bistable is set and is the expected 

value to be achieved during calibration. The [NTSP] value is the LSSS 

and ensures the safety analysis limits are met for the surveillance interval 

selected when a channel is adjusted based on stated channel 

uncertainties. Any bistable is considered to be properly adjusted when
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-6 Rev. 4.0

BASES

BACKGROUND (continued)

the "as-left" [NTSP] value is within the as-left tolerance band for 

CHANNEL CALIBRATION uncertainty allowance (i.e., ± rack calibration 

and comparator setting uncertainties). The [NTSP] value is therefore 

considered a "nominal" value (i.e., expressed as a value without 

inequalities) for the purposes of COT and CHANNEL CALIBRATION.

[NTSPs], in conjunction with the use of as-found and as-left tolerances, 

together with the requirements of the Allowable Value ensure that SLs are 

not violated during AOOs (and that the consequences of DBAs will be 

acceptable, providing the unit is operated from within the LCOs at the 

onset of the AOO or DBA and the equipment functions as designed).

Note that the Allowable Values listed in the SCP are the least 

conservative value of the as-found setpoint that a channel can have 

during a periodic CHANNEL CALIBRATION, COTs, or a TRIP 

ACTUATING DEVICE OPERATIONAL TEST that requires trip setpoint 

verification

Each channel of the process control equipment can be tested on line to 

verify that the signal or setpoint accuracy is within the specified allowance 

requirements of the SCP. Once a designated channel is taken out of 

service for testing, a simulated signal is injected in place of the field 

instrument signal. The process equipment for the channel in test is then 

tested, verified, and calibrated. SRs for the channels are specified in the 

SRs section.

Solid State Protection System

The SSPS equipment is used for the decision logic processing of outputs 

from the signal processing equipment bistables. To meet the redundancy 

requirements, two trains of SSPS, each performing the same functions, 

are provided. If one train is taken out of service for maintenance or test 

purposes, the second train will provide reactor trip and/or ESF actuation 

for the unit. If both trains are taken out of service or placed in test, a 

reactor trip will result. Each train is packaged in its own cabinet for 

physical and electrical separation to satisfy separation and independence 

requirements. The system has been designed to trip in the event of a 

loss of power, directing the unit to a safe shutdown condition.

The SSPS performs the decision logic for actuating a reactor trip or ESF 

actuation, generates the electrical output signal that will initiate the 

required trip or actuation, and provides the status, permissive, and 

annunciator output signals to the main control room of the unit.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-7 Rev. 4.0

BASES

BACKGROUND (continued)

The bistable outputs from the signal processing equipment are sensed by 

the SSPS equipment and combined into logic matrices that represent 

combinations indicative of various unit upset and accident transients. If a 

required logic matrix combination is completed, the system will initiate a 

reactor trip or send actuation signals via master and slave relays to those 

components whose aggregate Function best serves to alleviate the 

condition and restore the unit to a safe condition. Examples are given in 

the Applicable Safety Analyses, LCO, and Applicability sections of this 

Bases.

Reactor Trip Switchgear

The RTBs are in the electrical power supply line from the control rod drive 

motor generator set power supply to the CRDMs. Opening of the RTBs 

interrupts power to the CRDMs, which allows the shutdown rods and 

control rods to fall into the core by gravity. Each RTB is equipped with a 

bypass breaker to allow testing of the RTB while the unit is at power. 

During normal operation the output from the SSPS is a voltage signal that 

energizes the undervoltage coils in the RTBs and bypass breakers, if in 

use. When the required logic matrix combination is completed, the SSPS 

output voltage signal is removed, the undervoltage coils are deenergized, the breaker trip lever is actuated by the de-energized 

undervoltage coil, and the RTBs and bypass breakers are tripped open. 

This allows the shutdown rods and control rods to fall into the core. In 

addition to the de-energization of the undervoltage coils, each breaker is 

also equipped with a shunt trip device that is energized to trip the breaker 

open upon receipt of a reactor trip signal from the SSPS. Either the 

undervoltage coil or the shunt trip mechanism is sufficient by itself, thus 

providing a diverse trip mechanism.

The decision logic matrix Functions are described in the functional 

diagrams included in Reference 3. In addition to the reactor trip or ESF, 

these diagrams also describe the various "permissive interlocks" that are 

associated with unit conditions. Each train has a built in testing device 

that can automatically test the decision logic matrix Functions and the 

actuation channels while the unit is at power. When any one train is 

taken out of service for testing, the other train is capable of providing unit 

monitoring and protection until the testing has been completed. The 

testing device is semiautomatic to minimize testing time.

APPLICABLE The RTS functions to maintain the SLs during all AOOs and mitigates

SAFETY the consequences of DBAs in all MODES in which the Rod Control 

ANALYSES, LCO, System is capable of rod withdrawal or one or more rods are not fully 

and APPLICABILITY inserted.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-8 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Each of the analyzed accidents and transients can be detected by one or 

more RTS Functions. The accident analysis described in Reference 4 

takes credit for most RTS trip Functions. RTS trip Functions not 

specifically credited in the accident analysis are implicitly credited in the 

safety analysis and the NRC staff approved licensing basis for the unit. 

These RTS trip Functions may provide protection for conditions that do 

not require dynamic transient analysis to demonstrate Function 

performance. They may also serve as backups to RTS trip Functions that 

were credited in the accident analysis.

Permissive and interlock setpoints allow the blocking of trips during plant 

startups, and restoration of trips when the permissive conditions are not 

satisfied, but they are not explicitly modeled in the Safety Analyses. 

These permissives and interlocks ensure that the starting conditions are 

consistent with the safety analysis, before preventive or mitigating actions 

occur. Because these permissives or interlocks are only one of multiple 

conservative starting assumptions for the accident analysis, they are 

generally considered as nominal values without regard to measurement 

accuracy. 

The LCO requires all instrumentation performing an RTS Function, listed 

in Table 3.3.1-1 to be OPERABLE. The Allowable Value specified in the 

SCP is the least conservative value of the as-found setpoint that the 

channel can have when tested, such that a channel is OPERABLE if the 

as-found setpoint is within the as-found tolerance and is conservative with 

respect to the Allowable Value during a CHANNEL CALIBRATION or 

COT. As such, the Allowable Value differs from the [NTSP] by an amount 

[greater than or] equal to the expected instrument channel uncertainties, 

such as drift, during the surveillance interval. In this manner, the actual 

setting of the channel [NTSP] will ensure that a SL is not exceeded at any 

given point of time as long as the channel has not drifted beyond 

expected tolerances during the surveillance interval. Note that, although 

the channel is OPERABLE under these circumstances, the trip setpoint 

must be left adjusted to a value within the as-left tolerance, in accordance 

with uncertainty assumptions stated in the referenced setpoint 

methodology (as-left criteria), and confirmed to be operating within the 

statistical allowances of the uncertainty terms assigned (as-found 

criteria). 

If the actual setting of the channel is found to be conservative with 

respect to the Allowable Value but is beyond the as-found tolerance band, 

the channel is OPERABLE but degraded. The degraded condition of the 

channel will be further evaluated during performance of the SR. This 

evaluation will consist of resetting the channel setpoint to the [NTSP]
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-9 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

(within the allowed tolerance), and evaluating the channel's response. If 

the channel is functioning as required and is expected to pass the next 

surveillance, then the channel is OPERABLE and can be restored to 

service at the completion of the surveillance. After the surveillance is 

completed, the channel as-found condition will be entered into the 

Corrective Action Program for further evaluation.

A trip setpoint may be set more conservative than the [NTSP] as 

necessary in response to plant conditions. However, in this case, the 

OPERABILITY of this instrument must be verified based on the [field 

setting] and not the [NTSP]. Failure of any instrument renders the 

affected channel(s) inoperable and reduces the reliability of the affected 

Functions.

The LCO generally requires OPERABILITY of four or three channels in 

each instrumentation Function, two channels of Manual Reactor Trip in 

each logic Function, and two trains in each Automatic Trip Logic Function. 

Four OPERABLE instrumentation channels in a two-out-of-four 

configuration are required when one RTS channel is also used as a 

control system input. This configuration accounts for the possibility of the 

shared channel failing in such a manner that it creates a transient that 

requires RTS action. In this case, the RTS will still provide protection, 

even with random failure of one of the other three protection channels. 

Three OPERABLE instrumentation channels in a two-out-of-three 

configuration are generally required when there is no potential for control 

system and protection system interaction that could simultaneously create 

a need for RTS trip and disable one RTS channel. The two-out-of-three 

and two-out-of-four configurations allow one channel to be tripped during 

maintenance or testing without causing a reactor trip. Specific exceptions 

to the above general philosophy exist and are discussed below.

Reactor Trip System Functions

The safety analyses and OPERABILITY requirements applicable to each 

RTS Function are discussed below:

1. Manual Reactor Trip

The Manual Reactor Trip ensures that the control room operator can 

initiate a reactor trip at any time by using either of two reactor trip 

switches in the control room. A Manual Reactor Trip accomplishes 

the same results as any one of the automatic trip Functions. It is 

used by the reactor operator to shut down the reactor whenever any 

parameter is rapidly trending toward its Trip Setpoint.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-10 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The LCO requires two Manual Reactor Trip channels to be 

OPERABLE. Each channel is controlled by a manual reactor trip 

switch. Each channel activates the reactor trip breaker in both trains. 

Two independent channels are required to be OPERABLE so that no 

single random failure will disable the Manual Reactor Trip Function.

In MODE 1 or 2, manual initiation of a reactor trip must be 

OPERABLE. These are the MODES in which the shutdown rods 

and/or control rods are partially or fully withdrawn from the core. In 

MODE 3, 4, or 5, the manual initiation Function must also be 

OPERABLE if one or more shutdown rods or control rods are 

withdrawn or the Rod Control System is capable of withdrawing the 

shutdown rods or the control rods. In this condition, inadvertent 

control rod withdrawal is possible. In MODE 3, 4, or 5, manual 

initiation of a reactor trip does not have to be OPERABLE if the Rod 

Control System is not capable of withdrawing the shutdown rods or 

control rods and if all rods are fully inserted. If the rods cannot be 

withdrawn from the core, or all of the rods are inserted, there is no 

need to be able to trip the reactor. In MODE 6, neither the shutdown 

rods nor the control rods are permitted to be withdrawn and the 

CRDMs are disconnected from the control rods and shutdown rods. 

Therefore, the manual initiation Function is not required.

2. Power Range Neutron Flux

The NIS power range detectors are located external to the reactor 

vessel and measure neutrons leaking from the core. The NIS power 

range detectors provide input to the Rod Control System and the 

Steam Generator (SG) Water Level Control System. Therefore, the 

actuation logic must be able to withstand an input failure to the 

control system, which may then require the protection function 

actuation, and a single failure in the other channels providing the 

protection function actuation. Note that this Function also provides a 

signal to prevent automatic and manual rod withdrawal prior to 

initiating a reactor trip. Limiting further rod withdrawal may terminate 

the transient and eliminate the need to trip the reactor.

a. Power Range Neutron Flux - High

The Power Range Neutron Flux - High trip Function ensures that 

protection is provided, from all power levels, against a positive 

reactivity excursion leading to DNB during power operations. 

These can be caused by rod withdrawal or reductions in RCS 

temperature.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-11 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The LCO requires all four of the Power Range Neutron Flux -

High channels to be OPERABLE.

In MODE 1 or 2, when a positive reactivity excursion could 

occur, the Power Range Neutron Flux - High trip must be 

OPERABLE. This Function will terminate the reactivity excursion 

and shut down the reactor prior to reaching a power level that 

could damage the fuel. In MODE 3, 4, 5, or 6, the NIS power 

range detectors cannot detect neutron levels in this range. In 

these MODES, the Power Range Neutron Flux - High does not 

have to be OPERABLE because the reactor is shut down and 

reactivity excursions into the power range are extremely unlikely. 

Other RTS Functions and administrative controls provide 

protection against reactivity additions when in MODE 3, 4, 5, 

or 6.

b. Power Range Neutron Flux - Low

The LCO requirement for the Power Range Neutron Flux - Low 

trip Function ensures that protection is provided against a 

positive reactivity excursion from low power or subcritical 

conditions.

The LCO requires all four of the Power Range Neutron Flux -

Low channels to be OPERABLE.

In MODE 1, below the Power Range Neutron Flux (P-10 

setpoint), and in MODE 2, the Power Range Neutron Flux - Low 

trip must be OPERABLE. This Function may be manually 

blocked by the operator when two out of four power range 

channels are greater than approximately 10% RTP (P-10 

setpoint). This Function is automatically unblocked when three 

out of four power range channels are below the P-10 setpoint. 

Above the P-10 setpoint, positive reactivity additions are 

mitigated by the Power Range Neutron Flux - High trip Function.

In MODE 3, 4, 5, or 6, the Power Range Neutron Flux - Low trip 

Function does not have to be OPERABLE because the reactor is 

shut down and the NIS power range detectors cannot detect 

neutron levels in this range. Other RTS trip Functions and 

administrative controls provide protection against positive 

reactivity additions or power excursions in MODE 3, 4, 5, or 6.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-12 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

3. Power Range Neutron Flux Rate

The Power Range Neutron Flux Rate trips use the same channels as 

discussed for Function 2 above.

a. Power Range Neutron Flux - High Positive Rate

The Power Range Neutron Flux - High Positive Rate trip 

Function ensures that protection is provided against rapid 

increases in neutron flux that are characteristic of an RCCA drive 

rod housing rupture and the accompanying ejection of the 

RCCA. This Function compliments the Power Range Neutron 

Flux - High and Low Setpoint trip Functions to ensure that the 

criteria are met for a rod ejection from the power range.

The LCO requires all four of the Power Range Neutron Flux -

High Positive Rate channels to be OPERABLE.

In MODE 1 or 2, when there is a potential to add a large amount 

of positive reactivity from a rod ejection accident (REA), the 

Power Range Neutron Flux - High Positive Rate trip must be 

OPERABLE. In MODE 3, 4, 5, or 6, the Power Range Neutron 

Flux - High Positive Rate trip Function does not have to be 

OPERABLE because other RTS trip Functions and 

administrative controls will provide protection against positive 

reactivity additions. Also, since only the shutdown banks may be 

withdrawn in MODE 3, 4, or 5, the remaining complement of 

control bank worth ensures a sufficient degree of SDM in the 

event of an REA. In MODE 6, no rods are withdrawn and the 

SDM is increased during refueling operations. The reactor 

vessel head is also removed or the closure bolts are detensioned 

preventing any pressure buildup. In addition, the NIS power

range detectors cannot detect neutron levels present in this 

mode.

b. Power Range Neutron Flux - High Negative Rate

The Power Range Neutron Flux - High Negative Rate trip 

Function ensures that protection is provided for multiple rod drop 

accidents. At high power levels, a multiple rod drop accident 

could cause local flux peaking that would result in a 

nonconservative local DNBR. DNBR is defined as the ratio of 
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-13 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

the heat flux required to cause a DNB at a particular location in 

the core to the local heat flux. The DNBR is indicative of the 

margin to DNB. No credit is taken for the operation of this 

Function for those rod drop accidents in which the local DNBRs 

will be greater than the limit.

The LCO requires all four Power Range Neutron Flux - High 

Negative Rate channels to be OPERABLE.

In MODE 1 or 2, when there is potential for a multiple rod drop 

accident to occur, the Power Range Neutron Flux - High 

Negative Rate trip must be OPERABLE. In MODE 3, 4, 5, or 6, 

the Power Range Neutron Flux - High Negative Rate trip 

Function does not have to be OPERABLE because the core is 

not critical and DNB is not a concern. Also, since only the 

shutdown banks may be withdrawn in MODE 3, 4, or 5, the 

remaining complement of control bank worth ensures a sufficient 

degree of SDM in the event of an REA. In MODE 6, no rods are 

withdrawn and the required SDM is increased during refueling 

operations. In addition, the NIS power range detectors cannot 

detect neutron levels present in this MODE.

4. Intermediate Range Neutron Flux

The Intermediate Range Neutron Flux trip Function ensures that 

protection is provided against an uncontrolled RCCA bank rod 

withdrawal accident from a subcritical condition during startup. This 

trip Function provides redundant protection to the Power Range 

Neutron Flux - Low Setpoint trip Function. The NIS intermediate 

range detectors are located external to the reactor vessel and 

measure neutrons leaking from the core. The NIS intermediate 

range detectors do not provide any input to control systems. Note 

that this Function also provides a signal to prevent automatic and 

manual rod withdrawal prior to initiating a reactor trip. Limiting further 

rod withdrawal may terminate the transient and eliminate the need to 

trip the reactor.

The LCO requires two channels of Intermediate Range Neutron Flux 

to be OPERABLE. Two OPERABLE channels are sufficient to 

ensure no single random failure will disable this trip Function.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-14 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Because this trip Function is important only during startup, there is 

generally no need to disable channels for testing while the Function 

is required to be OPERABLE. Therefore, a third channel is 

unnecessary.

In MODE 1 below the P-10 setpoint, and in MODE 2 above the P-6 

setpoint, when there is a potential for an uncontrolled RCCA bank rod 

withdrawal accident during reactor startup, the Intermediate Range 

Neutron Flux trip must be OPERABLE. Above the P-10 setpoint, the 

Power Range Neutron Flux - High Setpoint trip and the Power Range 

Neutron Flux - High Positive Rate trip provide core protection for a 

rod withdrawal accident. In MODE 2 below the P-6 setpoint, the 

Source Range Neutron Flux Trip provides the core protection for 

reactivity accidents. In MODE 3, 4, or 5, the Intermediate Range 

Neutron Flux trip does not have to be OPERABLE because the 

control rods must be fully inserted and only the shutdown rods may 

be withdrawn. The reactor cannot be started up in this condition. 

The core also has the required SDM to mitigate the consequences of 

a positive reactivity addition accident. In MODE 6, all rods are fully 

inserted and the core has a required increased SDM. Also, the NIS 

intermediate range detectors cannot detect neutron levels present in 

this MODE.

5. Source Range Neutron Flux

The LCO requirement for the Source Range Neutron Flux trip 

Function ensures that protection is provided against an uncontrolled 

RCCA bank rod withdrawal accident from a subcritical condition 

during startup. This trip Function provides redundant protection to 

the Power Range Neutron Flux - Low trip Function. In MODES 3, 4, 

and 5, administrative controls also prevent the uncontrolled 

withdrawal of rods. The NIS source range detectors are located 

external to the reactor vessel and measure neutrons leaking from the 

core. The NIS source range detectors do not provide any inputs to 

control systems. The source range trip is the only RTS automatic 

protection function required in MODES 3, 4, and 5 when rods are 

capable of withdrawal or one or more rods are not fully inserted. 

Therefore, the functional capability at the specified Trip Setpoint is 

assumed to be available.

The Source Range Neutron Flux Function provides protection for 

control rod withdrawal from subcritical, boron dilution and control rod 

ejection events.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-15 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

In MODE 2 when below the P-6 setpoint and in MODES 3, 4, and 5 

when there is a potential for an uncontrolled RCCA bank rod 

withdrawal accident, the Source Range Neutron Flux trip must be 

OPERABLE. Two OPERABLE channels are sufficient to ensure no 

single random failure will disable this trip Function. Above the P-6 

setpoint, the Intermediate Range Neutron Flux trip and the Power 

Range Neutron Flux - Low trip will provide core protection for 

reactivity accidents. Above the P-6 setpoint, the NIS source range 

detectors are de-energized.

In MODES 3, 4, and 5 with all rods fully inserted and the Rod Control 

System not capable of rod withdrawal, and in MODE 6, the outputs of 

the Function to RTS logic are not required OPERABLE. The 

requirements for the NIS source range detectors to monitor core 

neutron levels and provide indication of reactivity changes that may 

occur as a result of events like a boron dilution are addressed in 

LCO 3.3.9 "Boron Dilution Protection System (BDPS)," for MODE 3, 

4, or 5 and LCO 3.9.3, "Nuclear Instrumentation," for MODE 6.

6. Overtemperature ∆T

The Overtemperature ∆T trip Function is provided to ensure that the 

design limit DNBR is met. This trip Function also limits the range 

over which the Overpower ∆T trip Function must provide protection. 

The inputs to the Overtemperature ∆T trip include all pressure, 

coolant temperature, axial power distribution, and reactor power as 

indicated by loop ∆T assuming full reactor coolant flow. Protection 

from violating the DNBR limit is assured for those transients that are 

slow with respect to delays from the core to the measurement 

system. The Function monitors both variation in power and flow 

since a decrease in flow has the same effect on ∆T as a power 

increase. The Overtemperature ∆T trip Function uses each loop's ∆T 

as a measure of reactor power and is compared with a setpoint that 

is automatically varied with the following parameters:

 reactor coolant average temperature - the Trip Setpoint is varied 

to correct for changes in coolant density and specific heat 

capacity with changes in coolant temperature,

 pressurizer pressure - the Trip Setpoint is varied to correct for 

changes in system pressure, and
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-16 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

 axial power distribution - f(∆I), the Trip Setpoint is varied to 

account for imbalances in the axial power distribution as 

detected by the NIS upper and lower power range detectors. If 

axial peaks are greater than the design limit, as indicated by the 

difference between the upper and lower NIS power range 

detectors, the Trip Setpoint is reduced in accordance with the 

SCP.

Dynamic compensation is included for system piping delays from the 

core to the temperature measurement system.

The Overtemperature ∆T trip Function is calculated for each loop as 

described in the SCP. Trip occurs if Overtemperature ∆T is indicated 

in two loops. At some units, the pressure and temperature signals 

are used for other control functions. For those units, the actuation 

logic must be able to withstand an input failure to the control system, 

which may then require the protection function actuation, and a single 

failure in the other channels providing the protection function 

actuation. Note that this Function also provides a signal to generate 

a turbine runback prior to reaching the Trip Setpoint. A turbine 

runback will reduce turbine power and reactor power. A reduction in 

power will normally alleviate the Overtemperature ∆T condition and 

may prevent a reactor trip.

The LCO requires all four channels of the Overtemperature ∆T trip 

Function to be OPERABLE for two and four loop units (the LCO 

requires all three channels on the Overtemperature ∆T trip Function 

to be OPERABLE for three loop units). Note that the 

Overtemperature ∆T Function receives input from channels shared 

with other RTS Functions. Failures that affect multiple Functions 

require entry into the Conditions applicable to all affected Functions.

In MODE 1 or 2, the Overtemperature ∆T trip must be OPERABLE to 

prevent DNB. In MODE 3, 4, 5, or 6, this trip Function does not have 

to be OPERABLE because the reactor is not operating and there is 

insufficient heat production to be concerned about DNB.

7. Overpower ∆T

The Overpower ∆T trip Function ensures that protection is provided 

to ensure the integrity of the fuel (i.e., no fuel pellet melting and less 

than 1% cladding strain) under all possible overpower conditions. 

This trip Function also limits the required range of the

Overtemperature ∆T trip Function and provides a backup to the 

Power Range Neutron Flux - High Setpoint trip. The Overpower ∆T 

trip Function ensures that the allowable heat generation rate (kW/ft)
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-17 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

of the fuel is not exceeded. It uses the ∆T of each loop as a measure 

of reactor power with a setpoint that is automatically varied with the 

following parameters:

 reactor coolant average temperature - the Trip Setpoint is varied 

to correct for changes in coolant density and specific heat 

capacity with changes in coolant temperature, and

 rate of change of reactor coolant average temperature - including 

dynamic compensation for the delays between the core and the 

temperature measurement system.

The Overpower ∆T trip Function is calculated for each loop as per the 

SCP. Trip occurs if Overpower ∆T is indicated in two loops. At some 

units, the temperature signals are used for other control functions. At 

those units, the actuation logic must be able to withstand an input 

failure to the control system, which may then require the protection 

function actuation and a single failure in the remaining channels 

providing the protection function actuation. Note that this Function 

also provides a signal to generate a turbine runback prior to reaching 

the Allowable Value. A turbine runback will reduce turbine power and 

reactor power. A reduction in power will normally alleviate the 

Overpower ∆T condition and may prevent a reactor trip.

The LCO requires four channels for two and four loop units (three 

channels for three loop units) of the Overpower ∆T trip Function to be 

OPERABLE. Note that the Overpower ∆T trip Function receives 

input from channels shared with other RTS Functions. Failures that 

affect multiple Functions require entry into the Conditions applicable 

to all affected Functions.

In MODE 1 or 2, the Overpower ∆T trip Function must be 

OPERABLE. These are the only times that enough heat is generated 

in the fuel to be concerned about the heat generation rates and 

overheating of the fuel. In MODE 3, 4, 5, or 6, this trip Function does 

not have to be OPERABLE because the reactor is not operating and 

there is insufficient heat production to be concerned about fuel 

overheating and fuel damage.

8. Pressurizer Pressure

The same sensors provide input to the Pressurizer Pressure - High 

and - Low trips and the Overtemperature ∆T trip. At some units, the 

Pressurizer Pressure channels are also used to provide input to the 

Pressurizer Pressure Control System. For those units, the actuation
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-18 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

logic must be able to withstand an input failure to the control system, 

which may then require the protection function actuation, and a single 

failure in the other channels providing the protection function 

actuation.

a. Pressurizer Pressure - Low

The Pressurizer Pressure - Low trip Function ensures that 

protection is provided against violating the DNBR limit due to low 

pressure.

The LCO requires four channels for two and four loop units 

(three channels for three loop units) of Pressurizer Pressure -

Low to be OPERABLE.

In MODE 1, when DNB is a major concern, the Pressurizer 

Pressure - Low trip must be OPERABLE. This trip Function is 

automatically enabled on increasing power by the P-7 interlock 

(NIS power range P-10 or turbine impulse pressure greater than 

approximately 10% of full power equivalent (P-13)). On 

decreasing power, this trip Function is automatically blocked 

below P-7. Below the P-7 setpoint, no conceivable power 

distributions can occur that would cause DNB concerns.

b. Pressurizer Pressure - High

The Pressurizer Pressure - High trip Function ensures that 

protection is provided against overpressurizing the RCS. This 

trip Function operates in conjunction with the pressurizer relief 

and safety valves to prevent RCS overpressure conditions.

The LCO requires four channels for two and four loop units 

(three channels for three loop units) of the Pressurizer Pressure -

High to be OPERABLE.

The Pressurizer Pressure - High LSSS is selected to be below 

the pressurizer safety valve actuation pressure and above the 

power operated relief valve (PORV) setting. This setting

minimizes challenges to safety valves while avoiding 

unnecessary reactor trip for those pressure increases that can 

be controlled by the PORVs.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-19 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

In MODE 1 or 2, the Pressurizer Pressure - High trip must be 

OPERABLE to help prevent RCS overpressurization and 

minimize challenges to the relief and safety valves. In MODE 3, 

4, 5, or 6, the Pressurizer Pressure - High trip Function does not 

have to be OPERABLE because transients that could cause an 

overpressure condition will be slow to occur. Therefore, the 

operator will have sufficient time to evaluate unit conditions and 

take corrective actions. Additionally, low temperature 

overpressure protection systems provide overpressure protection 

when below MODE 4.

9. Pressurizer Water Level - High

The Pressurizer Water Level - High trip Function provides a backup 

signal for the Pressurizer Pressure - High trip and also provides 

protection against water relief through the pressurizer safety valves. 

These valves are designed to pass steam in order to achieve their 

design energy removal rate. A reactor trip is actuated prior to the 

pressurizer becoming water solid. The LCO requires three channels

of Pressurizer Water Level - High to be OPERABLE. The pressurizer 

level channels are used as input to the Pressurizer Level Control 

System. A fourth channel is not required to address 

control/protection interaction concerns. The level channels do not 

actuate the safety valves, and the high pressure reactor trip is set 

below the safety valve setting. Therefore, with the slow rate of 

charging available, pressure overshoot due to level channel failure 

cannot cause the safety valve to lift before reactor high pressure trip.

In MODE 1, when there is a potential for overfilling the pressurizer, 

the Pressurizer Water Level - High trip must be OPERABLE. This 

trip Function is automatically enabled on increasing power by the P-7 

interlock. On decreasing power, this trip Function is automatically 

blocked below P-7. Below the P-7 setpoint, transients that could 

raise the pressurizer water level will be slow and the operator will 

have sufficient time to evaluate unit conditions and take corrective 

actions.

10. Reactor Coolant Flow - Low

The Reactor Coolant Flow - Low trip Function ensures that protection 

is provided against violating the DNBR limit due to low flow in one or 

more RCS loops, while avoiding reactor trips due to normal 

variations in loop flow. Above the P-7 setpoint, the reactor trip on 

low flow in two or more RCS loops is automatically enabled. Above 
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-20 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

the P-8 setpoint, which is approximately 48% RTP, a loss of flow in 

any RCS loop will actuate a reactor trip. Each RCS loop has three 

flow detectors to monitor flow. The flow signals are not used for any 

control system input.

The LCO requires three Reactor Coolant Flow - Low channels per 

loop to be OPERABLE in MODE 1 above P-7.

In MODE 1 above the P-8 setpoint, a loss of flow in one RCS loop 

could result in DNB conditions in the core because of the higher 

power level. In MODE 1 below the P-8 setpoint and above the P-7 

setpoint, a loss of flow in two or more loops is required to actuate a 

reactor trip because of the lower power level and the greater margin 

to the design limit DNBR. Below the P-7 setpoint, all reactor trips on 

low flow are automatically blocked since there is insufficient heat 

production to generate DNB conditions.

11. Reactor Coolant Pump (RCP) Breaker Position

Both RCP Breaker Position trip Functions operate together on two 

sets of auxiliary contacts, with one set on each RCP breaker. These 

Functions anticipate the Reactor Coolant Flow - Low trips to avoid 

RCS heatup that would occur before the low flow trip actuates.

a. Reactor Coolant Pump Breaker Position (Single Loop)

The RCP Breaker Position (Single Loop) trip Function ensures 

that protection is provided against violating the DNBR limit due to 

a loss of flow in one RCS loop. The position of each RCP 

breaker is monitored. If one RCP breaker is open above the P-8 

setpoint, a reactor trip is initiated. This trip Function will generate 

a reactor trip before the Reactor Coolant Flow - Low (Single 

Loop) Trip Setpoint is reached.

The LCO requires one RCP Breaker Position channel per RCP 

to be OPERABLE. One OPERABLE channel is sufficient for this 

trip Function because the RCS Flow - Low trip alone provides 

sufficient protection of unit SLs for loss of flow events. The RCP 

Breaker Position trip serves only to anticipate the low flow trip, 

minimizing the thermal transient associated with loss of a pump.

This Function measures only the discrete position (open or 

closed) of the RCP breaker, using a position switch. Therefore, 

the Function has no adjustable trip setpoint with which to 

associate an LSSS.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-21 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

In MODE 1 above the P-8 setpoint, when a loss of flow in any 

RCS loop could result in DNB conditions in the core, the RCP 

Breaker Position (Single Loop) trip must be OPERABLE. In 

MODE 1 below the P-8 setpoint, a loss of flow in two or more 

loops is required to actuate a reactor trip because of the lower 

power level and the greater margin to the design limit DNBR.

b. Reactor Coolant Pump Breaker Position (Two Loops)

The RCP Breaker Position (Two Loops) trip Function ensures 

that protection is provided against violating the DNBR limit due to 

a loss of flow in two or more RCS loops. The position of each 

RCP breaker is monitored. Above the P-7 setpoint and below 

the P-8 setpoint, a loss of flow in two or more loops will initiate a 

reactor trip. This trip Function will generate a reactor trip before 

the Reactor Coolant Flow - Low (Two Loops) Trip Setpoint is 

reached.

The LCO requires one RCP Breaker Position channel per RCP 

to be OPERABLE. One OPERABLE channel is sufficient for this 

Function because the RCS Flow - Low trip alone provides 

sufficient protection of unit SLs for loss of flow events. The RCP 

Breaker Position trip serves only to anticipate the low flow trip, 

minimizing the thermal transient associated with loss of an RCP.

This Function measures only the discrete position (open or 

closed) of the RCP breaker, using a position switch. Therefore, 

the Function has no adjustable trip setpoint with which to 

associate an LSSS.

In MODE 1 above the P-7 setpoint and below the P-8 setpoint, 

the RCP Breaker Position (Two Loops) trip must be OPERABLE. 

Below the P-7 setpoint, all reactor trips on loss of flow are 

automatically blocked since no conceivable power distributions 

could occur that would cause a DNB concern at this low power 

level. Above the P-7 setpoint, the reactor trip on loss of flow in 

two RCS loops is automatically enabled. Above the P-8 setpoint, 

a loss of flow in any one loop will actuate a reactor trip because 

of the higher power level and the reduced margin to the design 

limit DNBR.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-22 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

12. Undervoltage Reactor Coolant Pumps

The Undervoltage RCPs reactor trip Function ensures that protection 

is provided against violating the DNBR limit due to a loss of flow in 

two or more RCS loops. The voltage to each RCP is monitored. 

Above the P-7 setpoint, a loss of voltage detected on two or more 

RCP buses will initiate a reactor trip. This trip Function will generate 

a reactor trip before the Reactor Coolant Flow - Low (Two Loops) 

Trip Setpoint is reached. Time delays are incorporated into the 

Undervoltage RCPs channels to prevent reactor trips due to 

momentary electrical power transients.

The LCO requires three Undervoltage RCPs channels (one per 

phase) per bus to be OPERABLE.

In MODE 1 above the P-7 setpoint, the Undervoltage RCP trip must 

be OPERABLE. Below the P-7 setpoint, all reactor trips on loss of 

flow are automatically blocked since no conceivable power 

distributions could occur that would cause a DNB concern at this low

power level. Above the P-7 setpoint, the reactor trip on loss of flow in 

two or more RCS loops is automatically enabled. This Function uses 

the same relays as the ESFAS Function 6.f, "Undervoltage Reactor 

Coolant Pump (RCP)" start of the auxiliary feedwater (AFW) pumps.

13. Underfrequency Reactor Coolant Pumps

The Underfrequency RCPs reactor trip Function ensures that 

protection is provided against violating the DNBR limit due to a loss 

of flow in two or more RCS loops from a major network frequency 

disturbance. An underfrequency condition will slow down the pumps, 

thereby reducing their coastdown time following a pump trip. The 

proper coastdown time is required so that reactor heat can be 

removed immediately after reactor trip. The frequency of each RCP 

bus is monitored. Above the P-7 setpoint, a loss of frequency 

detected on two or more RCP buses will initiate a reactor trip. This 

trip Function will generate a reactor trip before the Reactor Coolant 

Flow - Low (Two Loops) Trip Setpoint is reached. Time delays are 

incorporated into the Underfrequency RCPs channels to prevent 

reactor trips due to momentary electrical power transients.

The LCO requires three Underfrequency RCPs channels per bus to 

be OPERABLE.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-23 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

In MODE 1 above the P-7 setpoint, the Underfrequency RCPs trip 

must be OPERABLE. Below the P-7 setpoint, all reactor trips on loss 

of flow are automatically blocked since no conceivable power 

distributions could occur that would cause a DNB concern at this low 

power level. Above the P-7 setpoint, the reactor trip on loss of flow in 

two or more RCS loops is automatically enabled.

14. Steam Generator Water Level - Low Low

The SG Water Level - Low Low trip Function ensures that protection 

is provided against a loss of heat sink and actuates the AFW System 

prior to uncovering the SG tubes. The SGs are the heat sink for the 

reactor. In order to act as a heat sink, the SGs must contain a 

minimum amount of water. A narrow range low low level in any SG is 

indicative of a loss of heat sink for the reactor. The level transmitters 

provide input to the SG Level Control System. Therefore, the 

actuation logic must be able to withstand an input failure to the 

control system, which may then require the protection function 

actuation, and a single failure in the other channels providing the 

protection function actuation. This Function also performs the 

ESFAS function of starting the AFW pumps on low low SG level.

The LCO requires four channels of SG Water Level - Low Low per 

SG to be OPERABLE for four loop units in which these channels are 

shared between protection and control. In two, three, and four loop 

units where three SG Water Levels are dedicated to the RTS, only 

three channels per SG are required to be OPERABLE.

In MODE 1 or 2, when the reactor requires a heat sink, the SG Water 

Level - Low Low trip must be OPERABLE. The normal source of 

water for the SGs is the Main Feedwater (MFW) System (not safety 

related). The MFW System is only in operation in MODE 1 or 2. The 

AFW System is the safety related backup source of water to ensure 

that the SGs remain the heat sink for the reactor. During normal 

startups and shutdowns, the AFW System provides feedwater to 

maintain SG level. In MODE 3, 4, 5, or 6, the SG Water Level - Low 

Low Function does not have to be OPERABLE because the MFW 

System is not in operation and the reactor is not operating or even 

critical. Decay heat removal is accomplished by the AFW System in 

MODE 3 and by the Residual Heat Removal (RHR) System in 

MODE 4, 5, or 6.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-24 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

15. Steam Generator Water Level - Low, Coincident With Steam 

Flow/Feedwater Flow Mismatch

SG Water Level - Low, in conjunction with the Steam Flow/Feedwater 

Flow Mismatch, ensures that protection is provided against a loss of 

heat sink and actuates the AFW System prior to uncovering the SG 

tubes. In addition to a decreasing water level in the SG, the 

difference between feedwater flow and steam flow is evaluated to 

determine if feedwater flow is significantly less than steam flow. With 

less feedwater flow than steam flow, SG level will decrease at a rate 

dependent upon the magnitude of the difference in flow rates. There 

are two SG level channels and two Steam Flow/Feedwater Flow 

Mismatch channels per SG. One narrow range level channel sensing 

a low level coincident with one Steam Flow/Feedwater Flow 

Mismatch channel sensing flow mismatch (steam flow greater than 

feed flow) will actuate a reactor trip.

The LCO requires two channels of SG Water Level - Low coincident 

with Steam Flow/Feedwater Flow Mismatch.

In MODE 1 or 2, when the reactor requires a heat sink, the SG Water 

Level - Low coincident with Steam Flow/Feedwater Flow Mismatch 

trip must be OPERABLE. The normal source of water for the SGs is 

the MFW System (not safety related). The MFW System is only in 

operation in MODE 1 or 2. The AFW System is the safety related 

backup source of water to ensure that the SGs remain the heat sink 

for the reactor. During normal startups and shutdowns, the AFW 

System provides feedwater to maintain SG level. In MODE 3, 4, 5, 

or 6, the SG Water Level - Low coincident with Steam 

Flow/Feedwater Flow Mismatch Function does not have to be 

OPERABLE because the MFW System is not in operation and the 

reactor is not operating or even critical. Decay heat removal is 

accomplished by the AFW System in MODE 3 and by the RHR 

System in MODE 4, 5, or 6. The MFW System is in operation only in 

MODE 1 or 2 and, therefore, this trip Function need only be 

OPERABLE in these MODES.

16. Turbine Trip

a. Turbine Trip - Low Fluid Oil Pressure

The Turbine Trip - Low Fluid Oil Pressure trip Function 

anticipates the loss of heat removal capabilities of the secondary 

system following a turbine trip. This trip Function acts to 

minimize the pressure/temperature transient on the reactor. Any 

turbine trip from a power level below the P-9 setpoint, 
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-25 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

approximately 50% power, will not actuate a reactor trip. Three 

pressure switches monitor the control oil pressure in the Turbine 

Electrohydraulic Control System. A low pressure condition 

sensed by two-out-of-three pressure switches will actuate a 

reactor trip. These pressure switches do not provide any input to 

the control system. The unit is designed to withstand a complete 

loss of load and not sustain core damage or challenge the RCS 

pressure limitations. Core protection is provided by the 

Pressurizer Pressure - High trip Function and RCS integrity is 

ensured by the pressurizer safety valves.

The LCO requires three channels of Turbine Trip - Low Fluid Oil 

Pressure to be OPERABLE in MODE 1 above P-9.

Below the P-9 setpoint, a turbine trip does not actuate a reactor 

trip. In MODE 2, 3, 4, 5, or 6, there is no potential for a turbine 

trip, and the Turbine Trip - Low Fluid Oil Pressure trip Function 

does not need to be OPERABLE.

b. Turbine Trip - Turbine Stop Valve Closure

The Turbine Trip - Turbine Stop Valve Closure trip Function 

anticipates the loss of heat removal capabilities of the secondary 

system following a turbine trip from a power level below the P-9 

setpoint, approximately 50% power. This action will not actuate 

a reactor trip. The trip Function anticipates the loss of secondary 

heat removal capability that occurs when the stop valves close. 

Tripping the reactor in anticipation of loss of secondary heat 

removal acts to minimize the pressure and temperature transient 

on the reactor. This trip Function will not and is not required to 

operate in the presence of a single channel failure. The unit is 

designed to withstand a complete loss of load and not sustain 

core damage or challenge the RCS pressure limitations. Core 

protection is provided by the Pressurizer Pressure - High trip 

Function, and RCS integrity is ensured by the pressurizer safety 

valves. This trip Function is diverse to the Turbine Trip - Low 

Fluid Oil Pressure trip Function. Each turbine stop valve is 

equipped with one limit switch that inputs to the RTS. If all four 

limit switches indicate that the stop valves are all closed, a 

reactor trip is initiated.

The LSSS for this Function is set to assure channel trip occurs 

when the associated stop valve is completely closed.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-26 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The LCO requires four Turbine Trip - Turbine Stop Valve Closure 

channels, one per valve, to be OPERABLE in MODE 1 above 

P-9. All four channels must trip to cause reactor trip.

Below the P-9 setpoint, a load rejection can be accommodated 

by the Steam Dump System. In MODE 2, 3, 4, 5, or 6, there is 

no potential for a load rejection, and the Turbine Trip - Stop 

Valve Closure trip Function does not need to be OPERABLE.

17. Safety Injection Input from Engineered Safety Feature Actuation 

System

The SI Input from ESFAS ensures that if a reactor trip has not 

already been generated by the RTS, the ESFAS automatic actuation 

logic will initiate a reactor trip upon any signal that initiates SI. This is 

a condition of acceptability for the LOCA. However, other transients 

and accidents take credit for varying levels of ESF performance and 

rely upon rod insertion, except for the most reactive rod that is 

assumed to be fully withdrawn, to ensure reactor shutdown. 

Therefore, a reactor trip is initiated every time an SI signal is present.

Trip Setpoint and Allowable Values are not applicable to this 

Function. The SI Input is provided by relay in the ESFAS. Therefore, 

there is no measurement signal with which to associate an LSSS.

The LCO requires two trains of SI Input from ESFAS to be 

OPERABLE in MODE 1 or 2.

A reactor trip is initiated every time an SI signal is present. 

Therefore, this trip Function must be OPERABLE in MODE 1 or 2, 

when the reactor is critical, and must be shut down in the event of an 

accident. In MODE 3, 4, 5, or 6, the reactor is not critical, and this 

trip Function does not need to be OPERABLE.

18. Reactor Trip System Interlocks

Reactor protection interlocks are provided to ensure reactor trips are 

in the correct configuration for the current unit status. They back up 

operator actions to ensure protection system Functions are not 

bypassed during unit conditions under which the safety analysis 

assumes the Functions are not bypassed. Therefore, the interlock 

Functions do not need to be OPERABLE when the associated 

reactor trip functions are outside the applicable MODES. These are:
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-27 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

a. Intermediate Range Neutron Flux, P-6

The Intermediate Range Neutron Flux, P-6 interlock is actuated 

when any NIS intermediate range channel goes approximately 

one decade above the minimum channel reading. If both 

channels drop below the setpoint, the permissive will 

automatically be defeated. The LCO requirement for the P-6 

interlock ensures that the following Functions are performed:

 on increasing power, the P-6 interlock allows the manual 

block of the NIS Source Range, Neutron Flux reactor trip. 

This prevents a premature block of the source range trip and 

allows the operator to ensure that the intermediate range is 

OPERABLE prior to leaving the source range. When the 

source range trip is blocked, the high voltage to the detectors 

is also removed,

 on decreasing power, the P-6 interlock automatically 

energizes the NIS source range detectors and enables the 

NIS Source Range Neutron Flux reactor trip, and

 on increasing power, the P-6 interlock provides a backup 

block signal to the source range flux doubling circuit. 

Normally, this Function is manually blocked by the control 

room operator during the reactor startup.

The LCO requires two channels of Intermediate Range Neutron 

Flux, P-6 interlock to be OPERABLE in MODE 2 when below the 

P-6 interlock setpoint.

Above the P-6 interlock setpoint, the NIS Source Range Neutron 

Flux reactor trip will be blocked, and this Function will no longer 

be necessary.

In MODE 3, 4, 5, or 6, the P-6 interlock does not have to be 

OPERABLE because the NIS Source Range is providing core 

protection.

b. Low Power Reactor Trips Block, P-7

The Low Power Reactor Trips Block, P-7 interlock is actuated by 

input from either the Power Range Neutron Flux, P-10, or the 

Turbine Impulse Pressure, P-13 interlock. The LCO requirement 

for the P-7 interlock ensures that the following Functions are 

performed:
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-28 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

(1) on increasing power, the P-7 interlock automatically enables 

reactor trips on the following Functions:

 Pressurizer Pressure - Low,

 Pressurizer Water Level - High,

 Reactor Coolant Flow - Low (low flow in two or more 

RCS loops),

 RCPs Breaker Open (Two Loops),

 Undervoltage RCPs, and

 Underfrequency RCPs.

These reactor trips are only required when operating above 

the P-7 setpoint (approximately 10% power). The reactor 

trips provide protection against violating the DNBR limit. 

Below the P-7 setpoint, the RCS is capable of providing 

sufficient natural circulation without any RCP running.

(2) on decreasing power, the P-7 interlock automatically blocks 

reactor trips on the following Functions:

 Pressurizer Pressure - Low,

 Pressurizer Water Level - High,

 Reactor Coolant Flow - Low (low flow in two or more 

RCS loops),

 RCP Breaker Position (Two Loops),

 Undervoltage RCPs, and

 Underfrequency RCPs.

Trip Setpoint and Allowable Value are not applicable to the P-7 

interlock because it is a logic Function and thus has no 

parameter with which to associate an LSSS.

The P-7 interlock is a logic Function with train and not channel 

identity. Therefore, the LCO requires one channel per train of 

Low Power Reactor Trips Block, P-7 interlock to be OPERABLE 

in MODE 1.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-29 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The low power trips are blocked below the P-7 setpoint and 

unblocked above the P-7 setpoint. In MODE 2, 3, 4, 5, or 6, this 

Function does not have to be OPERABLE because the interlock 

performs its Function when power level drops below 10% power, 

which is in MODE 1.

c. Power Range Neutron Flux, P-8

The Power Range Neutron Flux, P-8 interlock is actuated at 

approximately 48% power as determined by two-out-of-four NIS 

power range detectors. The P-8 interlock automatically enables 

the Reactor Coolant Flow - Low and RCP Breaker Position 

(Single Loop) reactor trips on low flow in one or more RCS loops 

on increasing power. The LCO requirement for this trip Function 

ensures that protection is provided against a loss of flow in any 

RCS loop that could result in DNB conditions in the core when 

greater than approximately 48% power. On decreasing power, 

the reactor trip on low flow in any loop is automatically blocked.

The LCO requires four channels of Power Range Neutron Flux, 

P-8 interlock to be OPERABLE in MODE 1.

In MODE 1, a loss of flow in one RCS loop could result in DNB 

conditions, so the Power Range Neutron Flux, P-8 interlock must 

be OPERABLE. In MODE 2, 3, 4, 5, or 6, this Function does not 

have to be OPERABLE because the core is not producing 

sufficient power to be concerned about DNB conditions.

d. Power Range Neutron Flux, P-9

The Power Range Neutron Flux, P-9 interlock is actuated at 

approximately 50% power as determined by two-out-of-four NIS 

power range detectors. The LCO requirement for this Function 

ensures that the Turbine Trip - Low Fluid Oil Pressure and 

Turbine Trip - Turbine Stop Valve Closure reactor trips are 

enabled above the P-9 setpoint. Above the P-9 setpoint, a 

turbine trip will cause a load rejection beyond the capacity of the 

Steam Dump System. A reactor trip is automatically initiated on 

a turbine trip when it is above the P-9 setpoint, to minimize the 

transient on the reactor.

The LCO requires four channels of Power Range Neutron Flux, 

P-9 interlock to be OPERABLE in MODE 1.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-30 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

In MODE 1, a turbine trip could cause a load rejection beyond 

the capacity of the Steam Dump System, so the Power Range 

Neutron Flux interlock must be OPERABLE. In MODE 2, 3, 4, 5, 

or 6, this Function does not have to be OPERABLE because the 

reactor is not at a power level sufficient to have a load rejection 

beyond the capacity of the Steam Dump System.

e. Power Range Neutron Flux, P-10

The Power Range Neutron Flux, P-10 interlock is actuated at 

approximately 10% power, as determined by two-out-of-four NIS 

power range detectors. If power level falls below 10% RTP on 3 

of 4 channels, the nuclear instrument trips will be automatically 

unblocked. The LCO requirement for the P-10 interlock ensures 

that the following Functions are performed:

 on increasing power, the P-10 interlock allows the operator 

to manually block the Intermediate Range Neutron Flux 

reactor trip. Note that blocking the reactor trip also blocks 

the signal to prevent automatic and manual rod withdrawal,

 on increasing power, the P-10 interlock allows the operator 

to manually block the Power Range Neutron Flux - Low 

reactor trip,

 on increasing power, the P-10 interlock automatically 

provides a backup signal to block the Source Range 

Neutron Flux reactor trip, and also to de-energize the NIS 

source range detectors,

 the P-10 interlock provides one of the two inputs to the P-7 

interlock, and

 on decreasing power, the P-10 interlock automatically 

enables the Power Range Neutron Flux - Low reactor trip 

and the Intermediate Range Neutron Flux reactor trip (and 

rod stop).

The LCO requires four channels of Power Range Neutron 

Flux, P-10 interlock to be OPERABLE in MODE 1 or 2.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-31 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

OPERABILITY in MODE 1 ensures the Function is available to 

perform its decreasing power Functions in the event of a reactor 

shutdown. This Function must be OPERABLE in MODE 2 to 

ensure that core protection is provided during a startup or 

shutdown by the Power Range Neutron Flux - Low and 

Intermediate Range Neutron Flux reactor trips. In MODE 3, 4, 5, 

or 6, this Function does not have to be OPERABLE because the 

reactor is not at power and the Source Range Neutron Flux 

reactor trip provides core protection.

f. Turbine Impulse Pressure, P-13

The Turbine Impulse Pressure, P-13 interlock is actuated when 

the pressure in the first stage of the high pressure turbine is 

greater than approximately 10% of the rated full power pressure. 

This is determined by one-out-of-two pressure detectors. The 

LCO requirement for this Function ensures that one of the inputs 

to the P-7 interlock is available.

The LCO requires two channels of Turbine Impulse Pressure, 

P-13 interlock to be OPERABLE in MODE 1.

The Turbine Impulse Chamber Pressure, P-13 interlock must be 

OPERABLE when the turbine generator is operating. The 

interlock Function is not required OPERABLE in MODE 2, 3, 4, 

5, or 6 because the turbine generator is not operating.

19. Reactor Trip Breakers

This trip Function applies to the RTBs exclusive of individual trip 

mechanisms. The LCO requires two OPERABLE trains of trip 

breakers. A trip breaker train consists of all trip breakers associated 

with a single RTS logic train that are racked in, closed, and capable 

of supplying power to the Rod Control System. Thus, the train may 

consist of the main breaker, bypass breaker, or main breaker and 

bypass breaker, depending upon the system configuration. Two 

OPERABLE trains ensure no single random failure can disable the 

RTS trip capability.

These trip Functions must be OPERABLE in MODE 1 or 2 when the 

reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must 

be OPERABLE when the Rod Control System is capable of rod 

withdrawal or one or more rods are not fully inserted.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-32 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

20. Reactor Trip Breaker Undervoltage and Shunt Trip Mechanisms

The LCO requires both the Undervoltage and Shunt Trip 

Mechanisms to be OPERABLE for each RTB that is in service. The 

trip mechanisms are not required to be OPERABLE for trip breakers 

that are open, racked out, incapable of supplying power to the Rod 

Control System, or declared inoperable under Function 19 above. 

OPERABILITY of both trip mechanisms on each breaker ensures that 

no single trip mechanism failure will prevent opening any breaker on 

a valid signal.

These trip Functions must be OPERABLE in MODE 1 or 2 when the 

reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must 

be OPERABLE when the Rod Control System is capable of rod 

withdrawal or one or more rods are not fully inserted.

21. Automatic Trip Logic

The LCO requirement for the RTBs (Functions 19 and 20) and 

Automatic Trip Logic (Function 21) ensures that means are provided 

to interrupt the power to allow the rods to fall into the reactor core. 

Each RTB is equipped with an undervoltage coil and a shunt trip coil 

to trip the breaker open when needed. Each RTB is equipped with a 

bypass breaker to allow testing of the trip breaker while the unit is at 

power. The reactor trip signals generated by the RTS Automatic Trip 

Logic cause the RTBs and associated bypass breakers to open and 

shut down the reactor.

The LCO requires two trains of RTS Automatic Trip Logic to be 

OPERABLE. Having two OPERABLE channels ensures that random 

failure of a single logic channel will not prevent reactor trip.

These trip Functions must be OPERABLE in MODE 1 or 2 when the 

reactor is critical. In MODE 3, 4, or 5, these RTS trip Functions must 

be OPERABLE when the Rod Control System is capable of rod 

withdrawal or one or more rods are not fully inserted.

The RTS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-33 Rev. 4.0

BASES

ACTIONS -----------------------------------REVIEWER’S NOTE-----------------------------------

In Table 3.3.1-1, Functions 11.a and 11.b were not included in the generic 

evaluations approved in either WCAP-10271, as supplemented, 

WCAP-15376, or WCAP-14333. In order to apply the WCAP-10271, as 

supplemented, and WCAP-15376 or WCAP-14333 TS relaxations to plant 

specific Functions not evaluated generically, licensees must submit plant 

specific evaluations for NRC review and approval.

--------------------------------------------------------------------------------------------------

A Note has been added to the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed in Table 3.3.1-1.

In the event a channel's [NTSP] is found nonconservative with respect to 

the Allowable Value, or the channel is not functioning as required, or the 

transmitter, instrument loop, signal processing electronics, or bistable is 

found inoperable, then all affected Functions provided by that channel 

must be declared inoperable and the LCO Condition(s) entered for the 

protection Function(s) affected.

When the number of inoperable channels in a trip Function exceed those 

specified in one or other related Conditions associated with a trip 

Function, then the unit is outside the safety analysis. Therefore, 

LCO 3.0.3 must be immediately entered if applicable in the current MODE 

of operation.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use these times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report.

--------------------------------------------------------------------------------------------------

A.1

Condition A applies to all RTS protection Functions. Condition A 

addresses the situation where one or more required channels or trains for 

one or more Functions are inoperable at the same time. The Required 

Action is to refer to Table 3.3.1-1 and to take the Required Actions for the 

protection functions affected. The Completion Times are those from the 

referenced Conditions and Required Actions.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-34 Rev. 4.0

BASES

ACTIONS (continued)

B.1 and B.2

Condition B applies to the Manual Reactor Trip in MODE 1 or 2. This 

action addresses the train orientation of the SSPS for this Function. With 

one channel inoperable, the inoperable channel must be restored to 

OPERABLE status within 48 hours. In this Condition, the remaining 

OPERABLE channel is adequate to perform the safety function.

The Completion Time of 48 hours is reasonable considering that there are 

two automatic actuation trains and another manual initiation channel 

OPERABLE, and the low probability of an event occurring during this 

interval.

If the Manual Reactor Trip Function cannot be restored to OPERABLE 

status within the allowed 48 hour Completion Time, the unit must be 

brought to a MODE in which the requirement does not apply. To achieve 

this status, the unit must be brought to at least MODE 3 within 

6 additional hours (54 hours total time). The 6 additional hours to reach 

MODE 3 is reasonable, based on operating experience, to reach MODE 3 

from full power operation in an orderly manner and without challenging 

unit systems. With the unit in MODE 3, ACTION C would apply to any 

inoperable Manual Reactor Trip Function if the Rod Control System is 

capable of rod withdrawal or one or more rods are not fully inserted.

C.1, C.2.1, and C.2.2

Condition C applies to the following reactor trip Functions in MODE 3, 4, 

or 5 with the Rod Control System capable of rod withdrawal or one or 

more rods not fully inserted:

 Manual Reactor Trip,

 RTBs,

 RTB Undervoltage and Shunt Trip Mechanisms, and

 Automatic Trip Logic.

This action addresses the train orientation of the SSPS for these 

Functions. With one channel or train inoperable, the inoperable channel 

or train must be restored to OPERABLE status within 48 hours. If the 

affected Function(s) cannot be restored to OPERABLE status within the 

allowed 48 hour Completion Time, the unit must be placed in a MODE in 
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-35 Rev. 4.0

BASES

ACTIONS (continued)

which the requirement does not apply. To achieve this status, action 

must be initiated within the same 48 hours to ensure that all rods are fully 

inserted, and the Rod Control System must be placed in a condition 

incapable of rod withdrawal within the next hour. The additional hour 

provides sufficient time to accomplish the action in an orderly manner. 

With rods fully inserted and the Rod Control System incapable of rod 

withdrawal, these Functions are no longer required.

The Completion Time is reasonable considering that in this Condition, the 

remaining OPERABLE train is adequate to perform the safety function, 

and given the low probability of an event occurring during this interval.

D.1.1, D.1.2, D.2.1, D.2.2, and D.3

Condition D applies to the Power Range Neutron Flux - High Function.

The NIS power range detectors provide input to the Rod Control System 

and the SG Water Level Control System and, therefore, have a two-outof-four trip logic. A known inoperable channel must be placed in the 

tripped condition. This results in a partial trip condition requiring only 

one-out-of-three logic for actuation. The 72 hours allowed to place the 

inoperable channel in the tripped condition is justified in 

WCAP-14333-P-A (Ref. 8).

In addition to placing the inoperable channel in the tripped condition, 

THERMAL POWER must be reduced to  75% RTP within 78 hours. 

Reducing the power level prevents operation of the core with radial power 

distributions beyond the design limits. With one of the NIS power range 

detectors inoperable, 1/4 of the radial power distribution monitoring 

capability is lost.

As an alternative to the above actions, the inoperable channel can be 

placed in the tripped condition within 72 hours and the QPTR monitored 

once every 12 hours as per SR 3.2.4.2, QPTR verification. Calculating 

QPTR every 12 hours compensates for the lost monitoring capability due 

to the inoperable NIS power range channel and allows continued unit 

operation at power levels > 75% RTP. The 12 hour Frequency is 

consistent with LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-36 Rev. 4.0

BASES

ACTIONS (continued)

As an alternative to the above Actions, the plant must be placed in a 

MODE where this Function is no longer required OPERABLE. Seventyeight hours are allowed to place the plant in MODE 3. The 78 hour 

Completion Time includes 72 hours for channel corrective maintenance, 

and an additional 6 hours for the MODE reduction as required by 

Required Action D.3. This is a reasonable time, based on operating 

experience, to reach MODE 3 from full power in an orderly manner and 

without challenging plant systems. If Required Actions cannot be 

completed within their allowed Completion Times, LCO 3.0.3 must be 

entered.

[ The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypass condition for up to 12 hours while 

performing routine surveillance testing of other channels. The Note also 

allows placing the inoperable channel in the bypass condition to allow 

setpoint adjustments of other channels when required to reduce the 

setpoint in accordance with other Technical Specifications. The 12 hour 

time limit is justified in Reference 8. ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for 12 hours while performing routine surveillance 

testing, and setpoint adjustments when a setpoint reduction is required by 

other Technical Specifications. The 12 hour time limit is justified in 

Reference 8.

--------------------------------------------------------------------------------------------------

Required Action D.2.2 has been modified by a Note which only requires 

SR 3.2.4.2 to be performed if the Power Range Neutron Flux input to 

QPTR becomes inoperable. Failure of a component in the Power Range 

Neutron Flux Channel which renders the High Flux Trip Function 

inoperable may not affect the capability to monitor QPTR. As such, 

determining QPTR using this movable incore detectors once per 12 hours 

may not be necessary.

E.1 and E.2

Condition E applies to the following reactor trip Functions:

 Power Range Neutron Flux - Low,

 Overtemperature ∆T,
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-37 Rev. 4.0

BASES

ACTIONS (continued)

 Overpower ∆T,

 Power Range Neutron Flux - High Positive Rate,

 Power Range Neutron Flux - High Negative Rate,

 Pressurizer Pressure - High,

 SG Water Level - Low Low, and

 SG Water Level - Low coincident with Steam Flow/Feedwater Flow 

Mismatch.

A known inoperable channel must be placed in the tripped condition 

within 72 hours. Placing the channel in the tripped condition results in a 

partial trip condition requiring only one-out-of-two logic for actuation of the 

two-out-of-three trips and one-out-of-three logic for actuation of the twoout-of-four trips. The 72 hours allowed to place the inoperable channel in 

the tripped condition is justified in Reference 8.

If the inoperable channel cannot be placed in the trip condition within the 

specified Completion Time, the unit must be placed in a MODE where 

these Functions are not required OPERABLE. An additional 6 hours is 

allowed to place the unit in MODE 3. Six hours is a reasonable time, 

based on operating experience, to place the unit in MODE 3 from full 

power in an orderly manner and without challenging unit systems.

[ The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to 12 hours while 

performing routine surveillance testing of the other channels. The 

12 hour time limit is justified in Reference 8. ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should be used for plants with installed bypass test 

capability:

--------------------------------------------------------------------------------------------------

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 9.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-38 Rev. 4.0

BASES

ACTIONS (continued)

F.1 and F.2

Condition F applies to the Intermediate Range Neutron Flux trip when 

THERMAL POWER is above the P-6 setpoint and below the P-10 

setpoint and one channel is inoperable. Above the P-6 setpoint and 

below the P-10 setpoint, the NIS intermediate range detector performs 

the monitoring Functions. If THERMAL POWER is greater than the P-6 

setpoint but less than the P-10 setpoint, 24 hours is allowed to reduce 

THERMAL POWER below the P-6 setpoint or increase to THERMAL 

POWER above the P-10 setpoint. The NIS Intermediate Range Neutron 

Flux channels must be OPERABLE when the power level is above the 

capability of the source range, P-6, and below the capability of the power 

range, P-10. If THERMAL POWER is greater than the P-10 setpoint, the 

NIS power range detectors perform the monitoring and protection 

functions and the intermediate range is not required. The Completion 

Times allow for a slow and controlled power adjustment above P-10 or 

below P-6 and take into account the redundant capability afforded by the 

redundant OPERABLE channel, and the low probability of its failure 

during this period. This action does not require the inoperable channel to 

be tripped because the Function uses one-out-of-two logic. Tripping one 

channel would trip the reactor. Thus, the Required Actions specified in 

this Condition are only applicable when channel failure does not result in 

reactor trip.

G.1 and G.2

Condition G applies to two inoperable Intermediate Range Neutron Flux 

trip channels in MODE 2 when THERMAL POWER is above the P-6 

setpoint and below the P-10 setpoint. Required Actions specified in this 

Condition are only applicable when channel failures do not result in 

reactor trip. Above the P-6 setpoint and below the P-10 setpoint, the NIS 

intermediate range detector performs the monitoring Functions. With no 

intermediate range channels OPERABLE, the Required Actions are to 

suspend operations involving positive reactivity additions immediately. 

This will preclude any power level increase since there are no 

OPERABLE Intermediate Range Neutron Flux channels. The operator 

must also reduce THERMAL POWER below the P-6 setpoint within two 

hours. Below P-6, the Source Range Neutron Flux channels will be able 

to monitor the core power level. The Completion Time of 2 hours will 

allow a slow and controlled power reduction to less than the P-6 setpoint 

and takes into account the low probability of occurrence of an event 

during this period that may require the protection afforded by the NIS 

Intermediate Range Neutron Flux trip.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-39 Rev. 4.0

BASES

ACTIONS (continued)

Required Action G.1 is modified by a Note to indicate that normal plant 

control operations that individually add limited positive reactivity (e.g., 

temperature or boron fluctuations associated with RCS inventory 

management or temperature control) are not precluded by this Action, 

provided they are accounted for in the calculated SDM.

H.1

Condition H applies to one inoperable Source Range Neutron Flux trip 

channel when in MODE 2, below the P-6 setpoint, and performing a 

reactor startup. With the unit in this Condition, below P-6, the NIS source 

range performs the monitoring and protection functions. With one of the 

two channels inoperable, operations involving positive reactivity additions 

shall be suspended immediately.

This will preclude any power escalation. With only one source range 

channel OPERABLE, core protection is severely reduced and any actions 

that add positive reactivity to the core must be suspended immediately.

Required Action H.1 is modified by a Note to indicate that normal plant 

control operations that individually add limited positive reactivity (e.g., 

temperature or boron fluctuations associated with RCS inventory 

management or temperature control) are not precluded by this Action, 

provided they are accounted for in the calculated SDM.

I.1

Condition I applies to two inoperable Source Range Neutron Flux trip 

channels when in MODE 2, below the P-6 setpoint, and in MODE 3, 4, 

or 5 with the Rod Control System capable of rod withdrawal or one or 

more rods not fully inserted. With the unit in this Condition, below P-6, 

the NIS source range performs the monitoring and protection functions. 

With both source range channels inoperable, the RTBs must be opened 

immediately. With the RTBs open, the core is in a more stable condition.

J.1, J.2.1, and J.2.2

Condition J applies to one inoperable source range channel in MODE 3, 

4, or 5 with the Rod Control System capable of rod withdrawal or one or 

more rods not fully inserted. With the unit in this Condition, below P-6, 

the NIS source range performs the monitoring and protection functions. 

With one of the source range channels inoperable, 48 hours is allowed to
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-40 Rev. 4.0

BASES

ACTIONS (continued)

restore it to an OPERABLE status. If the channel cannot be returned to 

an OPERABLE status, action must be initiated within the same 48 hours 

to ensure that all rods are fully inserted, and the Rod Control System 

must be placed in a condition incapable of rod withdrawal within the next 

hour.

K.1 and K.2

Condition K applies to the following reactor trip Functions:

 Pressurizer Pressure - Low,

 Pressurizer Water Level - High,

 Reactor Coolant Flow – Low,

 Undervoltage RCPs, and

 Underfrequency RCPs.

With one channel inoperable, the inoperable channel must be placed in 

the tripped condition within 72 hours (Ref. 8). For the Pressurizer 

Pressure - Low, Pressurizer Water Level - High, Undervoltage RCPs, and 

Underfrequency RCPs trip Functions, placing the channel in the tripped 

condition when above the P-7 setpoint results in a partial trip condition 

requiring only one additional channel to initiate a reactor trip. For the 

Reactor Coolant Flow - Low trip Function, placing the channel in the 

tripped condition when above the P-8 setpoint results in a partial trip 

condition requiring only one additional channel in the same loop to initiate 

a reactor trip. For the latter trip Function, two tripped channels in two 

RCS loops are required to initiate a reactor trip when below the P-8 

setpoint and above the P-7 setpoint. These Functions do not have to be 

OPERABLE below the P-7 setpoint because there are no loss of flow trips 

below the P-7 setpoint. There is insufficient heat production to generate 

DNB conditions below the P-7 setpoint. The 72 hours allowed to place 

the channel in the tripped condition is justified in Reference 8. An 

additional 6 hours is allowed to reduce THERMAL POWER to below P-7 

if the inoperable channel cannot be restored to OPERABLE status or 

placed in trip within the specified Completion Time.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-41 Rev. 4.0

BASES

ACTIONS (continued)

Allowance of this time interval takes into consideration the redundant 

capability provided by the remaining redundant OPERABLE channel, and 

the low probability of occurrence of an event during this period that may 

require the protection afforded by the Functions associated with 

Condition K.

[ The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to 12 hours while 

performing routine surveillance testing of the other channels. The 

12 hour time limit is justified in Reference 8. ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 8.

--------------------------------------------------------------------------------------------------

L.1 and L.2

Condition L applies to the RCP Breaker Position (Single Loop) reactor trip 

Function. There is one breaker position device per RCP breaker. With 

one channel inoperable, the inoperable channel must be restored to 

OPERABLE status within [6] hours. If the channel cannot be restored to 

OPERABLE status within the [6] hours, then THERMAL POWER must be 

reduced below the P-8 setpoint within the next 4 hours.

This places the unit in a MODE where the LCO is no longer applicable. 

This Function does not have to be OPERABLE below the P-8 setpoint 

because other RTS Functions provide core protection below the P-8 

setpoint. The [6] hours allowed to restore the channel to OPERABLE

status and the 4 additional hours allowed to reduce THERMAL POWER 

to below the P-8 setpoint are justified in Reference 11.

The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to [4] hours while 

performing routine surveillance testing of the other channels. The 

[4] hour time limit is justified in Reference 11.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-42 Rev. 4.0

BASES

ACTIONS (continued)

M.1 and M.2

Condition M applies to the RCP Breaker Position (Two Loops) reactor trip 

Function. There is one breaker position device per RCP breaker. With 

one channel inoperable, the inoperable channel must be placed in trip 

within [6] hours. If the channel cannot be placed in trip within the [6] 

hours, then THERMAL POWER must be reduced below the P-7 setpoint 

within the next 6 hours.

This places the unit in a MODE where the LCO is no longer applicable.

This Function does not have to be OPERABLE below the P-7 setpoint 

because other RTS Functions provide core protection below the P-7 

setpoint. The [6] hours allowed to place the channel in trip and the 6

additional hours allowed to reduce THERMAL POWER to below the P-7 

setpoint are justified in Reference 11.

The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to [4] hours while 

performing routine surveillance testing of the other channels. The 

[4] hour time limit is justified in Reference 11.

N.1 and N.2

Condition N applies to Turbine Trip on Low Fluid Oil Pressure or on 

Turbine Stop Valve Closure. With one channel inoperable, the inoperable 

channel must be placed in the trip condition within 72 hours. If placed in 

the tripped condition, this results in a partial trip condition requiring only 

one additional channel to initiate a reactor trip. If the channel cannot be 

restored to OPERABLE status or placed in the trip condition, then power 

must be reduced below the P-9 setpoint within the next 4 hours. The 

72 hours allowed to place the inoperable channel in the tripped condition

is justified in Reference 8. Four hours is allowed for reducing power.

[ The Required Actions have been modified by a Note that allows placing 

the inoperable channel in the bypassed condition for up to 12 hours while 

performing routine surveillance testing of the other channels. The 

12 hour time limit is justified in Reference 8. ]
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-43 Rev. 4.0

BASES

ACTIONS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 8.

--------------------------------------------------------------------------------------------------

O.1 and O.2

Condition O applies to the SI Input from ESFAS reactor trip and the RTS 

Automatic Trip Logic in MODES 1 and 2. These actions address the train 

orientation of the RTS for these Functions. With one train inoperable, 

24 hours are allowed to restore the train to OPERABLE status (Required 

Action O.1) or the unit must be placed in MODE 3 within the next 6 hours. 

The Completion Time of 24 hours (Required Action O.1) is reasonable 

considering that in this Condition, the remaining OPERABLE train is 

adequate to perform the safety function and given the low probability of 

an event during this interval. The 24 hours allowed to restore the 

inoperable RTS Automatic Trip Logic train to OPERABLE status is 

justified in Reference 8. The Completion Time of 6 hours (Required 

Action O.2) is reasonable, based on operating experience, to reach 

MODE 3 from full power in an orderly manner and without challenging 

unit systems.

The Required Actions have been modified by a Note that allows 

bypassing one train up to [4] hours for surveillance testing, provided the 

other train is OPERABLE. [The [4] hour time limit for testing the RTS 

Automatic Trip logic train may include testing the RTB also, if both the 

Logic test and RTB test are conducted within the [4] hour time limit. The 

[4] hour time limit is justified in Reference 8.]

-----------------------------------REVIEWER’S NOTE-----------------------------------

The below text should replace the bracketed information in the previous 

paragraph if WCAP-14333 and WCAP-15376 are being incorporated:

The [4] hour time limit for the RTS Automatic Trip Logic train testing is 

greater than the 2 hour time limit for the RTBs, which the logic train

supports. The longer time limit for the logic train ([4] hours) is acceptable 

based on Reference 12.

--------------------------------------------------------------------------------------------------
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-44 Rev. 4.0

BASES

ACTIONS (continued)

P.1 and P.2

-----------------------------------REVIEWER’S NOTE-----------------------------------

WCAP-14333-P-A, Rev. 1, "Probabilistic Risk Analysis of the RPS and 

ESFAS Test Times and Completion Times," and the associated TSTF 

(TSTF-418) and WCAP-15376-P, "Risk-Informed Assessment of the RTS 

and ESFAS Surveillance Test Intervals and Reactor Trip Breaker Test 

and Completion Times," and the associated TSTF (TSTF-411) both

modify Condition P. 

WCAP-14333-P-A, Rev. 1 and the associated TSTF-418 provide a 

Completion Time for Required Action P.1 of 1 hour and Required 

Action P.2 of 7 hours. WCAP-14333-P-A, Rev. 1 contains three Notes to 

TS 3.3.1 Condition P. Note 1 states, "One train may be bypassed for up 

to 2 hours for surveillance testing, provided the other train is 

OPERABLE." Note 2 states, "One RTB may be bypassed for up to 

2 hours for maintenance on undervoltage or shunt trip mechanisms, 

provided the other train is OPERABLE." WCAP-14333-P-A, Rev. 1 also 

adds a third Note, which states: "One RTB train may be bypassed for up 

to [4] hours for concurrent surveillance testing of the RTB and automatic 

trip logic, provided the other train is OPERABLE."

WCAP-15376-P and the associated TSTF-411 provide a Completion 

Time for Required Action P.1 of 24 hours and Required Action P.2 of 

30 hours. WCAP-15376-P relaxes the time that an RTB train may be 

bypassed for surveillance testing from 2 hours to 4 hours, and deletes 

Notes 2 and 3 that are added by WCAP-14333-P-A, Rev. 1.

Implementation of TS 3.3.1, Condition P:

1. If WCAP-14333-P-A, Rev. 1 is implemented without implementing 

WCAP-15376-P, the Completion Time for Required Action P.1 will be 

1 hour and for Required Action P.2 will be 7 hours. Condition P will 

contain the three Notes as discussed above, with 2 hours to bypass 

an RTB train for surveillance testing in Note 1.

2. If WCAP-15376-P is implemented without implementing WCAP14333-P-A, Rev. 1, the Completion Time for Required Action P.1 will 

be 24 hours and for Required Action P.2 will be 30 hours. Condition 

P will only contain one Note (Note 1 as discussed in the first

paragraph above), with 4 hours to bypass an RTB train for 

surveillance testing in the Note.

3. If WCAP-14333-P-A, Rev. 1, and WCAP-15376-P are both 

implemented, follow the direction for Item 2, above.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-45 Rev. 4.0

BASES

ACTIONS (continued)

Use the following Bases if WCAP-14333-P-A, Rev. 1 is adopted without 

adopting WCAP-15376-P:

Condition P applies to the RTBs in MODES 1 and 2. These actions 

address the train orientation of the RTS for the RTBs. With one train 

inoperable, 1 hour is allowed to restore the train to OPERABLE 

status or the unit must be placed in MODE 3 within the next 6 hours. 

The Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power in an orderly manner 

and without challenging unit systems. The 1 hour and 6 hour 

Completion Times are equal to the time allowed by LCO 3.0.3 for 

shutdown actions in the event of a complete loss of RTS Function. 

Placing the unit in MODE 3 results in Condition C entry while an RTB

is inoperable.

The Required Actions have been modified by three Notes. Note 1 

allows one channel to be bypassed for up to 2 hours for surveillance 

testing, provided the other train is OPERABLE. Note 1 applies to 

RTB testing that is performed independently from the corresponding 

automatic trip logic testing. Note 2 allows one RTB to be bypassed 

for up to 2 hours for maintenance if the other RTP train is 

OPERABLE. The 2 hour time limit is justified in Reference 9. Note 3 

applies to RTB testing that is performed concurrently with the 

corresponding automatic trip logic test. For concurrent testing of the 

automatic trip logic and RTB, one RTB train may be bypassed for up 

to [4] hours provided the other train is OPERABLE. The [4] hour time 

limit is approved by Reference 8.

Use the following Bases if WCAP-15376-P is adopted without adopting 

WCAP-14333-P-A, Rev. 1 or if both are adopted:

Condition P applies to the RTBs in MODES 1 and 2. These actions 

address the train orientation of the RTS for the RTBs. With one train 

inoperable, 24 hours is allowed for train corrective maintenance to 

restore the train to OPERABLE status or the unit must be placed in 

MODE 3 within the next 6 hours. The 24 hour Completion Time is 

justified in Reference 13. The Completion Time of 6 hours is 

reasonable, based on operating experience, to reach MODE 3 from 

full power in an orderly manner and without challenging unit systems.

Placing the unit in MODE 3 results in Condition C entry while an RTB 

is inoperable.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-46 Rev. 4.0

BASES

ACTIONS (continued)

The Required Actions have been modified by a Note. The Note 

allows one train to be bypassed for up to 4 hours for surveillance 

testing, provided the other train is OPERABLE. The 4 hour time limit 

is justified in Reference 13.

--------------------------------------------------------------------------------------------------

Q.1 and Q.2

Condition Q applies to the P-6 and P-10 interlocks. With one or more 

channels inoperable for one-out-of-two or two-out-of-four coincidence 

logic, the associated interlock must be verified to be in its required state 

for the existing unit condition within 1 hour or the unit must be placed in 

MODE 3 within the next 6 hours. Verifying the interlock status manually 

accomplishes the interlock's Function. The Completion Time of 1 hour is 

based on operating experience and the minimum amount of time allowed 

for manual operator actions. The Completion Time of 6 hours is 

reasonable, based on operating experience, to reach MODE 3 from full 

power in an orderly manner and without challenging unit systems. The 

1 hour and 6 hour Completion Times are equal to the time allowed by 

LCO 3.0.3 for shutdown actions in the event of a complete loss of RTS 

Function.

R.1 and R.2

Condition R applies to the P-7, P-8, P-9, and P-13 interlocks. With one or 

more channels inoperable for one-out-of-two or two-out-of-four 

coincidence logic, the associated interlock must be verified to be in its 

required state for the existing unit condition within 1 hour or the unit must 

be placed in MODE 2 within the next 6 hours. These actions are 

conservative for the case where power level is being raised. Verifying the 

interlock status manually accomplishes the interlock's Function. The 

Completion Time of 1 hour is based on operating experience and the 

minimum amount of time allowed for manual operator actions. The 

Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 2 from full power in an orderly manner and 

without challenging unit systems.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-47 Rev. 4.0

BASES

ACTIONS (continued)

S.1 and S.2

Condition S applies to the RTB Undervoltage and Shunt Trip 

Mechanisms, or diverse trip features, in MODES 1 and 2. With one of the 

diverse trip features inoperable, it must be restored to an OPERABLE 

status within 48 hours or the unit must be placed in a MODE where the 

requirement does not apply. This is accomplished by placing the unit in 

MODE 3 within the next 6 hours (54 hours total time). The Completion 

Time of 6 hours is a reasonable time, based on operating experience, to 

reach MODE 3 from full power in an orderly manner and without 

challenging unit systems. With the unit in MODE 3, ACTION C would 

apply to any inoperable RTB trip mechanism. The affected RTB shall not 

be bypassed while one of the diverse features is inoperable except for the 

time required to perform maintenance to one of the diverse features. The 

allowable time for performing maintenance of the diverse features is 

2 hours for the reasons stated under Condition P.

The Completion Time of 48 hours for Required Action S.1 is reasonable 

considering that in this Condition there is one remaining diverse feature 

for the affected RTB, and one OPERABLE RTB capable of performing the 

safety function and given the low probability of an event occurring during 

this interval.

SURVEILLANCE -----------------------------------REVIEWER’S NOTE-----------------------------------

REQUIREMENTS In Table 3.3.1-1, Functions 11.a and 11.b were not included in the generic 

evaluations approved in either WCAP-10271, as supplemented, or 

WCAP-14333. In order to apply the WCAP-10271, as supplemented, and 

WCAP-14333 TS relaxations to plant specific Functions not evaluated 

generically, licensees must submit plant specific evaluations for NRC 

review and approval.

--------------------------------------------------------------------------------------------------

The SRs for each RTS Function are identified by the SRs column of 

Table 3.3.1-1 for that Function.

A Note has been added to the SR Table stating that Table 3.3.1-1 

determines which SRs apply to which RTS Functions.

Note that each channel of process protection supplies both trains of the 

RTS. When testing Channel I, Train A and Train B must be examined. 

Similarly, Train A and Train B must be examined when testing Channel II, 

Channel III, and Channel IV (if applicable). The CHANNEL 

CALIBRATION and COTs are performed in a manner that is consistent 

with the assumptions used in analytically calculating the required channel 

accuracies.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-48 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Certain Frequencies are based on approval topical reports. In order for a 

licensee to use these times, the licensee must justify the Frequencies as 

required by the staff SER for the topical report.

--------------------------------------------------------------------------------------------------

SR 3.3.1.1

Performance of the CHANNEL CHECK ensures that gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-49 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.1.2

SR 3.3.1.2 compares the calorimetric heat balance calculation to the 

power range channel output. If the calorimetric heat balance calculation 

results exceed the power range channel output by more than 2% RTP, 

the power range channel is not declared inoperable, but must be 

adjusted. The power range channel output shall be adjusted consistent 

with the calorimetric heat balance calculation results if the calorimetric 

calculation exceed the power range channel output by more than + 2% 

RTP. If the power range channel output cannot be properly adjusted, the 

channel is declared inoperable.

If the calorimetric is performed at part power (< [70]% RTP), adjusting the 

power range channel indication in the increasing power direction will 

assure a reactor trip below the safety analysis limit (< [118]% RTP). 

Making no adjustment to the power range channel in the decreasing 

power direction due to a part power calorimetric assures a reactor trip 

consistent with the safety analyses.

This allowance does not preclude making indicated power adjustments, if 

desired, when the calorimetric heat balance calculation is less than the 

power range channel output. To provide close agreement between 

indicated power and to preserve operating margin, the power range 

channels are normally adjusted when operating at or near full power 

during steady-state conditions. However, discretion must be exercised if 

the power range channel output is adjusted in the decreasing power 

direction due to a part power calorimetric ( [70]% RTP). This action may 

introduce a nonconservative bias at higher power levels which may result 

in an NIS reactor trip above the safety analysis limit ( > [118]% RTP). 

The cause of the potential nonconservative bias is the decreased 

accuracy of the calorimetric at reduced power conditions. The primary 

error contributor to the instrument uncertainty for a secondary side power 

calorimetric measurement is the feedwater flow measurement, which is 

typically a P measurement across a feedwater venturi. While the 

measurement uncertainty remains constant in P as power decreases, 

when translated into flow, the uncertainty increases as a square term. 

Thus a 1% flow error at 100% power can approach a 10% flow error at 

30% RTP even though the P error has not changed. An evaluation of 

extended operation at part power conditions would conclude that it is 

prudent to administratively adjust the setpoint of the Power Range 

Neutron Flux - High bistables to ≤ [85]% RTP when: 1) the power range 

channel output is adjusted in the decreasing power direction due to a part 

power calorimetric below [70]% RTP; or 2) for a post refueling startup. 

The evaluation of extended operation at part power conditions would also 
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-50 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

conclude that the potential need to adjust the indication of the Power 

Range Neutron Flux in the decreasing power direction is quite small, 

primarily to address operation in the intermediate range about P-10 

(nominally 10% RTP) to allow enabling of the Power Range Neutron Flux 

- Low setpoint and the Intermediate Range Neutron Flux reactor trips. 

Before the Power Range Neutron Flux - High bistables are reset to 

≤ [109]% RTP, the power range channel adjustment must be confirmed 

based on a calorimetric performed at ≥ [70]% RTP.

-----------------------------------REVIEWER’S NOTE-----------------------------------

A plant specific evaluation based on the guidance in Westinghouse 

Technical Bulletin ESBU-TB-92-14 is required to determine the power 

level below which power range channel adjustments in a decreasing 

power direction become a concern. This evaluation must reflect the plant 

specific RTS setpoint study. In addition, this evaluation should determine 

if additional administrative controls are required for Power Range Neutron 

Flux-High trip setpoint setting changes

--------------------------------------------------------------------------------------------------

The Note clarifies that this Surveillance is required only if reactor power is 

≥ 15% RTP and that 12 hours are allowed for performing the first 

Surveillance after reaching 15% RTP. A power level of 15% RTP is 

chosen based on plant stability, i.e., automatic rod control capability and 

turbine generator synchronized to the grid.

[ The Frequency of every 24 hours is adequate. It is based on unit 

operating experience, considering instrument reliability and operating 

history data for instrument drift. Together these factors demonstrate that 

a difference between the calorimetric heat balance calculation and the 

power range channel output of more than +2% RTP is not expected in 

any 24 hour period.

In addition, control room operators periodically monitor redundant 

indications and alarms to detect deviations in channel outputs.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-51 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.3

SR 3.3.1.3 compares the incore system to the NIS channel output. If the 

absolute difference is ≥ 3%, the NIS channel is still OPERABLE, but must 

be readjusted. The excore NIS channel shall be adjusted if the absolute 

difference between the incore and excore AFD is ≥ 3%.

If the NIS channel cannot be properly readjusted, the channel is declared 

inoperable. This Surveillance is performed to verify the f(∆I) input to the 

overtemperature ∆T Function.

A Note clarifies that the Surveillance is required only if reactor power is 

≥ [15%] RTP and that 24 hours is allowed for performing the first 

Surveillance after reaching [15%] RTP.

[ The Frequency of every 31 EFPD is adequate. It is based on unit 

operating experience, considering instrument reliability and operating 

history data for instrument drift. Also, the slow changes in neutron flux 

during the fuel cycle can be detected during this interval.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-52 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.1.4

SR 3.3.1.4 is the performance of a TADOT. This test shall verify 

OPERABILITY by actuation of the end devices. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

The RTB test shall include separate verification of the undervoltage and 

shunt trip mechanisms. Independent verification of RTB undervoltage 

and shunt trip Function is not required for the bypass breakers. No 

capability is provided for performing such a test at power. The 

independent test for bypass breakers is included in SR 3.3.1.14. The 

bypass breaker test shall include a local shunt trip. A Note has been 

added to indicate that this test must be performed on the bypass breaker 

prior to placing it in service.

[ The Frequency of every 62 days on a STAGGERED TEST BASIS is 

justified in Reference 13.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.5

SR 3.3.1.5 is the performance of an ACTUATION LOGIC TEST. The 

SSPS is tested using the semiautomatic tester. The train being tested is 

placed in the bypass condition, thus preventing inadvertent actuation. 

Through the semiautomatic tester, all possible logic combinations, with 

and without applicable permissives, are tested for each protection 
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-53 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

function, including operation of the P-7 permissive which is a logic 

function only. [ The Frequency of every 92 days on a STAGGERED 

TEST BASIS is justified in Reference 13.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.6

SR 3.3.1.6 is a calibration of the excore channels to the incore channels. 

If the measurements do not agree, the excore channels are not declared 

inoperable but must be calibrated to agree with the incore detector 

measurements. If the excore channels cannot be adjusted, the channels 

are declared inoperable. This Surveillance is performed to verify the f(∆I) 

input to the overtemperature ∆T Function.

A Note modifies SR 3.3.1.6. The Note states that this Surveillance is 

required only if reactor power is > 50% RTP and that [24] hours is allowed 

for performing the first surveillance after reaching 50% RTP.

[ The Frequency of 92 EFPD is adequate. It is based on industry operating 

experience, considering instrument reliability and operating history data 

for instrument drift.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-54 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.7

SR 3.3.1.7 is the performance of a COT. The test is performed in 

accordance with the SCP. If the actual setting of the channel is found to 

be conservative with respect to the Allowable Value but is beyond the asfound tolerance band, the channel is OPERABLE but degraded. The 

degraded condition of the channel will be further evaluated during 

performance of the SR. This evaluation will consist of resetting the 

channel setpoint to the [NTSP] (within the allowed tolerance), and 

evaluating the channel response. If the channel is functioning as required 

and is expected to pass the next surveillance, then the channel is 

OPERABLE and can be restored to service at the completion of the 

surveillance. After the surveillance is completed, the channel as-found 

condition will be entered into the Corrective Action Program for further 

evaluation.

A COT is performed on each required channel to ensure the entire 

channel will perform the intended Function. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

SR 3.3.1.7 is modified by a Note that provides a 4 hours delay in the 

requirement to perform this Surveillance for source range instrumentation 

when entering MODE 3 from MODE 2. This Note allows a normal 

shutdown to proceed without a delay for testing in MODE 2 and for a 

short time in MODE 3 until the RTBs are open and SR 3.3.1.7 is no 

longer required to be performed. If the unit is to be in MODE 3 with the 

RTBs closed for > 4 hours this Surveillance must be performed prior to 

4 hours after entry into MODE 3.

[ The Frequency of 184 days is justified in Reference 9.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-55 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.8

SR 3.3.1.8 is the performance of a COT as described in SR 3.3.1.7, 

except it is modified by a Note that this test shall include verification that 

the P-6 and P-10 interlocks are in their required state for the existing unit 

condition. The test is performed in accordance with the SCP. If the 

actual setting of the channel is found to be conservative with respect to 

the Allowable Value but is beyond the as-found tolerance band, the 

channel is OPERABLE but degraded. The degraded condition of the 

channel will be further evaluated during performance of the SR. This 

evaluation will consist of resetting the channel setpoint to the [NTSP] 

(within the allowed tolerance), and evaluating the channel response. If 

the channel is functioning as required and is expected to pass the next 

surveillance, then the channel is OPERABLE and can be restored to 

service at the completion of the surveillance. After the surveillance is 

completed, the channel as-found condition will be entered into the 

Corrective Action Program for further evaluation.

A successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable COT of a relay. This is 

acceptable because all of the other required contacts of the relay are 

verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. The Frequency is modified by a Note that allows this 

surveillance to be satisfied if it has been performed within [the Frequency 

specified in the Surveillance Frequency Control Program OR 184 days] of 

the Frequencies prior to reactor startup and four hours after reducing 

power below P-10 and P-6. The Frequency of "prior to startup" ensures 

this surveillance is performed prior to critical operations and applies to the 

source, intermediate and power range low instrument channels. The 
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-56 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Frequency of [12] hours after reducing power below P-10 (applicable to 

intermediate and power range low channels) and 4 hours after reducing 

power below P-6 (applicable to source range channels) allows a normal 

shutdown to be completed and the unit removed from the MODE of 

Applicability for this surveillance without a delay to perform the testing 

required by this surveillance. The Frequency thereafter applies if the 

plant remains in the MODE of Applicability after the initial performances of 

prior to reactor startup and [12] and four hours after reducing power 

below P-10 or P-6, respectively. The MODE of Applicability for this 

surveillance is < P-10 for the power range low and intermediate range 

channels and < P-6 for the source range channels. Once the unit is in 

MODE 3, this surveillance is no longer required. If power is to be 

maintained < P-10 for more than [12] hours or < P-6 for more than 4 

hours, then the testing required by this surveillance must be performed 

prior to the expiration of the time limit. [Twelve] hours and four hours are 

reasonable times to complete the required testing or place the unit in a 

MODE where this surveillance is no longer required. This test ensures 

that the NIS source, intermediate, and power range low channels are 

OPERABLE prior to taking the reactor critical and after reducing power 

into the applicable MODE (< P-10 or < P-6) for periods > [12] and 

4 hours, respectively. [ The Frequency of 184 days is justified in 

Reference 13.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.9

SR 3.3.1.9 is the performance of a TADOT and [ is performed every 

[92] days, as justified in Reference 9. 

OR
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-57 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

A successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable TADOT of a relay. This is 

acceptable because all of the other required contacts of the relay are 

verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions.

The SR is modified by a Note that excludes verification of setpoints from 

the TADOT. Since this SR applies to RCP undervoltage and 

underfrequency relays, setpoint verification requires elaborate bench 

calibration and is accomplished during the CHANNEL CALIBRATION.

SR 3.3.1.10

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy.

The test is performed in accordance with the SCP. If the actual setting of 

the channel is found to be conservative with respect to the Allowable 

Value but is beyond the as-found tolerance band, the channel is 

OPERABLE but degraded. The degraded condition of the channel will be 

further evaluated during performance of the SR. This evaluation will 

consist of resetting the channel setpoint to the [NTSP] (within the allowed 

tolerance), and evaluating the channel response. If the channel is 

functioning as required and is expected to pass the next surveillance, 

then the channel is OPERABLE and can be restored to service at the 

completion of the surveillance. After the surveillance is completed, the 

channel as-found condition will be entered into the Corrective Action 

Program for further evaluation.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-58 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency of 18 months is based on the assumption of an 18 month 

calibration interval in the determination of the magnitude of equipment 

drift in the setpoint methodology.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.10 is modified by a Note stating that this test shall include 

verification that the time constants are adjusted to the prescribed values 

where applicable.

SR 3.3.1.11

SR 3.3.1.11 is the performance of a CHANNEL CALIBRATION, as 

described in SR 3.3.1.10. This SR is modified by a Note stating that 

neutron detectors are excluded from the CHANNEL CALIBRATION. The 

test is performed in accordance with the SCP. If the actual setting of the 

channel is found to be conservative with respect to the Allowable Value 

but is beyond the as-found tolerance band, the channel is OPERABLE 

but degraded. The degraded condition of the channel will be further 

evaluated during performance of the SR. This evaluation will consist of 

resetting the channel setpoint to the [NTSP] (within the allowed 

tolerance), and evaluating the channel response. If the channel is 

functioning as required and is expected to pass the next surveillance, 

then the channel is OPERABLE and can be restored to service at the 

completion of the surveillance. After the surveillance is completed, the 

channel as-found condition will be entered into the Corrective Action 

Program for further evaluation. The CHANNEL CALIBRATION for the 

power range neutron detectors consists of a normalization of the 

detectors based on a power calorimetric and flux map performed above 

15% RTP. The CHANNEL CALIBRATION for the source range and 

intermediate range neutron detectors consists of obtaining the detector 

plateau or preamp discriminator curves, evaluating those curves, and 

comparing the curves to the manufacturer's data. This Surveillance is not 
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-59 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

required for the NIS power range detectors for entry into MODE 2 or 1, 

and is not required for the NIS intermediate range detectors for entry into 

MODE 2, because the unit must be in at least MODE 2 to perform the test 

for the intermediate range detectors and MODE 1 for the power range 

detectors. [ The [18] month Frequency is based on the need to perform 

this Surveillance under the conditions that apply during a plant outage 

and the potential for an unplanned transient if the Surveillance were 

performed with the reactor at power. Operating experience has shown 

these components usually pass the Surveillance when performed on the 

[18] month Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.12

SR 3.3.1.12 is the performance of a CHANNEL CALIBRATION, as 

described in SR 3.3.1.10. The test is performed in accordance with the 

SCP. If the actual setting of the channel is found to be conservative with 

respect to the Allowable Value but is beyond the as-found tolerance band, 

the channel is OPERABLE but degraded. The degraded condition of the 

channel will be further evaluated during performance of the SR. This 

evaluation will consist of resetting the channel setpoint to the [NTSP] 

(within the allowed tolerance), and evaluating the channel response. If 

the channel is functioning as required and is expected to pass the next 

surveillance, then the channel is OPERABLE and can be restored to 

service at the completion of the surveillance. After the surveillance is 

completed, the channel as-found condition will be entered into the 

Corrective Action Program for further evaluation.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-60 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This SR is modified by a Note stating that this test shall include 

verification of the RCS resistance temperature detector (RTD) bypass 

loop flow rate. Whenever a sensing element is replaced, the next 

required CHANNEL CALIBRATION of the resistance temperature 

detectors (RTD) sensors is accomplished by an inplace cross calibration 

that compares the other sensing elements with the recently installed 

sensing element.

This test will verify the rate lag compensation for flow from the core to the 

RTDs.

[ The Frequency is justified by the assumption of an 18 month calibration 

interval in the determination of the magnitude of equipment drift in the 

setpoint analysis.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.13

SR 3.3.1.13 is the performance of a COT of RTS interlocks. A successful 

test of the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

[ The Frequency of 18 months is based on the known reliability of the 

interlocks and the multichannel redundancy available, and has been 

shown to be acceptable through operating experience.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-61 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.14

SR 3.3.1.14 is the performance of a TADOT of the Manual Reactor Trip, 

RCP Breaker Position, and the SI Input from ESFAS. A successful test of 

the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The test shall 

independently verify the OPERABILITY of the undervoltage and shunt trip 

mechanisms for the Manual Reactor Trip Function for the Reactor Trip 

Breakers and Reactor Trip Bypass Breakers. The Reactor Trip Bypass 

Breaker test shall include testing of the automatic undervoltage trip.

[ The Frequency of 18 months is based on the known reliability of the 

Functions and the multichannel redundancy available, and has been 

shown to be acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-62 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The SR is modified by a Note that excludes verification of setpoints from 

the TADOT. The Functions affected have no setpoints associated with 

them.

SR 3.3.1.15

SR 3.3.1.15 is the performance of a TADOT of Turbine Trip Functions. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable TADOT of a relay. This is 

acceptable because all of the other required contacts of the relay are 

verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable

extensions. This TADOT is as described in SR 3.3.1.4, except that this 

test is performed prior to exceeding the [P-9] interlock whenever the unit 

has been in MODE 3. This Surveillance is not required if it has been 

performed within the previous 31 days. Verification of the Trip Setpoint 

does not have to be performed for this Surveillance. Performance of this 

test will ensure that the turbine trip Function is OPERABLE prior to 

exceeding the [P-9] interlock.

SR 3.3.1.16

SR 3.3.1.16 verifies that the individual channel/train actuation response 

times are less than or equal to the maximum values assumed in the 

accident analysis. Response time testing acceptance criteria are 

included in Technical Requirements Manual, Section 15 (Ref. 14). 

Individual component response times are not modeled in the analyses.

The analyses model the overall or total elapsed time, from the point at 

which the parameter exceeds the trip setpoint value at the sensor to the 

point at which the equipment reaches the required functional state (i.e., 

control and shutdown rods fully inserted in the reactor core).

For channels that include dynamic transfer Functions (e.g., lag, lead/lag, 

rate/lag, etc.), the response time test may be performed with the transfer 

Function set to one, with the resulting measured response time compared 

to the appropriate FSAR response time. Alternately, the response time 

test can be performed with the time constants set to their nominal value, 

provided the required response time is analytically calculated assuming 

the time constants are set at their nominal values. The response time 

may be measured by a series of overlapping tests such that the entire 

response time is measured.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-63 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Applicable portions of the following Bases are applicable for plants 

adopting WCAP-13632-P-A and/or WCAP-14036-P.

--------------------------------------------------------------------------------------------------

Response time may be verified by actual response time tests in any 

series of sequential, overlapping or total channel measurements, or by 

the summation of allocated sensor, signal processing and actuation logic 

response times with actual response time tests on the remainder of the 

channel. Allocations for sensor response times may be obtained from: 

(1) historical records based on acceptable response time tests (hydraulic, 

noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g., 

vendor) test measurements, or (3) utilizing vendor engineering 

specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure 

Sensor Response Time Testing Requirements," (Ref. 10) provides the 

basis and methodology for using allocated sensor response times in the 

overall verification of the channel response time for specific sensors 

identified in the WCAP. Response time verification for other sensor types 

must be demonstrated by test.

[ WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel 

Response Time Tests," (Ref. 15) provides the basis and methodology for 

using allocated signal processing and actuation logic response times in 

the overall verification of the protection system channel response time.] 

The allocations for sensor, signal conditioning, and actuation logic 

response times must be verified prior to placing the component in 

operational service and re-verified following maintenance that may 

adversely affect response time. In general, electrical repair work does not 

impact response time provided the parts used for repair are of the same 

type and value. Specific components identified in the WCAP may be 

replaced without verification testing. One example where response time 

could be affected is replacing the sensing assembly of a transmitter.

[ As appropriate, each channel's response must be verified every 

[18] months on a STAGGERED TEST BASIS. Testing of the final 

actuation devices is included in the testing. Response times cannot be 

determined during unit operation because equipment operation is 

required to measure response times. Experience has shown that these 

components usually pass this surveillance when performed at the 

18 months Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-64 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.1.16 is modified by a Note stating that neutron detectors are 

excluded from RTS RESPONSE TIME testing. This Note is necessary 

because of the difficulty in generating an appropriate detector input 

signal. Excluding the detectors is acceptable because the principles of 

detector operation ensure a virtually instantaneous response.

REFERENCES 1. Regulatory Guide 1.105, Revision 3, "Setpoints for Safety Related 

Instrumentation." 

2. FSAR, Chapter [7].

3. FSAR, Chapter [6].

4. FSAR, Chapter [15].

5. IEEE-279-1971.

6. 10 CFR 50.49.

7. Plant specific setpoint methodology study.

8. WCAP-14333-P-A, Rev. 1, October 1998.

9. WCAP-10271-P-A, Supplement 1, May 1986.

10. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor 

Response Time Testing Requirements," January 1996.

11. [ Plant specific evaluation reference.]

12. WCAP-10271-P-A, Supplement 2, June 1990.
RTS Instrumentation (With Setpoint Control Program)

B 3.3.1B

Westinghouse STS B 3.3.1B-65 Rev. 4.0

BASES

REFERENCES (continued)

13. WCAP-15376, Rev. 0, October 2000.

14. Technical Requirements Manual, Section 15, "Response Times."

15. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection 

Channel Response Time Tests," December 1995.

Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.2A Engineered Safety Feature Actuation System (ESFAS) Instrumentation (Without 

Setpoint Control Program)

BASES

BACKGROUND The ESFAS initiates necessary safety systems, based on the values of 

selected unit parameters, to protect against violating core design limits 

and the Reactor Coolant System (RCS) pressure boundary, and to 

mitigate accidents. This is achieved by specifying limiting safety system 

settings (LSSS) in terms of parameters directly monitored by the ESFAS, 

as well as specifying LCOs on other reactor system parameters and 

equipment performance. 

Technical Specifications are required by 10 CFR 50.36 to include LSSS 

for variables that have significant safety functions. LSSS are defined by 

the regulation as "Where a LSSS is specified for a variable on which a 

safety limit has been placed, the setting must be chosen so that 

automatic protective actions will correct the abnormal situation before a 

Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the 

process variable at which a protective action is initiated, as established by 

the safety analysis, to ensure that a SL is not exceeded. Any automatic 

protection action that occurs on reaching the Analytical Limit therefore 

ensures that the SL is not exceeded. However, in practice, the actual 

settings for automatic protection channels must be chosen to be more 

conservative than the Analytical Limit to account for instrument loop 

uncertainties related to the setting at which the automatic protective 

action would actually occur. 

-------------------------------- REVIEWER'S NOTE ------------------------------------

The term "[Limiting Trip Setpoint (LTSP)]" is generic terminology for the 

calculated field setting (setpoint) value calculated by means of the plantspecific setpoint methodology documented in a document controlled 

under 10 CFR 50.59. The term [LTSP] indicates that no additional margin 

has been added between the Analytical Limit and the calculated trip 

setting. 

For most Westinghouse plants the term [Nominal Trip Setpoint (NTSP)] is 

used in place of the term [LTSP], and [NTSP] will replace [LTSP] in the 

Bases descriptions. "Field setting" is the suggested terminology for the 

actual setpoint implemented in the plant surveillance procedures where 

margin has been added to the calculated field setting. The as-found and 

as-left tolerances will apply to the field setting implemented in the 

Surveillance procedures to confirm channel performance. 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-2 Rev. 4.0

BASES

BACKGROUND (continued)

Licensees are to insert the name of the document(s) controlled under 

10 CFR 50.59 that contain the methodology for calculating the as-left and 

as-found tolerances, in Note c of Table 3.3.2-1 for the phrase "[insert the 

name of a document controlled under 10 CFR 50.59 such as the 

Technical Requirements Manual or any document incorporated into the 

facility FSAR]" throughout these Bases. 

Where the [NTSP] is not included in Table 3.3.2-1, the plant-specific 

location for the [NTSP] must be cited in Note c of Table 3.3.2-1. The 

brackets indicate plant-specific terms may apply, as reviewed and 

approved by the NRC. 

--------------------------------------------------------------------------------------------------

The [Nominal Trip Setpoint (NTSP)] specified in Table 3.3.2-1 is a 

predetermined setting for a protection channel chosen to ensure 

automatic actuation prior to the process variable reaching the Analytical 

Limit and thus ensuring that the SL would not be exceeded. As such, the 

[NTSP] accounts for uncertainties in setting the channel (e.g., calibration), 

uncertainties in how the channel might actually perform (e.g., 

repeatability), changes in the point of action of the channel over time 

(e.g., drift during surveillance intervals), and any other factors which may 

influence its actual performance (e.g., harsh accident environments). In 

this manner, the [NTSP] ensures that SLs are not exceeded. Therefore, 

the [NTSP] meets the definition of an LSSS (Ref. 1).

Technical Specifications contain values related to the OPERABILITY of 

equipment required for safe operation of the facility. OPERABLE is 

defined in Technical Specifications as "...being capable of performing its 

safety functions(s)." Relying solely on the [NTSP] to define 

OPERABILITY in Technical Specifications would be an overly restrictive 

requirement if it were applied as an OPERABILITY limit for the "as-found" 

value of a protection channel setting during a surveillance. This would 

result in Technical Specification compliance problems, as well as reports 

and corrective actions required by the rule which are not necessary to 

ensure safety. For example, an automatic protection channel with a 

setting that has been found to be different from the [NTSP] due to some 

drift of the setting may still be OPERABLE since drift is to be expected. 

This expected drift would have been specifically accounted for in the 

setpoint methodology for calculating the [NTSP] and thus the automatic 

protective action would still have ensured that the SL would not be 

exceeded with the "as-found" setting of the protection channel. 

Therefore, the channel would still be OPERABLE since it would have 

performed its safety function and the only corrective action required would 

be to reset the channel within the established as-left tolerance around the

[NTSP] to account for further drift during the next surveillance interval. 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-3 Rev. 4.0

BASES

BACKGROUND (continued)

[Note: Alternatively, a Technical Specification format incorporating an 

Allowable Value only column may be proposed by a licensee. In this 

case, the [NTSP] value and the methodologies used to calculate the asfound and as-left tolerances must be specified in [insert the name of a 

document controlled under 10 CFR 50.59 such as the Technical 

Requirements Manual or any document incorporated into the facility 

FSAR]. Changes to the actual plant trip setpoint or [NTSP] value would 

be controlled by 10 CFR 50.59 or administratively as appropriate, and 

adjusted per the setpoint methodology and applicable surveillance 

requirements.

During Anticipated Operational Occurrences (AOOs), which are those 

events expected to occur one or more times during the unit life, the 

acceptable limits are:

1. The Departure from Nucleate Boiling Ratio (DNBR) shall be 

maintained above the SL value to prevent departure from nucleate 

boiling (DNB),

2. Fuel centerline melt shall not occur, and

3. The RCS pressure SL of [2735] psig shall not be exceeded.

Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also 

maintains the above values and assures that offsite dose will be within 

the 10 CFR 50 and 10 CFR 100 criteria during AOOs.

Accidents are events that are analyzed even though they are not 

expected to occur during the unit life. The acceptable limit during 

accidents is that offsite dose shall be maintained within an acceptable 

fraction of 10 CFR 100 limits. Different accident categories are allowed a 

different fraction of these limits, based on probability of occurrence. 

Meeting the acceptable dose limit for an accident category is considered 

having acceptable consequences for that event.

The ESFAS instrumentation is segmented into three distinct but 

interconnected modules as identified below:

 Field transmitters or process sensors and instrumentation: provide a 

measurable electronic signal based on the physical characteristics of 

the parameter being measured,
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-4 Rev. 4.0

BASES

BACKGROUND (continued)

 Signal processing equipment including analog protection system, 

field contacts, and protection channel sets: provide signal 

conditioning, bistable setpoint comparison, process algorithm 

actuation, compatible electrical signal output to protection system 

channels, and control board/control room/miscellaneous indications, 

and

 Solid State Protection System (SSPS) including input, logic, and 

output bays: initiates the proper unit shutdown or engineered safety 

feature (ESF) actuation in accordance with the defined logic and 

based on the bistable outputs from the signal process control and 

protection system.

Field Transmitters or Sensors

To meet the design demands for redundancy and reliability, more than 

one, and often as many as four, field transmitters or sensors are used to 

measure unit parameters. In many cases, field transmitters or sensors 

that input to the ESFAS are shared with the Reactor Trip System (RTS). 

In some cases, the same channels also provide control system inputs. 

To account for calibration tolerances and instrument drift, which are 

assumed to occur between calibrations, statistical allowances are 

provided in the [NTSP] and Allowable Value. The OPERABILITY of each 

transmitter or sensor is determined by either "as-found" calibration data 

evaluated during the CHANNEL CALIBRATION or by qualitative 

assessment of field transmitter or sensor, as related to the channel 

behavior observed during performance of the CHANNEL CHECK.

Signal Processing Equipment

Generally, three or four channels of process control equipment are used 

for the signal processing of unit parameters measured by the field 

instruments. The process control equipment provides signal conditioning, 

comparable output signals for instruments located on the main control 

board, and comparison of measured input signals with [NTSPs] derived 

from Analytical Limits established by the safety analyses. Analytical 

Limits are defined in FSAR, Chapter [6] (Ref. 2), Chapter [7] (Ref. 3), and 

Chapter [15] (Ref. 4). If the measured value of a unit parameter exceeds 

the predetermined setpoint, an output from a bistable is forwarded to the 

SSPS for decision evaluation. Channel separation is maintained up to 

and through the input bays. However, not all unit parameters require four 

channels of sensor measurement and signal processing. Some unit 

parameters provide input only to the SSPS, while others provide input to 

the SSPS, the main control board, the unit computer, and one or more 

control systems.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-5 Rev. 4.0

BASES

BACKGROUND (continued)

Generally, if a parameter is used only for input to the protection circuits, 

three channels with a two-out-of-three logic are sufficient to provide the 

required reliability and redundancy. If one channel fails in a direction that 

would not result in a partial Function trip, the Function is still OPERABLE 

with a two-out-of-two logic. If one channel fails such that a partial 

Function trip occurs, a trip will not occur and the Function is still 

OPERABLE with a one-out-of-two logic.

Generally, if a parameter is used for input to the SSPS and a control 

function, four channels with a two-out-of-four logic are sufficient to provide 

the required reliability and redundancy. The circuit must be able to 

withstand both an input failure to the control system, which may then 

require the protection function actuation, and a single failure in the other 

channels providing the protection function actuation. Again, a single 

failure will neither cause nor prevent the protection function actuation.

These requirements are described in IEEE-279-1971 (Ref. 5). The actual 

number of channels required for each unit parameter is specified in 

Reference 3.

[NTSPs] and ESFAS Setpoints [Allowable Values]

The trip setpoints used in the bistables are based on the analytical limits 

stated in Reference 3. The calculation of the [NTSPs] specified in 

Table 3.3.2-1 is such that adequate protection is provided when all sensor 

and processing time delays are taken into account. To allow for 

calibration tolerances, instrumentation uncertainties, instrument drift, and 

severe environment errors for those ESFAS channels that must function 

in harsh environments as defined by 10 CFR 50.49 (Ref. 6), the Allowable 

Values specified in Table 3.3.2-1 in the accompanying LCO are 

conservative with respect to the analytical limits. A detailed description of 

the methodology used to calculate the Allowable Values and ESFAS 

[NTSPs] including their explicit uncertainties, is provided in the plant 

specific setpoint methodology study (Ref. 7) which incorporates all of the 

known uncertainties applicable to each channel. The as-left tolerance 

and as-found tolerance band methodology is provided in [insert the name 

of a document controlled under 10 CFR 50.59 such as the Technical 

Requirements Manual or any document incorporated into the facility 

FSAR]. The magnitudes of these uncertainties are factored into the 

determination of each ESFAS [NTSP] and corresponding Allowable 

Value. The nominal ESFAS setpoint entered into the bistable is more 

conservative than that specified by the [NTSP] to account for 

measurement errors detectable by the CHANNEL OPERATIONAL TEST 

(COT). The Allowable Value serves as the as-found Technical 

Specification OPERABILITY limit for the purpose of the COT. 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-6 Rev. 4.0

BASES

BACKGROUND (continued)

The [NTSP] is the value at which the bistables are set and is the expected 

value to be achieved during calibration. The [NTSP] value is the LSSS 

and ensures the safety analysis limits are met for the surveillance interval 

selected when a channel is adjusted based on stated channel 

uncertainties. Any bistable is considered to be properly adjusted when 

the "as-left" [NTSP] value is within the as-left tolerance for CHANNEL 

CALIBRATION uncertainty allowance (i.e., + rack calibration and

comparator setting uncertainties). The [NTSP] value is therefore 

considered a "nominal value" (i.e., expressed as a value without 

inequalities) for the purposes of the COT and CHANNEL CALIBRATION. 

[Nominal Trip Setpoints], in conjunction with the use of as-found and asleft tolerances together with the requirements of the Allowable Value 

ensure that the consequences of Design Basis Accidents (DBAs) will be 

acceptable, providing the unit is operated from within the LCOs at the 

onset of the DBA and the equipment functions as designed.

Note that the Allowable Values listed in Table 3.3.2-1 are the least 

conservative value of the as-found setpoint that a channel can have 

during a periodic CHANNEL CALIBRATION, COT, or a TADOT.

Each channel can be tested on line to verify that the signal processing 

equipment and setpoint accuracy is within the specified allowance 

requirements of Reference 3. Once a designated channel is taken out of 

service for testing, a simulated signal is injected in place of the field 

instrument signal. The process equipment for the channel in test is then 

tested, verified, and calibrated. SRs for the channels are specified in the 

SR section.

Solid State Protection System

The SSPS equipment is used for the decision logic processing of outputs 

from the signal processing equipment bistables. To meet the redundancy 

requirements, two trains of SSPS, each performing the same functions, 

are provided. If one train is taken out of service for maintenance or test 

purposes, the second train will provide ESF actuation for the unit. If both 

trains are taken out of service or placed in test, a reactor trip will result. 

Each train is packaged in its own cabinet for physical and electrical 

separation to satisfy separation and independence requirements. 

The SSPS performs the decision logic for most ESF equipment actuation; 

generates the electrical output signals that initiate the required actuation; 

and provides the status, permissive, and annunciator output signals to the 

main control room of the unit.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-7 Rev. 4.0

BASES

BACKGROUND (continued)

The bistable outputs from the signal processing equipment are sensed by 

the SSPS equipment and combined into logic matrices that represent 

combinations indicative of various transients. If a required logic matrix 

combination is completed, the system will send actuation signals via 

master and slave relays to those components whose aggregate Function 

best serves to alleviate the condition and restore the unit to a safe 

condition. Examples are given in the Applicable Safety Analyses, LCO, 

and Applicability sections of this Bases.

Each SSPS train has a built in testing device that can automatically test 

the decision logic matrix functions and the actuation channels while the 

unit is at power. When any one train is taken out of service for testing, 

the other train is capable of providing unit monitoring and protection until 

the testing has been completed. The testing device is semiautomatic to 

minimize testing time.

The actuation of ESF components is accomplished through master and 

slave relays. The SSPS energizes the master relays appropriate for the 

condition of the unit. Each master relay then energizes one or more slave 

relays, which then cause actuation of the end devices. The master and 

slave relays are routinely tested to ensure operation. The test of the 

master relays energizes the relay, which then operates the contacts and 

applies a low voltage to the associated slave relays. The low voltage is 

not sufficient to actuate the slave relays but only demonstrates signal 

path continuity. The SLAVE RELAY TEST actuates the devices if their 

operation will not interfere with continued unit operation. For the latter 

case, actual component operation is prevented by the SLAVE RELAY 

TEST circuit, and slave relay contact operation is verified by a continuity 

check of the circuit containing the slave relay.

----------------------------REVIEWER’S NOTE------------------------------------------

No one unit ESFAS incorporates all of the Functions listed in 

Table 3.3.2-1. In some cases (e.g., Containment Pressure - High 3, 

Function 2.c), the Table reflects several different implementations of the 

same Function. Typically, only one of these implementations are used at 

any specific unit.

--------------------------------------------------------------------------------------------------

APPLICABLE Each of the analyzed accidents can be detected by one or more ESFAS

SAFETY Functions. One of the ESFAS Functions is the primary actuation signal 

ANALYSES, LCO, for that accident. An ESFAS Function may be the primary actuation 

and APPLICABILITY signal for more than one type of accident. An ESFAS Function may also 

be a secondary, or backup, actuation signal for one or more other 

accidents. For example, Pressurizer Pressure - Low is a primary 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-8 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

actuation signal for small loss of coolant accidents (LOCAs) and a backup 

actuation signal for steam line breaks (SLBs) outside containment.

Functions such as manual initiation, not specifically credited in the 

accident safety analysis, are implicitly credited in the safety analysis and 

the NRC staff approved licensing basis for the unit. These Functions may 

provide protection for conditions that do not require dynamic transient 

analysis to demonstrate Function performance. These Functions may 

also serve as backups to Functions that were credited in the accident 

analysis (Ref. 4).

Permissive and interlock setpoints allow the blocking of trips during plant 

startups, and restoration of trips when the permissive conditions are not 

satisfied, but they are not explicitly modeled in the Safety Analyses. 

These permissives and interlocks ensure that the starting conditions are 

consistent with the safety analysis, before preventive or mitigating actions 

occur. Because these permissives or interlocks are only one of multiple 

conservative starting assumptions for the accident analysis, they are 

generally considered as nominal values without regard to measurement 

accuracy.

The LCO requires all instrumentation performing an ESFAS Function, 

listed in Table 3.3.2-1 in the accompanying LCO, to be OPERABLE. The 

Allowable Value specified in Table 3.3.2-1 is the least conservative value 

of the as-found setpoint that the channel can have when tested, such that 

a channel is OPERABLE if the as-found setpoint is within the as-found 

tolerance and is conservative with respect to the Allowable Value during 

the CHANNEL CALIBRATION or COT. As such, the Allowable Value 

differs from the [NTSP] by an amount [greater than or] equal to the 

expected instrument channel uncertainties, such as drift, during the 

surveillance interval. In this manner, the actual setting of the channel 

[NTSP] will ensure that a SL is not exceeded at any given point of time as 

long as the channel has not drifted beyond expected tolerances during 

the surveillance interval. Note that, although the channel is OPERABLE 

under these circumstances, the trip setpoint must be left adjusted to a 

value within the as-left tolerance, in accordance with uncertainty 

assumptions stated in the referenced setpoint methodology (as-left 

criteria), and confirmed to be operating within the statistical allowances of 

the uncertainty terms assigned (as-found criteria).

If the actual setting of the channel is found to be conservative with 

respect to the Allowable Value but is beyond the as-found tolerance band, 

the channel is OPERABLE, but degraded. The degraded condition of the 

channel will be evaluated during performance of the SR. This evaluation 

will consist of resetting the channel setpoint to the [NTSP] (within the 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-9 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

allowed tolerance) and evaluating the channel response. If the channel is 

functioning as required and expected to pass the next surveillance, then 

the channel can be restored to service at the completion of the 

surveillance. 

A trip setpoint may be set more conservative than the [NTSP] as 

necessary in response to plant conditions. However, in this case, the 

OPERABILITY of this instrument must be verified based on the [field 

setting] and not the [NTSP]. Failure of any instrument renders the 

affected channel(s) inoperable and reduces the reliability of the affected 

Functions.

The LCO generally requires OPERABILITY of four or three channels in 

each instrumentation function and two channels in each logic and manual 

initiation function. The two-out-of-three and the two-out-of-four 

configurations allow one channel to be tripped during maintenance or 

testing without causing an ESFAS initiation. Two logic or manual 

initiation channels are required to ensure no single random failure 

disables the ESFAS.

The required channels of ESFAS instrumentation provide unit protection 

in the event of any of the analyzed accidents. ESFAS protection 

functions are as follows:

1. Safety Injection

Safety Injection (SI) provides two primary functions:

1. Primary side water addition to ensure maintenance or recovery 

of reactor vessel water level (coverage of the active fuel for heat 

removal, clad integrity, and for limiting peak clad temperature to 

< 2200°F), and

2. Boration to ensure recovery and maintenance of SDM (keff< 1.0).

These functions are necessary to mitigate the effects of high energy 

line breaks (HELBs) both inside and outside of containment. The SI 

signal is also used to initiate other Functions such as:

 Phase A Isolation,

 Containment Purge Isolation,
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-10 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

 Reactor Trip,

 Turbine Trip,

 Feedwater Isolation,

 Start of motor driven auxiliary feedwater (AFW) pumps,

 Control room ventilation isolation, and

 Enabling automatic switchover of Emergency Core Cooling 

Systems (ECCS) suction to containment sump.

These other functions ensure:

 Isolation of nonessential systems through containment 

penetrations,

 Trip of the turbine and reactor to limit power generation,

 Isolation of main feedwater (MFW) to limit secondary side mass 

losses,

 Start of AFW to ensure secondary side cooling capability,

 Isolation of the control room to ensure habitability, and

 Enabling ECCS suction from the refueling water storage tank 

(RWST) switchover on low low RWST level to ensure continued 

cooling via use of the containment sump.

a. Safety Injection - Manual Initiation

The LCO requires one channel per train to be OPERABLE. The 

operator can initiate SI at any time by using either of two 

switches in the control room. This action will cause actuation of 

all components in the same manner as any of the automatic 

actuation signals.

The LCO for the Manual Initiation Function ensures the proper 

amount of redundancy is maintained in the manual ESFAS 

actuation circuitry to ensure the operator has manual ESFAS 

initiation capability.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-11 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Each channel consists of one push button and the 

interconnecting wiring to the actuation logic cabinet. Each push 

button actuates both trains. This configuration does not allow 

testing at power.

b. Safety Injection - Automatic Actuation Logic and Actuation 

Relays

This LCO requires two trains to be OPERABLE. Actuation logic 

consists of all circuitry housed within the actuation subsystems, 

including the initiating relay contacts responsible for actuating 

the ESF equipment.

Manual and automatic initiation of SI must be OPERABLE in 

MODES 1, 2, and 3. In these MODES, there is sufficient energy 

in the primary and secondary systems to warrant automatic 

initiation of ESF systems. Manual Initiation is also required in 

MODE 4 even though automatic actuation is not required. In this 

MODE, adequate time is available to manually actuate required 

components in the event of a DBA, but because of the large 

number of components actuated on a SI, actuation is simplified 

by the use of the manual actuation push buttons. Automatic 

actuation logic and actuation relays must be OPERABLE in 

MODE 4 to support system level manual initiation.

These Functions are not required to be OPERABLE in MODES 5 

and 6 because there is adequate time for the operator to 

evaluate unit conditions and respond by manually starting 

individual systems, pumps, and other equipment to mitigate the 

consequences of an abnormal condition or accident. Unit

pressure and temperature are very low and many ESF 

components are administratively locked out or otherwise 

prevented from actuating to prevent inadvertent 

overpressurization of unit systems.

c. Safety Injection - Containment Pressure - High 1

This signal provides protection against the following accidents:

 SLB inside containment,

 LOCA, and

 Feed line break inside containment.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-12 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Containment Pressure - High 1 provides no input to any control 

functions. Thus, three OPERABLE channels are sufficient to 

satisfy protective requirements with a two-out-of-three logic. The 

transmitters (d/p cells) and electronics are located outside of 

containment with the sensing line (high pressure side of the 

transmitter) located inside containment.

Thus, the high pressure Function will not experience any 

adverse environmental conditions and the [NTSP] reflects only 

steady state instrument uncertainties.

Containment Pressure - High 1 must be OPERABLE in 

MODES 1, 2, and 3 when there is sufficient energy in the primary 

and secondary systems to pressurize the containment following 

a pipe break. In MODES 4, 5, and 6, there is insufficient energy 

in the primary or secondary systems to pressurize the 

containment.

d. Safety Injection - Pressurizer Pressure – Low

This signal provides protection against the following accidents:

 Inadvertent opening of a steam generator (SG) relief or 

safety valve,

 SLB,

 A spectrum of rod cluster control assembly ejection 

accidents (rod ejection),

 Inadvertent opening of a pressurizer relief or safety valve,

 LOCAs, and

 SG Tube Rupture.

At some units pressurizer pressure provides both control and 

protection functions: input to the Pressurizer Pressure Control 

System, reactor trip, and SI. Therefore, the actuation logic must 

be able to withstand both an input failure to control system, 

which may then require the protection function actuation, and a 

single failure in the other channels providing the protection 

function actuation. Thus, four OPERABLE channels are required 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-13 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

to satisfy the requirements with a two-out-of-four logic. For units 

that have dedicated protection and control channels, only three 

protection channels are necessary to satisfy the protective 

requirements.

The transmitters are located inside containment, with the taps in 

the vapor space region of the pressurizer, and thus possibly 

experiencing adverse environmental conditions (LOCA, SLB 

inside containment, rod ejection). Therefore, the [NTSP] reflects 

the inclusion of both steady state and adverse environmental 

instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 

(above P-11) to mitigate the consequences of an HELB inside 

containment. This signal may be manually blocked by the 

operator below the P-11 setpoint. Automatic SI actuation below 

this pressure setpoint is then performed by the Containment 

Pressure - High 1 signal.

This Function is not required to be OPERABLE in MODE 3 

below the P-11 setpoint. Other ESF functions are used to detect 

accident conditions and actuate the ESF systems in this MODE. 

In MODES 4, 5, and 6, this Function is not needed for accident 

detection and mitigation.

e. Safety Injection - Steam Line Pressure

(1) Steam Line Pressure – Low

Steam Line Pressure - Low provides protection against the 

following accidents:

 SLB,

 Feed line break, and

 Inadvertent opening of an SG relief or an SG safety 

valve.

Steam Line Pressure - Low provides no input to any control 

functions. Thus, three OPERABLE channels on each steam 

line are sufficient to satisfy the protective requirements with 

a two-out-of-three logic on each steam line.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-14 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

With the transmitters typically located inside the steam 

tunnels, it is possible for them to experience adverse 

environmental conditions during a secondary side break. 

Therefore, the [NTSP] reflects both steady state and 

adverse environmental instrument uncertainties.

This Function is anticipatory in nature and has a typical 

lead/lag ratio of 50/5.

Steam Line Pressure - Low must be OPERABLE in 

MODES 1, 2, and 3 (above P-11) when a secondary side 

break or stuck open valve could result in the rapid 

depressurization of the steam lines. This signal may be 

manually blocked by the operator below the P-11 setpoint. 

Below P-11, feed line break is not a concern. Inside 

containment SLB will be terminated by automatic SI 

actuation via Containment Pressure - High 1, and outside 

containment SLB will be terminated by the Steam Line 

Pressure - Negative Rate - High signal for steam line 

isolation. This Function is not required to be OPERABLE in 

MODE 4, 5, or 6 because there is insufficient energy in the 

secondary side of the unit to cause an accident.

(2) Steam Line Pressure - High Differential Pressure Between 

Steam Lines

Steam Line Pressure - High Differential Pressure Between 

Steam Lines provides protection against the following 

accidents:

 SLB,

 Feed line break, and

 Inadvertent opening of an SG relief or an SG safety 

valve.

Steam Line Pressure - High Differential Pressure Between 

Steam Lines provides no input to any control functions. 

Thus, three OPERABLE channels on each steam line are 

sufficient to satisfy the requirements, with a two-out-of-three 

logic on each steam line.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-15 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

With the transmitters typically located inside the steam 

tunnels, it is possible for them to experience adverse 

environmental conditions during a SLB event. Therefore, 

the [NTSP] reflects both steady state and adverse 

environmental instrument uncertainties. Steam line high 

differential pressure must be OPERABLE in MODES 1, 2, 

and 3 when a secondary side break or stuck open valve 

could result in the rapid depressurization of the steam 

line(s). This Function is not required to be OPERABLE in 

MODE 4, 5, or 6 because there is not sufficient energy in the 

secondary side of the unit to cause an accident.

f, g. Safety Injection - High Steam Flow in Two Steam Lines 

Coincident With Tavg - Low Low or Coincident With Steam Line 

Pressure – Low

These Functions (1.f and 1.g) provide protection against the 

following accidents:

 SLB, and

 the inadvertent opening of an SG relief or an SG safety 

valve.

Two steam line flow channels per steam line are required 

OPERABLE for these Functions. The steam line flow channels 

are combined in a one-out-of-two logic to indicate high steam 

flow in one steam line. The steam flow transmitters provide 

control inputs, but the control function cannot cause the events 

that the Function must protect against. Therefore, two channels 

are sufficient to satisfy redundancy requirements. The one-outof-two configuration allows online testing because trip of one 

high steam flow channel is not sufficient to cause initiation. High 

steam flow in two steam lines is acceptable in the case of a 

single steam line fault due to the fact that the remaining intact 

steam lines will pick up the full turbine load. The increased 

steam flow in the remaining intact lines will actuate the required 

second high steam flow trip. Additional protection is provided by 

Function 1.e.(2), High Differential Pressure Between Steam 

Lines.

One channel of Tavg per loop and one channel of low steam line 

pressure per steam line are required OPERABLE. For each 

parameter, the channels for all loops or steam lines are 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-16 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

combined in a logic such that two channels tripped will cause a 

trip for the parameter. For example, for three loop units, the low

steam line pressure channels are combined in two-out-of- three 

logic. Thus, the Function trips on one-out-of-two high flow in any 

two-out-of-three steam lines if there is one-out-of-one low low 

Tavg trip in any two-out-of-three RCS loops, or if there is a oneout-of-one low pressure trip in any two-out-of-three steam lines. 

Since the accidents that this event protects against cause both 

low steam line pressure and low low Tavg, provision of one 

channel per loop or steam line ensures no single random failure 

can disable both of these Functions. The steam line pressure 

channels provide no control inputs. The Tavg channels provide 

control inputs, but the control function cannot initiate events that 

the Function acts to mitigate.

The Allowable Value for high steam flow is a linear function that 

varies with power level. The function is a ∆P corresponding to 

44% of full steam flow between 0% and 20% load to 114% of full 

steam flow at 100% load. The nominal trip setpoint is similarly 

calculated.

With the transmitters typically located inside the containment 

(Tavg) or inside the steam tunnels (High Steam Flow), it is 

possible for them to experience adverse steady state 

environmental conditions during a SLB event. Therefore, the 

[NTSP] reflects both steady state and adverse environmental 

instrument uncertainties. The Steam Line Pressure - Low signal 

was discussed previously under Function 1.e.(1).

This Function must be OPERABLE in MODES 1, 2, and 3 

(above P-12) when a secondary side break or stuck open valve 

could result in the rapid depressurization of the steam line(s). 

This signal may be manually blocked by the operator when 

below the P-12 setpoint. Above P-12, this Function is 

automatically unblocked. This Function is not required 

OPERABLE below P-12 because the reactor is not critical, so 

feed line break is not a concern. SLB may be addressed by 

Containment Pressure High 1 (inside containment) or by High 

Steam Flow in Two Steam Lines coincident with Steam Line 

Pressure - Low, for Steam Line Isolation, followed by High 

Differential Pressure Between Two Steam Lines, for SI. This 

Function is not required to be OPERABLE in MODE 4, 5, or 6 

because there is insufficient energy in the secondary side of the 

unit to cause an accident.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-17 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

2. Containment Spray

Containment Spray provides three primary functions:

1. Lowers containment pressure and temperature after an HELB in 

containment,

2. Reduces the amount of radioactive iodine in the containment 

atmosphere, and

3. Adjusts the pH of the water in the containment recirculation 

sump after a large break LOCA.

These functions are necessary to:

 Ensure the pressure boundary integrity of the containment 

structure,

 Limit the release of radioactive iodine to the environment in the 

event of a failure of the containment structure, and

 Minimize corrosion of the components and systems inside 

containment following a LOCA.

The containment spray actuation signal starts the containment spray 

pumps and aligns the discharge of the pumps to the containment 

spray nozzle headers in the upper levels of containment. Water is 

initially drawn from the RWST by the containment spray pumps and 

mixed with a sodium hydroxide solution from the spray additive tank. 

When the RWST reaches the low low level setpoint, the spray pump 

suctions are shifted to the containment sump if continued 

containment spray is required. Containment spray is actuated 

manually by Containment Pressure - High 3 or Containment Pressure 

- High High.

a. Containment Spray - Manual Initiation

The operator can initiate containment spray at any time from the 

control room by simultaneously turning two containment spray 

actuation switches in the same train. Because an inadvertent 

actuation of containment spray could have such serious 

consequences, two switches must be turned simultaneously to 

initiate containment spray. There are two sets of two switches 

each in the control room. Simultaneously turning the two
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-18 Rev. 4.0

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

switches in either set will actuate containment spray in both 

trains in the same manner as the automatic actuation signal. 

Two Manual Initiation switches in each train are required to be 

OPERABLE to ensure no single failure disables the Manual 

Initiation Function. Note that Manual Initiation of containment 

spray also actuates Phase B containment isolation.

b. Containment Spray - Automatic Actuation Logic and Actuation 

Relays

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

Manual and automatic initiation of containment spray must be 

OPERABLE in MODES 1, 2, and 3 when there is a potential for 

an accident to occur, and sufficient energy in the primary or 

secondary systems to pose a threat to containment integrity due 

to overpressure conditions. Manual initiation is also required in 

MODE 4, even though automatic actuation is not required. In 

this MODE, adequate time is available to manually actuate 

required components in the event of a DBA. However, because 

of the large number of components actuated on a containment 

spray, actuation is simplified by the use of the manual actuation 

push buttons. Automatic actuation logic and actuation relays 

must be OPERABLE in MODE 4 to support system level manual 

initiation. In MODES 5 and 6, there is insufficient energy in the 

primary and secondary systems to result in containment 

overpressure. In MODES 5 and 6, there is also adequate time 

for the operators to evaluate unit conditions and respond, to 

mitigate the consequences of abnormal conditions by manually 

starting individual components.

c. Containment Spray - Containment Pressure

This signal provides protection against a LOCA or a SLB inside 

containment. The transmitters (d/p cells) are located outside of 

containment with the sensing line (high pressure side of the 

transmitter) located inside containment. The transmitters and 

electronics are located outside of containment. Thus, they will 

not experience any adverse environmental conditions and the 

[NTSP] reflects only steady state instrument uncertainties.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-19 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

This is one of the only Functions that requires the bistable output 

to energize to perform its required action. It is not desirable to 

have a loss of power actuate containment spray, since the 

consequences of an inadvertent actuation of containment spray 

could be serious. Note that this Function also has the inoperable 

channel placed in bypass rather than trip to decrease the 

probability of an inadvertent actuation.

Two different logic configurations are typically used. Three and 

four loop units use four channels in a two-out-of-four logic 

configuration. This configuration may be called the Containment 

Pressure - High 3 Setpoint for three and four loop units, and 

Containment Pressure - High High Setpoint for other units. 

Some two loop units use three sets of two channels, each set 

combined in a one-out-of-two configuration, with these outputs 

combined so that two-out-of-three sets tripped initiates 

containment spray. This configuration is called Containment 

Pressure - High 3 Setpoint. Since containment pressure is not 

used for control, both of these arrangements exceed the 

minimum redundancy requirements. Additional redundancy is 

warranted because this Function is energized to trip. 

Containment Pressure - [High 3] [High High] must be 

OPERABLE in MODES 1, 2, and 3 when there is sufficient 

energy in the primary and secondary sides to pressurize the 

containment following a pipe break. In MODES 4, 5, and 6, 

there is insufficient energy in the primary and secondary sides to 

pressurize the containment and reach the Containment Pressure 

- High 3 (High High) setpoints.

3. Containment Isolation

Containment Isolation provides isolation of the containment 

atmosphere, and all process systems that penetrate containment, 

from the environment. This Function is necessary to prevent or limit 

the release of radioactivity to the environment in the event of a large 

break LOCA.

There are two separate Containment Isolation signals, Phase A and 

Phase B. Phase A isolation isolates all automatically isolable 

process lines, except component cooling water (CCW), at a relatively 

low containment pressure indicative of primary or secondary system 

leaks. For these types of events, forced circulation cooling using the 

reactor coolant pumps (RCPs) and SGs is the preferred (but not 

required) method of decay heat removal. Since CCW is required to 

support RCP operation, not isolating CCW on the low pressure
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-20 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Phase A signal enhances unit safety by allowing operators to use 

forced RCS circulation to cool the unit. Isolating CCW on the low 

pressure signal may force the use of feed and bleed cooling, which 

could prove more difficult to control.

Phase A containment isolation is actuated automatically by SI, or 

manually via the automatic actuation logic. All process lines 

penetrating containment, with the exception of CCW, are isolated. 

CCW is not isolated at this time to permit continued operation of the 

RCPs with cooling water flow to the thermal barrier heat exchangers 

and air or oil coolers. All process lines not equipped with remote 

operated isolation valves are manually closed, or otherwise isolated, 

prior to reaching MODE 4.

Manual Phase A Containment Isolation is accomplished by either of 

two switches in the control room. Either switch actuates both trains. 

Note that manual actuation of Phase A Containment Isolation also 

actuates Containment Purge and Exhaust Isolation.

The Phase B signal isolates CCW. This occurs at a relatively high 

containment pressure that is indicative of a large break LOCA or a 

SLB. For these events, forced circulation using the RCPs is no 

longer desirable. Isolating the CCW at the higher pressure does not 

pose a challenge to the containment boundary because the CCW 

System is a closed loop inside containment. Although some system 

components do not meet all of the ASME Code requirements applied

to the containment itself, the system is continuously pressurized to a 

pressure greater than the Phase B setpoint. Thus, routine operation 

demonstrates the integrity of the system pressure boundary for 

pressures exceeding the Phase B setpoint. Furthermore, because 

system pressure exceeds the Phase B setpoint, any system leakage 

prior to initiation of Phase B isolation would be into containment. 

Therefore, the combination of CCW System design and Phase B 

isolation ensures the CCW System is not a potential path for 

radioactive release from containment.

Phase B containment isolation is actuated by Containment Pressure -

High 3 or Containment Pressure - High High, or manually, via the 

automatic actuation logic, as previously discussed. For containment 

pressure to reach a value high enough to actuate Containment 

Pressure - High 3 or Containment Pressure - High High, a large

break LOCA or SLB must have occurred and containment spray must 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-21 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

have been actuated. RCP operation will no longer be required and 

CCW to the RCPs is, therefore, no longer necessary. The RCPs can 

be operated with seal injection flow alone and without CCW flow to 

the thermal barrier heat exchanger.

Manual Phase B Containment Isolation is accomplished by the same 

switches that actuate Containment Spray. When the two switches in 

either set are turned simultaneously, Phase B Containment Isolation 

and Containment Spray will be actuated in both trains.

a. Containment Isolation - Phase A Isolation

(1) Phase A Isolation - Manual Initiation

Manual Phase A Containment Isolation is actuated by either 

of two switches in the control room. Either switch actuates 

both trains. Note that manual initiation of Phase A 

Containment Isolation also actuates Containment Purge 

Isolation.

(2) Phase A Isolation - Automatic Actuation Logic and Actuation 

Relays

Automatic Actuation Logic and Actuation Relays consist of 

the same features and operate in the same manner as 

described for ESFAS Function 1.b.

Manual and automatic initiation of Phase A Containment 

Isolation must be OPERABLE in MODES 1, 2, and 3, when 

there is a potential for an accident to occur. Manual 

initiation is also required in MODE 4 even though automatic 

actuation is not required. In this MODE, adequate time is 

available to manually actuate required components in the 

event of a DBA, but because of the large number of 

components actuated on a Phase A Containment Isolation, 

actuation is simplified by the use of the manual actuation 

push buttons. Automatic actuation logic and actuation 

relays must be OPERABLE in MODE 4 to support system 

level manual initiation. In MODES 5 and 6, there is 

insufficient energy in the primary or secondary systems to 

pressurize the containment to require Phase A Containment 

Isolation. There also is adequate time for the operator to 

evaluate unit conditions and manually actuate individual 

isolation valves in response to abnormal or accident 

conditions.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-22 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

(3) Phase A Isolation - Safety Injection

Phase A Containment Isolation is also initiated by all 

Functions that initiate SI. The Phase A Containment 

Isolation requirements for these Functions are the same as 

the requirements for their SI function. Therefore, the 

requirements are not repeated in Table 3.3.2-1. Instead, 

Function 1, SI, is referenced for all initiating Functions and 

requirements.

b. Containment Isolation - Phase B Isolation

Phase B Containment Isolation is accomplished by Manual 

Initiation, Automatic Actuation Logic and Actuation Relays, and 

by Containment Pressure channels (the same channels that 

actuate Containment Spray, Function 2). The Containment 

Pressure trip of Phase B Containment Isolation is energized to 

trip in order to minimize the potential of spurious trips that may 

damage the RCPs.

(1) Phase B Isolation - Manual Initiation

(2) Phase B Isolation - Automatic Actuation Logic and Actuation 

Relays

Manual and automatic initiation of Phase B containment 

isolation must be OPERABLE in MODES 1, 2, and 3, when 

there is a potential for an accident to occur. Manual 

initiation is also required in MODE 4 even though automatic 

actuation is not required. In this MODE, adequate time is 

available to manually actuate required components in the 

event of a DBA. However, because of the large number of 

components actuated on a Phase B containment isolation, 

actuation is simplified by the use of the manual actuation 

push buttons. Automatic actuation logic and actuation 

relays must be OPERABLE in MODE 4 to support system 

level manual initiation. In MODES 5 and 6, there is 

insufficient energy in the primary or secondary systems to 

pressurize the containment to require Phase B containment 

isolation. There also is adequate time for the operator to 

evaluate unit conditions and manually actuate individual 

isolation valves in response to abnormal or accident 

conditions.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-23 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

(3) Phase B Isolation - Containment Pressure

The basis for containment pressure MODE applicability is as 

discussed for ESFAS Function 2.c above.

4. Steam Line Isolation

Isolation of the main steam lines provides protection in the event of a 

SLB inside or outside containment. Rapid isolation of the steam lines 

will limit the steam break accident to the blowdown from one SG, at 

most. For a SLB upstream of the main steam isolation valves 

(MSIVs), inside or outside of containment, closure of the MSIVs limits 

the accident to the blowdown from only the affected SG. For a SLB 

downstream of the MSIVs, closure of the MSIVs terminates the 

accident as soon as the steam lines depressurize. For units that do 

not have steam line check valves, Steam Line Isolation also mitigates 

the effects of a feed line break and ensures a source of steam for the 

turbine driven AFW pump during a feed line break.

a. Steam Line Isolation - Manual Initiation

Manual initiation of Steam Line Isolation can be accomplished 

from the control room. There are two switches in the control 

room and either switch can initiate action to immediately close all 

MSIVs. The LCO requires two channels to be OPERABLE.

b. Steam Line Isolation - Automatic Actuation Logic and Actuation 

Relays

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

Manual and automatic initiation of steam line isolation must be 

OPERABLE in MODES 1, 2, and 3 when there is sufficient 

energy in the RCS and SGs to have a SLB or other accident. 

This could result in the release of significant quantities of energy 

and cause a cooldown of the primary system. The Steam Line 

Isolation Function is required in MODES 2 and 3 unless all 

MSIVs are closed and [de-activated]. In MODES 4, 5, and 6, 

there is insufficient energy in the RCS and SGs to experience a 

SLB or other accident releasing significant quantities of energy.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-24 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

c. Steam Line Isolation - Containment Pressure - High 2

This Function actuates closure of the MSIVs in the event of a 

LOCA or a SLB inside containment to maintain at least one 

unfaulted SG as a heat sink for the reactor, and to limit the mass 

and energy release to containment. The transmitters (d/p cells) 

are located outside containment with the sensing line (high 

pressure side of the transmitter) located inside containment. 

Containment Pressure - High 2 provides no input to any control 

functions. Thus, three OPERABLE channels are sufficient to 

satisfy protective requirements with two-out-of-three logic. 

However, for enhanced reliability, this Function was designed 

with four channels and a two-out-of-four logic. The transmitters 

and electronics are located outside of containment. Thus, they 

will not experience any adverse environmental conditions, and 

the [NTSP] reflects only steady state instrument uncertainties.

Containment Pressure - High 2 must be OPERABLE in 

MODES 1, 2, and 3, when there is sufficient energy in the 

primary and secondary side to pressurize the containment 

following a pipe break. This would cause a significant increase 

in the containment pressure, thus allowing detection and closure 

of the MSIVs. The Steam Line Isolation Function remains 

OPERABLE in MODES 2 and 3 unless all MSIVs are closed and 

[de-activated]. In MODES 4, 5, and 6, there is not enough 

energy in the primary and secondary sides to pressurize the 

containment to the Containment Pressure - High 2 setpoint.

d. Steam Line Isolation - Steam Line Pressure

(1) Steam Line Pressure – Low

Steam Line Pressure - Low provides closure of the MSIVs in 

the event of a SLB to maintain at least one unfaulted SG as 

a heat sink for the reactor, and to limit the mass and energy 

release to containment. This Function provides closure of 

the MSIVs in the event of a feed line break to ensure a 

supply of steam for the turbine driven AFW pump. Steam 

Line Pressure - Low was discussed previously under SI 

Function 1.e.1.

Steam Line Pressure - Low Function must be OPERABLE in 

MODES 1, 2, and 3 (above P-11), with any main steam 

valve open, when a secondary side break or stuck open 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-25 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

valve could result in the rapid depressurization of the steam 

lines. This signal may be manually blocked by the operator 

below the P-11 setpoint. Below P-11, an inside containment 

SLB will be terminated by automatic actuation via 

Containment Pressure - High 2. Stuck valve transients and 

outside containment SLBs will be terminated by the Steam 

Line Pressure - Negative Rate - High signal for Steam Line 

Isolation below P-11 when SI has been manually blocked. 

The Steam Line Isolation Function is required in MODES 2 

and 3 unless all MSIVs are closed and [de-activated]. This 

Function is not required to be OPERABLE in MODES 4, 5, 

and 6 because there is insufficient energy in the secondary 

side of the unit to have an accident.

(2) Steam Line Pressure - Negative Rate – High

Steam Line Pressure - Negative Rate - High provides 

closure of the MSIVs for a SLB when less than the P-11 

setpoint, to maintain at least one unfaulted SG as a heat 

sink for the reactor, and to limit the mass and energy 

release to containment. When the operator manually blocks 

the Steam Line Pressure - Low main steam isolation signal 

when less than the P-11 setpoint, the Steam Line Pressure -

Negative Rate - High signal is automatically enabled. 

Steam Line Pressure - Negative Rate - High provides no 

input to any control functions. Thus, three OPERABLE 

channels are sufficient to satisfy requirements with a twoout-of-three logic on each steam line.

Steam Line Pressure - Negative Rate - High must be 

OPERABLE in MODE 3 when less than the P-11 setpoint, 

when a secondary side break or stuck open valve could 

result in the rapid depressurization of the steam line(s). In 

MODES 1 and 2, and in MODE 3, when above the P-11 

setpoint, this signal is automatically disabled and the Steam 

Line Pressure - Low signal is automatically enabled. The 

Steam Line Isolation Function is required to be OPERABLE 

in MODES 2 and 3 unless all MSIVs are closed and [deactivated]. In MODES 4, 5, and 6, there is insufficient 

energy in the primary and secondary sides to have a SLB or 

other accident that would result in a release of significant 

enough quantities of energy to cause a cooldown of the 

RCS.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-26 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

While the transmitters may experience elevated ambient 

temperatures due to a SLB, the trip function is based on rate 

of change, not the absolute accuracy of the indicated steam 

pressure. Therefore, the [NTSP] reflects only steady state 

instrument uncertainties.

e, f. Steam Line Isolation - High Steam Flow in Two Steam Lines 

Coincident with Tavg - Low Low or Coincident With Steam Line 

Pressure - Low (Three and Four Loop Units)

These Functions (4.e and 4.f) provide closure of the MSIVs 

during a SLB or inadvertent opening of an SG relief or a safety 

valve, to maintain at least one unfaulted SG as a heat sink for 

the reactor and to limit the mass and energy release to 

containment.

These Functions were discussed previously as Functions 1.f. 

and 1.g.

These Functions must be OPERABLE in MODES 1 and 2, and in 

MODE 3, when a secondary side break or stuck open valve 

could result in the rapid depressurization of the steam lines 

unless all MSIVs are closed and [de-activated]. These Functions 

are not required to be OPERABLE in MODES 4, 5, and 6 

because there is insufficient energy in the secondary side of the 

unit to have an accident.

g. Steam Line Isolation - High Steam Flow Coincident With Safety 

Injection and Coincident With Tavg - Low Low (Two Loop Units)

This Function provides closure of the MSIVs during a SLB or 

inadvertent opening of an SG relief or safety valve to maintain at 

least one unfaulted SG as a heat sink for the reactor, and to limit 

the mass and energy release to containment.

Two steam line flow channels per steam line are required 

OPERABLE for this Function. These are combined in a one-outof-two logic to indicate high steam flow in one steam line. The 

steam flow transmitters provide control inputs, but the control 

function cannot cause the events that the function must protect 

against. Therefore, two channels are sufficient to satisfy 

redundancy requirements. The one-out-of-two configuration 

allows online testing because trip of one high steam flow channel 

is not sufficient to cause initiation.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-27 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The High Steam Flow Allowable Value is a ∆P corresponding to 

25% of full steam flow at no load steam pressure. The Trip 

Setpoint is similarly calculated.

With the transmitters (d/p cells) typically located inside the steam 

tunnels, it is possible for them to experience adverse 

environmental conditions during a SLB event. Therefore, the 

[NTSP] reflect both steady state and adverse environmental 

instrument uncertainties.

The main steam line isolates only if the high steam flow signal 

occurs coincident with a SI and low low RCS average 

temperature. The Main Steam Line Isolation Function 

requirements for the SI Functions are the same as the 

requirements for their SI function. Therefore, the requirements 

are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is 

referenced for all initiating functions and requirements.

Two channels of Tavg per loop are required to be OPERABLE. 

The Tavg channels are combined in a logic such that two 

channels tripped cause a trip for the parameter. The accidents 

that this Function protects against cause reduction of Tavg in the 

entire primary system. Therefore, the provision of two 

OPERABLE channels per loop in a two-out-of-four configuration 

ensures no single random failure disables the Tavg - Low Low 

Function. The Tavg channels provide control inputs, but the 

control function cannot initiate events that the Function acts to 

mitigate. Therefore, additional channels are not required to 

address control protection interaction issues.

With the Tavg resistance temperature detectors (RTDs) located 

inside the containment, it is possible for them to experience 

adverse environmental conditions during a SLB event. 

Therefore, the [NTSP] reflects both steady state and adverse 

environmental instrumental uncertainties.

This Function must be OPERABLE in MODES 1 and 2, and in 

MODE 3, when above the P-12 setpoint, when a secondary side 

break or stuck open valve could result in rapid depressurization 

of the steam lines. Below P-12 this Function is not required to 

be OPERABLE because the High High Steam Flow coincident 

with SI Function provides the required protection. The Steam 

Line Isolation Function is required to be OPERABLE in 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-28 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

MODES 2 and 3 unless all MSIVs are closed and [de-activated]. 

This Function is not required to be OPERABLE in MODES 4, 5, 

and 6 because there is insufficient energy in the secondary side 

of the unit to have an accident.

h. Steam Line Isolation - High High Steam Flow Coincident With 

Safety Injection (Two Loop Units)

This Function provides closure of the MSIVs during a steam line 

break (or inadvertent opening of a relief or safety valve) to 

maintain at least one unfaulted SG as a heat sink for the reactor, 

and to limit the mass and energy release to containment.

Two steam line flow channels per steam line are required to be 

OPERABLE for this Function. These are combined in a one-outof-two logic to indicate high steam flow in one steam line. The 

steam flow transmitters provide control inputs, but the control 

function cannot cause the events that the Function must protect 

against. Therefore, two channels are sufficient to satisfy 

redundancy requirements.

The Allowable Value for high steam flow is a ∆P, corresponding 

to 130% of full steam flow at full steam pressure. The Trip 

Setpoint is similarly calculated.

With the transmitters typically located inside the steam tunnels, it 

is possible for them to experience adverse environmental 

conditions during a SLB event. Therefore, the [NTSP] reflects 

both steady state and adverse environmental instrument 

uncertainties.

The main steam lines isolate only if the high steam flow signal 

occurs coincident with a SI signal. The Main Steam Line 

Isolation Function requirements for the SI Functions are the 

same as the requirements for their SI function. Therefore, the 

requirements are not repeated in Table 3.3.2-1. Instead, 

Function 1, SI, is referenced for all initiating functions and 

requirements.

This Function must be OPERABLE in MODES 1, 2, and 3 when 

a secondary side break or stuck open valve could result in rapid 

depressurization of the steam lines unless all MSIVs are closed 

and [de-activated]. This Function is not required to be 

OPERABLE in MODES 4, 5, and 6 because there is insufficient 

energy in the secondary side of the unit to have an accident.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-29 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

5. Turbine Trip and Feedwater Isolation

The primary functions of the Turbine Trip and Feedwater Isolation 

signals are to prevent damage to the turbine due to water in the 

steam lines, and to stop the excessive flow of feedwater into the 

SGs. These Functions are necessary to mitigate the effects of a high 

water level in the SGs, which could result in carryover of water into 

the steam lines and excessive cooldown of the primary system. The 

SG high water level is due to excessive feedwater flows.

The Function is actuated when the level in any SG exceeds the high 

high setpoint, and performs the following functions:

 Trips the main turbine,

 Trips the MFW pumps,

 Initiates feedwater isolation, and

 Shuts the MFW regulating valves and the bypass feedwater 

regulating valves.

This Function is actuated by SG Water Level - High High, or by a SI 

signal. The RTS also initiates a turbine trip signal whenever a 

reactor trip (P-4) is generated. In the event of SI, the unit is taken off 

line and the turbine generator must be tripped. The MFW System is 

also taken out of operation and the AFW System is automatically 

started. The SI signal was discussed previously.

a. Turbine Trip and Feedwater Isolation - Automatic Actuation Logic 

and Actuation Relays

Automatic Actuation Logic and Actuation Relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

b. Turbine Trip and Feedwater Isolation - Steam Generator Water 

Level - High High (P-14)

This signal provides protection against excessive feedwater flow. 

The ESFAS SG water level instruments provide input to the SG 

Water Level Control System. Therefore, the actuation logic must 

be able to withstand both an input failure to the control system 

(which may then require the protection function actuation) and a 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-30 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

single failure in the other channels providing the protection 

function actuation. Thus, four OPERABLE channels are required

to satisfy the requirements with a two-out-of-four logic. For units 

that have dedicated protection and control channels, only three 

protection channels are necessary to satisfy the protective 

requirements. For other units that have only three channels, a 

median signal selector is provided or justification is provided in 

NUREG-1218 (Ref. 8).

The transmitters (d/p cells) are located inside containment. 

However, the events that this Function protects against cannot 

cause a severe environment in containment. Therefore, the 

[NTSP] reflects only steady state instrument uncertainties.

c. Turbine Trip and Feedwater Isolation - Safety Injection

Turbine Trip and Feedwater Isolation is also initiated by all 

Functions that initiate SI. The Feedwater Isolation Function 

requirements for these Functions are the same as the 

requirements for their SI function. Therefore, the requirements 

are not repeated in Table 3.3.2-1. Instead Function 1, SI, is 

referenced for all initiating functions and requirements.

Turbine Trip and Feedwater Isolation Functions must be OPERABLE 

in MODES 1 and 2 [and 3] except when all MFIVs, MFRVs, [and 

associated bypass valves] are closed and [de-activated] [or isolated 

by a closed manual valve] when the MFW System is in operation and 

the turbine generator may be in operation. In MODES [3,] 4, 5, 

and 6, the MFW System and the turbine generator are not in service 

and this Function is not required to be OPERABLE.

6. Auxiliary Feedwater

The AFW System is designed to provide a secondary side heat sink 

for the reactor in the event that the MFW System is not available. 

The system has two motor driven pumps and a turbine driven pump, 

making it available during normal unit operation, during a loss of AC 

power, a loss of MFW, and during a Feedwater System pipe break. 

The normal source of water for the AFW System is the condensate 

storage tank (CST) (normally not safety related). A low level in the 

CST will automatically realign the pump suctions to the Essential 

Service Water (ESW) System (safety related). The AFW System is

aligned so that upon a pump start, flow is initiated to the respective 

SGs immediately.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-31 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

a. Auxiliary Feedwater - Automatic Actuation Logic and Actuation 

Relays (Solid State Protection System)

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

b. Auxiliary Feedwater - Automatic Actuation Logic and Actuation 

Relays (Balance of Plant ESFAS)

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

c. Auxiliary Feedwater - Steam Generator Water Level - Low Low

SG Water Level - Low Low provides protection against a loss of 

heat sink. A feed line break, inside or outside of containment, or 

a loss of MFW, would result in a loss of SG water level. SG 

Water Level - Low Low provides input to the SG Level Control 

System. Therefore, the actuation logic must be able to withstand 

both an input failure to the control system which may then 

require a protection function actuation and a single failure in the 

other channels providing the protection function actuation. Thus, 

four OPERABLE channels are required to satisfy the 

requirements with two-out-of-four logic. For units that have 

dedicated protection and control channels, only three protection 

channels are necessary to satisfy the protective requirements. 

For other units that have only three channels, a median signal 

selector is provided or justification is provided in Reference 8.

With the transmitters (d/p cells) located inside containment and 

thus possibly experiencing adverse environmental conditions 

(feed line break), the [NTSP] reflects the inclusion of both steady 

state and adverse environmental instrument uncertainties.

d. Auxiliary Feedwater - Safety Injection

A SI signal starts the motor driven and turbine driven AFW 

pumps. The AFW initiation functions are the same as the 

requirements for their SI function. Therefore, the requirements 

are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is 

referenced for all initiating functions and requirements.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-32 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

e. Auxiliary Feedwater - Loss of Offsite Power

A loss of offsite power to the service buses will be accompanied 

by a loss of reactor coolant pumping power and the subsequent 

need for some method of decay heat removal. The loss of offsite 

power is detected by a voltage drop on each service bus. Loss 

of power to either service bus will start the turbine driven AFW 

pumps to ensure that at least one SG contains enough water to 

serve as the heat sink for reactor decay heat and sensible heat 

removal following the reactor trip.

Functions 6.a through 6.e must be OPERABLE in MODES 1, 2, 

and 3 to ensure that the SGs remain the heat sink for the reactor. 

SG Water Level - Low Low in any operating SG will cause the motor 

driven AFW pumps to start. The system is aligned so that upon a 

start of the pump, water immediately begins to flow to the SGs. SG 

Water Level - Low Low in any two operating SGs will cause the 

turbine driven pumps to start. These Functions do not have to be 

OPERABLE in MODES 5 and 6 because there is not enough heat 

being generated in the reactor to require the SGs as a heat sink. In 

MODE 4, AFW actuation does not need to be OPERABLE because 

either AFW or residual heat removal (RHR) will already be in 

operation to remove decay heat or sufficient time is available to 

manually place either system in operation.

f. Auxiliary Feedwater - Undervoltage Reactor Coolant Pump

A loss of power on the buses that provide power to the RCPs 

provides indication of a pending loss of RCP forced flow in the 

RCS. The Undervoltage RCP Function senses the voltage 

downstream of each RCP breaker. A loss of power, or an open 

RCP breaker, on two or more RCPs, will start the turbine driven 

AFW pump to ensure that at least one SG contains enough 

water to serve as the heat sink for reactor decay heat and 

sensible heat removal following the reactor trip.

g. Auxiliary Feedwater - Trip of All Main Feedwater Pumps

A Trip of all MFW pumps is an indication of a loss of MFW and 

the subsequent need for some method of decay heat and 

sensible heat removal to bring the reactor back to no load 

temperature and pressure. A turbine driven MFW pump is 

equipped with two pressure switches on the control air/oil line for 

the speed control system. A low pressure signal from either of 

these pressure switches indicates a trip of that pump. Motor 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-33 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

driven MFW pumps are equipped with a breaker position sensing 

channel. An open supply breaker indicates that the pump is not 

running. Two OPERABLE channels per pump satisfy

redundancy requirements with one-out-of-two taken twice logic. 

A trip of all MFW pumps starts the motor driven and turbine 

driven AFW pumps to ensure that at least one SG is available 

with water to act as the heat sink for the reactor.

Functions 6.f and 6.g must be OPERABLE in MODES 1 and 2. This 

ensures that at least one SG is provided with water to serve as the 

heat sink to remove reactor decay heat and sensible heat in the 

event of an accident. In MODES 3, 4, and 5, the RCPs and MFW 

pumps may be normally shut down, and thus neither pump trip is 

indicative of a condition requiring automatic AFW initiation.

h. Auxiliary Feedwater - Pump Suction Transfer on Suction 

Pressure – Low

A low pressure signal in the AFW pump suction line protects the 

AFW pumps against a loss of the normal supply of water for the 

pumps, the CST. Two pressure switches are located on the 

AFW pump suction line from the CST. A low pressure signal 

sensed by any one of the switches will cause the emergency 

supply of water for both pumps to be aligned, or cause the AFW 

pumps to stop until the emergency source of water is aligned. 

ESW (safety grade) is then lined up to supply the AFW pumps to 

ensure an adequate supply of water for the AFW System to 

maintain at least one of the SGs as the heat sink for reactor 

decay heat and sensible heat removal.

Since the detectors are located in an area not affected by HELBs 

or high radiation, they will not experience any adverse 

environmental conditions and the [NTSP] reflects only steady 

state instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 to 

ensure a safety grade supply of water for the AFW System to 

maintain the SGs as the heat sink for the reactor. This Function 

does not have to be OPERABLE in MODES 5 and 6 because

there is not enough heat being generated in the reactor to 

require the SGs as a heat sink. In MODE 4, AFW automatic 

suction transfer does not need to be OPERABLE because RHR 

will already be in operation, or sufficient time is available to place 

RHR in operation, to remove decay heat.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-34 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

7. Automatic Switchover to Containment Sump

At the end of the injection phase of a LOCA, the RWST will be nearly 

empty. Continued cooling must be provided by the ECCS to remove 

decay heat. The source of water for the ECCS pumps is 

automatically switched to the containment recirculation sump. The 

low head residual heat removal (RHR) pumps and containment spray 

pumps draw the water from the containment recirculation sump, the 

RHR pumps pump the water through the RHR heat exchanger, inject 

the water back into the RCS, and supply the cooled water to the 

other ECCS pumps. Switchover from the RWST to the containment 

sump must occur before the RWST empties to prevent damage to 

the RHR pumps and a loss of core cooling capability. For similar 

reasons, switchover must not occur before there is sufficient water in 

the containment sump to support ESF pump suction. Furthermore, 

early switchover must not occur to ensure that sufficient borated 

water is injected from the RWST. This ensures the reactor remains 

shut down in the recirculation mode.

a. Automatic Switchover to Containment Sump - Automatic 

Actuation Logic and Actuation Relays

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

b, c. Automatic Switchover to Containment Sump - Refueling Water 

Storage Tank (RWST) Level - Low Low Coincident With Safety 

Injection and Coincident With Containment Sump Level – High

During the injection phase of a LOCA, the RWST is the source of 

water for all ECCS pumps. A low low level in the RWST 

coincident with a SI signal provides protection against a loss of 

water for the ECCS pumps and indicates the end of the injection 

phase of the LOCA. The RWST is equipped with four level 

transmitters. These transmitters provide no control functions. 

Therefore, a two-out-of-four logic is adequate to initiate the 

protection function actuation. Although only three channels 

would be sufficient, a fourth channel has been added for 

increased reliability.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-35 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The RWST - Low Low Allowable Value/Trip Setpoint has both 

upper and lower limits. The lower limit is selected to ensure 

switchover occurs before the RWST empties, to prevent ECCS 

pump damage. The upper limit is selected to ensure enough 

borated water is injected to ensure the reactor remains shut 

down. The high limit also ensures adequate water inventory in 

the containment sump to provide ECCS pump suction.

The transmitters are located in an area not affected by HELBs or 

post accident high radiation. Thus, they will not experience any 

adverse environmental conditions and the [NTSP] reflects only 

steady state instrument uncertainties.

Automatic switchover occurs only if the RWST low low level 

signal is coincident with SI. This prevents accidental switchover 

during normal operation. Accidental switchover could damage 

ECCS pumps if they are attempting to take suction from an 

empty sump. The automatic switchover Function requirements 

for the SI Functions are the same as the requirements for their SI 

function. Therefore, the requirements are not repeated in 

Table 3.3.2-1. Instead, Function 1, SI, is referenced for all 

initiating Functions and requirements.

---------------------------------------REVIEWER’S NOTE-------------------------------

In some units, additional protection from spurious switchover is provided 

by requiring a Containment Sump Level - High signal as well as RWST 

Level - Low Low and SI. This ensures sufficient water is available in 

containment to support the recirculation phase of the accident. A 

Containment Sump Level - High signal must be present, in addition to the 

SI signal and the RWST Level - Low Low signal, to transfer the suctions 

of the RHR pumps to the containment sump. The containment sump is 

equipped with four level transmitters. These transmitters provide no 

control functions. Therefore, a two-out-of-four logic is adequate to initiate 

the protection function actuation. Although only three channels would be 

sufficient, a fourth channel has been added for increased reliability. The 

containment sump level Trip Setpoint/Allowable Value is selected to 

ensure enough borated water is injected to ensure the reactor remains 

shut down. The high limit also ensures adequate water inventory in the 

containment sump to provide ECCS pump suction. The transmitters are 

located inside containment and thus possibly experience adverse 

environmental conditions. Therefore, the [NTSP] reflects the inclusion of 

both steady state and environmental instrument uncertainties.

Units only have one of the Functions, 7.b or 7.c.

--------------------------------------------------------------------------------------------------
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-36 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

These Functions must be OPERABLE in MODES 1, 2, 3, and 4 

when there is a potential for a LOCA to occur, to ensure a 

continued supply of water for the ECCS pumps. These 

Functions are not required to be OPERABLE in MODES 5 and 6 

because there is adequate time for the operator to evaluate unit 

conditions and respond by manually starting systems, pumps, 

and other equipment to mitigate the consequences of an 

abnormal condition or accident. System pressure and 

temperature are very low and many ESF components are 

administratively locked out or otherwise prevented from actuating 

to prevent inadvertent overpressurization of unit systems.

8. Engineered Safety Feature Actuation System Interlocks

To allow some flexibility in unit operations, several interlocks are 

included as part of the ESFAS. These interlocks permit the operator 

to block some signals, automatically enable other signals, prevent 

some actions from occurring, and cause other actions to occur. The 

interlock Functions back up manual actions to ensure bypassable 

functions are in operation under the conditions assumed in the safety 

analyses.

a. Engineered Safety Feature Actuation System Interlocks -

Reactor Trip, P-4

The P-4 interlock is enabled when a reactor trip breaker (RTB) 

and its associated bypass breaker is open. Once the P-4 

interlock is enabled, automatic SI initiation is blocked after a 

[ ] second time delay. This Function allows operators to take 

manual control of SI systems after the initial phase of injection is 

complete. Once SI is blocked, automatic actuation of SI cannot 

occur until the RTBs have been manually closed. The functions 

of the P-4 interlock are:

 Trip the main turbine,

 Isolate MFW with coincident low Tavg,

 Prevent reactuation of SI after a manual reset of SI,

 Transfer the steam dump from the load rejection controller 

to the unit trip controller, and

 Prevent opening of the MFW isolation valves if they were 

closed on SI or SG Water Level - High High.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-37 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Each of the above Functions is interlocked with P-4 to avert or 

reduce the continued cooldown of the RCS following a reactor 

trip. An excessive cooldown of the RCS following a reactor trip 

could cause an insertion of positive reactivity with a subsequent 

increase in generated power. To avoid such a situation, the 

noted Functions have been interlocked with P-4 as part of the 

design of the unit control and protection system.

None of the noted Functions serves a mitigation function in the 

unit licensing basis safety analyses. Only the turbine trip 

Function is explicitly assumed since it is an immediate 

consequence of the reactor trip Function. Neither turbine trip, 

nor any of the other four Functions associated with the reactor 

trip signal, is required to show that the unit licensing basis safety 

analysis acceptance criteria are not exceeded.

The RTB position switches that provide input to the P-4 interlock 

only function to energize or de-energize or open or close 

contacts. Therefore, this Function has no adjustable trip setpoint 

with which to associate a [NTSP] and Allowable Value.

This Function must be OPERABLE in MODES 1, 2, and 3 when 

the reactor may be critical or approaching criticality. This 

Function does not have to be OPERABLE in MODE 4, 5, or 6 

because the main turbine, the MFW System, and the Steam 

Dump System are not in operation.

b. Engineered Safety Feature Actuation System Interlocks -

Pressurizer Pressure, P-11

The P-11 interlock permits a normal unit cooldown and 

depressurization without actuation of SI or main steam line 

isolation. With two-out-of-three pressurizer pressure channels 

(discussed previously) less than the P-11 setpoint, the operator 

can manually block the Pressurizer Pressure - Low and Steam 

Line Pressure - Low SI signals and the Steam Line Pressure -

Low steam line isolation signal (previously discussed). When the 

Steam Line Pressure - Low steam line isolation signal is

manually blocked, a main steam isolation signal on Steam Line 

Pressure - Negative Rate - High is enabled. This provides 

protection for a SLB by closure of the MSIVs. With two-out-ofthree pressurizer pressure channels above the P-11 setpoint, the

Pressurizer Pressure - Low and Steam Line Pressure - Low SI 

signals and the Steam Line Pressure - Low steam line isolation 

signal are automatically enabled. The operator can also enable
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-38 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

these trips by use of the respective manual reset buttons. When 

the Steam Line Pressure - Low steam line isolation signal is 

enabled, the main steam isolation on Steam Line Pressure -

Negative Rate - High is disabled. The [NTSP] reflects only 

steady state instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 to 

allow an orderly cooldown and depressurization of the unit 

without the actuation of SI or main steam isolation. This 

Function does not have to be OPERABLE in MODE 4, 5, or 6 

because system pressure must already be below the P-11 

setpoint for the requirements of the heatup and cooldown curves 

to be met.

c. Engineered Safety Feature Actuation System Interlocks - Tavg -

Low Low, P-12

On increasing reactor coolant temperature, the P-12 interlock 

reinstates SI on High Steam Flow Coincident With Steam Line 

Pressure - Low or Coincident With Tavg - Low Low and provides 

an arming signal to the Steam Dump System. On decreasing 

reactor coolant temperature, the P-12 interlock allows the 

operator to manually block SI on High Steam Flow Coincident 

With Steam Line Pressure - Low or Coincident with Tavg - Low 

Low. On a decreasing temperature, the P-12 interlock also 

removes the arming signal to the Steam Dump System to 

prevent an excessive cooldown of the RCS due to a 

malfunctioning Steam Dump System.

Since Tavg is used as an indication of bulk RCS temperature, this 

Function meets redundancy requirements with one OPERABLE 

channel in each loop. In three loop units, these channels are 

used in two-out-of-three logic. In four loop units, they are used in 

two-out-of-four logic.

This Function must be OPERABLE in MODES 1, 2, and 3 when 

a secondary side break or stuck open valve could result in the 

rapid depressurization of the steam lines. This Function does 

not have to be OPERABLE in MODE 4, 5, or 6 because there is 

insufficient energy in the secondary side of the unit to have an 

accident.

The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-39 Rev. 4.0

BASES

ACTIONS ----------------------------REVIEWER’S NOTE------------------------------------------

In Table 3.3.2-1, Functions 7.b and 7.c were not included in the generic 

evaluations approved in either WCAP-10271, as supplemented, 

WCAP-15376 or WCAP-14333. In order to apply the WCAP-10271, as 

supplemented, and WCAP-15376 or WCAP-14333 TS relaxations to plant 

specific Functions not evaluated generically, licensees must submit plant 

specific evaluations for NRC review and approval.

--------------------------------------------------------------------------------------------------

A Note has been added in the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed on Table 3.3.2-1.

In the event a channel's [NTSP] is found nonconservative with respect to 

the Allowable Value, or the channel is not functioning as required, or the 

transmitter, instrument Loop, signal processing electronics, or bistable is 

found inoperable, then all affected Functions provided by that channel 

must be declared inoperable and the LCO Condition(s) entered for the 

protection Function(s) affected. When the Required Channels in 

Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, 

etc., basis), then the Condition may be entered separately for each steam 

line, loop, SG, etc., as appropriate.

When the number of inoperable channels in a trip function exceed those 

specified in one or other related Conditions associated with a trip function, 

then the unit is outside the safety analysis. Therefore, LCO 3.0.3 should 

be immediately entered if applicable in the current MODE of operation.

----------------------------REVIEWER’S NOTE------------------------------------------

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use these times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report.

--------------------------------------------------------------------------------------------------

A.1

Condition A applies to all ESFAS protection functions.

Condition A addresses the situation where one or more channels or trains 

for one or more Functions are inoperable at the same time. The Required 

Action is to refer to Table 3.3.2-1 and to take the Required Actions for the 

protection functions affected. The Completion Times are those from the 

referenced Conditions and Required Actions.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-40 Rev. 4.0

BASES

ACTIONS (continued)

B.1, B.2.1, and B.2.2

Condition B applies to manual initiation of:

 SI,

 Containment Spray,

 Phase A Isolation, and

 Phase B Isolation.

This action addresses the train orientation of the SSPS for the functions 

listed above. If a channel or train is inoperable, 24 hours is allowed to 

return it to an OPERABLE status. Note that for containment spray and 

Phase B isolation, failure of one or both channels in one train renders the 

train inoperable. Condition B, therefore, encompasses both situations. 

The specified Completion Time is reasonable considering that there are 

two automatic actuation trains and another manual initiation train 

OPERABLE for each Function, and the low probability of an event 

occurring during this interval. If the train cannot be restored to 

OPERABLE status, the unit must be placed in a MODE in which the LCO 

does not apply. This is done by placing the unit in at least MODE 3 within 

an additional 6 hours (54 hours total time) and in MODE 5 within an 

additional 30 hours (84 hours total time). The allowable Completion 

Times are reasonable, based on operating experience, to reach the 

required unit conditions from full power conditions in an orderly manner 

and without challenging unit systems.

C.1, C.2.1, and C.2.2

Condition C applies to the automatic actuation logic and actuation relays 

for the following functions:

 SI,

 Containment Spray,

 Phase A Isolation,

 Phase B Isolation, and

 Automatic Switchover to Containment Sump.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-41 Rev. 4.0

BASES

ACTIONS (continued)

This action addresses the train orientation of the SSPS and the master 

and slave relays. If one train is inoperable, 24 hours are allowed to 

restore the train to OPERABLE status. The 24 hours allowed for 

restoring the inoperable train to OPERABLE status is justified in 

Reference 9. The specified Completion Time is reasonable considering 

that there is another train OPERABLE, and the low probability of an event 

occurring during this interval. If the train cannot be restored to 

OPERABLE status, the unit must be placed in a MODE in which the LCO 

does not apply. This is done by placing the unit in at least MODE 3 within 

an additional 6 hours (30 hours total time) and in MODE 5 within an 

additional 30 hours (60 hours total time). The Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems.

The Required Actions are modified by a Note that allows one train to be 

bypassed for up to [4] hours for surveillance testing, provided the other 

train is OPERABLE. This allowance is based on the reliability analysis 

assumption of WCAP-10271-P-A (Ref. 10) that 4 hours is the average 

time required to perform train surveillance.

D.1, D.2.1, and D.2.2

Condition D applies to:

 Containment Pressure - High 1,

 Pressurizer Pressure - Low (two, three, and four loop units),

 Steam Line Pressure - Low,

 Steam Line Differential Pressure - High,

 High Steam Flow in Two Steam Lines Coincident With Tavg - Low Low 

or Coincident With Steam Line Pressure - Low,

 Containment Pressure - High 2,

 Steam Line Pressure - Negative Rate - High,

 High Steam Flow Coincident With Safety Injection Coincident With 

Tavg - Low Low,
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-42 Rev. 4.0

BASES

ACTIONS (continued)

 High High Steam Flow Coincident With Safety Injection,

 High Steam Flow in Two Steam Lines Coincident With Tavg - Low 

Low,

 SG Water level - Low Low (two, three, and four loop units), and

 [SG Water level - High High (P-14) (two, three, and four loop units). ]

If one channel is inoperable, 72 hours are allowed to restore the channel 

to OPERABLE status or to place it in the tripped condition. Generally this 

Condition applies to functions that operate on two-out-of-three logic. 

Therefore, failure of one channel places the Function in a two-out-of-two 

configuration. One channel must be tripped to place the Function in a 

one-out-of-three configuration that satisfies redundancy requirements. 

The 72 hours allowed to restore the channel to OPERABLE status or to 

place it in the tripped condition is justified in Reference 9.

Failure to restore the inoperable channel to OPERABLE status or place it 

in the tripped condition within 72 hours requires the unit be placed in 

MODE 3 within the following 6 hours and MODE 4 within the next 

6 hours.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. In 

MODE 4, these Functions are no longer required OPERABLE.

[ The Required Actions are modified by a Note that allows the inoperable 

channel to be bypassed for up to 12 hours for surveillance testing of other 

channels. The 12 hours allowed for testing, are justified in Reference 9. ]

----------------------------REVIEWER’S NOTE------------------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 9.

--------------------------------------------------------------------------------------------------
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-43 Rev. 4.0

BASES

ACTIONS (continued)

E.1, E.2.1, and E.2.2

Condition E applies to:

 Containment Spray Containment Pressure - High 3 (High, High) (two, 

three, and four loop units), and

 Containment Phase B Isolation Containment Pressure - High 3 (High, 

High).

None of these signals has input to a control function. Thus, two-out-ofthree logic is necessary to meet acceptable protective requirements. 

However, a two-out-of-three design would require tripping a failed 

channel. This is undesirable because a single failure would then cause 

spurious containment spray initiation. Spurious spray actuation is 

undesirable because of the cleanup problems presented. Therefore, 

these channels are designed with two-out-of-four logic so that a failed 

channel may be bypassed rather than tripped. Note that one channel 

may be bypassed and still satisfy the single failure criterion. Furthermore, 

with one channel bypassed, a single instrumentation channel failure will 

not spuriously initiate containment spray.

To avoid the inadvertent actuation of containment spray and Phase B 

containment isolation, the inoperable channel should not be placed in the 

tripped condition. Instead it is bypassed. Restoring the channel to 

OPERABLE status, or placing the inoperable channel in the bypass 

condition within 72 hours, is sufficient to assure that the Function remains 

OPERABLE and minimizes the time that the Function may be in a partial 

trip condition (assuming the inoperable channel has failed high). The 

Completion Time is further justified based on the low probability of an 

event occurring during this interval. Failure to restore the inoperable 

channel to OPERABLE status, or place it in the bypassed condition within 

6 hours, requires the unit be placed in MODE 3 within the following 

6 hours and MODE 4 within the next 72 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required unit conditions from full power conditions in an orderly manner 

and without challenging unit systems. In MODE 4, these Functions are 

no longer required OPERABLE.

[ The Required Actions are modified by a Note that allows one additional 

channel to be bypassed for up to 12 hours for surveillance testing. 

Placing a second channel in the bypass condition for up to 12 hours for 

testing purposes is acceptable based on the results of Reference 9. ]
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-44 Rev. 4.0

BASES

ACTIONS (continued)

----------------------------REVIEWER’S NOTE------------------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 9.

--------------------------------------------------------------------------------------------------

F.1, F.2.1, and F.2.2

Condition F applies to:

 Manual Initiation of Steam Line Isolation,

 Loss of Offsite Power,

 Auxiliary Feedwater Pump Suction Transfer on Suction Pressure -

Low, and

 P-4 Interlock.

For the Manual Initiation and the P-4 Interlock Functions, this action 

addresses the train orientation of the SSPS. For the Loss of Offsite 

Power Function, this action recognizes the lack of manual trip provision 

for a failed channel. For the AFW System pump suction transfer 

channels, this action recognizes that placing a failed channel in trip during 

operation is not necessarily a conservative action. Spurious trip of this 

function could align the AFW System to a source that is not immediately 

capable of supporting pump suction. If a train or channel is inoperable, 

48 hours is allowed to return it to OPERABLE status. The specified 

Completion Time is reasonable considering the nature of these Functions, 

the available redundancy, and the low probability of an event occurring 

during this interval. If the Function cannot be returned to OPERABLE 

status, the unit must be placed in MODE 3 within the next 6 hours and 

MODE 4 within the following 6 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power in an orderly manner and without challenging 

unit systems. In MODE 4, the unit does not have any analyzed transients 

or conditions that require the explicit use of the protection functions noted 

above.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-45 Rev. 4.0

BASES

ACTIONS (continued)

G.1, G.2.1, and G.2.2

Condition G applies to the automatic actuation logic and actuation relays 

for the Steam Line Isolation [Turbine Trip and Feedwater Isolation,] and 

AFW actuation Functions.

The action addresses the train orientation of the SSPS and the master 

and slave relays for these functions. If one train is inoperable, 24 hours 

are allowed to restore the train to OPERABLE status. The 24 hours 

allowed for restoring the inoperable train to OPERABLE status is justified 

in Reference 9. The Completion Time for restoring a train to OPERABLE 

status is reasonable considering that there is another train OPERABLE, 

and the low probability of an event occurring during this interval. If the 

train cannot be returned to OPERABLE status, the unit must be brought 

to MODE 3 within the next 6 hours and MODE 4 within the following 

6 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

Placing the unit in MODE 4 removes all requirements for OPERABILITY 

of the protection channels and actuation functions. In this MODE, the unit 

does not have analyzed transients or conditions that require the explicit 

use of the protection functions noted above.

The Required Actions are modified by a Note that allows one train to be 

bypassed for up to [4] hours for surveillance testing provided the other 

train is OPERABLE. This allowance is based on the reliability analysis 

(Ref. 10) assumption that 4 hours is the average time required to perform 

channel surveillance.

[ H.1 and H.2

Condition H applies to the automatic actuation logic and actuation relays 

for the Turbine Trip and Feedwater Isolation Function.

This action addresses the train orientation of the SSPS and the master 

and slave relays for this Function. If one train is inoperable, 24 hours are 

allowed to restore the train to OPERABLE status or the unit must be 

placed in MODE 3 within the following 6 hours. The 24 hours allowed for 

restoring the inoperable train to OPERABLE status is justified in 

Reference 9. The Completion Time for restoring a train to OPERABLE 

status is reasonable considering that there is another train OPERABLE, 

and the low probability of an event occurring during this interval. The 

allowed Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power conditions in an orderly 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-46 Rev. 4.0

BASES

ACTIONS (continued)

manner and without challenging unit systems. These Functions are no 

longer required in MODE 3. Placing the unit in MODE 3 removes all 

requirements for OPERABILITY of the protection channels and actuation 

functions. In this MODE, the unit does not have analyzed transients or 

conditions that require the explicit use of the protection functions noted 

above.

The Required Actions are modified by a Note that allows one train to be 

bypassed for up to [4] hours for surveillance testing provided the other 

train is OPERABLE. This allowance is based on the reliability analysis 

(Ref. 10) assumption that 4 hours is the average time required to perform 

channel surveillance. ]

I.1 and I.2

Condition I applies to:

 [ SG Water Level - High High (P-14) (two, three, and four loop units), 

and ]

 Undervoltage Reactor Coolant Pump.

If one channel is inoperable, 72 hours are allowed to restore one channel 

to OPERABLE status or to place it in the tripped condition. If placed in 

the tripped condition, the Function is then in a partial trip condition where 

one-out-of-two or one-out-of-three logic will result in actuation. Failure to 

restore the inoperable channel to OPERABLE status or place it in the 

tripped condition within 72 hours requires the unit to be placed in MODE 3 

within the following 6 hours. The allowed Completion Time of 78 hours is 

reasonable, based on operating experience, to reach MODE 3 from full 

power conditions in an orderly manner and without challenging unit 

systems. In MODE 3, these Functions are no longer required 

OPERABLE.

[ The Required Actions are modified by a Note that allows the inoperable 

channel to be bypassed for up to [12] hours for surveillance testing of 

other channels. The 72 hours allowed to place the inoperable channel in 

the tripped condition, and the 12 hours allowed for a second channel to 

be in the bypassed condition for testing, are justified in Reference 9. ]
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-47 Rev. 4.0

BASES

ACTIONS (continued)

----------------------------REVIEWER’S NOTE------------------------------------------

The below text should be used for plants with installed bypass test

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 72 hours allowed to place the inoperable channel in the 

tripped condition, and the 12 hours allowed for a second channel to be in 

the bypassed condition for testing, are justified in Reference 9.

--------------------------------------------------------------------------------------------------

J.1 and J.2

Condition J applies to the AFW pump start on trip of all MFW pumps.

This action addresses the train orientation of the SSPS for the auto start 

function of the AFW System on loss of all MFW pumps. The 

OPERABILITY of the AFW System must be assured by allowing 

automatic start of the AFW System pumps. If a channel is inoperable, 

48 hours are allowed to return it to an OPERABLE status. If the function 

cannot be returned to an OPERABLE status, 6 hours are allowed to place 

the unit in MODE 3. The allowed Completion Time of 6 hours is 

reasonable, based on operating experience, to reach MODE 3 from full 

power conditions in an orderly manner and without challenging unit 

systems. In MODE 3, the unit does not have any analyzed transients or 

conditions that require the explicit use of the protection function noted 

above. The allowance of 48 hours to return the train to an OPERABLE 

status is justified in Reference 10.

K.1, K.2.1, and K.2.2

Condition K applies to:

 RWST Level - Low Low Coincident with Safety Injection, and

 RWST Level - Low Low Coincident with Safety Injection and 

Coincident with Containment Sump Level - High.

RWST Level - Low Low Coincident With SI and Coincident With 

Containment Sump Level - High provides actuation of switchover to the 

containment sump. Note that this Function requires the bistables to 

energize to perform their required action. The failure of up to two 

channels will not prevent the operation of this Function. However, placing 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-48 Rev. 4.0

BASES

ACTIONS (continued)

a failed channel in the tripped condition could result in a premature 

switchover to the sump, prior to the injection of the minimum volume from 

the RWST. Placing the inoperable channel in bypass results in a two-outof-three logic configuration, which satisfies the requirement to allow 

another failure without disabling actuation of the switchover when 

required. Restoring the channel to OPERABLE status or placing the 

inoperable channel in the bypass condition within [6] hours is sufficient to 

ensure that the Function remains OPERABLE, and minimizes the time 

that the Function may be in a partial trip condition (assuming the 

inoperable channel has failed high). The [6] hour Completion Time is 

justified in Reference 11. If the channel cannot be returned to 

OPERABLE status or placed in the bypass condition within 6 hours, the 

unit must be brought to MODE 3 within the following [6] hours and 

MODE 5 within the next 30 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems. In MODE 5, the unit does not have any 

analyzed transients or conditions that require the explicit use of the 

protection functions noted above.

[ The Required Actions are modified by a Note that allows placing a 

second channel in the bypass condition for up to [4] hours for surveillance 

testing. The total of [12] hours to reach MODE 3 and [4] hours for a 

second channel to be bypassed is acceptable based on the results of 

Reference 11.]

----------------------------REVIEWER’S NOTE------------------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The channel to be tested can be tested in bypass with the 

inoperable channel also in bypass. The total of [12] hours to reach 

MODE 3 and [4] hours for a second channel to be bypassed is acceptable 

based on the results of Reference 11.

--------------------------------------------------------------------------------------------------

L.1, L.2.1, and L.2.2

Condition L applies to the P-11 and P-12 [and P-14] interlocks.

With one or more channels inoperable, the operator must verify that the 

interlock is in the required state for the existing unit condition. This action 

manually accomplishes the function of the interlock. Determination must 

be made within 1 hour. The 1 hour Completion Time is equal to the time 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-49 Rev. 4.0

BASES

ACTIONS (continued)

allowed by LCO 3.0.3 to initiate shutdown actions in the event of a 

complete loss of ESFAS function. If the interlock is not in the required

state (or placed in the required state) for the existing unit condition, the 

unit must be placed in MODE 3 within the next 6 hours and MODE 4 

within the following 6 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems. Placing the unit in MODE 4 removes all 

requirements for OPERABILITY of these interlocks.

SURVEILLANCE ----------------------------REVIEWER’S NOTE------------------------------------------

REQUIREMENTS In Table 3.3.2-1, Functions 7.b and 7.c were not included in the generic 

evaluations approved in either WCAP-10271, as supplemented, or 

WCAP-14333. In order to apply the WCAP-10271, as supplemented, and 

WCAP-14333 TS relaxations to plant specific Functions not evaluated 

generically, licensees must submit plant specific evaluations for NRC 

review and approval.

--------------------------------------------------------------------------------------------------

----------------------------REVIEWER’S NOTE------------------------------------------

Notes b and c are applied to the setpoint verification Surveillances for all 

Engineered Safety Feature Actuation System (ESFAS) Instrumentation 

Function in Table 3.3.2-1 unless one or more of the following exclusions 

apply:

1. Manual actuation circuits, automatic actuation logic circuits or 

instrument functions that derive input from contacts which have no 

associated sensor or adjustable device, e.g., limit switches, breaker 

position switches, manual actuation switches, float switches, proximity 

detectors, etc. are excluded. In addition, those permissives and 

interlocks that derive input from a sensor or adjustable device that is 

tested as part of another TS function are excluded.

2. Settings associated with safety relief valves are excluded. The 

performance of these components is already controlled (i.e., trended 

with as-left and as-found limits) under the ASME Code for Operation 

and Maintenance of Nuclear Power Plants testing program. 

3. Functions and Surveillance Requirements which test only digital 

components are normally excluded. There is no expected change in 

result between SR performances for these components. Where 

separate as-left and as-found tolerance is established for digital 

component SRs, the requirements would apply.

-----------------------------------------------------------------------------------------------
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-50 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The SRs for each ESFAS Function are identified by the SRs column

of Table 3.3.2-1.

A Note has been added to the SR Table to clarify that Table 3.3.2-1 

determines which SRs apply to which ESFAS Functions.

Note that each channel of process protection supplies both trains of the 

ESFAS. When testing channel I, train A and train B must be examined. 

Similarly, train A and train B must be examined when testing channel II, 

channel III, and channel IV (if applicable). The CHANNEL CALIBRATION 

and COTs are performed in a manner that is consistent with the 

assumptions used in analytically calculating the required channel 

accuracies.

-----------------------------REVIEWER’S NOTE-----------------------------------------

Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these times, the licensee must justify the Frequencies as 

required by the staff SER for the topical report.

--------------------------------------------------------------------------------------------------

SR 3.3.2.1

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION.

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and reliability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-51 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.2

SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST using the 

semiautomatic tester. The train being tested is placed in the bypass 

condition, thus preventing inadvertent actuation. Through the 

semiautomatic tester, all possible logic combinations, with and without 

applicable permissives, are tested for each protection function. In

addition, the master relay coil is pulse tested for continuity. This verifies 

that the logic modules are OPERABLE and that there is an intact voltage 

signal path to the master relay coils. [ The Frequency of every 92 days 

on a STAGGERED TEST BASIS is justified in Reference 12.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.3

SR 3.3.2.3 is the performance of an ACTUATION LOGIC TEST as 

described in SR 3.3.2.2, except that the semiautomatic tester is not used 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-52 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

and the continuity check does not have to be performed, as explained in 

the Note. This SR is applied to the balance of plant actuation logic and 

relays that do not have the SSPS test circuits installed to utilize the 

semiautomatic tester or perform the continuity check. [ This test is also 

performed every 31 days on a STAGGERED TEST BASIS. The 

Frequency is adequate based on industry operating experience, 

considering instrument reliability and operating history data.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.4

SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 

large enough to demonstrate signal path continuity. The time allowed for 

the testing on a STAGGERED TEST BASIS (4 hours) is justified in 

Reference 12. [ The Frequency of 92 days is justified in Reference 10.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-53 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.5

SR 3.3.2.5 is the performance of a COT.

A COT is performed on each required channel to ensure the entire 

channel will perform the intended Function. Setpoints must be found 

conservative with respect to the Allowable Values specified in 

Table 3.3.2-1. A successful test of the required contact(s) of a channel 

relay may be performed by the verification of the change of state of a 

single contact of the relay. This clarifies what is an acceptable COT of a 

relay. This is acceptable because all of the other required contacts of the 

relay are verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions.

The difference between the current "as-found" values and the previous 

test "as left" values must be consistent with the drift allowance used in the 

setpoint methodology. The setpoint shall be left set consistent with the 

assumptions of the current unit specific setpoint methodology.

The "as-found" and "as-left" values must also be recorded and reviewed 

for consistency with the assumptions of Reference 7.

[ The Frequency of 184 days is justified in Reference 12.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.5 is modified by two Notes as identified in Table 3.3.2-1. The 

first Note requires evaluation of channel performance for the condition 

where the as-found setting for the channel setpoint is outside its as-found 

tolerance but conservative with respect to the Allowable Value. 

Evaluation of channel performance will verify that the channel will 

continue to behave in accordance with safety analysis assumptions and 

the channel performance assumptions in the setpoint methodology. The 

purpose of the assessment is to ensure confidence in the channel 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-54 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

performance prior to returning the channel to service. For channels 

determined to be OPERABLE but degraded, after returning the channel to 

service the performance of these channels will be evaluated under the 

plant Corrective Action Program. Entry into the Corrective Action 

Program will ensure required review and documentation of the condition. 

The second Note requires that the as-left setting for the channel be 

returned to within the as-left tolerance of the [NTSP]. Where a setpoint 

more conservative than the [NTSP] is used in the plant surveillance 

procedures (field setting), the as-left and as-found tolerances, as 

applicable, will be applied to the surveillance procedure setpoint. This will 

ensure that sufficient margin to the Safety Limit and/or Analytical Limit is 

maintained. If the as-left channel setting cannot be returned to a setting 

within the as-left tolerance of the [NTSP], then the channel shall be 

declared inoperable.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed section '[NTSP and the]' of the sentence in Note (c) in 

Table 3.3.2-1 is not required in plant-specific Technical Specifications 

which include a [Nominal Trip Setpoint] column in Table 3.3.2-1.

--------------------------------------------------------------------------------------------------

The second Note also requires that the [NTSP and the] methodologies for 

calculating the as-left and the as-found tolerances be in [insert the facility 

FSAR reference or the name of any document incorporated into the 

facility FSAR by reference].

SR 3.3.2.6

SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE 

RELAY TEST is the energizing of the slave relays. Contact operation is 

verified in one of two ways. Actuation equipment that may be operated in 

the design mitigation MODE is either allowed to function, or is placed in a 

condition where the relay contact operation can be verified without 

operation of the equipment. Actuation equipment that may not be 

operated in the design mitigation MODE is prevented from operation by

the SLAVE RELAY TEST circuit. For this latter case, contact operation is 

verified by a continuity check of the circuit containing the slave relay. 

[ The Frequency of 92 days is adequate, based on industry operating 

experience, considering instrument reliability and operating history data.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-55 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.7

SR 3.3.2.7 is the performance of a TADOT. This test is a check of the 

Loss of Offsite Power, Undervoltage RCP, and AFW Pump Suction 

Transfer on Suction Pressure - Low Functions. Each Function is tested 

up to, and including, the master transfer relay coils. A successful test of 

the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

The test also includes trip channels that provide actuation signals directly 

to the SSPS. The SR is modified by a Note that excludes verification of 

setpoints for relays. Relay setpoints require elaborate bench calibration 

and are verified during CHANNEL CALIBRATION. [ The Frequency of 

92 days is adequate. It is based on industry operating experience, 

considering instrument reliability and operating history data.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-56 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.8

SR 3.3.2.8 is the performance of a TADOT. This test is a check of the 

Manual Actuation Functions and AFW pump start on trip of all MFW 

pumps. Each Manual Actuation Function is tested up to, and including, 

the master relay coils. A successful test of the required contact(s) of a 

channel relay may be performed by the verification of the change of state 

of a single contact of the relay. This clarifies what is an acceptable 

TADOT of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. In some instances, the test includes actuation of 

the end device (i.e., pump starts, valve cycles, etc.). [ The Frequency of 

18 months is adequate, based on industry operating experience and is 

consistent with the typical refueling cycle. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.8 is modified by two Notes as identified in Table 3.3.2-1. The 

first Note requires evaluation of channel performance for the condition 

where the as-found setting for the channel setpoint is outside its as-found 

tolerance but conservative with respect to the Allowable Value. 

Evaluation of channel performance will verify that the channel will 

continue to behave in accordance with safety analysis assumptions and 

the channel performance assumptions in the setpoint methodology. The 

purpose of the assessment is to ensure confidence in the channel 

performance prior to returning the channel to service. For channels 

determined to be OPERABLE but degraded, after returning the channel to 

service the performance of these channels will be evaluated under the 

plant Corrective Action Program. Entry into the Corrective Action 

Program will ensure required review and documentation of the condition. 

The second Note requires that the as-left setting for the channel be 

returned to within the as-left tolerance of the [NTSP]. Where a setpoint

more conservative than the [NTSP] is used in the plant surveillance 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-57 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

procedures (field setting), the as-left and as-found tolerances, as 

applicable, will be applied to the surveillance procedure setpoint. This will 

ensure that sufficient margin to the Safety Limit and/or Analytical Limit is 

maintained. If the as-left channel setting cannot be returned to a setting 

within the as-left tolerance of the [NTSP], then the channel shall be 

declared inoperable.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed section '[NTSP and the]' of the sentence in Note (c) in 

Table 3.3.2-1 is not required in plant-specific Technical Specifications 

which include a [Nominal Trip Setpoint] column in Table 3.3.2-1.

--------------------------------------------------------------------------------------------------

The second Note also requires that the [NTSP and the] methodologies for 

calculating the as-left and the as-found tolerances be in [insert the facility 

FSAR reference or the name of any document incorporated into the 

facility FSAR by reference].

The SR is modified by a Note that excludes verification of setpoints during 

the TADOT for manual initiation Functions. The manual initiation 

Functions have no associated setpoints.

SR 3.3.2.9

SR 3.3.2.9 is the performance of a CHANNEL CALIBRATION.

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to 

measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATIONS must be performed consistent with the 

assumptions of the unit specific setpoint methodology. The difference 

between the current "as-found" values and the previous test "as-left" 

values must be consistent with the drift allowance used in the setpoint 

methodology.

[ The Frequency of [18] months is based on the assumption of an 

[18] month calibration interval in the determination of the magnitude of 

equipment drift in the setpoint methodology.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-58 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note stating that this test should include 

verification that the time constants are adjusted to the prescribed values 

where applicable.

SR 3.3.2.9 is modified by two Notes as identified in Table 3.3.2-1. The 

first Note requires evaluation of channel performance for the condition 

where the as-found setting for the channel setpoint is outside its as-found 

tolerance but conservative with respect to the Allowable Value. 

Evaluation of channel performance will verify that the channel will 

continue to behave in accordance with safety analysis assumptions and 

the channel performance assumptions in the setpoint methodology. The 

purpose of the assessment is to ensure confidence in the channel 

performance prior to returning the channel to service. For channels 

determined to be OPERABLE but degraded, after returning the channel to 

service the performance of these channels will be evaluated under the 

plant Corrective Action Program. Entry into the Corrective Action 

Program will ensure required review and documentation of the condition. 

The second Note requires that the as-left setting for the channel be 

returned to within the as-left tolerance of the [NTSP]. Where a setpoint 

more conservative than the [NTSP] is used in the plant surveillance 

procedures (field setting), the as-left and as-found tolerances, as 

applicable, will be applied to the surveillance procedure setpoint. This will 

ensure that sufficient margin to the Safety Limit and/or Analytical Limit is 

maintained. If the as-left channel setting cannot be returned to a setting 

within the as-left tolerance of the [NTSP], then the channel shall be 

declared inoperable.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed section '[NTSP and the]' of the sentence in Note (c) in 

Table 3.3.2-1 is not required in plant-specific Technical Specifications 

which include a [Nominal Trip Setpoint] column in Table 3.3.2-1.

--------------------------------------------------------------------------------------------------

The second Note also requires that the [NTSP and the] methodologies for 

calculating the as-left and the as-found tolerances be in [insert the facility 

FSAR reference or the name of any document incorporated into the 

facility FSAR by reference].
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-59 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.10

This SR ensures the individual channel ESF RESPONSE TIMES are less 

than or equal to the maximum values assumed in the accident analysis. 

Response Time testing acceptance criteria are included in the Technical 

Requirements Manual, Section 15 (Ref. 13). Individual component 

response times are not modeled in the analyses. The analyses model the 

overall or total elapsed time, from the point at which the parameter 

exceeds the Trip Setpoint value at the sensor, to the point at which the 

equipment in both trains reaches the required functional state (e.g., 

pumps at rated discharge pressure, valves in full open or closed position).

For channels that include dynamic transfer functions (e.g., lag, lead/lag, 

rate/lag, etc.), the response time test may be performed with the transfer 

functions set to one with the resulting measured response time compared 

to the appropriate FSAR response time. Alternately, the response time 

test can be performed with the time constants set to their nominal value 

provided the required response time is analytically calculated assuming 

the time constants are set at their nominal values. The response time 

may be measured by a series of overlapping tests such that the entire 

response time is measured.

-----------------------------REVIEWER’S NOTE-----------------------------------------

Applicable portions of the following Bases are applicable for plants 

adopting WCAP-13632-P-A (Ref. 14). and/or WCAP-14036-P (Ref. 15).

--------------------------------------------------------------------------------------------------

Response time may be verified by actual response time tests in any 

series of sequential, overlapping or total channel measurements, or by 

the summation of allocated sensor, signal processing and actuation logic 

response times with actual response time tests on the remainder of the 

channel. Allocations for sensor response times may be obtained from: 

(1) historical records based on acceptable response time tests (hydraulic, 

noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g., 

vendor) test measurements, or (3) utilizing vendor engineering 

specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure 

Sensor Response Time Testing Requirements," (Ref. 14) dated January 

1996, provides the basis and methodology for using allocated sensor 

response times in the overall verification of the channel response time for 

specific sensors identified in the WCAP. Response time verification for 

other sensor types must be demonstrated by test.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-60 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel 

Response Time Tests," (Ref. 15) provides the basis and methodology for 

using allocated signal processing and actuation logic response times in 

the overall verification of the protection system channel response time. 

The allocations for sensor, signal conditioning, and actuation logic

response times must be verified prior to placing the component in 

operational service and re-verified following maintenance that may 

adversely affect response time. In general, electrical repair work does not 

impact response time provided the parts used for repair are of the same 

type and value. Specific components identified in the WCAP may be 

replaced without verification testing. One example where response time 

could be affected is replacing the sensing assembly of a transmitter.

[ ESF RESPONSE TIME tests are conducted on an [18] month 

STAGGERED TEST BASIS. Testing of the final actuation devices, which 

make up the bulk of the response time, is included in the testing of each 

channel. The final actuation device in one train is tested with each 

channel. Therefore, staggered testing results in response time 

verification of these devices every [18] months. The [18] month 

Frequency is consistent with the typical refueling cycle and is based on 

unit operating experience, which shows that random failures of 

instrumentation components causing serious response time degradation, 

but not channel failure, are infrequent occurrences.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note that clarifies that the turbine driven AFW 

pump is tested within 24 hours after reaching [1000] psig in the SGs.

SR 3.3.2.11

SR 3.3.2.11 is the performance of a TADOT as described in SR 3.3.2.8, 

except that it is performed for the P-4 Reactor Trip Interlock, and the 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(Without Setpoint Control Program)

B 3.3.2A

Westinghouse STS B 3.3.2A-61 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Frequency is once per RTB cycle. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable TADOT of a relay. This is acceptable because all of the other 

required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per 

refueling interval with applicable extensions. This Frequency is based on 

operating experience demonstrating that undetected failure of the P-4 

interlock sometimes occurs when the RTB is cycled.

The SR is modified by a Note that excludes verification of setpoints during 

the TADOT. The Function tested has no associated setpoint.

REFERENCES 1. Regulatory Guide 1.105, "Setpoint for Safety Related 

Instrumentation," Revision 3.

2. FSAR, Chapter [6].

3. FSAR, Chapter [7].

4. FSAR, Chapter [15].

5. IEEE-279-1971.

6. 10 CFR 50.49.

7. Plant-specific setpoint methodology study.

8. NUREG-1218, April 1988.

9. WCAP-14333-P-A, Rev. 1, October 1998.

10. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

11. [Plant specific evaluation reference.]

12. WCAP-15376, Rev. 0. October 2000.

13. Technical Requirements Manual, Section 15, "Response Times."

14. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor 

Response Time Testing Requirements," January 1996.

15. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection 

Channel Response Time Tests," December 1995.

Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.2B Engineered Safety Feature Actuation System (ESFAS) Instrumentation (With Setpoint 

Control Program)

BASES

BACKGROUND The ESFAS initiates necessary safety systems, based on the values of 

selected unit parameters, to protect against violating core design limits 

and the Reactor Coolant System (RCS) pressure boundary, and to 

mitigate accidents. This is achieved by specifying limiting safety system 

settings (LSSS) in terms of parameters directly monitored by the ESFAS, 

as well as specifying LCOs on other reactor system parameters and 

equipment performance. 

Technical Specifications are required by 10 CFR 50.36 to include LSSS 

for variables that have significant safety functions. LSSS are defined by 

the regulation as "Where a LSSS is specified for a variable on which a 

safety limit has been placed, the setting must be chosen so that 

automatic protective actions will correct the abnormal situation before a 

Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the 

process variable at which a protective action is initiated, as established by 

the safety analysis, to ensure that a SL is not exceeded. Any automatic 

protection action that occurs on reaching the Analytical Limit therefore 

ensures that the SL is not exceeded. However, in practice, the actual 

settings for automatic protection channels must be chosen to be more 

conservative than the Analytical Limit to account for instrument loop 

uncertainties related to the setting at which the automatic protective 

action would actually occur. The LSSS values are identified and 

maintained in the Setpoint Control Program (SCP) controlled by 

10 CFR 50.59. 

-------------------------------- REVIEWER'S NOTE ------------------------------------

The term "Limiting Trip Setpoint (LTSP)" is generic terminology for the 

calculated field setting (setpoint) value calculated by means of the plantspecific setpoint methodology documented in a document controlled 

under 10 CFR 50.59. The term [LTSP] indicates that no additional margin 

has been added between the Analytical Limit and the calculated trip 

setting. 

For most Westinghouse plants the term Nominal Trip Setpoint (NTSP) is 

used in place of the term LTSP, and NTSP will replace LTSP in the Bases 

descriptions. "Field setting" is the suggested terminology for the actual 

setpoint implemented in the plant surveillance procedures where margin 

has been added to the calculated field setting. The as-found and as-left 

tolerances will apply to the field setting implemented in the Surveillance 

procedures to confirm channel performance. 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-2 Rev. 4.0

BASES

BACKGROUND (continued)

The [NTSP] is included in the SCP.

--------------------------------------------------------------------------------------------------

The [Nominal Trip Setpoint (NTSP)] specified in the SCP is a 

predetermined setting, plus margin, for a protection channel chosen to 

ensure automatic actuation prior to the process variable reaching the 

Analytical Limit and thus ensuring that the SL would not be exceeded. As 

such, the [NTSP] accounts for uncertainties in setting the channel (e.g., 

calibration), uncertainties in how the channel might actually perform (e.g., 

repeatability), changes in the point of action of the channel over time 

(e.g., drift during surveillance intervals), and any other factors which may 

influence its actual performance (e.g., harsh accident environments). In 

this manner, the [NTSP] ensures that SLs are not exceeded. Therefore, 

the [NTSP] meets the definition of an LSSS (Ref. 1).

Technical Specifications contain values related to the OPERABILITY of 

equipment required for safe operation of the facility. OPERABLE is 

defined in Technical Specifications as "...being capable of performing its 

safety functions(s)." Relying solely on the [NTSP] to define 

OPERABILITY in Technical Specifications would be an overly restrictive 

requirement if it were applied as an OPERABILITY limit for the "as-found" 

value of a protection channel setting during a surveillance. This would 

result in Technical Specification compliance problems, as well as reports 

and corrective actions required by the rule which are not necessary to 

ensure safety. For example, an automatic protection channel with a 

setting that has been found to be different from the [NTSP] due to some 

drift of the setting may still be OPERABLE since drift is to be expected. 

This expected drift would have been specifically accounted for in the 

setpoint methodology for calculating the [NTSP] and thus the automatic 

protective action would still have ensured that the SL would not be 

exceeded with the "as-found" setting of the protection channel. 

Therefore, the channel would still be OPERABLE since it would have 

performed its safety function and the only corrective action required would 

be to reset the channel within the established as-left tolerance around the

[NTSP] to account for further drift during the next surveillance interval. 

Note that, although the channel is OPERABLE under these 

circumstances, the trip setpoint must be left adjusted to a value within the 

as-left tolerance, in accordance with uncertainty assumptions stated in 

the referenced setpoint methodology (as-left criteria), and confirmed to be 

operating within the statistical allowances of the uncertainty terms 

assigned (as-found criteria). 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-3 Rev. 4.0

BASES

BACKGROUND (continued)

During anticipated operational occurrences (AOOs), which are those 

events expected to occur one or more times during the unit life, the 

acceptable limits are:

1. The Departure from Nucleate Boiling Ratio (DNBR) shall be 

maintained above the SL value to prevent departure from nucleate 

boiling (DNB),

2. Fuel centerline melt shall not occur, and

3. The RCS pressure SL of [2735] psia shall not be exceeded.

Operation within the SLs of Specification 2.0, "Safety Limits (SLs)," also 

maintains the above values and assures that offsite dose will be within 

the 10 CFR 50 and 10 CFR 100 criteria during AOOs.

Accidents are events that are analyzed even though they are not 

expected to occur during the unit life. The acceptable limit during 

accidents is that offsite dose shall be maintained within an acceptable 

fraction of 10 CFR 100 limits. Different accident categories are allowed a 

different fraction of these limits, based on probability of occurrence. 

Meeting the acceptable dose limit for an accident category is considered 

having acceptable consequences for that event. However, the 

acceptable dose limit for an accident category and their associated 

[NTSPs] are not considered to be LSSS as defined in 10 CFR 50.36.

The ESFAS instrumentation is segmented into three distinct but 

interconnected modules as identified below:

 Field transmitters or process sensors and instrumentation: provide a 

measurable electronic signal based on the physical characteristics of 

the parameter being measured,

 Signal processing equipment including analog protection system, 

field contacts, and protection channel sets: provide signal 

conditioning, bistable setpoint comparison, process algorithm 

actuation, compatible electrical signal output to protection system 

channels, and control board/control room/miscellaneous indications, 

and

 Solid State Protection System (SSPS) including input, logic, and 

output bays: initiates the proper unit shutdown or engineered safety 

feature (ESF) actuation in accordance with the defined logic and 

based on the bistable outputs from the signal process control and 

protection system.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-4 Rev. 4.0

BASES

BACKGROUND (continued)

Field Transmitters or Sensors

To meet the design demands for redundancy and reliability, more than 

one, and often as many as four, field transmitters or sensors are used to 

measure unit parameters. In many cases, field transmitters or sensors 

that input to the ESFAS are shared with the Reactor Trip System (RTS). 

In some cases, the same channels also provide control system inputs. 

To account for calibration tolerances and instrument drift, which are 

assumed to occur between calibrations, statistical allowances are 

provided in the [NTSP] and Allowable Value. The OPERABILITY of each 

transmitter or sensor is determined by either "as-found" calibration data 

evaluated during the CHANNEL CALIBRATION or by qualitative 

assessment of field transmitter or sensor, as related to the channel 

behavior observed during performance of the CHANNEL CHECK.

Signal Processing Equipment

Generally, three or four channels of process control equipment are used 

for the signal processing of unit parameters measured by the field 

instruments. The process control equipment provides signal conditioning, 

comparable output signals for instruments located on the main control 

board, and comparison of measured input signals with [NTSPs] derived 

from Analytical Limits established by the safety analyses. These 

Analytical Limits are defined in FSAR, Chapter [6] (Ref. 2), Chapter [7] 

(Ref. 3), and Chapter [15] (Ref. 4). If the measured value of a unit 

parameter exceeds the predetermined setpoint, an output from a bistable 

is forwarded to the SSPS for decision evaluation. Channel separation is 

maintained up to and through the input bays. However, not all unit 

parameters require four channels of sensor measurement and signal 

processing. Some unit parameters provide input only to the SSPS, while 

others provide input to the SSPS, the main control board, the unit 

computer, and one or more control systems.

Generally, if a parameter is used only for input to the protection circuits, 

three channels with a two-out-of-three logic are sufficient to provide the 

required reliability and redundancy. If one channel fails in a direction that 

would not result in a partial Function trip, the Function is still OPERABLE 

with a two-out-of-two logic. If one channel fails such that a partial 

Function trip occurs, a trip will not occur and the Function is still 

OPERABLE with a one-out-of- two logic.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-5 Rev. 4.0

BASES

BACKGROUND (continued)

Generally, if a parameter is used for input to the SSPS and a control 

function, four channels with a two-out-of-four logic are sufficient to provide 

the required reliability and redundancy. The circuit must be able to 

withstand both an input failure to the control system, which may then 

require the protection function actuation, and a single failure in the other 

channels providing the protection function actuation. Again, a single 

failure will neither cause nor prevent the protection function actuation.

These requirements are described in IEEE-279-1971 (Ref. 5). The actual 

number of channels required for each unit parameter is specified in 

Reference 3.

[NTSPs] and ESFAS Setpoints [Allowable Values]

The trip setpoints used in the bistables are based on the analytical limits 

stated in Reference 3. The calculation of the [NTSPs] is such that 

adequate protection is provided when all sensor and processing time 

delays are taken into account. To allow for calibration tolerances, 

instrumentation uncertainties, instrument drift, and severe environment 

errors for those ESFAS channels that must function in harsh 

environments as defined by 10 CFR 50.49 (Ref. 6), the Allowable Values 

specified in the SCP are conservative with respect to the analytical limits. 

A detailed description of the methodology used to calculate the Allowable

Values and ESFAS [NTSPs] including their explicit uncertainties, is 

provided in the plant specific setpoint methodology study (Ref. 7) which 

incorporates all of the known uncertainties applicable to each channel. 

The as-left tolerance and as-found tolerance band methodology is 

provided in the SCP. The magnitudes of these uncertainties are factored 

into the determination of each ESFAS [NTSP] and corresponding 

Allowable Value. The nominal ESFAS setpoint entered into the bistable 

is more conservative than that specified by the [NTSP] to account for 

measurement errors detectable by the CHANNEL OPERATIONAL TEST 

(COT). The Allowable Value serves as the as-found trip setpoint

Technical Specification OPERABILITY limit for the purpose of the COT. 

The [NTSP] is the value at which the bistables are set and is the expected 

value to be achieved during calibration. The [NTSP] value, is the LSSS 

and ensures the safety analysis limits are met for the surveillance interval 

selected when a channel is adjusted based on stated channel 

uncertainties. Any bistable is considered to be properly adjusted when 

the "as-left" [NTSP] value is within the as-left tolerance for CHANNEL 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-6 Rev. 4.0

BASES

BACKGROUND (continued)

CALIBRATION uncertainty allowance (i.e., + rack calibration and

comparator setting uncertainties). The [NTSP] value is therefore 

considered a "nominal value" (i.e., expressed as a value without 

inequalities) for the purposes of the COT and CHANNEL CALIBRATION. 

[Nominal Trip Setpoints], in conjunction with the use of as-found and asleft tolerances together with the requirements of the Allowable Value 

ensure that the consequences of Design Basis Accidents (DBAs) will be 

acceptable, providing the unit is operated from within the LCOs at the 

onset of the DBA and the equipment functions as designed.

Note that the Allowable Values listed in the SCP are the least 

conservative value of the as-found setpoint that a channel can have 

during a periodic CHANNEL CALIBRATION, COT, or a TADOT.

Each channel can be tested on line to verify that the signal processing 

equipment and setpoint accuracy is within the specified allowance 

requirements of the SCP. Once a designated channel is taken out of 

service for testing, a simulated signal is injected in place of the field 

instrument signal. The process equipment for the channel in test is then 

tested, verified, and calibrated. SRs for the channels are specified in the 

SR section.

Solid State Protection System

The SSPS equipment is used for the decision logic processing of outputs 

from the signal processing equipment bistables. To meet the redundancy 

requirements, two trains of SSPS, each performing the same functions, 

are provided. If one train is taken out of service for maintenance or test 

purposes, the second train will provide ESF actuation for the unit. If both 

trains are taken out of service or placed in test, a reactor trip will result. 

Each train is packaged in its own cabinet for physical and electrical 

separation to satisfy separation and independence requirements. 

The SSPS performs the decision logic for most ESF equipment actuation; 

generates the electrical output signals that initiate the required actuation; 

and provides the status, permissive, and annunciator output signals to the 

main control room of the unit.

The bistable outputs from the signal processing equipment are sensed by 

the SSPS equipment and combined into logic matrices that represent 

combinations indicative of various transients. If a required logic matrix 

combination is completed, the system will send actuation signals via 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-7 Rev. 4.0

BASES

BACKGROUND (continued)

master and slave relays to those components whose aggregate Function 

best serves to alleviate the condition and restore the unit to a safe 

condition. Examples are given in the Applicable Safety Analyses, LCO, 

and Applicability sections of this Bases.

Each SSPS train has a built in testing device that can automatically test 

the decision logic matrix functions and the actuation channels while the 

unit is at power. When any one train is taken out of service for testing, 

the other train is capable of providing unit monitoring and protection until 

the testing has been completed. The testing device is semiautomatic to 

minimize testing time.

The actuation of ESF components is accomplished through master and 

slave relays. The SSPS energizes the master relays appropriate for the 

condition of the unit. Each master relay then energizes one or more slave 

relays, which then cause actuation of the end devices. The master and 

slave relays are routinely tested to ensure operation. The test of the 

master relays energizes the relay, which then operates the contacts and 

applies a low voltage to the associated slave relays. The low voltage is 

not sufficient to actuate the slave relays but only demonstrates signal 

path continuity. The SLAVE RELAY TEST actuates the devices if their 

operation will not interfere with continued unit operation. For the latter 

case, actual component operation is prevented by the SLAVE RELAY 

TEST circuit, and slave relay contact operation is verified by a continuity 

check of the circuit containing the slave relay.

----------------------------REVIEWER’S NOTE------------------------------------------

No one unit ESFAS incorporates all of the Functions listed in 

Table 3.3.2-1. In some cases (e.g., Containment Pressure - High 3, 

Function 2.c), the Table reflects several different implementations of the 

same Function. Typically, only one of these implementations are used at 

any specific unit.

--------------------------------------------------------------------------------------------------

APPLICABLE Each of the analyzed accidents can be detected by one or more ESFAS

SAFETY Functions. One of the ESFAS Functions is the primary actuation signal 

ANALYSES, LCO, for that accident. An ESFAS Function may be the primary actuation 

and APPLICABILITY signal for more than one type of accident. An ESFAS Function may also 

be a secondary, or backup, actuation signal for one or more other 

accidents. For example, Pressurizer Pressure - Low is a primary 

actuation signal for small loss of coolant accidents (LOCAs) and a backup 

actuation signal for steam line breaks (SLBs) outside containment. 

Functions such as manual initiation, not specifically credited in the 

accident safety analysis, are implicitly credited in the safety analysis and 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-8 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

the NRC staff approved licensing basis for the unit. These Functions may 

provide protection for conditions that do not require dynamic transient 

analysis to demonstrate Function performance. These Functions may 

also serve as backups to Functions that were credited in the accident 

analysis (Ref. 4).

Permissive and interlock setpoints allow the blocking of trips during plant 

startups, and restoration of trips when the permissive conditions are not 

satisfied, but they are not explicitly modeled in the Safety Analyses. 

These permissives and interlocks ensure that the starting conditions are 

consistent with the safety analysis, before preventive or mitigating actions 

occur. Because these permissives or interlocks are only one of multiple 

conservative starting assumptions for the accident analysis, they are 

generally considered as nominal values without regard to measurement 

accuracy.

The LCO requires all instrumentation performing an ESFAS Function, 

listed in Table 3.3.2-1 in the accompanying LCO, to be OPERABLE. The 

Allowable Value specified in the SCP is the least conservative value of 

the as-found setpoint that the channel can have when tested, such that a 

channel is OPERABLE if the as-found setpoint is within the as-found 

tolerance and is conservative with respect to the Allowable Value during 

the CHANNEL CALIBRATION or COT. As such, the Allowable Value 

differs from the [NTSP] by an amount [greater than or] equal to the 

expected instrument channel uncertainties, such as drift, during the 

surveillance interval. In this manner, the actual setting of the channel 

[NTSP] will ensure that a SL is not exceeded at any given point of time as 

long as the channel has not drifted beyond expected tolerances during 

the surveillance interval. Note that, although the channel is OPERABLE 

under these circumstances, the trip setpoint must be left adjusted to a 

value within the as-left tolerance, in accordance with uncertainty 

assumptions stated in the referenced setpoint methodology (as-left 

criteria), and confirmed to be operating within the statistical allowances of 

the uncertainty terms assigned (as-found criteria).

If the actual setting of the channel is found to be conservative with 

respect to the Allowable Value but is beyond the as-found tolerance band, 

the channel is OPERABLE, but degraded. The degraded condition of the 

channel will be evaluated during performance of the SR. This evaluation 

will consist of resetting the channel setpoint to the [NTSP] (within the 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-9 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

allowed tolerance) and evaluating the channel response. If the channel is 

functioning as required and expected to pass the next surveillance, then 

the channel can be restored to service at the completion of the 

surveillance. After the surveillance is completed, the channel's as-found 

setting will be entered into the Corrective Action Program for further 

evaluation. 

A trip setpoint may be set more conservative than the [NTSP] as 

necessary in response to plant conditions. However, in this case, the 

OPERABILITY of this instrument must be verified based on the [field 

setting] and not the [NTSP]. Failure of any instrument renders the 

affected channel(s) inoperable and reduces the reliability of the affected 

Functions.

The LCO generally requires OPERABILITY of four or three channels in 

each instrumentation function and two channels in each logic and manual 

initiation function. The two-out-of-three and the two-out-of-four 

configurations allow one channel to be tripped during maintenance or 

testing without causing an ESFAS initiation. Two logic or manual 

initiation channels are required to ensure no single random failure 

disables the ESFAS.

The required channels of ESFAS instrumentation provide unit protection 

in the event of any of the analyzed accidents. ESFAS protection 

functions are as follows:

1. Safety Injection

Safety Injection (SI) provides two primary functions:

1. Primary side water addition to ensure maintenance or recovery 

of reactor vessel water level (coverage of the active fuel for heat 

removal, clad integrity, and for limiting peak clad temperature to 

< 2200°F), and

2. Boration to ensure recovery and maintenance of SDM (keff< 1.0).

These functions are necessary to mitigate the effects of high energy 

line breaks (HELBs) both inside and outside of containment. The SI 

signal is also used to initiate other Functions such as:

 Phase A Isolation,

 Containment Purge Isolation,
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-10 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

 Reactor Trip,

 Turbine Trip,

 Feedwater Isolation,

 Start of motor driven auxiliary feedwater (AFW) pumps,

 Control room ventilation isolation, and

 Enabling automatic switchover of Emergency Core Cooling 

Systems (ECCS) suction to containment sump.

These other functions ensure:

 Isolation of nonessential systems through containment 

penetrations,

 Trip of the turbine and reactor to limit power generation,

 Isolation of main feedwater (MFW) to limit secondary side mass 

losses,

 Start of AFW to ensure secondary side cooling capability,

 Isolation of the control room to ensure habitability, and

 Enabling ECCS suction from the refueling water storage tank 

(RWST) switchover on low low RWST level to ensure continued 

cooling via use of the containment sump.

a. Safety Injection - Manual Initiation

The LCO requires one channel per train to be OPERABLE. The 

operator can initiate SI at any time by using either of two 

switches in the control room. This action will cause actuation of 

all components in the same manner as any of the automatic 

actuation signals.

The LCO for the Manual Initiation Function ensures the proper 

amount of redundancy is maintained in the manual ESFAS 

actuation circuitry to ensure the operator has manual ESFAS 

initiation capability.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-11 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Each channel consists of one push button and the

interconnecting wiring to the actuation logic cabinet. Each push 

button actuates both trains. This configuration does not allow 

testing at power.

b. Safety Injection - Automatic Actuation Logic and Actuation 

Relays

This LCO requires two trains to be OPERABLE. Actuation logic 

consists of all circuitry housed within the actuation subsystems, 

including the initiating relay contacts responsible for actuating 

the ESF equipment.

Manual and automatic initiation of SI must be OPERABLE in 

MODES 1, 2, and 3. In these MODES, there is sufficient energy 

in the primary and secondary systems to warrant automatic 

initiation of ESF systems. Manual Initiation is also required in 

MODE 4 even though automatic actuation is not required. In this 

MODE, adequate time is available to manually actuate required 

components in the event of a DBA, but because of the large 

number of components actuated on a SI, actuation is simplified 

by the use of the manual actuation push buttons. Automatic 

actuation logic and actuation relays must be OPERABLE in 

MODE 4 to support system level manual initiation.

These Functions are not required to be OPERABLE in MODES 5 

and 6 because there is adequate time for the operator to 

evaluate unit conditions and respond by manually starting 

individual systems, pumps, and other equipment to mitigate the 

consequences of an abnormal condition or accident. Unit

pressure and temperature are very low and many ESF 

components are administratively locked out or otherwise 

prevented from actuating to prevent inadvertent 

overpressurization of unit systems.

c. Safety Injection - Containment Pressure - High 1

This signal provides protection against the following accidents:

 SLB inside containment,

 LOCA, and

 Feed line break inside containment.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-12 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Containment Pressure - High 1 provides no input to any control 

functions. Thus, three OPERABLE channels are sufficient to 

satisfy protective requirements with a two-out-of-three logic. The 

transmitters (d/p cells) and electronics are located outside of 

containment with the sensing line (high pressure side of the 

transmitter) located inside containment.

Thus, the high pressure Function will not experience any 

adverse environmental conditions and the [NTSP] reflects only 

steady state instrument uncertainties.

Containment Pressure - High 1 must be OPERABLE in 

MODES 1, 2, and 3 when there is sufficient energy in the primary 

and secondary systems to pressurize the containment following 

a pipe break. In MODES 4, 5, and 6, there is insufficient energy 

in the primary or secondary systems to pressurize the 

containment.

d. Safety Injection - Pressurizer Pressure – Low

This signal provides protection against the following accidents:

 Inadvertent opening of a steam generator (SG) relief or 

safety valve,

 SLB,

 A spectrum of rod cluster control assembly ejection 

accidents (rod ejection),

 Inadvertent opening of a pressurizer relief or safety valve,

 LOCAs, and

 SG Tube Rupture.

At some units pressurizer pressure provides both control and 

protection functions: input to the Pressurizer Pressure Control 

System, reactor trip, and SI. Therefore, the actuation logic must 

be able to withstand both an input failure to control system, 

which may then require the protection function actuation, and a 

single failure in the other channels providing the protection 

function actuation. Thus, four OPERABLE channels are required 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-13 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

to satisfy the requirements with a two-out-of-four logic. For units 

that have dedicated protection and control channels, only three 

protection channels are necessary to satisfy the protective 

requirements.

The transmitters are located inside containment, with the taps in 

the vapor space region of the pressurizer, and thus possibly 

experiencing adverse environmental conditions (LOCA, SLB 

inside containment, rod ejection). Therefore, the [NTSP] reflects 

the inclusion of both steady state and adverse environmental 

instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 

(above P-11) to mitigate the consequences of an HELB inside 

containment. This signal may be manually blocked by the 

operator below the P-11 setpoint. Automatic SI actuation below 

this pressure setpoint is then performed by the Containment 

Pressure - High 1 signal.

This Function is not required to be OPERABLE in MODE 3 

below the P-11 setpoint. Other ESF functions are used to detect 

accident conditions and actuate the ESF systems in this MODE. 

In MODES 4, 5, and 6, this Function is not needed for accident 

detection and mitigation.

e. Safety Injection - Steam Line Pressure

(1) Steam Line Pressure – Low

Steam Line Pressure - Low provides protection against the 

following accidents:

 SLB,

 Feed line break, and

 Inadvertent opening of an SG relief or an SG safety 

valve.

Steam Line Pressure - Low provides no input to any control 

functions. Thus, three OPERABLE channels on each steam 

line are sufficient to satisfy the protective requirements with 

a two-out-of-three logic on each steam line.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-14 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

With the transmitters typically located inside the steam 

tunnels, it is possible for them to experience adverse 

environmental conditions during a secondary side break. 

Therefore, the [NTSP] reflects both steady state and 

adverse environmental instrument uncertainties.

This Function is anticipatory in nature and has a typical 

lead/lag ratio of 50/5.

Steam Line Pressure - Low must be OPERABLE in 

MODES 1, 2, and 3 (above P-11) when a secondary side 

break or stuck open valve could result in the rapid 

depressurization of the steam lines. This signal may be 

manually blocked by the operator below the P-11 setpoint. 

Below P-11, feed line break is not a concern. Inside 

containment SLB will be terminated by automatic SI 

actuation via Containment Pressure - High 1, and outside 

containment SLB will be terminated by the Steam Line 

Pressure - Negative Rate - High signal for steam line 

isolation. This Function is not required to be OPERABLE in 

MODE 4, 5, or 6 because there is insufficient energy in the 

secondary side of the unit to cause an accident.

(2) Steam Line Pressure - High Differential Pressure Between 

Steam Lines

Steam Line Pressure - High Differential Pressure Between 

Steam Lines provides protection against the following 

accidents:

 SLB,

 Feed line break, and

 Inadvertent opening of an SG relief or an SG safety 

valve.

Steam Line Pressure - High Differential Pressure Between 

Steam Lines provides no input to any control functions. 

Thus, three OPERABLE channels on each steam line are 

sufficient to satisfy the requirements, with a two-out-of-three 

logic on each steam line.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-15 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

With the transmitters typically located inside the steam 

tunnels, it is possible for them to experience adverse 

environmental conditions during an SLB event. Therefore, 

the [NTSP] reflects both steady state and adverse 

environmental instrument uncertainties. Steam line high 

differential pressure must be OPERABLE in MODES 1, 2, 

and 3 when a secondary side break or stuck open valve 

could result in the rapid depressurization of the steam 

line(s). This Function is not required to be OPERABLE in 

MODE 4, 5, or 6 because there is not sufficient energy in the 

secondary side of the unit to cause an accident.

f, g. Safety Injection - High Steam Flow in Two Steam Lines 

Coincident With Tavg - Low Low or Coincident With Steam Line 

Pressure – Low

These Functions (1.f and 1.g) provide protection against the 

following accidents:

 SLB, and

 the inadvertent opening of an SG relief or an SG safety 

valve.

Two steam line flow channels per steam line are required 

OPERABLE for these Functions. The steam line flow channels 

are combined in a one-out-of-two logic to indicate high steam 

flow in one steam line. The steam flow transmitters provide 

control inputs, but the control function cannot cause the events 

that the Function must protect against. Therefore, two channels 

are sufficient to satisfy redundancy requirements. The one-outof-two configuration allows online testing because trip of one 

high steam flow channel is not sufficient to cause initiation. High 

steam flow in two steam lines is acceptable in the case of a 

single steam line fault due to the fact that the remaining intact 

steam lines will pick up the full turbine load. The increased 

steam flow in the remaining intact lines will actuate the required 

second high steam flow trip. Additional protection is provided by 

Function 1.e.(2), High Differential Pressure Between Steam 

Lines.

One channel of Tavg per loop and one channel of low steam line 

pressure per steam line are required OPERABLE. For each 

parameter, the channels for all loops or steam lines are 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-16 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

combined in a logic such that two channels tripped will cause a 

trip for the parameter. For example, for three loop units, the low 

steam line pressure channels are combined in two-out-of- three 

logic. Thus, the Function trips on one-out-of-two high flow in any 

two-out-of-three steam lines if there is one-out-of-one low low 

Tavg trip in any two-out-of-three RCS loops, or if there is a oneout-of-one low pressure trip in any two-out-of-three steam lines. 

Since the accidents that this event protects against cause both 

low steam line pressure and low low Tavg, provision of one 

channel per loop or steam line ensures no single random failure 

can disable both of these Functions. The steam line pressure 

channels provide no control inputs. The Tavg channels provide 

control inputs, but the control function cannot initiate events that 

the Function acts to mitigate.

The Allowable Value for high steam flow is a linear function that 

varies with power level. The function is a ∆P corresponding to 

44% of full steam flow between 0% and 20% load to 114% of full 

steam flow at 100% load. The nominal trip setpoint is similarly 

calculated.

With the transmitters typically located inside the containment 

(Tavg) or inside the steam tunnels (High Steam Flow), it is 

possible for them to experience adverse steady state 

environmental conditions during an SLB event. Therefore, the 

[NTSP] reflects both steady state and adverse environmental 

instrument uncertainties. The Steam Line Pressure - Low signal 

was discussed previously under Function 1.e.(1).

This Function must be OPERABLE in MODES 1, 2, and 3 

(above P-12) when a secondary side break or stuck open valve 

could result in the rapid depressurization of the steam line(s). 

This signal may be manually blocked by the operator when 

below the P-12 setpoint. Above P-12, this Function is 

automatically unblocked. This Function is not required 

OPERABLE below P-12 because the reactor is not critical, so 

feed line break is not a concern. SLB may be addressed by 

Containment Pressure High 1 (inside containment) or by High 

Steam Flow in Two Steam Lines coincident with Steam Line 

Pressure - Low, for Steam Line Isolation, followed by High 

Differential Pressure Between Two Steam Lines, for SI. This 

Function is not required to be OPERABLE in MODE 4, 5, or 6 

because there is insufficient energy in the secondary side of the 

unit to cause an accident.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-17 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

2. Containment Spray

Containment Spray provides three primary functions:

1. Lowers containment pressure and temperature after an HELB in 

containment,

2. Reduces the amount of radioactive iodine in the containment 

atmosphere, and

3. Adjusts the pH of the water in the containment recirculation 

sump after a large break LOCA.

These functions are necessary to:

 Ensure the pressure boundary integrity of the containment 

structure,

 Limit the release of radioactive iodine to the environment in the 

event of a failure of the containment structure, and

 Minimize corrosion of the components and systems inside 

containment following a LOCA.

The containment spray actuation signal starts the containment spray 

pumps and aligns the discharge of the pumps to the containment 

spray nozzle headers in the upper levels of containment. Water is 

initially drawn from the RWST by the containment spray pumps and 

mixed with a sodium hydroxide solution from the spray additive tank. 

When the RWST reaches the low low level setpoint, the spray pump 

suctions are shifted to the containment sump if continued 

containment spray is required. Containment spray is actuated 

manually by Containment Pressure - High 3 or Containment Pressure 

- High High.

a. Containment Spray - Manual Initiation

The operator can initiate containment spray at any time from the 

control room by simultaneously turning two containment spray 

actuation switches in the same train. Because an inadvertent 

actuation of containment spray could have such serious 

consequences, two switches must be turned simultaneously to 

initiate containment spray. There are two sets of two switches 

each in the control room. Simultaneously turning the two
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-18 Rev. 4.0

BASES 

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

switches in either set will actuate containment spray in both 

trains in the same manner as the automatic actuation signal. 

Two Manual Initiation switches in each train are required to be 

OPERABLE to ensure no single failure disables the Manual 

Initiation Function. Note that Manual Initiation of containment 

spray also actuates Phase B containment isolation.

b. Containment Spray - Automatic Actuation Logic and Actuation 

Relays

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

Manual and automatic initiation of containment spray must be 

OPERABLE in MODES 1, 2, and 3 when there is a potential for 

an accident to occur, and sufficient energy in the primary or 

secondary systems to pose a threat to containment integrity due 

to overpressure conditions. Manual initiation is also required in 

MODE 4, even though automatic actuation is not required. In 

this MODE, adequate time is available to manually actuate 

required components in the event of a DBA. However, because 

of the large number of components actuated on a containment 

spray, actuation is simplified by the use of the manual actuation 

push buttons. Automatic actuation logic and actuation relays 

must be OPERABLE in MODE 4 to support system level manual 

initiation. In MODES 5 and 6, there is insufficient energy in the 

primary and secondary systems to result in containment 

overpressure. In MODES 5 and 6, there is also adequate time 

for the operators to evaluate unit conditions and respond, to 

mitigate the consequences of abnormal conditions by manually 

starting individual components.

c. Containment Spray - Containment Pressure

This signal provides protection against a LOCA or an SLB inside 

containment. The transmitters (d/p cells) are located outside of 

containment with the sensing line (high pressure side of the 

transmitter) located inside containment. The transmitters and 

electronics are located outside of containment. Thus, they will 

not experience any adverse environmental conditions and the 

[NTSP] reflects only steady state instrument uncertainties.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-19 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

This is one of the only Functions that requires the bistable output 

to energize to perform its required action. It is not desirable to 

have a loss of power actuate containment spray, since the 

consequences of an inadvertent actuation of containment spray 

could be serious. Note that this Function also has the inoperable 

channel placed in bypass rather than trip to decrease the 

probability of an inadvertent actuation.

Two different logic configurations are typically used. Three and 

four loop units use four channels in a two-out-of-four logic 

configuration. This configuration may be called the Containment 

Pressure - High 3 Setpoint for three and four loop units, and 

Containment Pressure - High High Setpoint for other units. 

Some two loop units use three sets of two channels, each set 

combined in a one-out-of-two configuration, with these outputs 

combined so that two-out-of-three sets tripped initiates 

containment spray. This configuration is called Containment 

Pressure - High 3 Setpoint. Since containment pressure is not

used for control, both of these arrangements exceed the 

minimum redundancy requirements. Additional redundancy is 

warranted because this Function is energized to trip. 

Containment Pressure - [High 3] [High High] must be 

OPERABLE in MODES 1, 2, and 3 when there is sufficient 

energy in the primary and secondary sides to pressurize the 

containment following a pipe break. In MODES 4, 5, and 6, 

there is insufficient energy in the primary and secondary sides to 

pressurize the containment and reach the Containment Pressure 

- High 3 (High High) setpoints.

3. Containment Isolation

Containment Isolation provides isolation of the containment 

atmosphere, and all process systems that penetrate containment, 

from the environment. This Function is necessary to prevent or limit 

the release of radioactivity to the environment in the event of a large 

break LOCA.

There are two separate Containment Isolation signals, Phase A and 

Phase B. Phase A isolation isolates all automatically isolable 

process lines, except component cooling water (CCW), at a relatively 

low containment pressure indicative of primary or secondary system 

leaks. For these types of events, forced circulation cooling using the 

reactor coolant pumps (RCPs) and SGs is the preferred (but not 

required) method of decay heat removal. Since CCW is required to 

support RCP operation, not isolating CCW on the low pressure
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-20 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Phase A signal enhances unit safety by allowing operators to use 

forced RCS circulation to cool the unit. Isolating CCW on the low 

pressure signal may force the use of feed and bleed cooling, which 

could prove more difficult to control.

Phase A containment isolation is actuated automatically by SI, or

manually via the automatic actuation logic. All process lines 

penetrating containment, with the exception of CCW, are isolated. 

CCW is not isolated at this time to permit continued operation of the 

RCPs with cooling water flow to the thermal barrier heat exchangers 

and air or oil coolers. All process lines not equipped with remote 

operated isolation valves are manually closed, or otherwise isolated, 

prior to reaching MODE 4.

Manual Phase A Containment Isolation is accomplished by either of 

two switches in the control room. Either switch actuates both trains. 

Note that manual actuation of Phase A Containment Isolation also 

actuates Containment Purge and Exhaust Isolation.

The Phase B signal isolates CCW. This occurs at a relatively high 

containment pressure that is indicative of a large break LOCA or a 

SLB. For these events, forced circulation using the RCPs is no 

longer desirable. Isolating the CCW at the higher pressure does not 

pose a challenge to the containment boundary because the CCW 

System is a closed loop inside containment. Although some system 

components do not meet all of the ASME Code requirements applied

to the containment itself, the system is continuously pressurized to a 

pressure greater than the Phase B setpoint. Thus, routine operation 

demonstrates the integrity of the system pressure boundary for 

pressures exceeding the Phase B setpoint. Furthermore, because 

system pressure exceeds the Phase B setpoint, any system leakage 

prior to initiation of Phase B isolation would be into containment. 

Therefore, the combination of CCW System design and Phase B 

isolation ensures the CCW System is not a potential path for 

radioactive release from containment.

Phase B containment isolation is actuated by Containment Pressure -

High 3 or Containment Pressure - High High, or manually, via the 

automatic actuation logic, as previously discussed. For containment 

pressure to reach a value high enough to actuate Containment 

Pressure - High 3 or Containment Pressure - High High, a large

break LOCA or SLB must have occurred and containment spray must 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-21 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

have been actuated. RCP operation will no longer be required and 

CCW to the RCPs is, therefore, no longer necessary. The RCPs can 

be operated with seal injection flow alone and without CCW flow to 

the thermal barrier heat exchanger.

Manual Phase B Containment Isolation is accomplished by the same 

switches that actuate Containment Spray. When the two switches in 

either set are turned simultaneously, Phase B Containment Isolation 

and Containment Spray will be actuated in both trains.

a. Containment Isolation - Phase A Isolation

(1) Phase A Isolation - Manual Initiation

Manual Phase A Containment Isolation is actuated by either 

of two switches in the control room. Either switch actuates 

both trains. Note that manual initiation of Phase A 

Containment Isolation also actuates Containment Purge 

Isolation.

(2) Phase A Isolation - Automatic Actuation Logic and Actuation 

Relays

Automatic Actuation Logic and Actuation Relays consist of 

the same features and operate in the same manner as 

described for ESFAS Function 1.b.

Manual and automatic initiation of Phase A Containment 

Isolation must be OPERABLE in MODES 1, 2, and 3, when 

there is a potential for an accident to occur. Manual 

initiation is also required in MODE 4 even though automatic 

actuation is not required. In this MODE, adequate time is 

available to manually actuate required components in the 

event of a DBA, but because of the large number of 

components actuated on a Phase A Containment Isolation, 

actuation is simplified by the use of the manual actuation 

push buttons. Automatic actuation logic and actuation 

relays must be OPERABLE in MODE 4 to support system 

level manual initiation. In MODES 5 and 6, there is 

insufficient energy in the primary or secondary systems to 

pressurize the containment to require Phase A Containment 

Isolation. There also is adequate time for the operator to 

evaluate unit conditions and manually actuate individual 

isolation valves in response to abnormal or accident 

conditions.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-22 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

(3) Phase A Isolation - Safety Injection

Phase A Containment Isolation is also initiated by all 

Functions that initiate SI. The Phase A Containment 

Isolation requirements for these Functions are the same as 

the requirements for their SI function. Therefore, the 

requirements are not repeated in Table 3.3.2-1. Instead, 

Function 1, SI, is referenced for all initiating Functions and 

requirements.

b. Containment Isolation - Phase B Isolation

Phase B Containment Isolation is accomplished by Manual 

Initiation, Automatic Actuation Logic and Actuation Relays, and 

by Containment Pressure channels (the same channels that 

actuate Containment Spray, Function 2). The Containment 

Pressure trip of Phase B Containment Isolation is energized to 

trip in order to minimize the potential of spurious trips that may 

damage the RCPs.

(1) Phase B Isolation - Manual Initiation

(2) Phase B Isolation - Automatic Actuation Logic and Actuation 

Relays

Manual and automatic initiation of Phase B containment 

isolation must be OPERABLE in MODES 1, 2, and 3, when 

there is a potential for an accident to occur. Manual 

initiation is also required in MODE 4 even though automatic 

actuation is not required. In this MODE, adequate time is 

available to manually actuate required components in the 

event of a DBA. However, because of the large number of 

components actuated on a Phase B containment isolation, 

actuation is simplified by the use of the manual actuation 

push buttons. Automatic actuation logic and actuation 

relays must be OPERABLE in MODE 4 to support system 

level manual initiation. In MODES 5 and 6, there is 

insufficient energy in the primary or secondary systems to 

pressurize the containment to require Phase B containment 

isolation. There also is adequate time for the operator to 

evaluate unit conditions and manually actuate individual 

isolation valves in response to abnormal or accident 

conditions.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-23 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

(3) Phase B Isolation - Containment Pressure

The basis for containment pressure MODE applicability is as 

discussed for ESFAS Function 2.c above.

4. Steam Line Isolation

Isolation of the main steam lines provides protection in the event of a 

SLB inside or outside containment. Rapid isolation of the steam lines 

will limit the steam break accident to the blowdown from one SG, at 

most. For a SLB upstream of the main steam isolation valves 

(MSIVs), inside or outside of containment, closure of the MSIVs limits 

the accident to the blowdown from only the affected SG. For a SLB 

downstream of the MSIVs, closure of the MSIVs terminates the 

accident as soon as the steam lines depressurize. For units that do 

not have steam line check valves, Steam Line Isolation also mitigates 

the effects of a feed line break and ensures a source of steam for the 

turbine driven AFW pump during a feed line break.

a. Steam Line Isolation - Manual Initiation

Manual initiation of Steam Line Isolation can be accomplished 

from the control room. There are two switches in the control 

room and either switch can initiate action to immediately close all 

MSIVs. The LCO requires two channels to be OPERABLE.

b. Steam Line Isolation - Automatic Actuation Logic and Actuation 

Relays

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

Manual and automatic initiation of steam line isolation must be 

OPERABLE in MODES 1, 2, and 3 when there is sufficient 

energy in the RCS and SGs to have a SLB or other accident. 

This could result in the release of significant quantities of energy 

and cause a cooldown of the primary system. The Steam Line 

Isolation Function is required in MODES 2 and 3 unless all 

MSIVs are closed and [de-activated]. In MODES 4, 5, and 6, 

there is insufficient energy in the RCS and SGs to experience a 

SLB or other accident releasing significant quantities of energy.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-24 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

c. Steam Line Isolation - Containment Pressure - High 2

This Function actuates closure of the MSIVs in the event of a 

LOCA or a SLB inside containment to maintain at least one 

unfaulted SG as a heat sink for the reactor, and to limit the mass 

and energy release to containment. The transmitters (d/p cells) 

are located outside containment with the sensing line (high 

pressure side of the transmitter) located inside containment. 

Containment Pressure - High 2 provides no input to any control 

functions. Thus, three OPERABLE channels are sufficient to 

satisfy protective requirements with two-out-of-three logic. 

However, for enhanced reliability, this Function was designed 

with four channels and a two-out-of-four logic. The transmitters 

and electronics are located outside of containment. Thus, they 

will not experience any adverse environmental conditions, and 

the [NTSP] reflects only steady state instrument uncertainties.

Containment Pressure - High 2 must be OPERABLE in 

MODES 1, 2, and 3, when there is sufficient energy in the 

primary and secondary side to pressurize the containment 

following a pipe break. This would cause a significant increase 

in the containment pressure, thus allowing detection and closure 

of the MSIVs. The Steam Line Isolation Function remains 

OPERABLE in MODES 2 and 3 unless all MSIVs are closed and 

[de-activated]. In MODES 4, 5, and 6, there is not enough 

energy in the primary and secondary sides to pressurize the 

containment to the Containment Pressure - High 2 setpoint.

d. Steam Line Isolation - Steam Line Pressure

(1) Steam Line Pressure – Low

Steam Line Pressure - Low provides closure of the MSIVs in 

the event of a SLB to maintain at least one unfaulted SG as 

a heat sink for the reactor, and to limit the mass and energy 

release to containment. This Function provides closure of 

the MSIVs in the event of a feed line break to ensure a 

supply of steam for the turbine driven AFW pump. Steam 

Line Pressure - Low was discussed previously under SI 

Function 1.e.1.

Steam Line Pressure - Low Function must be OPERABLE in 

MODES 1, 2, and 3 (above P-11), with any main steam 

valve open, when a secondary side break or stuck open 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-25 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

valve could result in the rapid depressurization of the steam 

lines. This signal may be manually blocked by the operator 

below the P-11 setpoint. Below P-11, an inside containment 

SLB will be terminated by automatic actuation via 

Containment Pressure - High 2. Stuck valve transients and 

outside containment SLBs will be terminated by the Steam 

Line Pressure - Negative Rate - High signal for Steam Line 

Isolation below P-11 when SI has been manually blocked. 

The Steam Line Isolation Function is required in MODES 2 

and 3 unless all MSIVs are closed and [de-activated]. This 

Function is not required to be OPERABLE in MODES 4, 5, 

and 6 because there is insufficient energy in the secondary 

side of the unit to have an accident.

(2) Steam Line Pressure - Negative Rate – High

Steam Line Pressure - Negative Rate - High provides 

closure of the MSIVs for a SLB when less than the P-11 

setpoint, to maintain at least one unfaulted SG as a heat 

sink for the reactor, and to limit the mass and energy 

release to containment. When the operator manually blocks 

the Steam Line Pressure - Low main steam isolation signal 

when less than the P-11 setpoint, the Steam Line Pressure -

Negative Rate - High signal is automatically enabled. 

Steam Line Pressure - Negative Rate - High provides no 

input to any control functions. Thus, three OPERABLE 

channels are sufficient to satisfy requirements with a twoout-of-three logic on each steam line.

Steam Line Pressure - Negative Rate - High must be 

OPERABLE in MODE 3 when less than the P-11 setpoint, 

when a secondary side break or stuck open valve could 

result in the rapid depressurization of the steam line(s). In 

MODES 1 and 2, and in MODE 3, when above the P-11 

setpoint, this signal is automatically disabled and the Steam 

Line Pressure - Low signal is automatically enabled. The 

Steam Line Isolation Function is required to be OPERABLE 

in MODES 2 and 3 unless all MSIVs are closed and [deactivated]. In MODES 4, 5, and 6, there is insufficient 

energy in the primary and secondary sides to have a SLB or 

other accident that would result in a release of significant 

enough quantities of energy to cause a cooldown of the 

RCS.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-26 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

While the transmitters may experience elevated ambient 

temperatures due to a SLB, the trip function is based on rate 

of change, not the absolute accuracy of the indicated steam 

pressure. Therefore, the [NTSP] reflects only steady state

instrument uncertainties.

e, f. Steam Line Isolation - High Steam Flow in Two Steam Lines 

Coincident with Tavg - Low Low or Coincident With Steam Line 

Pressure - Low (Three and Four Loop Units)

These Functions (4.e and 4.f) provide closure of the MSIVs 

during a SLB or inadvertent opening of an SG relief or a safety 

valve, to maintain at least one unfaulted SG as a heat sink for 

the reactor and to limit the mass and energy release to 

containment.

These Functions were discussed previously as Functions 1.f. 

and 1.g.

These Functions must be OPERABLE in MODES 1 and 2, and in 

MODE 3, when a secondary side break or stuck open valve 

could result in the rapid depressurization of the steam lines 

unless all MSIVs are closed and [de-activated]. These Functions 

are not required to be OPERABLE in MODES 4, 5, and 6 

because there is insufficient energy in the secondary side of the 

unit to have an accident.

g. Steam Line Isolation - High Steam Flow Coincident With Safety 

Injection and Coincident With Tavg - Low Low (Two Loop Units)

This Function provides closure of the MSIVs during a SLB or 

inadvertent opening of an SG relief or safety valve to maintain at 

least one unfaulted SG as a heat sink for the reactor, and to limit 

the mass and energy release to containment.

Two steam line flow channels per steam line are required 

OPERABLE for this Function. These are combined in a one-outof-two logic to indicate high steam flow in one steam line. The 

steam flow transmitters provide control inputs, but the control 

function cannot cause the events that the function must protect 

against. Therefore, two channels are sufficient to satisfy 

redundancy requirements. The one-out-of-two configuration 

allows online testing because trip of one high steam flow channel 

is not sufficient to cause initiation.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-27 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The High Steam Flow Allowable Value is a ∆P corresponding to 

25% of full steam flow at no load steam pressure. The Trip 

Setpoint is similarly calculated.

With the transmitters (d/p cells) typically located inside the steam 

tunnels, it is possible for them to experience adverse 

environmental conditions during a SLB event. Therefore, the 

[NTSP] reflect both steady state and adverse environmental 

instrument uncertainties.

The main steam line isolates only if the high steam flow signal 

occurs coincident with a SI and low low RCS average 

temperature. The Main Steam Line Isolation Function 

requirements for the SI Functions are the same as the 

requirements for their SI function. Therefore, the requirements 

are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is 

referenced for all initiating functions and requirements.

Two channels of Tavg per loop are required to be OPERABLE. 

The Tavg channels are combined in a logic such that two 

channels tripped cause a trip for the parameter. The accidents 

that this Function protects against cause reduction of Tavg in the 

entire primary system. Therefore, the provision of two 

OPERABLE channels per loop in a two-out-of-four configuration 

ensures no single random failure disables the Tavg - Low Low 

Function. The Tavg channels provide control inputs, but the 

control function cannot initiate events that the Function acts to 

mitigate. Therefore, additional channels are not required to 

address control protection interaction issues.

With the Tavg resistance temperature detectors (RTDs) located 

inside the containment, it is possible for them to experience 

adverse environmental conditions during an SLB event. 

Therefore, the [NTSP] reflects both steady state and adverse 

environmental instrumental uncertainties.

This Function must be OPERABLE in MODES 1 and 2, and in 

MODE 3, when above the P-12 setpoint, when a secondary side 

break or stuck open valve could result in rapid depressurization 

of the steam lines. Below P-12 this Function is not required to 

be OPERABLE because the High High Steam Flow coincident 

with SI Function provides the required protection. The Steam 

Line Isolation Function is required to be OPERABLE in 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-28 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

MODES 2 and 3 unless all MSIVs are closed and [de-activated]. 

This Function is not required to be OPERABLE in MODES 4, 5, 

and 6 because there is insufficient energy in the secondary side 

of the unit to have an accident.

h. Steam Line Isolation - High High Steam Flow Coincident With 

Safety Injection (Two Loop Units)

This Function provides closure of the MSIVs during a steam line 

break (or inadvertent opening of a relief or safety valve) to

maintain at least one unfaulted SG as a heat sink for the reactor, 

and to limit the mass and energy release to containment.

Two steam line flow channels per steam line are required to be 

OPERABLE for this Function. These are combined in a one-outof-two logic to indicate high steam flow in one steam line. The 

steam flow transmitters provide control inputs, but the control 

function cannot cause the events that the Function must protect 

against. Therefore, two channels are sufficient to satisfy 

redundancy requirements.

The Allowable Value for high steam flow is a ∆P, corresponding 

to 130% of full steam flow at full steam pressure. The Trip 

Setpoint is similarly calculated.

With the transmitters typically located inside the steam tunnels, it 

is possible for them to experience adverse environmental 

conditions during a SLB event. Therefore, the [NTSP] reflects 

both steady state and adverse environmental instrument 

uncertainties.

The main steam lines isolate only if the high steam flow signal 

occurs coincident with a SI signal. The Main Steam Line 

Isolation Function requirements for the SI Functions are the 

same as the requirements for their SI function. Therefore, the 

requirements are not repeated in Table 3.3.2-1. Instead, 

Function 1, SI, is referenced for all initiating functions and 

requirements.

This Function must be OPERABLE in MODES 1, 2, and 3 when 

a secondary side break or stuck open valve could result in rapid 

depressurization of the steam lines unless all MSIVs are closed 

and [de-activated]. This Function is not required to be 

OPERABLE in MODES 4, 5, and 6 because there is insufficient 

energy in the secondary side of the unit to have an accident.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-29 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

5. Turbine Trip and Feedwater Isolation

The primary functions of the Turbine Trip and Feedwater Isolation 

signals are to prevent damage to the turbine due to water in the 

steam lines, and to stop the excessive flow of feedwater into the 

SGs. These Functions are necessary to mitigate the effects of a high 

water level in the SGs, which could result in carryover of water into 

the steam lines and excessive cooldown of the primary system. The 

SG high water level is due to excessive feedwater flows.

The Function is actuated when the level in any SG exceeds the high 

high setpoint, and performs the following functions:

 Trips the main turbine,

 Trips the MFW pumps,

 Initiates feedwater isolation, and

 Shuts the MFW regulating valves and the bypass feedwater 

regulating valves.

This Function is actuated by SG Water Level - High High, or by a SI 

signal. The RTS also initiates a turbine trip signal whenever a 

reactor trip (P-4) is generated. In the event of SI, the unit is taken off 

line and the turbine generator must be tripped. The MFW System is 

also taken out of operation and the AFW System is automatically 

started. The SI signal was discussed previously.

a. Turbine Trip and Feedwater Isolation - Automatic Actuation Logic 

and Actuation Relays

Automatic Actuation Logic and Actuation Relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

b. Turbine Trip and Feedwater Isolation - Steam Generator Water 

Level - High High (P-14)

This signal provides protection against excessive feedwater flow. 

The ESFAS SG water level instruments provide input to the SG 

Water Level Control System. Therefore, the actuation logic must 

be able to withstand both an input failure to the control system 

(which may then require the protection function actuation) and a 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-30 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

single failure in the other channels providing the protection 

function actuation. Thus, four OPERABLE channels are required

to satisfy the requirements with a two-out-of-four logic. For units 

that have dedicated protection and control channels, only three 

protection channels are necessary to satisfy the protective 

requirements. For other units that have only three channels, a 

median signal selector is provided or justification is provided in 

NUREG-1218 (Ref. 8).

The transmitters (d/p cells) are located inside containment. 

However, the events that this Function protects against cannot 

cause a severe environment in containment. Therefore, the 

[NTSP] reflects only steady state instrument uncertainties.

c. Turbine Trip and Feedwater Isolation - Safety Injection

Turbine Trip and Feedwater Isolation is also initiated by all 

Functions that initiate SI. The Feedwater Isolation Function 

requirements for these Functions are the same as the 

requirements for their SI function. Therefore, the requirements 

are not repeated in Table 3.3.2-1. Instead Function 1, SI, is 

referenced for all initiating functions and requirements.

Turbine Trip and Feedwater Isolation Functions must be OPERABLE 

in MODES 1 and 2 [and 3] except when all MFIVs, MFRVs, [and 

associated bypass valves] are closed and [de-activated] [or isolated 

by a closed manual valve] when the MFW System is in operation and 

the turbine generator may be in operation. In MODES [3,] 4, 5, 

and 6, the MFW System and the turbine generator are not in service 

and this Function is not required to be OPERABLE.

6. Auxiliary Feedwater

The AFW System is designed to provide a secondary side heat sink 

for the reactor in the event that the MFW System is not available. 

The system has two motor driven pumps and a turbine driven pump, 

making it available during normal unit operation, during a loss of AC 

power, a loss of MFW, and during a Feedwater System pipe break. 

The normal source of water for the AFW System is the condensate 

storage tank (CST) (normally not safety related). A low level in the 

CST will automatically realign the pump suctions to the Essential 

Service Water (ESW) System (safety related). The AFW System is 

aligned so that upon a pump start, flow is initiated to the respective 

SGs immediately.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-31 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

a. Auxiliary Feedwater - Automatic Actuation Logic and Actuation 

Relays (Solid State Protection System)

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

b. Auxiliary Feedwater - Automatic Actuation Logic and Actuation 

Relays (Balance of Plant ESFAS)

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

c. Auxiliary Feedwater - Steam Generator Water Level - Low Low

SG Water Level - Low Low provides protection against a loss of 

heat sink. A feed line break, inside or outside of containment, or 

a loss of MFW, would result in a loss of SG water level. SG 

Water Level - Low Low provides input to the SG Level Control 

System. Therefore, the actuation logic must be able to withstand 

both an input failure to the control system which may then 

require a protection function actuation and a single failure in the 

other channels providing the protection function actuation. Thus, 

four OPERABLE channels are required to satisfy the 

requirements with two-out-of-four logic. For units that have 

dedicated protection and control channels, only three protection 

channels are necessary to satisfy the protective requirements. 

For other units that have only three channels, a median signal 

selector is provided or justification is provided in Reference 8.

With the transmitters (d/p cells) located inside containment and 

thus possibly experiencing adverse environmental conditions 

(feed line break), the [NTSP] reflects the inclusion of both steady 

state and adverse environmental instrument uncertainties.

d. Auxiliary Feedwater - Safety Injection

A SI signal starts the motor driven and turbine driven AFW 

pumps. The AFW initiation functions are the same as the 

requirements for their SI function. Therefore, the requirements 

are not repeated in Table 3.3.2-1. Instead, Function 1, SI, is 

referenced for all initiating functions and requirements.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-32 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

e. Auxiliary Feedwater - Loss of Offsite Power

A loss of offsite power to the service buses will be accompanied 

by a loss of reactor coolant pumping power and the subsequent 

need for some method of decay heat removal. The loss of offsite 

power is detected by a voltage drop on each service bus. Loss 

of power to either service bus will start the turbine driven AFW 

pumps to ensure that at least one SG contains enough water to 

serve as the heat sink for reactor decay heat and sensible heat 

removal following the reactor trip.

Functions 6.a through 6.e must be OPERABLE in MODES 1, 2, 

and 3 to ensure that the SGs remain the heat sink for the reactor. 

SG Water Level - Low Low in any operating SG will cause the motor 

driven AFW pumps to start. The system is aligned so that upon a 

start of the pump, water immediately begins to flow to the SGs. SG 

Water Level - Low Low in any two operating SGs will cause the 

turbine driven pumps to start. These Functions do not have to be 

OPERABLE in MODES 5 and 6 because there is not enough heat 

being generated in the reactor to require the SGs as a heat sink. In 

MODE 4, AFW actuation does not need to be OPERABLE because 

either AFW or residual heat removal (RHR) will already be in 

operation to remove decay heat or sufficient time is available to 

manually place either system in operation.

f. Auxiliary Feedwater - Undervoltage Reactor Coolant Pump

A loss of power on the buses that provide power to the RCPs 

provides indication of a pending loss of RCP forced flow in the 

RCS. The Undervoltage RCP Function senses the voltage 

downstream of each RCP breaker. A loss of power, or an open 

RCP breaker, on two or more RCPs, will start the turbine driven 

AFW pump to ensure that at least one SG contains enough 

water to serve as the heat sink for reactor decay heat and 

sensible heat removal following the reactor trip.

g. Auxiliary Feedwater - Trip of All Main Feedwater Pumps

A Trip of all MFW pumps is an indication of a loss of MFW and 

the subsequent need for some method of decay heat and 

sensible heat removal to bring the reactor back to no load 

temperature and pressure. A turbine driven MFW pump is 

equipped with two pressure switches on the control air/oil line for 

the speed control system. A low pressure signal from either of 

these pressure switches indicates a trip of that pump. Motor 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-33 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

driven MFW pumps are equipped with a breaker position sensing 

channel. An open supply breaker indicates that the pump is not 

running. Two OPERABLE channels per pump satisfy 

redundancy requirements with one-out-of-two taken twice logic. 

A trip of all MFW pumps starts the motor driven and turbine 

driven AFW pumps to ensure that at least one SG is available 

with water to act as the heat sink for the reactor.

Functions 6.f and 6.g must be OPERABLE in MODES 1 and 2. This 

ensures that at least one SG is provided with water to serve as the 

heat sink to remove reactor decay heat and sensible heat in the 

event of an accident. In MODES 3, 4, and 5, the RCPs and MFW

pumps may be normally shut down, and thus neither pump trip is 

indicative of a condition requiring automatic AFW initiation.

h. Auxiliary Feedwater - Pump Suction Transfer on Suction 

Pressure – Low

A low pressure signal in the AFW pump suction line protects the 

AFW pumps against a loss of the normal supply of water for the 

pumps, the CST. Two pressure switches are located on the 

AFW pump suction line from the CST. A low pressure signal 

sensed by any one of the switches will cause the emergency 

supply of water for both pumps to be aligned, or cause the AFW 

pumps to stop until the emergency source of water is aligned. 

ESW (safety grade) is then lined up to supply the AFW pumps to 

ensure an adequate supply of water for the AFW System to 

maintain at least one of the SGs as the heat sink for reactor 

decay heat and sensible heat removal.

Since the detectors are located in an area not affected by HELBs 

or high radiation, they will not experience any adverse 

environmental conditions and the [NTSP] reflects only steady 

state instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 to 

ensure a safety grade supply of water for the AFW System to 

maintain the SGs as the heat sink for the reactor. This Function 

does not have to be OPERABLE in MODES 5 and 6 because 

there is not enough heat being generated in the reactor to 

require the SGs as a heat sink. In MODE 4, AFW automatic 

suction transfer does not need to be OPERABLE because RHR 

will already be in operation, or sufficient time is available to place 

RHR in operation, to remove decay heat.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-34 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

7. Automatic Switchover to Containment Sump

At the end of the injection phase of a LOCA, the RWST will be nearly 

empty. Continued cooling must be provided by the ECCS to remove 

decay heat. The source of water for the ECCS pumps is 

automatically switched to the containment recirculation sump. The 

low head residual heat removal (RHR) pumps and containment spray 

pumps draw the water from the containment recirculation sump, the 

RHR pumps pump the water through the RHR heat exchanger, inject 

the water back into the RCS, and supply the cooled water to the 

other ECCS pumps. Switchover from the RWST to the containment

sump must occur before the RWST empties to prevent damage to 

the RHR pumps and a loss of core cooling capability. For similar 

reasons, switchover must not occur before there is sufficient water in 

the containment sump to support ESF pump suction. Furthermore, 

early switchover must not occur to ensure that sufficient borated 

water is injected from the RWST. This ensures the reactor remains 

shut down in the recirculation mode.

a. Automatic Switchover to Containment Sump - Automatic 

Actuation Logic and Actuation Relays

Automatic actuation logic and actuation relays consist of the 

same features and operate in the same manner as described for 

ESFAS Function 1.b.

b, c. Automatic Switchover to Containment Sump - Refueling Water 

Storage Tank (RWST) Level - Low Low Coincident With Safety 

Injection and Coincident With Containment Sump Level – High

During the injection phase of a LOCA, the RWST is the source of 

water for all ECCS pumps. A low low level in the RWST 

coincident with a SI signal provides protection against a loss of 

water for the ECCS pumps and indicates the end of the injection 

phase of the LOCA. The RWST is equipped with four level 

transmitters. These transmitters provide no control functions. 

Therefore, a two-out-of-four logic is adequate to initiate the 

protection function actuation. Although only three channels 

would be sufficient, a fourth channel has been added for 

increased reliability.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-35 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The RWST - Low Low Allowable Value/Trip Setpoint has both 

upper and lower limits. The lower limit is selected to ensure 

switchover occurs before the RWST empties, to prevent ECCS 

pump damage. The upper limit is selected to ensure enough 

borated water is injected to ensure the reactor remains shut 

down. The high limit also ensures adequate water inventory in 

the containment sump to provide ECCS pump suction.

The transmitters are located in an area not affected by HELBs or 

post accident high radiation. Thus, they will not experience any 

adverse environmental conditions and the [NTSP] reflects only 

steady state instrument uncertainties.

Automatic switchover occurs only if the RWST low low level 

signal is coincident with SI. This prevents accidental switchover 

during normal operation. Accidental switchover could damage 

ECCS pumps if they are attempting to take suction from an 

empty sump. The automatic switchover Function requirements 

for the SI Functions are the same as the requirements for their SI 

function. Therefore, the requirements are not repeated in 

Table 3.3.2-1. Instead, Function 1, SI, is referenced for all 

initiating Functions and requirements.

---------------------------------------REVIEWER’S NOTE-------------------------------

In some units, additional protection from spurious switchover is provided 

by requiring a Containment Sump Level - High signal as well as RWST 

Level - Low Low and SI. This ensures sufficient water is available in 

containment to support the recirculation phase of the accident. A 

Containment Sump Level - High signal must be present, in addition to the 

SI signal and the RWST Level - Low Low signal, to transfer the suctions 

of the RHR pumps to the containment sump. The containment sump is 

equipped with four level transmitters. These transmitters provide no 

control functions. Therefore, a two-out-of-four logic is adequate to initiate 

the protection function actuation. Although only three channels would be 

sufficient, a fourth channel has been added for increased reliability. The 

containment sump level Trip Setpoint/Allowable Value is selected to 

ensure enough borated water is injected to ensure the reactor remains 

shut down. The high limit also ensures adequate water inventory in the 

containment sump to provide ECCS pump suction. The transmitters are 

located inside containment and thus possibly experience adverse 

environmental conditions. Therefore, the [NTSP] reflects the inclusion of 

both steady state and environmental instrument uncertainties.

Units only have one of the Functions, 7.b or 7.c.

--------------------------------------------------------------------------------------------------
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-36 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

These Functions must be OPERABLE in MODES 1, 2, 3, and 4 

when there is a potential for a LOCA to occur, to ensure a 

continued supply of water for the ECCS pumps. These 

Functions are not required to be OPERABLE in MODES 5 and 6 

because there is adequate time for the operator to evaluate unit 

conditions and respond by manually starting systems, pumps, 

and other equipment to mitigate the consequences of an 

abnormal condition or accident. System pressure and 

temperature are very low and many ESF components are 

administratively locked out or otherwise prevented from actuating 

to prevent inadvertent overpressurization of unit systems.

8. Engineered Safety Feature Actuation System Interlocks

To allow some flexibility in unit operations, several interlocks are 

included as part of the ESFAS. These interlocks permit the operator 

to block some signals, automatically enable other signals, prevent 

some actions from occurring, and cause other actions to occur. The 

interlock Functions back up manual actions to ensure bypassable 

functions are in operation under the conditions assumed in the safety 

analyses.

a. Engineered Safety Feature Actuation System Interlocks -

Reactor Trip, P-4

The P-4 interlock is enabled when a reactor trip breaker (RTB) 

and its associated bypass breaker is open. Once the P-4 

interlock is enabled, automatic SI initiation is blocked after a 

[ ] second time delay. This Function allows operators to take 

manual control of SI systems after the initial phase of injection is 

complete. Once SI is blocked, automatic actuation of SI cannot 

occur until the RTBs have been manually closed. The functions 

of the P-4 interlock are:

 Trip the main turbine,

 Isolate MFW with coincident low Tavg,

 Prevent reactuation of SI after a manual reset of SI,

 Transfer the steam dump from the load rejection controller 

to the unit trip controller, and

 Prevent opening of the MFW isolation valves if they were 

closed on SI or SG Water Level - High High.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-37 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Each of the above Functions is interlocked with P-4 to avert or 

reduce the continued cooldown of the RCS following a reactor 

trip. An excessive cooldown of the RCS following a reactor trip 

could cause an insertion of positive reactivity with a subsequent 

increase in generated power. To avoid such a situation, the 

noted Functions have been interlocked with P-4 as part of the 

design of the unit control and protection system.

None of the noted Functions serves a mitigation function in the 

unit licensing basis safety analyses. Only the turbine trip 

Function is explicitly assumed since it is an immediate 

consequence of the reactor trip Function. Neither turbine trip, 

nor any of the other four Functions associated with the reactor 

trip signal, is required to show that the unit licensing basis safety 

analysis acceptance criteria are not exceeded.

The RTB position switches that provide input to the P-4 interlock 

only function to energize or de-energize or open or close 

contacts. Therefore, this Function has no adjustable trip setpoint 

with which to associate a [NTSP] and Allowable Value.

This Function must be OPERABLE in MODES 1, 2, and 3 when 

the reactor may be critical or approaching criticality. This 

Function does not have to be OPERABLE in MODE 4, 5, or 6 

because the main turbine, the MFW System, and the Steam 

Dump System are not in operation.

b. Engineered Safety Feature Actuation System Interlocks -

Pressurizer Pressure, P-11

The P-11 interlock permits a normal unit cooldown and 

depressurization without actuation of SI or main steam line 

isolation. With two-out-of-three pressurizer pressure channels 

(discussed previously) less than the P-11 setpoint, the operator 

can manually block the Pressurizer Pressure - Low and Steam 

Line Pressure - Low SI signals and the Steam Line Pressure -

Low steam line isolation signal (previously discussed). When the 

Steam Line Pressure - Low steam line isolation signal is

manually blocked, a main steam isolation signal on Steam Line 

Pressure - Negative Rate - High is enabled. This provides 

protection for an SLB by closure of the MSIVs. With two-out-ofthree pressurizer pressure channels above the P-11 setpoint, the

Pressurizer Pressure - Low and Steam Line Pressure - Low SI 

signals and the Steam Line Pressure - Low steam line isolation

signal are automatically enabled. The operator can also enable
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-38 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

these trips by use of the respective manual reset buttons. When 

the Steam Line Pressure - Low steam line isolation signal is 

enabled, the main steam isolation on Steam Line Pressure -

Negative Rate - High is disabled. The [NTSP] reflects only 

steady state instrument uncertainties.

This Function must be OPERABLE in MODES 1, 2, and 3 to 

allow an orderly cooldown and depressurization of the unit 

without the actuation of SI or main steam isolation. This 

Function does not have to be OPERABLE in MODE 4, 5, or 6 

because system pressure must already be below the P-11 

setpoint for the requirements of the heatup and cooldown curves 

to be met.

c. Engineered Safety Feature Actuation System Interlocks - Tavg -

Low Low, P-12

On increasing reactor coolant temperature, the P-12 interlock 

reinstates SI on High Steam Flow Coincident With Steam Line 

Pressure - Low or Coincident With Tavg - Low Low and provides 

an arming signal to the Steam Dump System. On decreasing 

reactor coolant temperature, the P-12 interlock allows the 

operator to manually block SI on High Steam Flow Coincident 

With Steam Line Pressure - Low or Coincident with Tavg - Low 

Low. On a decreasing temperature, the P-12 interlock also 

removes the arming signal to the Steam Dump System to 

prevent an excessive cooldown of the RCS due to a 

malfunctioning Steam Dump System.

Since Tavg is used as an indication of bulk RCS temperature, this 

Function meets redundancy requirements with one OPERABLE 

channel in each loop. In three loop units, these channels are 

used in two-out-of-three logic. In four loop units, they are used in 

two-out-of-four logic.

This Function must be OPERABLE in MODES 1, 2, and 3 when 

a secondary side break or stuck open valve could result in the 

rapid depressurization of the steam lines. This Function does 

not have to be OPERABLE in MODE 4, 5, or 6 because there is 

insufficient energy in the secondary side of the unit to have an 

accident.

The ESFAS instrumentation satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-39 Rev. 4.0

BASES

ACTIONS ----------------------------REVIEWER’S NOTE------------------------------------------

In Table 3.3.2-1, Functions 7.b and 7.c were not included in the generic 

evaluations approved in either WCAP-10271, as supplemented, 

WCAP-15376 or WCAP-14333. In order to apply the WCAP-10271, as 

supplemented, and WCAP-15376 or WCAP-14333 TS relaxations to plant 

specific Functions not evaluated generically, licensees must submit plant 

specific evaluations for NRC review and approval.

--------------------------------------------------------------------------------------------------

A Note has been added in the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed on Table 3.3.2-1.

In the event a channel's [NTSP] is found nonconservative with respect to 

the Allowable Value, or the channel is not functioning as required, or the 

transmitter, instrument Loop, signal processing electronics, or bistable is 

found inoperable, then all affected Functions provided by that channel 

must be declared inoperable and the LCO Condition(s) entered for the 

protection Function(s) affected. When the Required Channels in 

Table 3.3.2-1 are specified (e.g., on a per steam line, per loop, per SG, 

etc., basis), then the Condition may be entered separately for each steam 

line, loop, SG, etc., as appropriate.

When the number of inoperable channels in a trip function exceed those 

specified in one or other related Conditions associated with a trip function, 

then the unit is outside the safety analysis. Therefore, LCO 3.0.3 should 

be immediately entered if applicable in the current MODE of operation.

----------------------------REVIEWER’S NOTE------------------------------------------

Certain LCO Completion Times are based on approved topical reports. In 

order for a licensee to use these times, the licensee must justify the 

Completion Times as required by the staff Safety Evaluation Report 

(SER) for the topical report.

--------------------------------------------------------------------------------------------------

A.1

Condition A applies to all ESFAS protection functions.

Condition A addresses the situation where one or more channels or trains 

for one or more Functions are inoperable at the same time. The Required 

Action is to refer to Table 3.3.2-1 and to take the Required Actions for the 

protection functions affected. The Completion Times are those from the 

referenced Conditions and Required Actions.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-40 Rev. 4.0

BASES

ACTIONS (continued)

B.1, B.2.1, and B.2.2

Condition B applies to manual initiation of:

 SI,

 Containment Spray,

 Phase A Isolation, and

 Phase B Isolation.

This action addresses the train orientation of the SSPS for the functions 

listed above. If a channel or train is inoperable, 24 hours is allowed to 

return it to an OPERABLE status. Note that for containment spray and 

Phase B isolation, failure of one or both channels in one train renders the 

train inoperable. Condition B, therefore, encompasses both situations. 

The specified Completion Time is reasonable considering that there are 

two automatic actuation trains and another manual initiation train 

OPERABLE for each Function, and the low probability of an event 

occurring during this interval. If the train cannot be restored to 

OPERABLE status, the unit must be placed in a MODE in which the LCO 

does not apply. This is done by placing the unit in at least MODE 3 within 

an additional 6 hours (54 hours total time) and in MODE 5 within an 

additional 30 hours (84 hours total time). The allowable Completion 

Times are reasonable, based on operating experience, to reach the 

required unit conditions from full power conditions in an orderly manner 

and without challenging unit systems.

C.1, C.2.1, and C.2.2

Condition C applies to the automatic actuation logic and actuation relays 

for the following functions:

 SI,

 Containment Spray,

 Phase A Isolation,

 Phase B Isolation, and

 Automatic Switchover to Containment Sump.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-41 Rev. 4.0

BASES

ACTIONS (continued)

This action addresses the train orientation of the SSPS and the master 

and slave relays. If one train is inoperable, 24 hours are allowed to 

restore the train to OPERABLE status. The 24 hours allowed for 

restoring the inoperable train to OPERABLE status is justified in 

Reference 9. The specified Completion Time is reasonable considering 

that there is another train OPERABLE, and the low probability of an event 

occurring during this interval. If the train cannot be restored to 

OPERABLE status, the unit must be placed in a MODE in which the LCO 

does not apply. This is done by placing the unit in at least MODE 3 within 

an additional 6 hours (30 hours total time) and in MODE 5 within an 

additional 30 hours (60 hours total time). The Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems.

The Required Actions are modified by a Note that allows one train to be 

bypassed for up to [4] hours for surveillance testing, provided the other 

train is OPERABLE. This allowance is based on the reliability analysis 

assumption of WCAP-10271-P-A (Ref. 10) that 4 hours is the average 

time required to perform train surveillance.

D.1, D.2.1, and D.2.2

Condition D applies to:

 Containment Pressure - High 1,

 Pressurizer Pressure - Low (two, three, and four loop units),

 Steam Line Pressure - Low,

 Steam Line Differential Pressure - High,

 High Steam Flow in Two Steam Lines Coincident With Tavg - Low Low 

or Coincident With Steam Line Pressure - Low,

 Containment Pressure - High 2,

 Steam Line Pressure - Negative Rate - High,

 High Steam Flow Coincident With Safety Injection Coincident With 

Tavg - Low Low,
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-42 Rev. 4.0

BASES

ACTIONS (continued)

 High High Steam Flow Coincident With Safety Injection,

 High Steam Flow in Two Steam Lines Coincident With Tavg - Low

Low,

 SG Water level - Low Low (two, three, and four loop units), and

 [SG Water level - High High (P-14) (two, three, and four loop units). ]

If one channel is inoperable, 72 hours are allowed to restore the channel 

to OPERABLE status or to place it in the tripped condition. Generally this 

Condition applies to functions that operate on two-out-of-three logic. 

Therefore, failure of one channel places the Function in a two-out-of-two 

configuration. One channel must be tripped to place the Function in a 

one-out-of-three configuration that satisfies redundancy requirements. 

The 72 hours allowed to restore the channel to OPERABLE status or to 

place it in the tripped condition is justified in Reference 9.

Failure to restore the inoperable channel to OPERABLE status or place it 

in the tripped condition within 72 hours requires the unit be placed in 

MODE 3 within the following 6 hours and MODE 4 within the next 

6 hours.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. In 

MODE 4, these Functions are no longer required OPERABLE.

[ The Required Actions are modified by a Note that allows the inoperable 

channel to be bypassed for up to 12 hours for surveillance testing of other 

channels. The 12 hours allowed for testing, are justified in Reference 9. ]

----------------------------REVIEWER’S NOTE------------------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 9.

--------------------------------------------------------------------------------------------------
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-43 Rev. 4.0

BASES

ACTIONS (continued)

E.1, E.2.1, and E.2.2

Condition E applies to:

 Containment Spray Containment Pressure - High 3 (High, High) (two, 

three, and four loop units), and

 Containment Phase B Isolation Containment Pressure - High 3 (High, 

High).

None of these signals has input to a control function. Thus, two-out-ofthree logic is necessary to meet acceptable protective requirements. 

However, a two-out-of-three design would require tripping a failed 

channel. This is undesirable because a single failure would then cause 

spurious containment spray initiation. Spurious spray actuation is 

undesirable because of the cleanup problems presented. Therefore, 

these channels are designed with two-out-of-four logic so that a failed 

channel may be bypassed rather than tripped. Note that one channel 

may be bypassed and still satisfy the single failure criterion. Furthermore, 

with one channel bypassed, a single instrumentation channel failure will 

not spuriously initiate containment spray.

To avoid the inadvertent actuation of containment spray and Phase B 

containment isolation, the inoperable channel should not be placed in the 

tripped condition. Instead it is bypassed. Restoring the channel to 

OPERABLE status, or placing the inoperable channel in the bypass 

condition within 72 hours, is sufficient to assure that the Function remains 

OPERABLE and minimizes the time that the Function may be in a partial 

trip condition (assuming the inoperable channel has failed high). The 

Completion Time is further justified based on the low probability of an 

event occurring during this interval. Failure to restore the inoperable 

channel to OPERABLE status, or place it in the bypassed condition within 

6 hours, requires the unit be placed in MODE 3 within the following 

6 hours and MODE 4 within the next 72 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required unit conditions from full power conditions in an orderly manner 

and without challenging unit systems. In MODE 4, these Functions are 

no longer required OPERABLE.

[ The Required Actions are modified by a Note that allows one additional 

channel to be bypassed for up to 12 hours for surveillance testing. 

Placing a second channel in the bypass condition for up to 12 hours for 

testing purposes is acceptable based on the results of Reference 9. ]
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-44 Rev. 4.0

BASES

ACTIONS (continued)

----------------------------REVIEWER’S NOTE------------------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 12 hour time limit is justified in Reference 9.

--------------------------------------------------------------------------------------------------

F.1, F.2.1, and F.2.2

Condition F applies to:

 Manual Initiation of Steam Line Isolation,

 Loss of Offsite Power,

 Auxiliary Feedwater Pump Suction Transfer on Suction Pressure -

Low, and

 P-4 Interlock.

For the Manual Initiation and the P-4 Interlock Functions, this action 

addresses the train orientation of the SSPS. For the Loss of Offsite 

Power Function, this action recognizes the lack of manual trip provision 

for a failed channel. For the AFW System pump suction transfer 

channels, this action recognizes that placing a failed channel in trip during 

operation is not necessarily a conservative action. Spurious trip of this 

function could align the AFW System to a source that is not immediately 

capable of supporting pump suction. If a train or channel is inoperable, 

48 hours is allowed to return it to OPERABLE status. The specified 

Completion Time is reasonable considering the nature of these Functions, 

the available redundancy, and the low probability of an event occurring 

during this interval. If the Function cannot be returned to OPERABLE 

status, the unit must be placed in MODE 3 within the next 6 hours and 

MODE 4 within the following 6 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power in an orderly manner and without challenging 

unit systems. In MODE 4, the unit does not have any analyzed transients 

or conditions that require the explicit use of the protection functions noted 

above.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-45 Rev. 4.0

BASES

ACTIONS (continued)

G.1, G.2.1, and G.2.2

Condition G applies to the automatic actuation logic and actuation relays 

for the Steam Line Isolation [Turbine Trip and Feedwater Isolation,] and 

AFW actuation Functions.

The action addresses the train orientation of the SSPS and the master 

and slave relays for these functions. If one train is inoperable, 24 hours 

are allowed to restore the train to OPERABLE status. The 24 hours 

allowed for restoring the inoperable train to OPERABLE status is justified 

in Reference 9. The Completion Time for restoring a train to OPERABLE 

status is reasonable considering that there is another train OPERABLE, 

and the low probability of an event occurring during this interval. If the 

train cannot be returned to OPERABLE status, the unit must be brought 

to MODE 3 within the next 6 hours and MODE 4 within the following 

6 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. 

Placing the unit in MODE 4 removes all requirements for OPERABILITY 

of the protection channels and actuation functions. In this MODE, the unit 

does not have analyzed transients or conditions that require the explicit 

use of the protection functions noted above.

The Required Actions are modified by a Note that allows one train to be 

bypassed for up to [4] hours for surveillance testing provided the other 

train is OPERABLE. This allowance is based on the reliability analysis 

(Ref. 10) assumption that 4 hours is the average time required to perform 

channel surveillance.

[ H.1 and H.2

Condition H applies to the automatic actuation logic and actuation relays 

for the Turbine Trip and Feedwater Isolation Function.

This action addresses the train orientation of the SSPS and the master 

and slave relays for this Function. If one train is inoperable, 24 hours are 

allowed to restore the train to OPERABLE status or the unit must be 

placed in MODE 3 within the following 6 hours. The 24 hours allowed for 

restoring the inoperable train to OPERABLE status is justified in 

Reference 9. The Completion Time for restoring a train to OPERABLE 

status is reasonable considering that there is another train OPERABLE, 

and the low probability of an event occurring during this interval. The 

allowed Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power conditions in an orderly 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-46 Rev. 4.0

BASES

ACTIONS (continued)

manner and without challenging unit systems. These Functions are no 

longer required in MODE 3. Placing the unit in MODE 3 removes all 

requirements for OPERABILITY of the protection channels and actuation 

functions. In this MODE, the unit does not have analyzed transients or 

conditions that require the explicit use of the protection functions noted 

above.

The Required Actions are modified by a Note that allows one train to be 

bypassed for up to [4] hours for surveillance testing provided the other 

train is OPERABLE. This allowance is based on the reliability analysis 

(Ref. 10) assumption that 4 hours is the average time required to perform 

channel surveillance. ]

I.1 and I.2

Condition I applies to:

 [ SG Water Level - High High (P-14) (two, three, and four loop units), 

and ]

 Undervoltage Reactor Coolant Pump.

If one channel is inoperable, 72 hours are allowed to restore one channel 

to OPERABLE status or to place it in the tripped condition. If placed in 

the tripped condition, the Function is then in a partial trip condition where 

one-out-of-two or one-out-of-three logic will result in actuation. Failure to 

restore the inoperable channel to OPERABLE status or place it in the 

tripped condition within 72 hours requires the unit to be placed in MODE 3 

within the following 6 hours. The allowed Completion Time of 78 hours is 

reasonable, based on operating experience, to reach MODE 3 from full 

power conditions in an orderly manner and without challenging unit 

systems. In MODE 3, these Functions are no longer required 

OPERABLE.

[ The Required Actions are modified by a Note that allows the inoperable 

channel to be bypassed for up to [12] hours for surveillance testing of 

other channels. The 72 hours allowed to place the inoperable channel in 

the tripped condition, and the 12 hours allowed for a second channel to 

be in the bypassed condition for testing, are justified in Reference 9. ]
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-47 Rev. 4.0

BASES

ACTIONS (continued)

----------------------------REVIEWER’S NOTE------------------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The 72 hours allowed to place the inoperable channel in the 

tripped condition, and the 12 hours allowed for a second channel to be in 

the bypassed condition for testing, are justified in Reference 9.

--------------------------------------------------------------------------------------------------

J.1 and J.2

Condition J applies to the AFW pump start on trip of all MFW pumps.

This action addresses the train orientation of the SSPS for the auto start 

function of the AFW System on loss of all MFW pumps. The 

OPERABILITY of the AFW System must be assured by allowing 

automatic start of the AFW System pumps. If a channel is inoperable, 

48 hours are allowed to return it to an OPERABLE status. If the function 

cannot be returned to an OPERABLE status, 6 hours are allowed to place 

the unit in MODE 3. The allowed Completion Time of 6 hours is 

reasonable, based on operating experience, to reach MODE 3 from full 

power conditions in an orderly manner and without challenging unit 

systems. In MODE 3, the unit does not have any analyzed transients or 

conditions that require the explicit use of the protection function noted 

above. The allowance of 48 hours to return the train to an OPERABLE 

status is justified in Reference 10.

K.1, K.2.1, and K.2.2

Condition K applies to:

 RWST Level - Low Low Coincident with Safety Injection, and

 RWST Level - Low Low Coincident with Safety Injection and 

Coincident with Containment Sump Level - High.

RWST Level - Low Low Coincident With SI and Coincident With 

Containment Sump Level - High provides actuation of switchover to the 

containment sump. Note that this Function requires the bistables to 

energize to perform their required action. The failure of up to two 

channels will not prevent the operation of this Function. However, placing 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-48 Rev. 4.0

BASES

ACTIONS (continued)

a failed channel in the tripped condition could result in a premature 

switchover to the sump, prior to the injection of the minimum volume from 

the RWST. Placing the inoperable channel in bypass results in a two-outof-three logic configuration, which satisfies the requirement to allow 

another failure without disabling actuation of the switchover when 

required. Restoring the channel to OPERABLE status or placing the 

inoperable channel in the bypass condition within [6] hours is sufficient to 

ensure that the Function remains OPERABLE, and minimizes the time 

that the Function may be in a partial trip condition (assuming the 

inoperable channel has failed high). The [6] hour Completion Time is 

justified in Reference 11. If the channel cannot be returned to 

OPERABLE status or placed in the bypass condition within 6 hours, the 

unit must be brought to MODE 3 within the following [6] hours and 

MODE 5 within the next 30 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems. In MODE 5, the unit does not have any 

analyzed transients or conditions that require the explicit use of the 

protection functions noted above.

[ The Required Actions are modified by a Note that allows placing a 

second channel in the bypass condition for up to [4] hours for surveillance 

testing. The total of [12] hours to reach MODE 3 and [4] hours for a 

second channel to be bypassed is acceptable based on the results of 

Reference 11.]

----------------------------REVIEWER’S NOTE------------------------------------------

The below text should be used for plants with installed bypass test 

capability:

The Required Actions are modified by a Note that allows placing one 

channel in bypass for up to 12 hours while performing routine surveillance 

testing. The channel to be tested can be tested in bypass with the 

inoperable channel also in bypass. The total of [12] hours to reach 

MODE 3 and [4] hours for a second channel to be bypassed is acceptable 

based on the results of Reference 11.

--------------------------------------------------------------------------------------------------

L.1, L.2.1, and L.2.2

Condition L applies to the P-11 and P-12 [and P-14] interlocks.

With one or more channels inoperable, the operator must verify that the 

interlock is in the required state for the existing unit condition. This action 

manually accomplishes the function of the interlock. Determination must 

be made within 1 hour. The 1 hour Completion Time is equal to the time 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-49 Rev. 4.0

BASES

ACTIONS (continued)

allowed by LCO 3.0.3 to initiate shutdown actions in the event of a 

complete loss of ESFAS function. If the interlock is not in the required

state (or placed in the required state) for the existing unit condition, the 

unit must be placed in MODE 3 within the next 6 hours and MODE 4 

within the following 6 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems. Placing the unit in MODE 4 removes all 

requirements for OPERABILITY of these interlocks.

SURVEILLANCE ----------------------------REVIEWER’S NOTE------------------------------------------

REQUIREMENTS In Table 3.3.2-1, Functions 7.b and 7.c were not included in the generic 

evaluations approved in either WCAP-10271, as supplemented, or 

WCAP-14333. In order to apply the WCAP-10271, as supplemented, and 

WCAP-14333 TS relaxations to plant specific Functions not evaluated 

generically, licensees must submit plant specific evaluations for NRC 

review and approval.

--------------------------------------------------------------------------------------------------

The SRs for each ESFAS Function are identified by the SRs column

of Table 3.3.2-1.

A Note has been added to the SR Table to clarify that Table 3.3.2-1 

determines which SRs apply to which ESFAS Functions.

Note that each channel of process protection supplies both trains of the 

ESFAS. When testing channel I, train A and train B must be examined. 

Similarly, train A and train B must be examined when testing channel II, 

channel III, and channel IV (if applicable). The CHANNEL CALIBRATION 

and COTs are performed in a manner that is consistent with the 

assumptions used in analytically calculating the required channel 

accuracies.

-----------------------------REVIEWER’S NOTE-----------------------------------------

Certain Frequencies are based on approved topical reports. In order for a 

licensee to use these times, the licensee must justify the Frequencies as 

required by the staff SER for the topical report.

--------------------------------------------------------------------------------------------------

SR 3.3.2.1

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-50 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION.

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and reliability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.2

SR 3.3.2.2 is the performance of an ACTUATION LOGIC TEST using the 

semiautomatic tester. The train being tested is placed in the bypass 

condition, thus preventing inadvertent actuation. Through the 

semiautomatic tester, all possible logic combinations, with and without 

applicable permissives, are tested for each protection function. In
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-51 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

addition, the master relay coil is pulse tested for continuity. This verifies 

that the logic modules are OPERABLE and that there is an intact voltage 

signal path to the master relay coils. [ The Frequency of every 92 days 

on a STAGGERED TEST BASIS is justified in Reference 12.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.3

SR 3.3.2.3 is the performance of an ACTUATION LOGIC TEST as 

described in SR 3.3.2.2, except that the semiautomatic tester is not used 

and the continuity check does not have to be performed, as explained in 

the Note. This SR is applied to the balance of plant actuation logic and 

relays that do not have the SSPS test circuits installed to utilize the 

semiautomatic tester or perform the continuity check. [ This test is also 

performed every 31 days on a STAGGERED TEST BASIS. The 

Frequency is adequate based on industry operating experience, 

considering instrument reliability and operating history data.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-52 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.4

SR 3.3.2.4 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 

large enough to demonstrate signal path continuity. The time allowed for 

the testing on a STAGGERED TEST BASIS (4 hours) is justified in 

Reference 12. [ The Frequency of 92 days is justified in Reference 10.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.5

SR 3.3.2.5 is the performance of a COT. The test is performed in 

accordance with the SCP. If the actual setting of the channel is found to 

be conservative with respect to the Allowable Value but is beyond the asfound tolerance band, the channel is OPERABLE but degraded. The 

degraded condition of the channel will be further evaluated during 

performance of the SR. This evaluation will consist of resetting the 

channel setpoint to the [NTSP] (within the allowed tolerance), and 

evaluating the channel response. If the channel is functioning as required 

and is expected to pass the next surveillance, then the channel is 

OPERABLE and can be restored to service at the completion of the 

surveillance. After the surveillance is completed, the channel as-found 

condition will be entered into the Corrective Action Program for further 

evaluation.

A COT is performed on each required channel to ensure the entire 

channel will perform the intended Function. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-53 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

[ The Frequency of 184 days is justified in Reference 12.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.6

SR 3.3.2.6 is the performance of a SLAVE RELAY TEST. The SLAVE 

RELAY TEST is the energizing of the slave relays. Contact operation is 

verified in one of two ways. Actuation equipment that may be operated in 

the design mitigation MODE is either allowed to function, or is placed in a 

condition where the relay contact operation can be verified without 

operation of the equipment. Actuation equipment that may not be 

operated in the design mitigation MODE is prevented from operation by

the SLAVE RELAY TEST circuit. For this latter case, contact operation is 

verified by a continuity check of the circuit containing the slave relay. 

[ The Frequency of 92 days is adequate, based on industry operating 

experience, considering instrument reliability and operating history data.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-54 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.2.7

SR 3.3.2.7 is the performance of a TADOT. This test is a check of the 

Loss of Offsite Power, Undervoltage RCP, and AFW Pump Suction 

Transfer on Suction Pressure - Low Functions. Each Function is tested 

up to, and including, the master transfer relay coils. A successful test of 

the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions.

The test also includes trip channels that provide actuation signals directly 

to the SSPS. The SR is modified by a Note that excludes verification of 

setpoints for relays. Relay setpoints require elaborate bench calibration

and are verified during CHANNEL CALIBRATION. [ The Frequency of 

92 days is adequate. It is based on industry operating experience, 

considering instrument reliability and operating history data.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-55 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.8

SR 3.3.2.8 is the performance of a TADOT. This test is a check of the 

Manual Actuation Functions and AFW pump start on trip of all MFW 

pumps. Each Manual Actuation Function is tested up to, and including, 

the master relay coils. A successful test of the required contact(s) of a 

channel relay may be performed by the verification of the change of state 

of a single contact of the relay. This clarifies what is an acceptable 

TADOT of a relay. This is acceptable because all of the other required 

contacts of the relay are verified by other Technical Specifications and 

non-Technical Specifications tests at least once per refueling interval with 

applicable extensions. In some instances, the test includes actuation of 

the end device (i.e., pump starts, valve cycles, etc.). [ The Frequency of 

18 months is adequate, based on industry operating experience and is 

consistent with the typical refueling cycle. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The test is performed in accordance with the SCP. If the actual setting of 

the channel is found to be conservative with respect to the Allowable 

Value but is beyond the as-found tolerance band, the channel is 

OPERABLE but degraded. The degraded condition of the channel will be 

further evaluated during performance of the SR. This evaluation will 

consist of resetting the channel setpoint to the [NTSP] (within the allowed 

tolerance), and evaluating the channel response. If the channel is 

functioning as required and is expected to pass the next surveillance, 

then the channel is OPERABLE and can be restored to service at the 

completion of the surveillance. After the surveillance is completed, the 

channel as-found condition will be entered into the Corrective Action 

Program for further evaluation.

The SR is modified by a Note that excludes verification of setpoints during 

the TADOT for manual initiation Functions. The manual initiation 

Functions have no associated setpoints.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-56 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.9

SR 3.3.2.9 is the performance of a CHANNEL CALIBRATION.

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to 

measured parameter within the necessary range and accuracy.

The test is performed in accordance with the SCP. If the actual setting of 

the channel is found to be conservative with respect to the Allowable 

Value but is beyond the as-found tolerance band, the channel is 

OPERABLE but degraded. The degraded condition of the channel will be 

further evaluated during performance of the SR. This evaluation will 

consist of resetting the channel setpoint to the [NTSP] (within the allowed 

tolerance), and evaluating the channel response. If the channel is 

functioning as required and is expected to pass the next surveillance, 

then the channel is OPERABLE and can be restored to service at the 

completion of the surveillance. After the surveillance is completed, the 

channel as-found condition will be entered into the Corrective Action 

Program for further evaluation.

[ The Frequency of [18] months is based on the assumption of an 

[18] month calibration interval in the determination of the magnitude of 

equipment drift in the setpoint methodology.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note stating that this test should include 

verification that the time constants are adjusted to the prescribed values 

where applicable.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-57 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.10

This SR ensures the individual channel ESF RESPONSE TIMES are less 

than or equal to the maximum values assumed in the accident analysis. 

Response Time testing acceptance criteria are included in the Technical 

Requirements Manual, Section 15 (Ref. 13). Individual component 

response times are not modeled in the analyses. The analyses model the 

overall or total elapsed time, from the point at which the parameter 

exceeds the Trip Setpoint value at the sensor, to the point at which the 

equipment in both trains reaches the required functional state (e.g., 

pumps at rated discharge pressure, valves in full open or closed position).

For channels that include dynamic transfer functions (e.g., lag, lead/lag, 

rate/lag, etc.), the response time test may be performed with the transfer 

functions set to one with the resulting measured response time compared 

to the appropriate FSAR response time. Alternately, the response time 

test can be performed with the time constants set to their nominal value 

provided the required response time is analytically calculated assuming 

the time constants are set at their nominal values. The response time 

may be measured by a series of overlapping tests such that the entire 

response time is measured.

-----------------------------REVIEWER’S NOTE-----------------------------------------

Applicable portions of the following Bases are applicable for plants 

adopting WCAP-13632-P-A (Ref. 14). and/or WCAP-14036-P (Ref. 15).

--------------------------------------------------------------------------------------------------

Response time may be verified by actual response time tests in any 

series of sequential, overlapping or total channel measurements, or by 

the summation of allocated sensor, signal processing and actuation logic 

response times with actual response time tests on the remainder of the 

channel. Allocations for sensor response times may be obtained from: 

(1) historical records based on acceptable response time tests (hydraulic, 

noise, or power interrupt tests), (2) in place, onsite, or offsite (e.g., 

vendor) test measurements, or (3) utilizing vendor engineering 

specifications. WCAP-13632-P-A, Revision 2, "Elimination of Pressure 

Sensor Response Time Testing Requirements," (Ref. 14) dated January 

1996, provides the basis and methodology for using allocated sensor 

response times in the overall verification of the channel response time for 

specific sensors identified in the WCAP. Response time verification for 

other sensor types must be demonstrated by test.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-58 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

WCAP-14036-P, Revision 1, "Elimination of Periodic Protection Channel 

Response Time Tests," (Ref. 15) provides the basis and methodology for 

using allocated signal processing and actuation logic response times in 

the overall verification of the protection system channel response time. 

The allocations for sensor, signal conditioning, and actuation logic 

response times must be verified prior to placing the component in 

operational service and re-verified following maintenance that may 

adversely affect response time. In general, electrical repair work does not 

impact response time provided the parts used for repair are of the same 

type and value. Specific components identified in the WCAP may be 

replaced without verification testing. One example where response time 

could be affected is replacing the sensing assembly of a transmitter.

[ ESF RESPONSE TIME tests are conducted on an [18] month 

STAGGERED TEST BASIS. Testing of the final actuation devices, which 

make up the bulk of the response time, is included in the testing of each 

channel. The final actuation device in one train is tested with each 

channel. Therefore, staggered testing results in response time 

verification of these devices every [18] months. The [18] month 

Frequency is consistent with the typical refueling cycle and is based on 

unit operating experience, which shows that random failures of 

instrumentation components causing serious response time degradation, 

but not channel failure, are infrequent occurrences.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note that clarifies that the turbine driven AFW 

pump is tested within 24 hours after reaching [1000] psig in the SGs.
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-59 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.2.11

SR 3.3.2.11 is the performance of a TADOT as described in SR 3.3.2.8, 

except that it is performed for the P-4 Reactor Trip Interlock, and the 

Frequency is once per RTB cycle. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable TADOT of a relay. This is acceptable because all of the other 

required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per 

refueling interval with applicable extensions. This Frequency is based on 

operating experience demonstrating that undetected failure of the P-4 

interlock sometimes occurs when the RTB is cycled.

The SR is modified by a Note that excludes verification of setpoints during 

the TADOT. The Function tested has no associated setpoint.

REFERENCES 1. Regulatory Guide 1.105, "Setpoint for Safety Related 

Instrumentation," Revision 3.

2. FSAR, Chapter [6].

3. FSAR, Chapter [7].

4. FSAR, Chapter [15].

5. IEEE-279-1971.

6. 10 CFR 50.49.

7. Plant-specific setpoint methodology study.

8. NUREG-1218, April 1988.

9. WCAP-14333-P-A, Rev. 1, October 1998.

10. WCAP-10271-P-A, Supplement 2, Rev. 1, June 1990.

11. [Plant specific evaluation reference.]

12. WCAP-15376, Rev. 0. October 2000.

13. Technical Requirements Manual, Section 15, "Response Times."
Engineered Safety Feature Actuation System (ESFAS) Instrumentation

(With Setpoint Control Program)

B 3.3.2B

Westinghouse STS B 3.3.2B-60 Rev. 4.0

BASES

REFERENCES (continued)

14. WCAP-13632-P-A, Revision 2, "Elimination of Pressure Sensor 

Response Time Testing Requirements," January 1996.

15. WCAP-14036-P, Revision 1, "Elimination of Periodic Protection 

Channel Response Time Tests," December 1995.
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.3 Post Accident Monitoring (PAM) Instrumentation

BASES

BACKGROUND The primary purpose of the PAM instrumentation is to display unit 

variables that provide information required by the control room operators 

during accident situations. This information provides the necessary 

support for the operator to take the manual actions for which no automatic 

control is provided and that are required for safety systems to accomplish 

their safety functions for Design Basis Accidents (DBAs).

The OPERABILITY of the accident monitoring instrumentation ensures 

that there is sufficient information available on selected unit parameters to 

monitor and to assess unit status and behavior following an accident.

The availability of accident monitoring instrumentation is important so that 

responses to corrective actions can be observed and the need for, and 

magnitude of, further actions can be determined. These essential 

instruments are identified by unit specific documents (Ref. 1) addressing 

the recommendations of Regulatory Guide 1.97 (Ref. 2) as required by 

Supplement 1 to NUREG-0737 (Ref. 3).

The instrument channels required to be OPERABLE by this LCO include 

two classes of parameters identified during unit specific implementation of 

Regulatory Guide 1.97 as Type A and Category I variables.

Type A variables are included in this LCO because they provide the 

primary information required for the control room operator to take specific 

manually controlled actions for which no automatic control is provided, 

and that are required for safety systems to accomplish their safety 

functions for DBAs. Because the list of Type A variables differs widely 

between units, Table 3.3.3-1 in the accompanying LCO contains no 

examples of Type A variables, except for those that may also be 

Category I variables.

Category I variables are the key variables deemed risk significant 

because they are needed to:

 Determine whether other systems important to safety are performing 

their intended functions,

 Provide information to the operators that will enable them to 

determine the likelihood of a gross breach of the barriers to 

radioactivity release, and
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-2 Rev. 4.0

BASES

BACKGROUND (continued)

 Provide information regarding the release of radioactive materials to 

allow for early indication of the need to initiate action necessary to 

protect the public, and to estimate the magnitude of any impending 

threat.

These key variables are identified by the unit specific Regulatory 

Guide 1.97 analyses (Ref. 1). These analyses identify the unit specific 

Type A and Category I variables and provide justification for deviating 

from the NRC proposed list of Category I variables.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Table 3.3.3-1 provides a list of variables typical of those identified by the 

unit specific Regulatory Guide 1.97 analyses. Table 3.3.3-1 in unit 

specific Technical Specifications (TS) shall list all Type A and Category I 

variables identified by the unit specific Regulatory Guide 1.97 analyses, 

as amended by the NRC's Safety Evaluation Report (SER).

--------------------------------------------------------------------------------------------------

The specific instrument Functions listed in Table 3.3.3-1 are discussed in 

the LCO section.

APPLICABLE The PAM instrumentation ensures the operability of Regulatory

SAFETY Guide 1.97 Type A and Category I variables so that the control room

ANALYSES operating staff can:

 Perform the diagnosis specified in the emergency operating 

procedures (these variables are restricted to preplanned actions for 

the primary success path of DBAs), e.g., loss of coolant accident 

(LOCA),

 Take the specified, pre-planned, manually controlled actions, for 

which no automatic control is provided, and that are required for 

safety systems to accomplish their safety function,

 Determine whether systems important to safety are performing their 

intended functions,

 Determine the likelihood of a gross breach of the barriers to 

radioactivity release,

 Determine if a gross breach of a barrier has occurred, and
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

 Initiate action necessary to protect the public and to estimate the 

magnitude of any impending threat.

PAM instrumentation that meets the definition of Type A in Regulatory 

Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category I, 

non-Type A, instrumentation must be retained in TS because it is 

intended to assist operators in minimizing the consequences of accidents. 

Therefore, Category I, non-Type A, variables are important for reducing 

public risk.

LCO The PAM instrumentation LCO provides OPERABILITY requirements for 

Regulatory Guide 1.97 Type A monitors, which provide information 

required by the control room operators to perform certain manual actions 

specified in the unit Emergency Operating Procedures. These manual 

actions ensure that a system can accomplish its safety function, and are 

credited in the safety analyses. Additionally, this LCO addresses 

Regulatory Guide 1.97 instruments that have been designated Category I, 

non-Type A.

The OPERABILITY of the PAM instrumentation ensures there is sufficient 

information available on selected unit parameters to monitor and assess 

unit status following an accident. This capability is consistent with the 

recommendations of Reference 1.

LCO 3.3.3 requires two OPERABLE channels for most Functions. Two 

OPERABLE channels ensure no single failure prevents operators from 

getting the information necessary for them to determine the safety status 

of the unit, and to bring the unit to and maintain it in a safe condition 

following an accident.

Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK 

during the post accident phase to confirm the validity of displayed 

information. More than two channels may be required at some units if the 

unit specific Regulatory Guide 1.97 analyses (Ref. 1) determined that 

failure of one accident monitoring channel results in information ambiguity 

(that is, the redundant displays disagree) that could lead operators to 

defeat or fail to accomplish a required safety function.

The exception to the two channel requirement is Penetration Flow Path 

Containment Isolation Valve (CIV) Position. In this case, the important 

information is the status of the containment penetrations. The LCO 

requires one position indicator for each active CIV. This is sufficient to 

redundantly verify the isolation status of each isolable penetration either 

via indicated status of the active valve and prior knowledge of a passive 
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-4 Rev. 4.0

BASES

LCO (continued)

valve, or via system boundary status. If a normally active CIV is known to 

be closed and deactivated, position indication is not needed to determine 

status. Therefore, the position indication for valves in this state is not 

required to be OPERABLE.

Table 3.3.3-1 provides a list of variables typical of those identified by the 

unit specific Regulatory Guide 1.97 (Ref. 1) analyses. Table 3.3.3-1 in 

unit specific TS should list all Type A and Category I variables identified 

by the unit specific Regulatory Guide 1.97 analyses, as amended by the 

NRC's SER.

Type A and Category I variables are required to meet Regulatory 

Guide 1.97 Category I (Ref. 2) design and qualification requirements for 

seismic and environmental qualification, single failure criterion, utilization 

of emergency standby power, immediately accessible display, continuous 

readout, and recording of display.

Listed below are discussions of the specified instrument Functions listed 

in Table 3.3.3-1. These discussions are intended as examples of what 

should be provided for each Function when the unit specific list is 

prepared.

1, 2. Power Range and Source Range Neutron Flux

Power Range and Source Range Neutron Flux indication is provided 

to verify reactor shutdown. The two ranges are necessary to cover 

the full range of flux that may occur post accident.

Neutron flux is used for accident diagnosis, verification of 

subcriticality, and diagnosis of positive reactivity insertion.

3, 4. Reactor Coolant System (RCS) Hot and Cold Leg Temperatures

RCS Hot and Cold Leg Temperatures are Category I variables 

provided for verification of core cooling and long term surveillance.

RCS hot and cold leg temperatures are used to determine RCS 

subcooling margin. RCS subcooling margin will allow termination of 

safety injection (SI), if still in progress, or reinitiation of SI if it has 

been stopped. RCS subcooling margin is also used for unit 

stabilization and cooldown control.
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-5 Rev. 4.0

BASES

LCO (continued)

In addition, RCS cold leg temperature is used in conjunction with 

RCS hot leg temperature to verify the unit conditions necessary to 

establish natural circulation in the RCS.

Reactor outlet temperature inputs to the Reactor Protection System 

are provided by two fast response resistance elements and 

associated transmitters in each loop. The channels provide 

indication over a range of 32°F to 700°F.

5. Reactor Coolant System Pressure (Wide Range)

RCS wide range pressure is a Category I variable provided for 

verification of core cooling and RCS integrity long term surveillance.

RCS pressure is used to verify delivery of SI flow to RCS from at 

least one train when the RCS pressure is below the pump shutoff 

head. RCS pressure is also used to verify closure of manually closed 

spray line valves and pressurizer power operated relief valves 

(PORVs).

In addition to these verifications, RCS pressure is used for 

determining RCS subcooling margin. RCS subcooling margin will 

allow termination of SI, if still in progress, or reinitiation of SI if it has 

been stopped. RCS pressure can also be used:

 to determine whether to terminate actuated SI or to reinitiate 

stopped SI,

 to determine when to reset SI and shut off low head SI,

 to manually restart low head SI,

 as reactor coolant pump (RCP) trip criteria, and

 to make a determination on the nature of the accident in 

progress and where to go next in the procedure.

RCS subcooling margin is also used for unit stabilization and 

cooldown control.
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-6 Rev. 4.0

BASES

LCO (continued)

RCS pressure is also related to three decisions about 

depressurization. They are:

 to determine whether to proceed with primary system 

depressurization,

 to verify termination of depressurization, and

 to determine whether to close accumulator isolation valves 

during a controlled cooldown/depressurization.

A final use of RCS pressure is to determine whether to operate the 

pressurizer heaters.

In some units, RCS pressure is a Type A variable because the 

operator uses this indication to monitor the cooldown of the RCS 

following a steam generator tube rupture (SGTR) or small break 

LOCA. Operator actions to maintain a controlled cooldown, such as 

adjusting steam generator (SG) pressure or level, would use this 

indication. Furthermore, RCS pressure is one factor that may be 

used in decisions to terminate RCP operation.

6. Reactor Vessel Water Level

Reactor Vessel Water Level is provided for verification and long term 

surveillance of core cooling. It is also used for accident diagnosis 

and to determine reactor coolant inventory adequacy.

The Reactor Vessel Water Level Monitoring System provides a direct 

measurement of the collapsed liquid level above the fuel alignment 

plate. The collapsed level represents the amount of liquid mass that 

is in the reactor vessel above the core. Measurement of the 

collapsed water level is selected because it is a direct indication of 

the water inventory.

7. Containment Sump Water Level (Wide Range)

Containment Sump Water Level is provided for verification and long 

term surveillance of RCS integrity.

Containment Sump Water Level is used to determine:

 containment sump level accident diagnosis,
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-7 Rev. 4.0

BASES

LCO (continued)

 when to begin the recirculation procedure, and

 whether to terminate SI, if still in progress.

8. Containment Pressure (Wide Range)

Containment Pressure (Wide Range) is provided for verification of 

RCS and containment OPERABILITY.

Containment pressure is used to verify closure of main steam 

isolation valves (MSIVs), and containment spray Phase B isolation 

when High-3 containment pressure is reached.

9. Penetration Flow Path Containment Isolation Valve Position

Penetration Flow Path CIV Position is provided for verification of 

Containment OPERABILITY, and Phase A and Phase B isolation.

When used to verify Phase A and Phase B isolation, the important 

information is the isolation status of the containment penetrations. 

The LCO requires one channel of valve position indication in the 

control room to be OPERABLE for each active CIV in a containment 

penetration flow path, i.e., two total channels of CIV position 

indication for a penetration flow path with two active valves. For 

containment penetrations with only one active CIV having control 

room indication, Note (b) requires a single channel of valve position 

indication to be OPERABLE. This is sufficient to redundantly verify 

the isolation status of each isolable penetration either via indicated 

status of the active valve, as applicable, and prior knowledge of a 

passive valve, or via system boundary status. If a normally active 

CIV is known to be closed and deactivated, position indication is not 

needed to determine status. Therefore, the position indication for 

valves in this state is not required to be OPERABLE. Note (a) to the 

Required Channels states that the Function is not required for 

isolation valves whose associated penetration is isolated by at least 

one closed and deactivated automatic valve, closed manual valve, 

blind flange, or check valve with flow through the valve secured. 

Each penetration is treated separately and each penetration flow 

path is considered a separate function. Therefore, separate 

Condition entry is allowed for each inoperable penetration flow path. 
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-8 Rev. 4.0

BASES

LCO (continued)

10. Containment Area Radiation (High Range)

Containment Area Radiation is provided to monitor for the potential of 

significant radiation releases and to provide release assessment for 

use by operators in determining the need to invoke site emergency 

plans. Containment radiation level is used to determine if a high 

energy line break (HELB) has occurred, and whether the event is 

inside or outside of containment.

11. Pressurizer Level

Pressurizer Level is used to determine whether to terminate SI, if still 

in progress, or to reinitiate SI if it has been stopped. Knowledge of 

pressurizer water level is also used to verify the unit conditions 

necessary to establish natural circulation in the RCS and to verify 

that the unit is maintained in a safe shutdown condition.

12. Steam Generator Water Level (Wide Range)

SG Water Level is provided to monitor operation of decay heat 

removal via the SGs. The Category I indication of SG level is the 

extended startup range level instrumentation. The extended startup 

range level covers a span of ≥ 6 inches to ≤ 394 inches above the 

lower tubesheet. The measured differential pressure is displayed in 

inches of water at 68°F.

Temperature compensation of this indication is performed manually 

by the operator. Redundant monitoring capability is provided by two 

trains of instrumentation. The uncompensated level signal is input to 

the unit computer, a control room indicator, and the Emergency 

Feedwater Control System.

SG Water Level (Wide Range) is used to:

 identify the faulted SG following a tube rupture,

 verify that the intact SGs are an adequate heat sink for the 

reactor,

 determine the nature of the accident in progress (e.g., verify an 

SGTR), and

 verify unit conditions for termination of SI during secondary unit 

HELBs outside containment.
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-9 Rev. 4.0

BASES

LCO (continued)

At some units, operator action is based on the control room indication 

of SG level. The RCS response during a design basis small break 

LOCA depends on the break size. For a certain range of break sizes, 

the boiler condenser mode of heat transfer is necessary to remove 

decay heat. Extended startup range level is a Type A variable 

because the operator must manually raise and control SG level to 

establish boiler condenser heat transfer. Operator action is initiated 

on a loss of subcooled margin. Feedwater flow is increased until the 

indicated extended startup range level reaches the boiler condenser 

setpoint.

13. Condensate Storage Tank (CST) Level

CST Level is provided to ensure water supply for auxiliary feedwater 

(AFW). The CST provides the ensured safety grade water supply for 

the AFW System. The CST consists of two identical tanks connected 

by a common outlet header. Inventory is monitored by a 0 inch to 

144 inch level indication for each tank. CST Level is displayed on a 

control room indicator, strip chart recorder, and unit computer. In 

addition, a control room annunciator alarms on low level.

At some units, CST Level is considered a Type A variable because 

the control room meter and annunciator are considered the primary 

indication used by the operator.

The DBAs that require AFW are the loss of electric power, steam line 

break (SLB), and small break LOCA.

The CST is the initial source of water for the AFW System. However, 

as the CST is depleted, manual operator action is necessary to 

replenish the CST or align suction to the AFW pumps from the 

hotwell.

14, 15, 16, 17. Core Exit Temperature

Core Exit Temperature is provided for verification and long term 

surveillance of core cooling.

An evaluation was made of the minimum number of valid core exit 

thermocouples (CET) necessary for measuring core cooling. The 

evaluation determined the reduced complement of CETs necessary 

to detect initial core recovery and trend the ensuing core heatup. 

The evaluations account for core nonuniformities, including incore 

effects of the radial decay power distribution, excore effects of 

condensate runback in the hot legs, and nonuniform inlet 
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-10 Rev. 4.0

BASES

LCO (continued)

temperatures. Based on these evaluations, adequate core cooling is 

ensured with two valid Core Exit Temperature channels per quadrant 

with two CETs per required channel. The CET pair are oriented 

radially to permit evaluation of core radial decay power distribution. 

Core Exit Temperature is used to determine whether to terminate SI, 

if still in progress, or to reinitiate SI if it has been stopped. Core Exit 

Temperature is also used for unit stabilization and cooldown control.

Two OPERABLE channels of Core Exit Temperature are required in 

each quadrant to provide indication of radial distribution of the 

coolant temperature rise across representative regions of the core. 

Power distribution symmetry was considered in determining the 

specific number and locations provided for diagnosis of local core 

problems. Therefore, two randomly selected thermocouples are not 

sufficient to meet the two thermocouples per channel requirement in 

any quadrant. The two thermocouples in each channel must meet 

the additional requirement that one is located near the center of the 

core and the other near the core perimeter, such that the pair of Core 

Exit Temperatures indicate the radial temperature gradient across 

their core quadrant. Unit specific evaluations in response to 

Item II.F.2 of NUREG-0737 (Ref. 3) should have identified the 

thermocouple pairings that satisfy these requirements. Two sets of 

two thermocouples ensure a single failure will not disable the ability 

to determine the radial temperature gradient.

18. Auxiliary Feedwater Flow

AFW Flow is provided to monitor operation of decay heat removal via 

the SGs.

The AFW Flow to each SG is determined from a differential pressure 

measurement calibrated for a range of 0 gpm to 1200 gpm. 

Redundant monitoring capability is provided by two independent 

trains of instrumentation for each SG. Each differential pressure 

transmitter provides an input to a control room indicator and the unit 

computer. Since the primary indication used by the operator during 

an accident is the control room indicator, the PAM specification deals 

specifically with this portion of the instrument channel.

AFW flow is used three ways:

 to verify delivery of AFW flow to the SGs,

 to determine whether to terminate SI if still in progress, in 

conjunction with SG water level (narrow range), and
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-11 Rev. 4.0

BASES

LCO (continued)

 to regulate AFW flow so that the SG tubes remain covered.

At some units, AFW flow is a Type A variable because operator 

action is required to throttle flow during an SLB accident to prevent 

the AFW pumps from operating in runout conditions. AFW flow is 

also used by the operator to verify that the AFW System is delivering 

the correct flow to each SG. However, the primary indication used by 

the operator to ensure an adequate inventory is SG level.

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3. 

These variables are related to the diagnosis and pre-planned actions 

required to mitigate DBAs. The applicable DBAs are assumed to occur in 

MODES 1, 2, and 3. In MODES 4, 5, and 6, unit conditions are such that 

the likelihood of an event that would require PAM instrumentation is low; 

therefore, the PAM instrumentation is not required to be OPERABLE in 

these MODES.

ACTIONS A Note has been added in the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed on Table 3.3.3-1. The 

Completion Time(s) of the inoperable channel(s) of a Function will be 

tracked separately for each Function starting from the time the Condition 

was entered for that Function.

A.1

Condition A applies when one or more Functions have one required 

channel that is inoperable. Required Action A.1 requires restoring the 

inoperable channel to OPERABLE status within 30 days. The 30 day 

Completion Time is based on operating experience and takes into 

account the remaining OPERABLE channel (or in the case of a Function 

that has only one required channel, other non-Regulatory Guide 1.97 

instrument channels to monitor the Function), the passive nature of the 

instrument (no critical automatic action is assumed to occur from these 

instruments), and the low probability of an event requiring PAM 

instrumentation during this interval.
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-12 Rev. 4.0

BASES

ACTIONS (continued)

B.1

Condition B applies when the Required Action and associated Completion 

Time for Condition A are not met. This Required Action specifies initiation 

of actions in Specification 5.6.5, which requires a written report to be 

submitted to the NRC immediately. This report discusses the results of 

the root cause evaluation of the inoperability and identifies proposed 

restorative actions. This action is appropriate in lieu of a shutdown 

requirement since alternative actions are identified before loss of 

functional capability, and given the likelihood of unit conditions that would 

require information provided by this instrumentation.

C.1

Condition C applies when one or more Functions have two inoperable 

required channels (i.e., two channels inoperable in the same Function). 

Required Action C.1 requires restoring one channel in the Function(s) to 

OPERABLE status within 7 days. The Completion Time of 7 days is 

based on the relatively low probability of an event requiring PAM 

instrument operation and the availability of alternate means to obtain the 

required information. Continuous operation with two required channels 

inoperable in a Function is not acceptable because the alternate 

indications may not fully meet all performance qualification requirements 

applied to the PAM instrumentation. Therefore, requiring restoration of 

one inoperable channel of the Function limits the risk that the PAM 

Function will be in a degraded condition should an accident occur.

D.1

Condition D applies when the Required Action and associated 

Completion Time of Condition C is not met. Required Action D.1 requires 

entering the appropriate Condition referenced in Table 3.3.3-1 for the 

channel immediately. The applicable Condition referenced in the Table is 

Function dependent. Each time an inoperable channel has not met the 

Required Action of Condition C, and the associated Completion Time has 

expired, Condition D is entered for that channel and provides for transfer 

to the appropriate subsequent Condition.
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-13 Rev. 4.0

BASES

ACTIONS (continued)

E.1 and E.2

If the Required Action and associated Completion Time of Condition C is 

not met and Table 3.3.3-1 directs entry into Condition E, the unit must be 

brought to a MODE where the requirements of this LCO do not apply. To 

achieve this status, the unit must be brought to at least MODE 3 within 

6 hours and MODE 4 within 12 hours.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

F.1

At this unit, alternate means of monitoring Reactor Vessel Water Level 

and Containment Area Radiation have been developed and tested. 

These alternate means may be temporarily installed if the normal PAM 

channel cannot be restored to OPERABLE status within the allotted time. 

If these alternate means are used, the Required Action is not to shut 

down the unit but rather to follow the directions of Specification 5.6.5, in 

the Administrative Controls section of the TS. The report provided to the 

NRC should discuss the alternate means used, describe the degree to 

which the alternate means are equivalent to the installed PAM channels, 

justify the areas in which they are not equivalent, and provide a schedule 

for restoring the normal PAM channels.

SURVEILLANCE A Note has been added to the SR Table to clarify that SR 3.3.3.1 and

REQUIREMENTS SR 3.3.3.3 apply to each PAM instrumentation Function in Table 3.3.3-1.

SR 3.3.3.1

Performance of the CHANNEL CHECK ensures that a gross 

instrumentation failure has not occurred. A CHANNEL CHECK is 

normally a comparison of the parameter indicated on one channel to a 

similar parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION. The high radiation instrumentation should be compared 

to similar unit instruments located throughout the unit.
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-14 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including isolation, 

indication, and readability. If a channel is outside the criteria, it may be 

an indication that the sensor or the signal processing equipment has 

drifted outside its limit. If the channels are within the criteria, it is an 

indication that the channels are OPERABLE.

As specified in the SR, a CHANNEL CHECK is only required for those 

channels that are normally energized.

[ The Frequency of 31 days is based on operating experience that 

demonstrates that channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.3.2

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to 

measured parameter with the necessary range and accuracy. This SR is 

modified by a Note that excludes neutron detectors. The calibration 

method for neutron detectors is specified in the Bases of LCO 3.3.1, 

"Reactor Trip System (RTS) Instrumentation." Whenever a sensing 

element is replaced, the next required CHANNEL CALIBRATION of the 

Core Exit thermocouple sensors is accomplished by an inplace cross 

calibration that compares the other sensing elements with the recently 

installed sensing element. [ The Frequency of 18 months is based on 

operating experience and consistency with the typical industry refueling 

cycle.
PAM Instrumentation

B 3.3.3

Westinghouse STS B 3.3.3-15 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES [ 1. Unit specific document (e.g., FSAR, NRC Regulatory Guide 1.97 

SER letter). ]

2. Regulatory Guide 1.97, [date].

3. NUREG-0737, Supplement 1, "TMI Action Items."

Remote Shutdown System

B 3.3.4

Westinghouse STS B 3.3.4-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.4 Remote Shutdown System

BASES

BACKGROUND The Remote Shutdown System provides the control room operator with 

sufficient instrumentation and controls to place and maintain the unit in a 

safe shutdown condition from a location other than the control room. This 

capability is necessary to protect against the possibility that the control 

room becomes inaccessible. A safe shutdown condition is defined as 

MODE 3. With the unit in MODE 3, the Auxiliary Feedwater (AFW) 

System and the steam generator (SG) safety valves or the SG 

atmospheric dump valves (ADVs) can be used to remove core decay heat 

and meet all safety requirements. The long term supply of water for the 

AFW System and the ability to borate the Reactor Coolant System (RCS) 

from outside the control room allows extended operation in MODE 3.

If the control room becomes inaccessible, the operators can establish 

control at the remote shutdown panel, and place and maintain the unit in 

MODE 3. Not all controls and necessary transfer switches are located at 

the remote shutdown panel. Some controls and transfer switches will 

have to be operated locally at the switchgear, motor control panels, or 

other local stations. The unit automatically reaches MODE 3 following a 

unit shutdown and can be maintained safely in MODE 3 for an extended 

period of time.

The OPERABILITY of the remote shutdown control and instrumentation 

functions ensures there is sufficient information available on selected unit 

parameters to place and maintain the unit in MODE 3 should the control 

room become inaccessible.

APPLICABLE The Remote Shutdown System is required to provide equipment at

SAFETY appropriate locations outside the control room with a capability to

ANALYSES promptly shut down and maintain the unit in a safe condition in MODE 3.

The criteria governing the design and specific system requirements of the 

Remote Shutdown System are located in 10 CFR 50, Appendix A, 

GDC 19 (Ref. 1).

The Remote Shutdown System satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii).
Remote Shutdown System

B 3.3.4

Westinghouse STS B 3.3.4-2 Rev. 4.0

BASES

LCO The Remote Shutdown System LCO provides the OPERABILITY 

requirements of the instrumentation and controls necessary to place and 

maintain the unit in MODE 3 from a location other than the control room. 

The instrumentation and controls required are listed in Table B 3.3.4-1.

The controls, instrumentation, and transfer switches are required for:

 Core reactivity control (initial and long term),

 RCS pressure control,

 Decay heat removal via the AFW System and the SG safety valves 

or SG ADVs,

 RCS inventory control via charging flow, and

 Safety support systems for the above Functions, including service 

water, component cooling water, and onsite power, including the 

diesel generators.

A Function of a Remote Shutdown System is OPERABLE if all instrument 

and control channels needed to support the Remote Shutdown System 

Function are OPERABLE. In some cases, Table B 3.3.4-1 may indicate 

that the required information or control capability is available from several 

alternate sources. In these cases, the Function is OPERABLE as long as 

one channel of any of the alternate information or control sources is 

OPERABLE.

The remote shutdown instrument and control circuits covered by this LCO 

do not need to be energized to be considered OPERABLE. This LCO is 

intended to ensure the instruments and control circuits will be 

OPERABLE if unit conditions require that the Remote Shutdown System 

be placed in operation.

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1, 2, and 3. 

This is required so that the unit can be placed and maintained in MODE 3 

for an extended period of time from a location other than the control room.

This LCO is not applicable in MODE 4, 5, or 6. In these MODES, the 

facility is already subcritical and in a condition of reduced RCS energy. 

Under these conditions, considerable time is available to restore 

necessary instrument control functions if control room instruments or 

controls become unavailable.
Remote Shutdown System

B 3.3.4

Westinghouse STS B 3.3.4-3 Rev. 4.0

BASES

ACTIONS A Remote Shutdown System division is inoperable when each function is 

not accomplished by at least one designated Remote Shutdown System 

channel that satisfies the OPERABILITY criteria for the channel's 

Function. These criteria are outlined in the LCO section of the Bases.

A Note has been added to the ACTIONS to clarify the application of 

Completion Time rules. Separate Condition entry is allowed for each 

Function. The Completion Time(s) of the inoperable channel(s)/train(s) of 

a Function will be tracked separately for each Function starting from the 

time the Condition was entered for that Function.

A.1

Condition A addresses the situation where one or more required 

Functions of the Remote Shutdown System are inoperable. This includes 

the control and transfer switches for any required Function.

The Required Action is to restore the required Function to OPERABLE 

status within 30 days. The Completion Time is based on operating 

experience and the low probability of an event that would require 

evacuation of the control room.

B.1 and B.2

If the Required Action and associated Completion Time of Condition A is 

not met, the unit must be brought to a MODE in which the LCO does not 

apply. To achieve this status, the unit must be brought to at least 

MODE 3 within 6 hours and to MODE 4 within 12 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems.

SURVEILLANCE SR 3.3.4.1

REQUIREMENTS

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION.
Remote Shutdown System

B 3.3.4

Westinghouse STS B 3.3.4-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued) 

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If the channels are within the criteria, it is an indication 

that the channels are OPERABLE. If a channel is outside the criteria, it 

may be an indication that the sensor or the signal processing equipment 

has drifted outside its limit.

As specified in the Surveillance, a CHANNEL CHECK is only required for 

those channels which are normally energized.

[ The Frequency of 31 days is based upon operating experience which 

demonstrates that channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.4.2

SR 3.3.4.2 verifies each required Remote Shutdown System control 

circuit and transfer switch performs the intended function. This 

verification is performed from the remote shutdown panel and locally, as 

appropriate. Operation of the equipment from the remote shutdown panel 

is not necessary. The Surveillance can be satisfied by performance of a 

continuity check. This will ensure that if the control room becomes 

inaccessible, the unit can be placed and maintained in MODE 3 from the 

remote shutdown panel and the local control stations. [ The [18] month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage and the potential for an 
Remote Shutdown System

B 3.3.4

Westinghouse STS B 3.3.4-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued) 

unplanned transient if the Surveillance were performed with the reactor at 

power. (However, this Surveillance is not required to be performed only 

during a unit outage.) Operating experience demonstrates that remote 

shutdown control channels usually pass the Surveillance test when 

performed at the [18] month Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.4.3

CHANNEL CALIBRATION is a complete check of the instrument loop and 

the sensor. The test verifies that the channel responds to a measured 

parameter within the necessary range and accuracy.

Whenever a sensing element is replaced, the next required CHANNEL 

CALIBRATION of the resistance temperature detectors (RTD) sensors is 

accomplished by an inplace cross calibration that compares the other 

sensing elements with the recently installed sensing element.

[ The Frequency of [18] months is based upon operating experience and 

consistency with the typical industry refueling cycle.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Remote Shutdown System

B 3.3.4

Westinghouse STS B 3.3.4-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.3.4.4

SR 3.3.4.4 is the performance of a TADOT. This test should verify the 

OPERABILITY of the reactor trip breakers (RTBs) open and closed 

indication on the remote shutdown panel, by actuating the RTBs. A 

successful test of the required contact(s) of a channel relay may be 

performed by the verification of the change of state of a single contact of 

the relay. This clarifies what is an acceptable TADOT of a relay. This is 

acceptable because all of the other required contacts of the relay are 

verified by other Technical Specifications and non-Technical 

Specifications tests at least once per refueling interval with applicable 

extensions. [ The Frequency of 18 months is based upon operating 

experience and consistency with the typical industry refueling outage.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.
Remote Shutdown System

B 3.3.4

Westinghouse STS B 3.3.4-7 Rev. 4.0

Table B 3.3.4-1 (page 1 of 1)

Remote Shutdown System Instrumentation and Controls

FUNCTION/INSTRUMENT

OR CONTROL PARAMETER

REQUIRED

NUMBER OF FUNCTIONS

1. Reactivity Control

a. Source Range Neutron Flux [1]

b. Reactor Trip Breaker Position [1 per trip breaker]

c. Manual Reactor Trip [2]

2. Reactor Coolant System (RCS) Pressure Control

a. Pressurizer Pressure

or

RCS Wide Range Pressure

[1]

b. Pressurizer Power Operated Relief Valve 

(PORV) Control and Block Valve Control

[1, controls must be for PORV & block valves on same 

line]

3. Decay Heat Removal via Steam Generators 

(SGs)

a. RCS Hot Leg Temperature [1 per loop]

b. RCS Cold Leg Temperature [1 per loop]

c. AFW Controls Condensate Storage Tank 

Level

[1]

d. SG Pressure [1 per SG]

4. RCS Inventory Control

a. Pressurizer Level [1]

b. Charging Pump Controls [1]

---------------------------------------------------------------REVIEWER’S NOTE-----------------------------------------------------------------

For channels that fulfill GDC 19 requirements, the number of OPERABLE channels required depends upon the unit 

licensing basis as described in the NRC unit specific Safety Evaluation Report (SER). Generally, two divisions are 

required OPERABLE. However, only one channel per a given Function is required if the unit has justified such a 

design, and NRC's SER accepted the justification.

------------------------------------------------------------------------------------------------------------------------------------------------------------

---------------------------------------------------------------REVIEWER’S NOTE-----------------------------------------------------------------

This Table is for illustration purposes only. It does not attempt to encompass every Function used at every unit, but 

does contain the types of Functions commonly found.

------------------------------------------------------------------------------------------------------------------------------------------------------------

LOP DG Start Instrumentation (Without Setpoint Control Program)

B 3.3.5A

Westinghouse STS B 3.3.5A-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.5A Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation (Without Setpoint 

Control Program)

BASES

BACKGROUND The DGs provide a source of emergency power when offsite power is 

either unavailable or is insufficiently stable to allow safe unit operation. 

Undervoltage protection will generate a LOP start if a loss of voltage or 

degraded voltage condition occurs in the switchyard. There are two LOP 

start signals, one for each 4.16 kV vital bus.

Three undervoltage relays with inverse time characteristics are provided 

on each 4160 Class 1E instrument bus for detecting a sustained 

degraded voltage condition or a loss of bus voltage. The relays are 

combined in a two-out-of-three logic to generate a LOP signal if the 

voltage is below 75% for a short time or below 90% for a long time. The 

LOP start actuation is described in FSAR, Section 8.3 (Ref. 1).

The Allowable Value in conjunction with the trip setpoint and LCO 

establishes the threshold for Engineered Safety Features Actuation 

System (ESFAS) action to prevent exceeding acceptable limits such that 

the consequences of Design Basis Accidents (DBAs) will be acceptable. 

The Allowable Value is considered a limiting value such that a channel is 

OPERABLE if the setpoint is found not to exceed the Allowable Value 

during the CHANNEL CALIBRATION. Note that although a channel is 

OPERABLE under these circumstances, the setpoint must be left 

adjusted to within the established calibration tolerance band of the 

setpoint in accordance with uncertainty assumptions stated in the 

referenced setpoint methodology, (as-left-criteria) and confirmed to be 

operating within the statistical allowances of the uncertainty terms 

assigned.

Allowable Values and LOP DG Start Instrumentation Setpoints

-----------------------------------REVIEWER’S NOTE-----------------------------------

Alternatively, a TS format incorporating an Allowable Value only may be 

proposed by a licensee. In this case the Nominal Trip Setpoint value is 

located in the TS Bases or in a licensee controlled document outside the 

TS. Changes to the trip setpoint value would be controlled by 

10 CFR 50.59 or administratively as appropriate, and adjusted per the 

setpoint methodology and applicable surveillance requirements. At their 

option, the licensee may include the trip setpoint in the surveillance 

requirement as shown, or suggested by the licensee's setpoint 

methodology.

--------------------------------------------------------------------------------------------------
LOP DG Start Instrumentation (Without Setpoint Control Program)

B 3.3.5A

Westinghouse STS B 3.3.5A-2 Rev. 4.0

BASES

BACKGROUND (continued)

The Trip Setpoints used in the relays are based on the analytical limits 

presented in FSAR, Chapter 15 (Ref. 2). The selection of these trip 

setpoints is such that adequate protection is provided when all sensor 

and processing time delays are taken into account.

Setpoints adjusted consistent with the requirements of the Allowable 

Value ensure that the consequences of accidents will be acceptable, 

providing the unit is operated from within the LCOs at the onset of the 

accident and that the equipment functions as designed.

Allowable Values and/or Nominal Trip Setpoints are specified for each 

Function in SR 3.3.5.3. Nominal Trip Setpoints are also specified in the 

unit specific setpoint calculations. The trip setpoints are selected to 

ensure that the setpoint measured by the surveillance procedure does not 

exceed the Allowable Value if the relay is performing as required. If the 

measured setpoint does not exceed the Allowable Value, the relay is 

considered OPERABLE. Operation with a trip setpoint less conservative 

than the nominal Trip Setpoint, but within the Allowable Value, is 

acceptable provided that operation and testing is consistent with the 

assumptions of the unit specific setpoint calculation (Ref. 3).

APPLICABLE The LOP DG start instrumentation is required for the Engineered Safety

SAFETY Features (ESF) Systems to function in any accident with a loss of offsite

ANALYSES power. Its design basis is that of the ESF Actuation System (ESFAS).

Accident analyses credit the loading of the DG based on the loss of offsite 

power during a loss of coolant accident (LOCA). The actual DG start has 

historically been associated with the ESFAS actuation. The DG loading 

has been included in the delay time associated with each safety system 

component requiring DG supplied power following a loss of offsite power. 

The analyses assume a non-mechanistic DG loading, which does not 

explicitly account for each individual component of loss of power 

detection and subsequent actions.

The required channels of LOP DG start instrumentation, in conjunction 

with the ESF systems powered from the DGs, provide unit protection in 

the event of any of the analyzed accidents discussed in Reference 2, in 

which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment 

include the 10 second DG start delay, and the appropriate sequencing 

delay, if applicable. The response times for ESFAS actuated equipment 

in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) 

Instrumentation," include the appropriate DG loading and sequencing 

delay.
LOP DG Start Instrumentation (Without Setpoint Control Program)

B 3.3.5A

Westinghouse STS B 3.3.5A-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The LOP DG start instrumentation channels satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO The LCO for LOP DG start instrumentation requires that [three] channels 

per bus of both the loss of voltage and degraded voltage Functions shall 

be OPERABLE in MODES 1, 2, 3, and 4 when the LOP DG start 

instrumentation supports safety systems associated with the ESFAS. In 

MODES 5 and 6, the [three] channels must be OPERABLE whenever the 

associated DG is required to be OPERABLE to ensure that the automatic 

start of the DG is available when needed. A channel is OPERABLE with 

a trip setpoint value outside its calibration tolerance band provided the trip 

setpoint "as-found" value does not exceed its associated Allowable Value 

and provided the trip setpoint "as-left" value is adjusted to a value within 

the "as-left" calibration tolerance band of the Nominal Trip Setpoint. A trip 

setpoint may be set more conservative than the Nominal Trip Setpoint as 

necessary in response to plant conditions. Loss of the LOP DG Start 

Instrumentation Function could result in the delay of safety systems 

initiation when required. This could lead to unacceptable consequences 

during accidents. During the loss of offsite power the DG powers the 

motor driven auxiliary feedwater pumps. Failure of these pumps to start 

would leave only one turbine driven pump, as well as an increased 

potential for a loss of decay heat removal through the secondary system.

APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 

2, 3, and 4 because ESF Functions are designed to provide protection in 

these MODES. Actuation in MODE 5 or 6 is required whenever the 

required DG must be OPERABLE so that it can perform its function on a 

LOP or degraded power to the vital bus.

ACTIONS ---------------------------------------REVIEWER’S NOTE-------------------------------

In TS 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start 

Instrumentation," the loss of power function was not included in the 

generic evaluations approved in either WCAP-10271, as supplemented, 

or WCAP-14333. In order to apply relaxations similar to those in 

WCAP-10271, as supplemented, or WCAP-14333, licensees must submit 

plant specific evaluations for NRC review and approval.

--------------------------------------------------------------------------------------------------

In the event a channel's trip setpoint is found nonconservative with 

respect to the Allowable Value, or the channel is found inoperable, then 

the function that channel provides must be declared inoperable and the 

LCO Condition entered for the particular protection function affected.
LOP DG Start Instrumentation (Without Setpoint Control Program)

B 3.3.5A

Westinghouse STS B 3.3.5A-4 Rev. 4.0

BASES

ACTIONS (continued)

Because the required channels are specified on a per bus basis, the 

Condition may be entered separately for each bus as appropriate.

A Note has been added in the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed in the LCO. The 

Completion Time(s) of the inoperable channel(s) of a Function will be 

tracked separately for each Function starting from the time the Condition 

was entered for that Function.

A.1

Condition A applies to the LOP DG start Functions with one loss of 

voltage or one degraded voltage channel per bus inoperable.

If one channel is inoperable, Required Action A.1 requires that channel to 

be placed in trip within [6] hours. With a channel in trip, the LOP DG start 

instrumentation channels are configured to provide a one-out-of-three 

logic to initiate a trip of the incoming offsite power.

A Note is added to allow bypassing an inoperable channel for up to 

[4] hours for surveillance testing of other channels. This allowance is 

made where bypassing the channel does not cause an actuation and 

where at least two other channels are monitoring that parameter.

The specified Completion Time and time allowed for bypassing one 

channel are reasonable considering the Function remains fully 

OPERABLE on every bus and the low probability of an event occurring 

during these intervals.

B.1

Condition B applies when more than one loss of voltage or more than one 

degraded voltage channel per bus are inoperable.

Required Action B.1 requires restoring all but one channel per bus to 

OPERABLE status. The 1 hour Completion Time should allow ample 

time to repair most failures and takes into account the low probability of 

an event requiring a LOP start occurring during this interval.
LOP DG Start Instrumentation (Without Setpoint Control Program)

B 3.3.5A

Westinghouse STS B 3.3.5A-5 Rev. 4.0

BASES

ACTIONS (continued)

C.1

Condition C applies to each of the LOP DG start Functions when the 

Required Action and associated Completion Time for Condition A or B are 

not met.

In these circumstances the Conditions specified in LCO 3.8.1, "AC 

Sources - Operating," or LCO 3.8.2, "AC Sources - Shutdown," for the DG 

made inoperable by failure of the LOP DG start instrumentation are 

required to be entered immediately. The actions of those LCOs provide 

for adequate compensatory actions to assure unit safety.

SURVEILLANCE SR 3.3.5.1

REQUIREMENTS

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
LOP DG Start Instrumentation

B 3.3.5

Westinghouse STS B 3.3.5-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.5.2

SR 3.3.5.2 is the performance of a TADOT. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The test checks 

trip devices that provide actuation signals directly, bypassing the analog 

process control equipment. For these tests, the relay trip setpoints are 

verified and adjusted as necessary. There is a plant specific program 

which verifies that the instrument channel functions as required by 

verifying the as-left and as-found setting are consistent with those 

established by the setpoint methodology.

[ The Frequency of 31 days is based on the known reliability of the relays 

and controls and the multichannel redundancy available, and has been 

shown to be acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
LOP DG Start Instrumentation

B 3.3.5

Westinghouse STS B 3.3.5A-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.5.3

SR 3.3.5.3 is the performance of a CHANNEL CALIBRATION.

The setpoints, as well as the response to a loss of voltage and a 

degraded voltage test, shall include a single point verification that the trip 

occurs within the required time delay, as shown in Reference 1.

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy. There is 

a plant specific program which verifies that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology.

[ The Frequency of [18] months is based on operating experience and 

consistency with the typical industry refueling cycle and is justified by the 

assumption of an [18] month calibration interval in the determination of 

the magnitude of equipment drift in the setpoint analysis.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [8.3].

2. FSAR, Chapter [15].

3. Plant specific setpoint methodology study.

LOP DG Start Instrumentation (With Setpoint Control Program)

B 3.3.5B

Westinghouse STS B 3.3.5B-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.5B Loss of Power (LOP) Diesel Generator (DG) Start Instrumentation (With Setpoint 

Control Program)

BASES

BACKGROUND The DGs provide a source of emergency power when offsite power is 

either unavailable or is insufficiently stable to allow safe unit operation. 

Undervoltage protection will generate a LOP start if a loss of voltage or 

degraded voltage condition occurs in the switchyard. There are two LOP 

start signals, one for each 4.16 kV vital bus.

Three undervoltage relays with inverse time characteristics are provided 

on each 4160 Class 1E instrument bus for detecting a sustained 

degraded voltage condition or a loss of bus voltage. The relays are 

combined in a two-out-of-three logic to generate a LOP signal if the 

voltage is below 75% for a short time or below 90% for a long time. The 

LOP start actuation is described in FSAR, Section 8.3 (Ref. 1).

The Allowable Value in conjunction with the trip setpoint and LCO 

establishes the threshold for Engineered Safety Features Actuation 

System (ESFAS) action to prevent exceeding acceptable limits such that 

the consequences of Design Basis Accidents (DBAs) will be acceptable. 

The Allowable Value is considered a limiting value such that a channel is 

OPERABLE if the setpoint is found not to exceed the Allowable Value 

during the CHANNEL CALIBRATION. Note that although a channel is 

OPERABLE under these circumstances, the setpoint must be left 

adjusted to within the established calibration tolerance band of the 

setpoint in accordance with uncertainty assumptions stated in the 

referenced setpoint methodology, (as-left-criteria) and confirmed to be 

operating within the statistical allowances of the uncertainty terms 

assigned.

Allowable Values and LOP DG Start Instrumentation Setpoints

-----------------------------------REVIEWER’S NOTE-----------------------------------

Alternatively, a TS format incorporating an Allowable Value only may be 

proposed by a licensee. In this case the Nominal Trip Setpoint value is 

located in the TS Bases or in a licensee controlled document outside the 

TS. Changes to the trip setpoint value would be controlled by 

10 CFR 50.59 or administratively as appropriate, and adjusted per the 

setpoint methodology and applicable surveillance requirements. At their 

option, the licensee may include the trip setpoint in the surveillance 

requirement as shown, or suggested by the licensee's setpoint 

methodology.

--------------------------------------------------------------------------------------------------
LOP DG Start Instrumentation (With Setpoint Control Program)

B 3.3.5B

Westinghouse STS B 3.3.5B-2 Rev. 4.0

BASES

BACKGROUND (continued)

The Trip Setpoints used in the relays are based on the analytical limits 

presented in FSAR, Chapter 15 (Ref. 2). The selection of these trip 

setpoints is such that adequate protection is provided when all sensor 

and processing time delays are taken into account.

Setpoints adjusted consistent with the requirements of the Allowable 

Value ensure that the consequences of accidents will be acceptable, 

providing the unit is operated from within the LCOs at the onset of the 

accident and that the equipment functions as designed.

Allowable Values and/or Nominal Trip Setpoints are specified for each 

Function in SR 3.3.5.3. Nominal Trip Setpoints are also specified in the 

unit specific setpoint calculations. The trip setpoints are selected to 

ensure that the setpoint measured by the surveillance procedure does not 

exceed the Allowable Value if the relay is performing as required. If the 

measured setpoint does not exceed the Allowable Value, the relay is 

considered OPERABLE. Operation with a trip setpoint less conservative 

than the nominal Trip Setpoint, but within the Allowable Value, is 

acceptable provided that operation and testing is consistent with the

assumptions of the unit specific setpoint calculation (Ref. 3).

APPLICABLE The LOP DG start instrumentation is required for the Engineered Safety

SAFETY Features (ESF) Systems to function in any accident with a loss of offsite

ANALYSES power. Its design basis is that of the ESF Actuation System (ESFAS).

Accident analyses credit the loading of the DG based on the loss of offsite 

power during a loss of coolant accident (LOCA). The actual DG start has 

historically been associated with the ESFAS actuation. The DG loading 

has been included in the delay time associated with each safety system 

component requiring DG supplied power following a loss of offsite power. 

The analyses assume a non-mechanistic DG loading, which does not 

explicitly account for each individual component of loss of power 

detection and subsequent actions.

The required channels of LOP DG start instrumentation, in conjunction 

with the ESF systems powered from the DGs, provide unit protection in 

the event of any of the analyzed accidents discussed in Reference 2, in 

which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment 

include the 10 second DG start delay, and the appropriate sequencing 

delay, if applicable. The response times for ESFAS actuated equipment 

in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) 

Instrumentation," include the appropriate DG loading and sequencing 

delay.
LOP DG Start Instrumentation (With Setpoint Control Program)

B 3.3.5B

Westinghouse STS B 3.3.5B-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The LOP DG start instrumentation channels satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO The LCO for LOP DG start instrumentation requires that [three] channels 

per bus of both the loss of voltage and degraded voltage Functions shall 

be OPERABLE in MODES 1, 2, 3, and 4 when the LOP DG start 

instrumentation supports safety systems associated with the ESFAS. In 

MODES 5 and 6, the [three] channels must be OPERABLE whenever the 

associated DG is required to be OPERABLE to ensure that the automatic 

start of the DG is available when needed. A channel is OPERABLE with 

a trip setpoint value outside its calibration tolerance band provided the trip 

setpoint "as-found" value does not exceed its associated Allowable Value 

and provided the trip setpoint "as-left" value is adjusted to a value within 

the "as-left" calibration tolerance band of the Nominal Trip Setpoint. A trip 

setpoint may be set more conservative than the Nominal Trip Setpoint as 

necessary in response to plant conditions. Loss of the LOP DG Start 

Instrumentation Function could result in the delay of safety systems 

initiation when required. This could lead to unacceptable consequences 

during accidents. During the loss of offsite power the DG powers the 

motor driven auxiliary feedwater pumps. Failure of these pumps to start 

would leave only one turbine driven pump, as well as an increased 

potential for a loss of decay heat removal through the secondary system.

APPLICABILITY The LOP DG Start Instrumentation Functions are required in MODES 1, 

2, 3, and 4 because ESF Functions are designed to provide protection in 

these MODES. Actuation in MODE 5 or 6 is required whenever the 

required DG must be OPERABLE so that it can perform its function on a 

LOP or degraded power to the vital bus.

ACTIONS ---------------------------------------REVIEWER’S NOTE-------------------------------

In TS 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start 

Instrumentation," the loss of power function was not included in the 

generic evaluations approved in either WCAP-10271, as supplemented, 

or WCAP-14333. In order to apply relaxations similar to those in 

WCAP-10271, as supplemented, or WCAP-14333, licensees must submit 

plant specific evaluations for NRC review and approval.

--------------------------------------------------------------------------------------------------

In the event a channel's trip setpoint is found nonconservative with 

respect to the Allowable Value, or the channel is found inoperable, then 

the function that channel provides must be declared inoperable and the 

LCO Condition entered for the particular protection function affected.
LOP DG Start Instrumentation (With Setpoint Control Program)

B 3.3.5B

Westinghouse STS B 3.3.5B-4 Rev. 4.0

BASES

ACTIONS (continued)

Because the required channels are specified on a per bus basis, the 

Condition may be entered separately for each bus as appropriate.

A Note has been added in the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed in the LCO. The 

Completion Time(s) of the inoperable channel(s) of a Function will be 

tracked separately for each Function starting from the time the Condition 

was entered for that Function.

A.1

Condition A applies to the LOP DG start Functions with one loss of 

voltage or one degraded voltage channel per bus inoperable.

If one channel is inoperable, Required Action A.1 requires that channel to 

be placed in trip within [6] hours. With a channel in trip, the LOP DG start 

instrumentation channels are configured to provide a one-out-of-three 

logic to initiate a trip of the incoming offsite power.

A Note is added to allow bypassing an inoperable channel for up to 

[4] hours for surveillance testing of other channels. This allowance is 

made where bypassing the channel does not cause an actuation and 

where at least two other channels are monitoring that parameter.

The specified Completion Time and time allowed for bypassing one 

channel are reasonable considering the Function remains fully 

OPERABLE on every bus and the low probability of an event occurring 

during these intervals.

B.1

Condition B applies when more than one loss of voltage or more than one 

degraded voltage channel per bus are inoperable.

Required Action B.1 requires restoring all but one channel per bus to 

OPERABLE status. The 1 hour Completion Time should allow ample 

time to repair most failures and takes into account the low probability of 

an event requiring a LOP start occurring during this interval.
LOP DG Start Instrumentation (With Setpoint Control Program)

B 3.3.5B

Westinghouse STS B 3.3.5B-5 Rev. 4.0

BASES

ACTIONS (continued)

C.1

Condition C applies to each of the LOP DG start Functions when the 

Required Action and associated Completion Time for Condition A or B are 

not met.

In these circumstances the Conditions specified in LCO 3.8.1, "AC 

Sources - Operating," or LCO 3.8.2, "AC Sources - Shutdown," for the DG 

made inoperable by failure of the LOP DG start instrumentation are 

required to be entered immediately. The actions of those LCOs provide 

for adequate compensatory actions to assure unit safety.

SURVEILLANCE SR 3.3.5.1

REQUIREMENTS

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
LOP DG Start Instrumentation

B 3.3.5

Westinghouse STS B 3.3.5-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.5.2

SR 3.3.5.2 is the performance of a TADOT. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The test checks 

trip devices that provide actuation signals directly, bypassing the analog 

process control equipment. For these tests, the relay trip setpoints are 

verified and adjusted as necessary. The Setpoint Control Program (SCP) 

has controls which require verification that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology.

[ The Frequency of 31 days is based on the known reliability of the relays 

and controls and the multichannel redundancy available, and has been 

shown to be acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
LOP DG Start Instrumentation

B 3.3.5

Westinghouse STS B 3.3.5B-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.5.3

SR 3.3.5.3 is the performance of a CHANNEL CALIBRATION.

The setpoints, as well as the response to a loss of voltage and a 

degraded voltage test, shall include a single point verification that the trip 

occurs within the required time delay, as shown in Reference 1.

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy. The SCP 

has controls which require verification that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology.

[ The Frequency of [18] months is based on operating experience and 

consistency with the typical industry refueling cycle and is justified by the 

assumption of an [18] month calibration interval in the determination of 

the magnitude of equipment drift in the setpoint analysis.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [8.3].

2. FSAR, Chapter [15].

3. Plant specific setpoint methodology study.

Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.6A Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control 

Program)

BASES

BACKGROUND Containment purge and exhaust isolation instrumentation closes the

containment isolation valves in the Mini Purge System and the Shutdown 

Purge System. This action isolates the containment atmosphere from the 

environment to minimize releases of radioactivity in the event of an 

accident. The Mini Purge System may be in use during reactor operation 

and the Shutdown Purge System will be in use with the reactor shutdown.

Containment purge and exhaust isolation initiates on a automatic safety 

injection (SI) signal through the Containment Isolation - Phase A 

Function, or by manual actuation of Phase A Isolation. The Bases for 

LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) 

Instrumentation," discuss these modes of initiation.

Four radiation monitoring channels are also provided as input to the 

containment purge and exhaust isolation. The four channels measure 

containment radiation at two locations. One channel is a containment 

area gamma monitor, and the other three measure radiation in a sample 

of the containment purge exhaust. The three purge exhaust radiation 

detectors are of three different types: gaseous, particulate, and iodine 

monitors. All four detectors will respond to most events that release 

radiation to containment. However, analyses have not been conducted to 

demonstrate that all credible events will be detected by more than one 

monitor. Therefore, for the purposes of this LCO the four channels are 

not considered redundant. Instead, they are treated as four one-out-ofone Functions. Since the purge exhaust monitors constitute a sampling 

system, various components such as sample line valves, sample line 

heaters, sample pumps, and filter motors are required to support monitor 

OPERABILITY.

Each of the purge systems has inner and outer containment isolation 

valves in its supply and exhaust ducts. A high radiation signal from any 

one of the four channels initiates containment purge isolation, which 

closes both inner and outer containment isolation valves in the Mini Purge 

System and the Shutdown Purge System. These systems are described 

in the Bases for LCO 3.6.3, "Containment Isolation Valves."

APPLICABLE The safety analyses assume that the containment remains intact with

SAFETY penetrations unnecessary for core cooling isolated early in the event,

ANALYSES within approximately 60 seconds. The isolation of the purge valves has 

not been analyzed mechanistically in the dose calculations, although its 
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

rapid isolation is assumed. The containment purge and exhaust isolation 

radiation monitors act as backup to the SI signal to ensure closing of the 

purge and exhaust valves. They are also the primary means for 

automatically isolating containment in the event of a fuel handling 

accident during shutdown. Containment isolation in turn ensures meeting 

the containment leakage rate assumptions of the safety analyses, and 

ensures that the calculated accidental offsite radiological doses are below 

10 CFR 100 (Ref. 1) limits. [Due to radioactive decay, containment is only 

required to isolate during fuel handling accidents involving handling 

recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor 

core within the previous [X] days).]

The containment purge and exhaust isolation instrumentation satisfies 

Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO requirements ensure that the instrumentation necessary to 

initiate Containment Purge and Exhaust Isolation, listed in Table 3.3.6-1, 

is OPERABLE.

1. Manual Initiation

The LCO requires two channels OPERABLE. The operator can 

initiate Containment Purge Isolation at any time by using either of two 

switches in the control room. Either switch actuates both trains. This 

action will cause actuation of all components in the same manner as 

any of the automatic actuation signals.

The LCO for Manual Initiation ensures the proper amount of 

redundancy is maintained in the manual actuation circuitry to ensure 

the operator has manual initiation capability.

Each channel consists of one push button and the interconnecting 

wiring to the actuation logic cabinet.

2. Automatic Actuation Logic and Actuation Relays

The LCO requires two trains of Automatic Actuation Logic and 

Actuation Relays OPERABLE to ensure that no single random failure 

can prevent automatic actuation.
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-3 Rev. 4.0

BASES

LCO (continued)

Automatic Actuation Logic and Actuation Relays consist of the same 

features and operate in the same manner as described for ESFAS 

Function 1.b, SI, and ESFAS Function 3.a, Containment Phase A 

Isolation. The applicable MODES and specified conditions for the 

containment purge isolation portion of these Functions are different 

and less restrictive than those for their Phase A isolation and SI 

roles. If one or more of the SI or Phase A isolation Functions 

becomes inoperable in such a manner that only the Containment 

Purge Isolation Function is affected, the Conditions applicable to their 

SI and Phase A isolation Functions need not be entered. The less 

restrictive Actions specified for inoperability of the Containment 

Purge Isolation Functions specify sufficient compensatory measures 

for this case.

3. Containment Radiation

The LCO specifies four required channels of radiation monitors to 

ensure that the radiation monitoring instrumentation necessary to 

initiate Containment Purge Isolation remains OPERABLE.

For sampling systems, channel OPERABILITY involves more than 

OPERABILITY of the channel electronics. OPERABILITY may also 

require correct valve lineups, sample pump operation, and filter motor 

operation, as well as detector OPERABILITY, if these supporting 

features are necessary for trip to occur under the conditions assumed 

by the safety analyses.

4. Containment Isolation - Phase A

Refer to LCO 3.3.2, Function 3.a., for all initiating Functions and 

requirements.

APPLICABILITY The Manual Initiation, Automatic Actuation Logic and Actuation Relays, 

Containment Isolation - Phase A, and Containment Radiation Functions 

are required OPERABLE in MODES 1, 2, 3, and 4, and during movement 

of [recently] irradiated fuel assemblies [(i.e., fuel that has occupied part of 

a critical reactor core within the previous [X] days)] within containment. 

Under these conditions, the potential exists for an accident that could 

release significant fission product radioactivity into containment. 

Therefore, the containment purge and exhaust isolation instrumentation 

must be OPERABLE in these MODES.
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-4 Rev. 4.0

BASES

APPLICABILITY (continued)

While in MODES 5 and 6 without fuel handling in progress, the 

containment purge and exhaust isolation instrumentation need not be 

OPERABLE since the potential for radioactive releases is minimized and 

operator action is sufficient to ensure post accident offsite doses are 

maintained within the limits of Reference 1.

The Applicability for the containment purge and exhaust isolation on the 

ESFAS Containment Isolation-Phase A Functions are specified in 

LCO 3.3.2. Refer to the Bases for LCO 3.3.2 for discussion of the 

Containment Isolation-Phases A Function Applicability.

ACTIONS The most common cause of channel inoperability is outright failure or drift 

of the bistable or process module sufficient to exceed the tolerance 

allowed by unit specific calibration procedures. Typically, the drift is 

found to be small and results in a delay of actuation rather than a total 

loss of function. This determination is generally made during the 

performance of a COT, when the process instrumentation is set up for 

adjustment to bring it within specification. If the Trip Setpoint is less 

conservative than the tolerance specified by the calibration procedure, the 

channel must be declared inoperable immediately and the appropriate 

Condition entered.

A Note has been added to the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed in Table 3.3.6-1. The 

Completion Time(s) of the inoperable channel(s)/train(s) of a Function will 

be tracked separately for each Function starting from the time the 

Condition was entered for that Function.

A.1

Condition A applies to the failure of one containment purge isolation 

radiation monitor channel. Since the four containment radiation monitors 

measure different parameters, failure of a single channel may result in 

loss of the radiation monitoring Function for certain events. 

Consequently, the failed channel must be restored to OPERABLE status. 

The 4 hours allowed to restore the affected channel is justified by the low 

likelihood of events occurring during this interval, and recognition that one 

or more of the remaining channels will respond to most events.
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-5 Rev. 4.0

BASES

ACTIONS (continued)

B.1

Condition B applies to all Containment Purge and Exhaust Isolation 

Functions and addresses the train orientation of the Solid State Protection 

System (SSPS) and the master and slave relays for these Functions. It 

also addresses the failure of multiple radiation monitoring channels, or the 

inability to restore a single failed channel to OPERABLE status in the time 

allowed for Required Action A.1.

If a train is inoperable, multiple channels are inoperable, or the Required 

Action and associated Completion Time of Condition A are not met, 

operation may continue as long as the Required Action for the applicable 

Conditions of LCO 3.6.3 is met for each valve made inoperable by failure 

of isolation instrumentation.

A Note is added stating that Condition B is only applicable in MODE 1, 2, 

3, or 4.

C.1 and C.2

Condition C applies to all Containment Purge and Exhaust Isolation 

Functions and addresses the train orientation of the SSPS and the master 

and slave relays for these Functions. It also addresses the failure of 

multiple radiation monitoring channels, or the inability to restore a single 

failed channel to OPERABLE status in the time allowed for Required 

Action A.1. If a train is inoperable, multiple channels are inoperable, or 

the Required Action and associated Completion Time of Condition A are 

not met, operation may continue as long as the Required Action to place 

and maintain containment purge and exhaust isolation valves in their 

closed position is met or the applicable Conditions of LCO 3.9.4, 

"Containment Penetrations," are met for each valve made inoperable by 

failure of isolation instrumentation. The Completion Time for these 

Required Actions is Immediately.

A Note states that Condition C is applicable during movement of [recently] 

irradiated fuel assemblies within containment.

SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.6-1

REQUIREMENTS determines which SRs apply to which Containment Purge and Exhaust

Isolation Functions. 
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.6.1

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION.

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 months is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.6.2

SR 3.3.6.2 is the performance of an ACTUATION LOGIC TEST. The 

train being tested is placed in the bypass condition, thus preventing 

inadvertent actuation. Through the semiautomatic tester, all possible 

logic combinations, with and without applicable permissives, are tested 

for each protection function. In addition, the master relay coil is pulse 

tested for continuity. This verifies that the logic modules are OPERABLE 

and there is an intact voltage signal path to the master relay coils. [ This 

test is performed every 31 days on a STAGGERED TEST BASIS. The 

Surveillance interval is acceptable based on instrument reliability and 

industry operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.6.3

SR 3.3.6.3 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 

large enough to demonstrate signal path continuity. [ This test is 

performed every 31 days on a STAGGERED TEST BASIS. The 

Surveillance interval is acceptable based on instrument reliability and 

industry operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.3.6.4

SR 3.3.6.4 is the performance of an ACTUATION LOGIC TEST. The 

train being tested is placed in the bypass condition, thus preventing 

inadvertent actuation. Through the semiautomatic tester, all possible 

logic combinations, with and without applicable permissives, are tested 

for each protection function. In addition, the master relay coil is pulse 

tested for continuity. This verifies that the logic modules are OPERABLE 

and there is an intact voltage signal path to the master relay coils. [ This 

test is performed every 92 days on a STAGGERED TEST BASIS. The 

Surveillance interval is justified in Reference 2.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that the Surveillance is only 

applicable to the actuation logic of the ESFAS Instrumentation. ]

[ SR 3.3.6.5

SR 3.3.6.5 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

large enough to demonstrate signal path continuity. [ This test is 

performed every 92 days on a STAGGERED TEST BASIS. The 

Surveillance interval is justified in Reference 2.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that the Surveillance is only 

applicable to the master relays of the EFAS Instrumentation. ]

SR 3.3.6.6

A COT is performed on each required channel to ensure the entire 

channel will perform the intended Function. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. [ The Frequency of 

92 days is based on the staff recommendation for increasing the 

availability of radiation monitors according to NUREG-1366 (Ref. 3). 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Containment Purge and Exhaust Isolation Instrumentation (Without Setpoint Control Program)

B 3.3.6A

Westinghouse STS B 3.3.6A-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This test verifies the capability of the instrumentation to provide the 

containment purge and exhaust system isolation. There is a plant 

specific program which verifies that the instrument channel functions as 

required by verifying the as-left and as-found setting are consistent with 

those established by the setpoint methodology.

SR 3.3.6.7

SR 3.3.6.7 is the performance of a SLAVE RELAY TEST. The SLAVE 

RELAY TEST is the energizing of the slave relays. Contact operation is 

verified in one of two ways. Actuation equipment that may be operated in 

the design mitigation mode is either allowed to function or is placed in a 

condition where the relay contact operation can be verified without 

operation of the equipment. Actuation equipment that may not be 

operated in the design mitigation mode is prevented from operation by the 

SLAVE RELAY TEST circuit. For this latter case, contact operation is 

verified by a continuity check of the circuit containing the slave relay. 

[ The Frequency of 92 days is acceptable based on instrument reliability 

and industry operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.6.8

SR 3.3.6.8 is the performance of a TADOT. This test is a check of the 

Manual Actuation Functions. Each Manual Actuation Function is tested 

up to, and including, the master relay coils. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This
Containment Purge and Exhaust Isolation Instrumentation

B 3.3.6A

Westinghouse STS B 3.3.6A-11 Rev. 4.0, 

BASES

SURVEILLANCE REQUIREMENTS (continued)

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. In some instances, 

the test includes actuation of the end device (i.e., pump starts, valve 

cycles, etc.).

The test also includes trip devices that provide actuation signals directly 

to the SSPS, bypassing the analog process control equipment. The SR is 

modified by a Note that excludes verification of setpoints during the 

TADOT. The Functions tested have no setpoints associated with them.

[ The Frequency of 18 months is based on the known reliability of the 

Function and the redundancy available, and has been shown to be 

acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.6.9

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy. There is 

a plant specific program which verifies that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology.

[ The Frequency of 18 months is based on operating experience and is 

consistent with the typical industry refueling cycle.

OR
Containment Purge and Exhaust Isolation Instrumentation

B 3.3.6A

Westinghouse STS B 3.3.6A-12 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 100.11.

2. WCAP-15376, Rev. 0, October 2000.

3. NUREG-1366, [date].
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.6B Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control 

Program)

BASES

BACKGROUND Containment purge and exhaust isolation instrumentation closes the 

containment isolation valves in the Mini Purge System and the Shutdown 

Purge System. This action isolates the containment atmosphere from the 

environment to minimize releases of radioactivity in the event of an 

accident. The Mini Purge System may be in use during reactor operation 

and the Shutdown Purge System will be in use with the reactor shutdown.

Containment purge and exhaust isolation initiates on a automatic safety 

injection (SI) signal through the Containment Isolation - Phase A 

Function, or by manual actuation of Phase A Isolation. The Bases for 

LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) 

Instrumentation," discuss these modes of initiation.

Four radiation monitoring channels are also provided as input to the 

containment purge and exhaust isolation. The four channels measure 

containment radiation at two locations. One channel is a containment 

area gamma monitor, and the other three measure radiation in a sample 

of the containment purge exhaust. The three purge exhaust radiation 

detectors are of three different types: gaseous, particulate, and iodine 

monitors. All four detectors will respond to most events that release 

radiation to containment. However, analyses have not been conducted to 

demonstrate that all credible events will be detected by more than one 

monitor. Therefore, for the purposes of this LCO the four channels are 

not considered redundant. Instead, they are treated as four one-out-ofone Functions. Since the purge exhaust monitors constitute a sampling 

system, various components such as sample line valves, sample line 

heaters, sample pumps, and filter motors are required to support monitor 

OPERABILITY.

Each of the purge systems has inner and outer containment isolation 

valves in its supply and exhaust ducts. A high radiation signal from any 

one of the four channels initiates containment purge isolation, which 

closes both inner and outer containment isolation valves in the Mini Purge 

System and the Shutdown Purge System. These systems are described 

in the Bases for LCO 3.6.3, "Containment Isolation Valves."

APPLICABLE The safety analyses assume that the containment remains intact with

SAFETY penetrations unnecessary for core cooling isolated early in the event,

ANALYSES within approximately 60 seconds. The isolation of the purge valves has 

not been analyzed mechanistically in the dose calculations, although its 
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

rapid isolation is assumed. The containment purge and exhaust isolation 

radiation monitors act as backup to the SI signal to ensure closing of the 

purge and exhaust valves. They are also the primary means for 

automatically isolating containment in the event of a fuel handling 

accident during shutdown. Containment isolation in turn ensures meeting 

the containment leakage rate assumptions of the safety analyses, and 

ensures that the calculated accidental offsite radiological doses are below 

10 CFR 100 (Ref. 1) limits. [Due to radioactive decay, containment is only 

required to isolate during fuel handling accidents involving handling 

recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor 

core within the previous [X] days).]

The containment purge and exhaust isolation instrumentation satisfies 

Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO requirements ensure that the instrumentation necessary to 

initiate Containment Purge and Exhaust Isolation, listed in Table 3.3.6-1, 

is OPERABLE.

1. Manual Initiation

The LCO requires two channels OPERABLE. The operator can 

initiate Containment Purge Isolation at any time by using either of two 

switches in the control room. Either switch actuates both trains. This 

action will cause actuation of all components in the same manner as 

any of the automatic actuation signals.

The LCO for Manual Initiation ensures the proper amount of 

redundancy is maintained in the manual actuation circuitry to ensure 

the operator has manual initiation capability.

Each channel consists of one push button and the interconnecting 

wiring to the actuation logic cabinet.

2. Automatic Actuation Logic and Actuation Relays

The LCO requires two trains of Automatic Actuation Logic and 

Actuation Relays OPERABLE to ensure that no single random failure 

can prevent automatic actuation.
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-3 Rev. 4.0

BASES

LCO (continued)

Automatic Actuation Logic and Actuation Relays consist of the same 

features and operate in the same manner as described for ESFAS 

Function 1.b, SI, and ESFAS Function 3.a, Containment Phase A 

Isolation. The applicable MODES and specified conditions for the 

containment purge isolation portion of these Functions are different 

and less restrictive than those for their Phase A isolation and SI 

roles. If one or more of the SI or Phase A isolation Functions 

becomes inoperable in such a manner that only the Containment 

Purge Isolation Function is affected, the Conditions applicable to their 

SI and Phase A isolation Functions need not be entered. The less 

restrictive Actions specified for inoperability of the Containment 

Purge Isolation Functions specify sufficient compensatory measures 

for this case.

3. Containment Radiation

The LCO specifies four required channels of radiation monitors to 

ensure that the radiation monitoring instrumentation necessary to 

initiate Containment Purge Isolation remains OPERABLE.

For sampling systems, channel OPERABILITY involves more than 

OPERABILITY of the channel electronics. OPERABILITY may also 

require correct valve lineups, sample pump operation, and filter motor 

operation, as well as detector OPERABILITY, if these supporting 

features are necessary for trip to occur under the conditions assumed 

by the safety analyses.

4. Containment Isolation - Phase A

Refer to LCO 3.3.2, Function 3.a., for all initiating Functions and 

requirements.

APPLICABILITY The Manual Initiation, Automatic Actuation Logic and Actuation Relays, 

Containment Isolation - Phase A, and Containment Radiation Functions 

are required OPERABLE in MODES 1, 2, 3, and 4, and during movement 

of [recently] irradiated fuel assemblies [(i.e., fuel that has occupied part of 

a critical reactor core within the previous [X] days)] within containment. 

Under these conditions, the potential exists for an accident that could 

release significant fission product radioactivity into containment. 

Therefore, the containment purge and exhaust isolation instrumentation 

must be OPERABLE in these MODES.
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-4 Rev. 4.0

BASES

APPLICABILITY (continued)

While in MODES 5 and 6 without fuel handling in progress, the 

containment purge and exhaust isolation instrumentation need not be 

OPERABLE since the potential for radioactive releases is minimized and 

operator action is sufficient to ensure post accident offsite doses are 

maintained within the limits of Reference 1.

The Applicability for the containment purge and exhaust isolation on the 

ESFAS Containment Isolation-Phase A Functions are specified in 

LCO 3.3.2. Refer to the Bases for LCO 3.3.2 for discussion of the 

Containment Isolation-Phases A Function Applicability.

ACTIONS The most common cause of channel inoperability is outright failure or drift 

of the bistable or process module sufficient to exceed the tolerance 

allowed by unit specific calibration procedures. Typically, the drift is 

found to be small and results in a delay of actuation rather than a total 

loss of function. This determination is generally made during the 

performance of a COT, when the process instrumentation is set up for 

adjustment to bring it within specification. If the Trip Setpoint is less 

conservative than the tolerance specified by the calibration procedure, the 

channel must be declared inoperable immediately and the appropriate 

Condition entered.

A Note has been added to the ACTIONS to clarify the application of 

Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed in Table 3.3.6-1. The 

Completion Time(s) of the inoperable channel(s)/train(s) of a Function will 

be tracked separately for each Function starting from the time the 

Condition was entered for that Function.

A.1

Condition A applies to the failure of one containment purge isolation 

radiation monitor channel. Since the four containment radiation monitors 

measure different parameters, failure of a single channel may result in 

loss of the radiation monitoring Function for certain events. 

Consequently, the failed channel must be restored to OPERABLE status. 

The 4 hours allowed to restore the affected channel is justified by the low 

likelihood of events occurring during this interval, and recognition that one 

or more of the remaining channels will respond to most events.
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-5 Rev. 4.0

BASES

ACTIONS (continued)

B.1

Condition B applies to all Containment Purge and Exhaust Isolation 

Functions and addresses the train orientation of the Solid State Protection 

System (SSPS) and the master and slave relays for these Functions. It 

also addresses the failure of multiple radiation monitoring channels, or the 

inability to restore a single failed channel to OPERABLE status in the time 

allowed for Required Action A.1.

If a train is inoperable, multiple channels are inoperable, or the Required 

Action and associated Completion Time of Condition A are not met, 

operation may continue as long as the Required Action for the applicable 

Conditions of LCO 3.6.3 is met for each valve made inoperable by failure 

of isolation instrumentation.

A Note is added stating that Condition B is only applicable in MODE 1, 2, 

3, or 4.

C.1 and C.2

Condition C applies to all Containment Purge and Exhaust Isolation 

Functions and addresses the train orientation of the SSPS and the master 

and slave relays for these Functions. It also addresses the failure of 

multiple radiation monitoring channels, or the inability to restore a single 

failed channel to OPERABLE status in the time allowed for Required 

Action A.1. If a train is inoperable, multiple channels are inoperable, or 

the Required Action and associated Completion Time of Condition A are 

not met, operation may continue as long as the Required Action to place 

and maintain containment purge and exhaust isolation valves in their 

closed position is met or the applicable Conditions of LCO 3.9.4, 

"Containment Penetrations," are met for each valve made inoperable by 

failure of isolation instrumentation. The Completion Time for these 

Required Actions is Immediately.

A Note states that Condition C is applicable during movement of [recently] 

irradiated fuel assemblies within containment.

SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.6-1

REQUIREMENTS determines which SRs apply to which Containment Purge and Exhaust

Isolation Functions. 
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.6.1

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION.

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 months is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.6.2

SR 3.3.6.2 is the performance of an ACTUATION LOGIC TEST. The 

train being tested is placed in the bypass condition, thus preventing 

inadvertent actuation. Through the semiautomatic tester, all possible 

logic combinations, with and without applicable permissives, are tested 

for each protection function. In addition, the master relay coil is pulse 

tested for continuity. This verifies that the logic modules are OPERABLE 

and there is an intact voltage signal path to the master relay coils. [ This 

test is performed every 31 days on a STAGGERED TEST BASIS. The 

Surveillance interval is acceptable based on instrument reliability and 

industry operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.6.3

SR 3.3.6.3 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 

large enough to demonstrate signal path continuity. [ This test is 

performed every 31 days on a STAGGERED TEST BASIS. The 

Surveillance interval is acceptable based on instrument reliability and 

industry operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.3.6.4

SR 3.3.6.4 is the performance of an ACTUATION LOGIC TEST. The 

train being tested is placed in the bypass condition, thus preventing 

inadvertent actuation. Through the semiautomatic tester, all possible 

logic combinations, with and without applicable permissives, are tested 

for each protection function. In addition, the master relay coil is pulse 

tested for continuity. This verifies that the logic modules are OPERABLE 

and there is an intact voltage signal path to the master relay coils. [ This 

test is performed every 92 days on a STAGGERED TEST BASIS. The 

Surveillance interval is justified in Reference 2.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that the Surveillance is only 

applicable to the actuation logic of the ESFAS Instrumentation. ]

[ SR 3.3.6.5

SR 3.3.6.5 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

large enough to demonstrate signal path continuity. [ This test is 

performed every 92 days on a STAGGERED TEST BASIS. The 

Surveillance interval is justified in Reference 2.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that the Surveillance is only 

applicable to the master relays of the EFAS Instrumentation. ]

SR 3.3.6.6

A COT is performed on each required channel to ensure the entire 

channel will perform the intended Function. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. [ The Frequency of 

92 days is based on the staff recommendation for increasing the 

availability of radiation monitors according to NUREG-1366 (Ref. 3). 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Containment Purge and Exhaust Isolation Instrumentation (With Setpoint Control Program)

B 3.3.6B

Westinghouse STS B 3.3.6B-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This test verifies the capability of the instrumentation to provide the 

containment purge and exhaust system isolation. The Setpoint Control 

Program (SCP) has controls which require verification that the instrument 

channel functions as required by verifying the as-left and as-found setting 

are consistent with those established by the setpoint methodology.

SR 3.3.6.7

SR 3.3.6.7 is the performance of a SLAVE RELAY TEST. The SLAVE 

RELAY TEST is the energizing of the slave relays. Contact operation is 

verified in one of two ways. Actuation equipment that may be operated in 

the design mitigation mode is either allowed to function or is placed in a 

condition where the relay contact operation can be verified without 

operation of the equipment. Actuation equipment that may not be 

operated in the design mitigation mode is prevented from operation by the 

SLAVE RELAY TEST circuit. For this latter case, contact operation is 

verified by a continuity check of the circuit containing the slave relay. 

[ The Frequency of 92 days is acceptable based on instrument reliability 

and industry operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.6.8

SR 3.3.6.8 is the performance of a TADOT. This test is a check of the 

Manual Actuation Functions. Each Manual Actuation Function is tested 

up to, and including, the master relay coils. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This
Containment Purge and Exhaust Isolation Instrumentation

B 3.3.6B

Westinghouse STS B 3.3.6B-11 Rev. 4.0, 

BASES

SURVEILLANCE REQUIREMENTS (continued)

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. In some instances, 

the test includes actuation of the end device (i.e., pump starts, valve 

cycles, etc.).

The test also includes trip devices that provide actuation signals directly 

to the SSPS, bypassing the analog process control equipment. The SR is 

modified by a Note that excludes verification of setpoints during the 

TADOT. The Functions tested have no setpoints associated with them.

[ The Frequency of 18 months is based on the known reliability of the 

Function and the redundancy available, and has been shown to be 

acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.6.9

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy. The SCP 

has controls which require verification that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology.

[ The Frequency of 18 months is based on operating experience and is 

consistent with the typical industry refueling cycle.

OR
Containment Purge and Exhaust Isolation Instrumentation

B 3.3.6B

Westinghouse STS B 3.3.6B-12 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 100.11.

2. WCAP-15376, Rev. 0, October 2000.

3. NUREG-1366, [date].
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.7A Control Room Emergency Filtration System (CREFS) Actuation Instrumentation

(Without Setpoint Control Program)

BASES

BACKGROUND The CREFS provides an enclosed control room environment from which 

the unit can be operated following an uncontrolled release of radioactivity. 

During normal operation, the Auxiliary Building Ventilation System 

provides control room ventilation. Upon receipt of an actuation signal, the 

CREFS initiates filtered ventilation and pressurization of the control room. 

This system is described in the Bases for LCO 3.7.10, "Control Room 

Emergency Filtration System."

The actuation instrumentation consists of redundant radiation monitors in 

the air intakes and control room area. A high radiation signal from any of 

these detectors will initiate both trains of the CREFS. The control room 

operator can also initiate CREFS trains by manual switches in the control 

room. The CREFS is also actuated by a safety injection (SI) signal. The 

SI Function is discussed in LCO 3.3.2, "Engineered Safety Feature 

Actuation System (ESFAS) Instrumentation."

APPLICABLE The control room must be kept habitable for the operators stationed there

SAFETY during accident recovery and post accident operations.

ANALYSES

The CREFS acts to terminate the supply of unfiltered outside air to the 

control room, initiate filtration, and pressurize the control room. These 

actions are necessary to ensure the control room is kept habitable for the 

operators stationed there during accident recovery and post accident 

operations by minimizing the radiation exposure of control room 

personnel.

In MODES 1, 2, 3, and 4, the radiation monitor actuation of the CREFS is 

a backup for the SI signal actuation. This ensures initiation of the CREFS 

during a loss of coolant accident or steam generator tube rupture.

The radiation monitor actuation of the CREFS in MODES 5 and 6, and 

during movement of [recently] irradiated fuel assemblies are the primary 

means to ensure control room habitability in the event of a fuel handling 

or waste gas decay tank rupture accident.

The CREFS actuation instrumentation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii).
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-2 Rev. 4.0

BASES

LCO The LCO requirements ensure that instrumentation necessary to initiate 

the CREFS is OPERABLE.

1. Manual Initiation

The LCO requires two channels OPERABLE. The operator can 

initiate the CREFS at any time by using either of two switches in the 

control room. This action will cause actuation of all components in 

the same manner as any of the automatic actuation signals.

The LCO for Manual Initiation ensures the proper amount of 

redundancy is maintained in the manual actuation circuitry to ensure 

the operator has manual initiation capability.

Each channel consists of one push button and the interconnecting 

wiring to the actuation logic cabinet.

2. Automatic Actuation Logic and Actuation Relays

The LCO requires two trains of Actuation Logic and Relays 

OPERABLE to ensure that no single random failure can prevent 

automatic actuation.

Automatic Actuation Logic and Actuation Relays consist of the same 

features and operate in the same manner as described for ESFAS 

Function 1.b., SI, in LCO 3.3.2. The applicable MODES and 

specified conditions for the CREFS portion of these functions are 

different and less restrictive than those specified for their SI roles. If 

one or more of the SI functions becomes inoperable in such a 

manner that only the CREFS function is affected, the Conditions 

applicable to their SI function need not be entered. The less 

restrictive Actions specified for inoperability of the CREFS Functions 

specify sufficient compensatory measures for this case.

3. Control Room Radiation

The LCO specifies two required Control Room Atmosphere Radiation 

Monitors and two required Control Room Air Intake Radiation 

Monitors to ensure that the radiation monitoring instrumentation 

necessary to initiate the CREFS remains OPERABLE.

For sampling systems, channel OPERABILITY involves more than 

OPERABILITY of channel electronics. OPERABILITY may also 

require correct valve lineups, sample pump operation, and filter motor 

operation, as well as detector OPERABILITY, if these supporting 

features are necessary for trip to occur under the conditions assumed 

by the safety analyses.
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-3 Rev. 4.0

BASES

LCO (continued)

4. Safety Injection

Refer to LCO 3.3.2, Function 1, for all initiating Functions and 

requirements.

APPLICABILITY The CREFS Functions must be OPERABLE in MODES 1, 2, 3, 4, and 

during movement of [recently] irradiated fuel assemblies. The Functions 

must also be OPERABLE in MODES [5 and 6] when required for a waste 

gas decay tank rupture accident, to ensure a habitable environment for 

the control room operators.

The Applicability for the CREFS actuation on the ESFAS Safety Injection 

Functions are specified in LCO 3.3.2. Refer to the Bases for LCO 3.3.2 

for discussion of the Safety Injection Function Applicability.

ACTIONS The most common cause of channel inoperability is outright failure or drift 

of the bistable or process module sufficient to exceed the tolerance 

allowed by the unit specific calibration procedures. Typically, the drift is 

found to be small and results in a delay of actuation rather than a total 

loss of function. This determination is generally made during the 

performance of a COT, when the process instrumentation is set up for 

adjustment to bring it within specification. If the Trip Setpoint is less 

conservative than the tolerance specified by the calibration procedure, the 

channel must be declared inoperable immediately and the appropriate 

Condition entered.

A Note has been added to the ACTIONS indicating that separate 

Condition entry is allowed for each Function. The Conditions of this 

Specification may be entered independently for each Function listed in 

Table 3.3.7-1 in the accompanying LCO. The Completion Time(s) of the 

inoperable channel(s)/train(s) of a Function will be tracked separately for 

each Function starting from the time the Condition was entered for that 

Function.

A.1

Condition A applies to the actuation logic train Function of the CREFS, 

the radiation monitor channel Functions, and the manual channel 

Functions.
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-4 Rev. 4.0

BASES

ACTIONS (continued)

If one train is inoperable, or one radiation monitor channel is inoperable in 

one or more Functions, 7 days are permitted to restore it to OPERABLE 

status. The 7 day Completion Time is the same as is allowed if one train 

of the mechanical portion of the system is inoperable. The basis for this 

Completion Time is the same as provided in LCO 3.7.10. If the 

channel/train cannot be restored to OPERABLE status, one CREFS train 

must be placed in the emergency radiation protection mode of operation. 

This accomplishes the actuation instrumentation Function and places the 

unit in a conservative mode of operation.

The Required Action for Condition A is modified by a Note that requires 

placing one CREFS train in the toxic gas protection mode instead of the 

[radiation protection] mode of operation if the automatic transfer to toxic 

gas protection mode is inoperable. This ensures the CREFS train is 

placed in the most conservative mode of operation relative to the 

OPERABILITY of the associated actuation instrumentation.

B.1.1, B.1.2, and B.2

Condition B applies to the failure of two CREFS actuation trains, two 

radiation monitor channels, or two manual channels. The first Required 

Action is to place one CREFS train in the emergency [radiation protection] 

mode of operation immediately. This accomplishes the actuation 

instrumentation Function that may have been lost and places the unit in a 

conservative mode of operation. The applicable Conditions and Required 

Actions of LCO 3.7.10 must also be entered for the CREFS train made 

inoperable by the inoperable actuation instrumentation. This ensures 

appropriate limits are placed upon train inoperability as discussed in the 

Bases for LCO 3.7.10.

Alternatively, both trains may be placed in the emergency [radiation 

protection] mode. This ensures the CREFS function is performed even in 

the presence of a single failure.

The Required Action for Condition B is modified by a Note that requires 

placing one CREFS train in the toxic gas protection mode instead of the 

[radiation protection] mode of operation if the automatic transfer to toxic 

gas protection mode is inoperable. This ensures the CREFS train is 

placed in the most conservative mode of operation relative to the 

OPERABILITY of the associated actuation instrumentation.
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-5 Rev. 4.0

BASES

ACTIONS (continued)

C.1 and C.2

Condition C applies when the Required Action and associated 

Completion Time for Condition A or B have not been met and the unit is in 

MODE 1, 2, 3, or 4. The unit must be brought to a MODE in which the 

LCO requirements are not applicable. To achieve this status, the unit 

must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

D.1

Condition D applies when the Required Action and associated 

Completion Time for Condition A or B have not been met when [recently] 

irradiated fuel assemblies are being moved. Movement of [recently] 

irradiated fuel assemblies must be suspended immediately to reduce the 

risk of accidents that would require CREFS actuation.

E.1

Condition E applies when the Required Action and associated Completion 

Time for Condition A or B have not been met in MODE 5 or 6. Actions 

must be initiated to restore the inoperable train(s) to OPERABLE status 

immediately to ensure adequate isolation capability in the event of a 

waste gas decay tank rupture.

SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.7-1

REQUIREMENTS determines which SRs apply to which CREFS Actuation Functions.

SR 3.3.7.1

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION.
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.7.2

A COT is performed on each required channel to ensure the entire 

channel will perform the intended function. This test verifies the capability 

of the instrumentation to provide the CREFS actuation. A successful test 

of the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. There is a plant 

specific program which verifies that the instrument channel functions as 

required by verifying the as-left and as-found setting are consistent with 

those established by the setpoint methodology. [ The Frequency of 

92 days is based on the known reliability of the monitoring equipment and 

has been shown to be acceptable through operating experience.

OR
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.7.3

SR 3.3.7.3 is the performance of an ACTUATION LOGIC TEST. The 

train being tested is placed in the bypass condition, thus preventing 

inadvertent actuation. Through the semiautomatic tester, all possible 

logic combinations, with and without applicable permissives, are tested 

for each protection function. In addition, the master relay coil is pulse 

tested for continuity. This verifies that the logic modules are OPERABLE 

and there is an intact voltage signal path to the master relay coils. [ This 

test is performed every 31 days on a STAGGERED TEST BASIS. The 

Frequency is acceptable based on instrument reliability and industry 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.7.4

SR 3.3.7.4 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 

large enough to demonstrate signal path continuity. [ This test is 

performed every 31 days on a STAGGERED TEST BASIS. The 

Frequency is acceptable based on instrument reliability and industry 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.3.7.5

SR 3.3.7.5 is the performance of an ACTUATION LOGIC TEST. The 

train being tested is placed in the bypass condition, thus preventing 

inadequate actuation. Through the semiautomatic tester, all possible 

logic combinations, with and without applicable permissives, are tested 

for each protection function. In addition, the master relay coil is pulse 

tested for continuity. This verifies that the logic modules are OPERABLE

and there is an intact voltage signal path to the master relay coils. [ This 

test is performed ever 92 days on a STAGGERED TEST BASIS. The 

Surveillance interval is justified in Reference 1.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that the Surveillance is only 

applicable to the actuation logic of the ESFAS Instrumentation. ]

[ SR 3.3.7.6

SR 3.3.7.6 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 

large enough to demonstrate signal path continuity. [ This test is 

performed every 92 days on a STAGGERED TEST BASIS. The 

Surveillance interval is justified in Reference 1.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that the Surveillance is only 

applicable to the master relays of the ESFAS Instrumentation. ] 
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.7.7

SR 3.3.7.7 is the performance of a SLAVE RELAY TEST. The SLAVE 

RELAY TEST is the energizing of the slave relays. Contact operation is 

verified in one of two ways. Actuation equipment that may be operated in 

the design mitigation MODE is either allowed to function or is placed in a 

condition where the relay contact operation can be verified without 

operation of the equipment. Actuation equipment that may not be 

operated in the design mitigation MODE is prevented from operation by 

the SLAVE RELAY TEST circuit. For this latter case, contact operation is 

verified by a continuity check of the circuit containing the slave relay. 

[ This test is performed every [92] days. The Frequency is acceptable 

based on instrument reliability and industry operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.7.8

SR 3.3.7.8 is the performance of a TADOT. This test is a check of the 

Manual Actuation Functions. Each Manual Actuation Function is tested 

up to, and including, the master relay coils. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. In some instances, 

the test includes actuation of the end device (i.e., pump starts, valve 

cycles, etc.).
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-11 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The test also includes trip devices that provide actuation signals directly 

to the Solid State Protection System, bypassing the analog process 

control equipment. [ The Frequency of 18 months is based on the known 

reliability of the Function and the redundancy available, and has been 

shown to be acceptable through operating experience. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note that excludes verification of setpoints during 

the TADOT. The Functions tested have no setpoints associated with 

them.

SR 3.3.7.9

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy.

There is a plant specific program which verifies that the instrument 

channel functions as required by verifying the as-left and as-found setting 

are consistent with those established by the setpoint methodology.

[ The Frequency of 18 months is based on operating experience and is 

consistent with the typical industry refueling cycle.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
CREFS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.7A

Westinghouse STS B 3.3.7A-12 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. WCAP-15376, Rev. 0, October 2000.
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.7B Control Room Emergency Filtration System (CREFS) Actuation Instrumentation (With 

Setpoint Control Program)

BASES

BACKGROUND The CREFS provides an enclosed control room environment from which 

the unit can be operated following an uncontrolled release of radioactivity. 

During normal operation, the Auxiliary Building Ventilation System 

provides control room ventilation. Upon receipt of an actuation signal, the 

CREFS initiates filtered ventilation and pressurization of the control room. 

This system is described in the Bases for LCO 3.7.10, "Control Room 

Emergency Filtration System."

The actuation instrumentation consists of redundant radiation monitors in 

the air intakes and control room area. A high radiation signal from any of 

these detectors will initiate both trains of the CREFS. The control room 

operator can also initiate CREFS trains by manual switches in the control 

room. The CREFS is also actuated by a safety injection (SI) signal. The 

SI Function is discussed in LCO 3.3.2, "Engineered Safety Feature 

Actuation System (ESFAS) Instrumentation."

APPLICABLE The control room must be kept habitable for the operators stationed there

SAFETY during accident recovery and post accident operations.

ANALYSES

The CREFS acts to terminate the supply of unfiltered outside air to the 

control room, initiate filtration, and pressurize the control room. These 

actions are necessary to ensure the control room is kept habitable for the 

operators stationed there during accident recovery and post accident 

operations by minimizing the radiation exposure of control room 

personnel.

In MODES 1, 2, 3, and 4, the radiation monitor actuation of the CREFS is 

a backup for the SI signal actuation. This ensures initiation of the CREFS 

during a loss of coolant accident or steam generator tube rupture.

The radiation monitor actuation of the CREFS in MODES 5 and 6, and 

during movement of [recently] irradiated fuel assemblies are the primary 

means to ensure control room habitability in the event of a fuel handling 

or waste gas decay tank rupture accident.

The CREFS actuation instrumentation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii).
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-2 Rev. 4.0

BASES

LCO The LCO requirements ensure that instrumentation necessary to initiate 

the CREFS is OPERABLE.

1. Manual Initiation

The LCO requires two channels OPERABLE. The operator can 

initiate the CREFS at any time by using either of two switches in the 

control room. This action will cause actuation of all components in 

the same manner as any of the automatic actuation signals.

The LCO for Manual Initiation ensures the proper amount of 

redundancy is maintained in the manual actuation circuitry to ensure 

the operator has manual initiation capability.

Each channel consists of one push button and the interconnecting 

wiring to the actuation logic cabinet.

2. Automatic Actuation Logic and Actuation Relays

The LCO requires two trains of Actuation Logic and Relays 

OPERABLE to ensure that no single random failure can prevent 

automatic actuation.

Automatic Actuation Logic and Actuation Relays consist of the same 

features and operate in the same manner as described for ESFAS 

Function 1.b., SI, in LCO 3.3.2. The applicable MODES and 

specified conditions for the CREFS portion of these functions are 

different and less restrictive than those specified for their SI roles. If 

one or more of the SI functions becomes inoperable in such a 

manner that only the CREFS function is affected, the Conditions 

applicable to their SI function need not be entered. The less 

restrictive Actions specified for inoperability of the CREFS Functions 

specify sufficient compensatory measures for this case.

3. Control Room Radiation

The LCO specifies two required Control Room Atmosphere Radiation 

Monitors and two required Control Room Air Intake Radiation 

Monitors to ensure that the radiation monitoring instrumentation 

necessary to initiate the CREFS remains OPERABLE.

For sampling systems, channel OPERABILITY involves more than 

OPERABILITY of channel electronics. OPERABILITY may also 

require correct valve lineups, sample pump operation, and filter motor 

operation, as well as detector OPERABILITY, if these supporting 

features are necessary for trip to occur under the conditions assumed 

by the safety analyses.
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-3 Rev. 4.0

BASES

LCO (continued)

4. Safety Injection

Refer to LCO 3.3.2, Function 1, for all initiating Functions and 

requirements.

APPLICABILITY The CREFS Functions must be OPERABLE in MODES 1, 2, 3, 4, and 

during movement of [recently] irradiated fuel assemblies. The Functions 

must also be OPERABLE in MODES [5 and 6] when required for a waste 

gas decay tank rupture accident, to ensure a habitable environment for 

the control room operators.

The Applicability for the CREFS actuation on the ESFAS Safety Injection 

Functions are specified in LCO 3.3.2. Refer to the Bases for LCO 3.3.2 

for discussion of the Safety Injection Function Applicability.

ACTIONS The most common cause of channel inoperability is outright failure or drift 

of the bistable or process module sufficient to exceed the tolerance 

allowed by the unit specific calibration procedures. Typically, the drift is 

found to be small and results in a delay of actuation rather than a total 

loss of function. This determination is generally made during the 

performance of a COT, when the process instrumentation is set up for 

adjustment to bring it within specification. If the Trip Setpoint is less 

conservative than the tolerance specified by the calibration procedure, the 

channel must be declared inoperable immediately and the appropriate 

Condition entered.

A Note has been added to the ACTIONS indicating that separate 

Condition entry is allowed for each Function. The Conditions of this 

Specification may be entered independently for each Function listed in 

Table 3.3.7-1 in the accompanying LCO. The Completion Time(s) of the 

inoperable channel(s)/train(s) of a Function will be tracked separately for 

each Function starting from the time the Condition was entered for that 

Function.

A.1

Condition A applies to the actuation logic train Function of the CREFS, 

the radiation monitor channel Functions, and the manual channel 

Functions.
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-4 Rev. 4.0

BASES

ACTIONS (continued)

If one train is inoperable, or one radiation monitor channel is inoperable in 

one or more Functions, 7 days are permitted to restore it to OPERABLE 

status. The 7 day Completion Time is the same as is allowed if one train 

of the mechanical portion of the system is inoperable. The basis for this 

Completion Time is the same as provided in LCO 3.7.10. If the 

channel/train cannot be restored to OPERABLE status, one CREFS train 

must be placed in the emergency radiation protection mode of operation. 

This accomplishes the actuation instrumentation Function and places the 

unit in a conservative mode of operation.

The Required Action for Condition A is modified by a Note that requires 

placing one CREFS train in the toxic gas protection mode instead of the 

[radiation protection] mode of operation if the automatic transfer to toxic 

gas protection mode is inoperable. This ensures the CREFS train is 

placed in the most conservative mode of operation relative to the 

OPERABILITY of the associated actuation instrumentation.

B.1.1, B.1.2, and B.2

Condition B applies to the failure of two CREFS actuation trains, two 

radiation monitor channels, or two manual channels. The first Required 

Action is to place one CREFS train in the emergency [radiation protection] 

mode of operation immediately. This accomplishes the actuation 

instrumentation Function that may have been lost and places the unit in a 

conservative mode of operation. The applicable Conditions and Required 

Actions of LCO 3.7.10 must also be entered for the CREFS train made 

inoperable by the inoperable actuation instrumentation. This ensures 

appropriate limits are placed upon train inoperability as discussed in the 

Bases for LCO 3.7.10.

Alternatively, both trains may be placed in the emergency [radiation 

protection] mode. This ensures the CREFS function is performed even in 

the presence of a single failure.

The Required Action for Condition B is modified by a Note that requires 

placing one CREFS train in the toxic gas protection mode instead of the 

[radiation protection] mode of operation if the automatic transfer to toxic 

gas protection mode is inoperable. This ensures the CREFS train is 

placed in the most conservative mode of operation relative to the 

OPERABILITY of the associated actuation instrumentation.
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-5 Rev. 4.0

BASES

ACTIONS (continued)

C.1 and C.2

Condition C applies when the Required Action and associated 

Completion Time for Condition A or B have not been met and the unit is in 

MODE 1, 2, 3, or 4. The unit must be brought to a MODE in which the 

LCO requirements are not applicable. To achieve this status, the unit 

must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

D.1

Condition D applies when the Required Action and associated 

Completion Time for Condition A or B have not been met when [recently] 

irradiated fuel assemblies are being moved. Movement of [recently] 

irradiated fuel assemblies must be suspended immediately to reduce the 

risk of accidents that would require CREFS actuation.

E.1

Condition E applies when the Required Action and associated Completion

Time for Condition A or B have not been met in MODE 5 or 6. Actions 

must be initiated to restore the inoperable train(s) to OPERABLE status 

immediately to ensure adequate isolation capability in the event of a 

waste gas decay tank rupture.

SURVEILLANCE A Note has been added to the SR Table to clarify that Table 3.3.7-1

REQUIREMENTS determines which SRs apply to which CREFS Actuation Functions.

SR 3.3.7.1

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION.
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.7.2

A COT is performed on each required channel to ensure the entire 

channel will perform the intended function. This test verifies the capability 

of the instrumentation to provide the CREFS actuation. A successful test 

of the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The Setpoint 

Control Program (SCP) has controls which require verification that the 

instrument channel functions as required by verifying the as-left and asfound setting are consistent with those established by the setpoint 

methodology. [ The Frequency of 92 days is based on the known 

reliability of the monitoring equipment and has been shown to be 

acceptable through operating experience.

OR
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.7.3

SR 3.3.7.3 is the performance of an ACTUATION LOGIC TEST. The 

train being tested is placed in the bypass condition, thus preventing 

inadvertent actuation. Through the semiautomatic tester, all possible 

logic combinations, with and without applicable permissives, are tested 

for each protection function. In addition, the master relay coil is pulse 

tested for continuity. This verifies that the logic modules are OPERABLE 

and there is an intact voltage signal path to the master relay coils. [ This 

test is performed every 31 days on a STAGGERED TEST BASIS. The 

Frequency is acceptable based on instrument reliability and industry 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.7.4

SR 3.3.7.4 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 

large enough to demonstrate signal path continuity. [ This test is 

performed every 31 days on a STAGGERED TEST BASIS. The 

Frequency is acceptable based on instrument reliability and industry 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.3.7.5

SR 3.3.7.5 is the performance of an ACTUATION LOGIC TEST. The 

train being tested is placed in the bypass condition, thus preventing 

inadequate actuation. Through the semiautomatic tester, all possible 

logic combinations, with and without applicable permissives, are tested 

for each protection function. In addition, the master relay coil is pulse 

tested for continuity. This verifies that the logic modules are OPERABLE 

and there is an intact voltage signal path to the master relay coils. [ This 

test is performed ever 92 days on a STAGGERED TEST BASIS. The 

Surveillance interval is justified in Reference 1.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that the Surveillance is only 

applicable to the actuation logic of the ESFAS Instrumentation. ]

[ SR 3.3.7.6

SR 3.3.7.6 is the performance of a MASTER RELAY TEST. The 

MASTER RELAY TEST is the energizing of the master relay, verifying 

contact operation and a low voltage continuity check of the slave relay 

coil. Upon master relay contact operation, a low voltage is injected to the 

slave relay coil. This voltage is insufficient to pick up the slave relay, but 

large enough to demonstrate signal path continuity. [ This test is 

performed every 92 days on a STAGGERED TEST BASIS. The 

Surveillance interval is justified in Reference 1.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that the Surveillance is only 

applicable to the master relays of the ESFAS Instrumentation. ] 
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.7.7

SR 3.3.7.7 is the performance of a SLAVE RELAY TEST. The SLAVE 

RELAY TEST is the energizing of the slave relays. Contact operation is 

verified in one of two ways. Actuation equipment that may be operated in 

the design mitigation MODE is either allowed to function or is placed in a 

condition where the relay contact operation can be verified without 

operation of the equipment. Actuation equipment that may not be 

operated in the design mitigation MODE is prevented from operation by 

the SLAVE RELAY TEST circuit. For this latter case, contact operation is 

verified by a continuity check of the circuit containing the slave relay. 

[ This test is performed every [92] days. The Frequency is acceptable 

based on instrument reliability and industry operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.7.8

SR 3.3.7.8 is the performance of a TADOT. This test is a check of the 

Manual Actuation Functions. Each Manual Actuation Function is tested 

up to, and including, the master relay coils. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable TADOT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. In some instances, 

the test includes actuation of the end device (i.e., pump starts, valve 

cycles, etc.).
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-11 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The test also includes trip devices that provide actuation signals directly 

to the Solid State Protection System, bypassing the analog process 

control equipment. [ The Frequency of 18 months is based on the known 

reliability of the Function and the redundancy available, and has been 

shown to be acceptable through operating experience. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note that excludes verification of setpoints during 

the TADOT. The Functions tested have no setpoints associated with 

them.

SR 3.3.7.9

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy.

The SCP has controls which require verification that the instrument 

channel functions as required by verifying the as-left and as-found setting 

are consistent with those established by the setpoint methodology.

[ The Frequency of 18 months is based on operating experience and is 

consistent with the typical industry refueling cycle.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
CREFS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.7B

Westinghouse STS B 3.3.7B-12 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. WCAP-15376, Rev. 0, October 2000.
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.8A Fuel Building Air Cleanup System (FBACS) Actuation Instrumentation (Without 

Setpoint Control Program)

BASES

BACKGROUND The FBACS ensures that radioactive materials in the fuel building 

atmosphere following a fuel handling accident [involving handling recently 

irradiated fuel] or a loss of coolant accident (LOCA) are filtered and 

adsorbed prior to exhausting to the environment. The system is 

described in the Bases for LCO 3.7.13, "Fuel Building Air Cleanup 

System." The system initiates filtered ventilation of the fuel building 

automatically following receipt of a high radiation signal (gaseous or 

particulate) or a safety injection (SI) signal. Initiation may also be 

performed manually as needed from the main control room.

High gaseous and particulate radiation, each monitored by either of two 

monitors, provides FBACS initiation. Each FBACS train is initiated by 

high radiation detected by a channel dedicated to that train. There are a 

total of two channels, one for each train. Each channel contains a 

gaseous and particulate monitor. High radiation detected by any monitor 

or an SI signal from the Engineered Safety Features Actuation System 

(ESFAS) initiates fuel building isolation and starts the FBACS. These 

actions function to prevent exfiltration of contaminated air by initiating 

filtered ventilation, which imposes a negative pressure on the fuel 

building. Since the radiation monitors include an air sampling system, 

various components such as sample line valves, sample line heaters, 

sample pumps, and filter motors are required to support monitor 

OPERABILITY.

APPLICABLE The FBACS ensures that radioactive materials in the fuel building

SAFETY atmosphere following a fuel handling accident [involving handling

ANALYSES recently irradiated fuel] or a LOCA are filtered and adsorbed prior to being 

exhausted to the environment. This action reduces the radioactive 

content in the fuel building exhaust following a LOCA or fuel handling 

accident so that offsite doses remain within the limits specified in 

10 CFR 100 (Ref. 1).

The FBACS actuation instrumentation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO The LCO requirements ensure that instrumentation necessary to initiate 

the FBACS is OPERABLE.
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-2 Rev. 4.0

BASES

LCO (continued)

1. Manual Initiation

The LCO requires two channels OPERABLE. The operator can 

initiate the FBACS at any time by using either of two switches in the 

control room. This action will cause actuation of all components in 

the same manner as any of the automatic actuation signals.

The LCO for Manual Initiation ensures the proper amount of 

redundancy is maintained in the manual actuation circuitry to ensure 

the operator has manual initiation capability.

Each channel consists of one push button and the interconnecting 

wiring to the actuation logic cabinet.

2. Automatic Actuation Logic and Actuation Relays

The LCO requires two trains of Actuation Logic and Relays 

OPERABLE to ensure that no single random failure can prevent 

automatic actuation.

Automatic Actuation Logic and Actuation Relays consist of the same 

features and operate in the same manner as described for ESFAS 

Function 1.b., SI, in LCO 3.3.2. The applicable MODES and 

specified conditions for the FBACS portion of these functions are 

different and less restrictive than those specified for their SI roles. If 

one or more of the SI functions becomes inoperable in such a 

manner that only the FBACS function is affected, the Conditions 

applicable to their SI function need not be entered. The less 

restrictive Actions specified for inoperability of the FBACS functions 

specify sufficient compensatory measures for this case.

3. Fuel Building Radiation

The LCO specifies two required Gaseous Radiation Monitor channels 

and two required Particulate Radiation Monitor channels to ensure 

that the radiation monitoring instrumentation necessary to initiate the 

FBACS remains OPERABLE.

For sampling systems, channel OPERABILITY involves more than 

OPERABILITY of channel electronics. OPERABILITY may also 

require correct valve lineups, sample pump operation, filter motor 

operation, detector OPERABILITY, if these supporting features are 

necessary for actuation to occur under the conditions assumed by 

the safety analyses.
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-3 Rev. 4.0

BASES

LCO (continued)

Only the Trip Setpoint is specified for each FBACS Function in the LCO. 

The Trip Setpoint limits account for instrument uncertainties, which are 

defined in the Unit Specific Setpoint Calibration Procedure (Ref. 2).

APPLICABILITY The manual FBACS initiation must be OPERABLE in MODES [1, 2, 3, 

and 4] and when moving [recently] irradiated fuel assemblies in the fuel 

building, to ensure the FBACS operates to remove fission products 

associated with leakage after a LOCA or a fuel handling accident 

[involving handling recently irradiated fuel]. The automatic FBACS 

actuation instrumentation is also required in MODES [1, 2, 3, and 4] to 

remove fission products caused by post LOCA Emergency Core Cooling 

Systems leakage.

High radiation initiation of the FBACS must be OPERABLE in any MODE 

during movement of [recently] irradiated fuel assemblies in the fuel 

building to ensure automatic initiation of the FBACS when the potential for 

the limiting fuel handling accident exists. [Due to radioactive decay, the 

FBACS instrumentation is only required to be OPERABLE during fuel 

handling involving handling recently irradiated fuel (i.e., fuel that has 

occupied part of a critical reactor core within the previous [X] days).] 

While in MODES 5 and 6 without fuel handling [involving handling 

recently irradiated fuel] in progress, the FBACS instrumentation need not 

be OPERABLE since a fuel handling accident [involving handling recently 

irradiated fuel] cannot occur.

ACTIONS The most common cause of channel inoperability is outright failure or drift 

of the bistable or process module sufficient to exceed the tolerance 

allowed by unit specific calibration procedures. Typically, the drift is 

found to be small and results in a delay of actuation rather than a total 

loss of function. This determination is generally made during the 

performance of a COT, when the process instrumentation is set up for 

adjustment to bring it within specification. If the Trip Setpoint is less 

conservative than the tolerance specified by the calibration procedure, the 

channel must be declared inoperable immediately and the appropriate 

Condition entered.

LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily.
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-4 Rev. 4.0

BASES

ACTIONS (continued)

A second Note has been added to the ACTIONS to clarify the application 

of Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed in Table 3.3.8-1 in the 

accompanying LCO. The Completion Time(s) of the inoperable 

channel(s)/train(s) of a Function will be tracked separately for each 

Function starting from the time the Condition was entered for that 

Function.

A.1

Condition A applies to the actuation logic train function of the Solid State 

Protection System (SSPS), the radiation monitor functions, and the 

manual function. Condition A applies to the failure of a single actuation 

logic train, radiation monitor channel, or manual channel. If one channel 

or train is inoperable, a period of 7 days is allowed to restore it to 

OPERABLE status. If the train cannot be restored to OPERABLE status, 

one FBACS train must be placed in operation. This accomplishes the 

actuation instrumentation function and places the unit in a conservative 

mode of operation. The 7 day Completion Time is the same as is allowed 

if one train of the mechanical portion of the system is inoperable. The 

basis for this time is the same as that provided in LCO 3.7.13.

B.1.1, B.1.2, B.2

Condition B applies to the failure of two FBACS actuation logic trains, two 

radiation monitors, or two manual channels. The Required Action is to 

place one FBACS train in operation immediately. This accomplishes the 

actuation instrumentation function that may have been lost and places the 

unit in a conservative mode of operation. The applicable Conditions and 

Required Actions of LCO 3.7.13 must also be entered for the FBACS train 

made inoperable by the inoperable actuation instrumentation. This 

ensures appropriate limits are placed on train inoperability as discussed 

in the Bases for LCO 3.7.13.

Alternatively, both trains may be placed in the emergency [radiation 

protection] mode. This ensures the FBACS Function is performed even 

in the presence of a single failure.
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-5 Rev. 4.0

BASES

ACTIONS (continued)

C.1

Condition C applies when the Required Action and associated 

Completion Time for Condition A or B have not been met and [recently] 

irradiated fuel assemblies are being moved in the fuel building. 

Movement of [recently] irradiated fuel assemblies in the fuel building must 

be suspended immediately to eliminate the potential for events that could 

require FBACS actuation.

D.1 and D.2

Condition D applies when the Required Action and associated 

Completion Time for Condition A or B have not been met and the unit is in 

MODE 1, 2, 3, or 4. The unit must be brought to a MODE in which the 

LCO requirements are not applicable. To achieve this status, the unit 

must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE A Note has been added to the SR Table to clarify that table 3.3.8-1

REQUIREMENTS determines which SRs apply to which FBACS Actuation Functions.

SR 3.3.8.1

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION.

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.8.2

A COT is performed on each required channel to ensure the entire 

channel will perform the intended function. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. This test verifies 

the capability of the instrumentation to provide the FBACS actuation. 

There is a plant specific program which verifies that the instrument 

channel functions as required by verifying the as-left and as-found setting 

are consistent with those established by the setpoint methodology. 

[ The Frequency of 92 days is based on the known reliability of the 

monitoring equipment and has been shown to be acceptable through 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.8.3

[ SR 3.3.8.3 is the performance of an ACTUATION LOGIC TEST. All 

possible logic combinations, with and without applicable permissives, are 

tested for each protection function. [ The actuation logic is tested every 

31 days on a STAGGERED TEST BASIS. The Frequency is based on 

the known reliability of the relays and controls and the multichannel 

redundancy available, and has been shown to be acceptable through 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

SR 3.3.8.4

SR 3.3.8.4 is the performance of a TADOT. This test is a check of the 

manual actuation functions. Each manual actuation function is tested up 

to, and including, the master relay coils. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable TADOT of a relay. This is acceptable because all of the other 

required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

refueling interval with applicable extensions. In some instances, the test 

includes actuation of the end device (e.g., pump starts, valve cycles, etc.). 

[ The Frequency of 18 months is based on operating experience and is 

consistent with the typical industry refueling cycle. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note that excludes verification of setpoints during 

the TADOT. The Functions tested have no setpoints associated with 

them.

SR 3.3.8.5

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy. There is 

a plant specific program which verifies that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology.

[ The Frequency of [18] months is based on operating experience and is 

consistent with the typical industry refueling cycle.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
FBACS Actuation Instrumentation (Without Setpoint Control Program)

B 3.3.8A

Westinghouse STS B 3.3.8A-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 100.11.

2. Unit Specific Setpoint Calibration Procedure.

FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.8B Fuel Building Air Cleanup System (FBACS) Actuation Instrumentation (With Setpoint 

Control Program)

BASES

BACKGROUND The FBACS ensures that radioactive materials in the fuel building 

atmosphere following a fuel handling accident [involving handling recently 

irradiated fuel] or a loss of coolant accident (LOCA) are filtered and 

adsorbed prior to exhausting to the environment. The system is 

described in the Bases for LCO 3.7.13, "Fuel Building Air Cleanup 

System." The system initiates filtered ventilation of the fuel building 

automatically following receipt of a high radiation signal (gaseous or 

particulate) or a safety injection (SI) signal. Initiation may also be 

performed manually as needed from the main control room.

High gaseous and particulate radiation, each monitored by either of two 

monitors, provides FBACS initiation. Each FBACS train is initiated by 

high radiation detected by a channel dedicated to that train. There are a 

total of two channels, one for each train. Each channel contains a 

gaseous and particulate monitor. High radiation detected by any monitor 

or an SI signal from the Engineered Safety Features Actuation System 

(ESFAS) initiates fuel building isolation and starts the FBACS. These 

actions function to prevent exfiltration of contaminated air by initiating 

filtered ventilation, which imposes a negative pressure on the fuel 

building. Since the radiation monitors include an air sampling system, 

various components such as sample line valves, sample line heaters, 

sample pumps, and filter motors are required to support monitor 

OPERABILITY.

APPLICABLE The FBACS ensures that radioactive materials in the fuel building

SAFETY atmosphere following a fuel handling accident [involving handling

ANALYSES recently irradiated fuel] or a LOCA are filtered and adsorbed prior to being 

exhausted to the environment. This action reduces the radioactive 

content in the fuel building exhaust following a LOCA or fuel handling 

accident so that offsite doses remain within the limits specified in 

10 CFR 100 (Ref. 1).

The FBACS actuation instrumentation satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO The LCO requirements ensure that instrumentation necessary to initiate 

the FBACS is OPERABLE.
FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-2 Rev. 4.0

BASES

LCO (continued)

1. Manual Initiation

The LCO requires two channels OPERABLE. The operator can 

initiate the FBACS at any time by using either of two switches in the 

control room. This action will cause actuation of all components in 

the same manner as any of the automatic actuation signals.

The LCO for Manual Initiation ensures the proper amount of 

redundancy is maintained in the manual actuation circuitry to ensure 

the operator has manual initiation capability.

Each channel consists of one push button and the interconnecting 

wiring to the actuation logic cabinet.

2. Automatic Actuation Logic and Actuation Relays

The LCO requires two trains of Actuation Logic and Relays 

OPERABLE to ensure that no single random failure can prevent 

automatic actuation.

Automatic Actuation Logic and Actuation Relays consist of the same 

features and operate in the same manner as described for ESFAS 

Function 1.b., SI, in LCO 3.3.2. The applicable MODES and 

specified conditions for the FBACS portion of these functions are 

different and less restrictive than those specified for their SI roles. If 

one or more of the SI functions becomes inoperable in such a 

manner that only the FBACS function is affected, the Conditions 

applicable to their SI function need not be entered. The less 

restrictive Actions specified for inoperability of the FBACS functions 

specify sufficient compensatory measures for this case.

3. Fuel Building Radiation

The LCO specifies two required Gaseous Radiation Monitor channels 

and two required Particulate Radiation Monitor channels to ensure 

that the radiation monitoring instrumentation necessary to initiate the 

FBACS remains OPERABLE.

For sampling systems, channel OPERABILITY involves more than 

OPERABILITY of channel electronics. OPERABILITY may also 

require correct valve lineups, sample pump operation, filter motor 

operation, detector OPERABILITY, if these supporting features are 

necessary for actuation to occur under the conditions assumed by 

the safety analyses.
FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-3 Rev. 4.0

BASES

LCO (continued)

The Setpoint Control Program (SCP) establishes the necessary controls 

for properly maintaining the applicable FBACS instrumentation channels.

APPLICABILITY The manual FBACS initiation must be OPERABLE in MODES [1, 2, 3, 

and 4] and when moving [recently] irradiated fuel assemblies in the fuel 

building, to ensure the FBACS operates to remove fission products 

associated with leakage after a LOCA or a fuel handling accident 

[involving handling recently irradiated fuel]. The automatic FBACS 

actuation instrumentation is also required in MODES [1, 2, 3, and 4] to 

remove fission products caused by post LOCA Emergency Core Cooling 

Systems leakage.

High radiation initiation of the FBACS must be OPERABLE in any MODE 

during movement of [recently] irradiated fuel assemblies in the fuel 

building to ensure automatic initiation of the FBACS when the potential for 

the limiting fuel handling accident exists. [Due to radioactive decay, the 

FBACS instrumentation is only required to be OPERABLE during fuel 

handling involving handling recently irradiated fuel (i.e., fuel that has 

occupied part of a critical reactor core within the previous [X] days).] 

While in MODES 5 and 6 without fuel handling [involving handling 

recently irradiated fuel] in progress, the FBACS instrumentation need not 

be OPERABLE since a fuel handling accident [involving handling recently 

irradiated fuel] cannot occur.

ACTIONS The most common cause of channel inoperability is outright failure or drift 

of the bistable or process module sufficient to exceed the tolerance 

allowed by unit specific calibration procedures. Typically, the drift is 

found to be small and results in a delay of actuation rather than a total 

loss of function. This determination is generally made during the 

performance of a COT, when the process instrumentation is set up for 

adjustment to bring it within specification. If the Trip Setpoint is less 

conservative than the tolerance specified by the calibration procedure, the 

channel must be declared inoperable immediately and the appropriate 

Condition entered.

LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily.
FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-4 Rev. 4.0

BASES

ACTIONS (continued)

A second Note has been added to the ACTIONS to clarify the application 

of Completion Time rules. The Conditions of this Specification may be 

entered independently for each Function listed in Table 3.3.8-1 in the 

accompanying LCO. The Completion Time(s) of the inoperable 

channel(s)/train(s) of a Function will be tracked separately for each 

Function starting from the time the Condition was entered for that 

Function.

A.1

Condition A applies to the actuation logic train function of the Solid State 

Protection System (SSPS), the radiation monitor functions, and the 

manual function. Condition A applies to the failure of a single actuation 

logic train, radiation monitor channel, or manual channel. If one channel 

or train is inoperable, a period of 7 days is allowed to restore it to 

OPERABLE status. If the train cannot be restored to OPERABLE status, 

one FBACS train must be placed in operation. This accomplishes the 

actuation instrumentation function and places the unit in a conservative 

mode of operation. The 7 day Completion Time is the same as is allowed 

if one train of the mechanical portion of the system is inoperable. The 

basis for this time is the same as that provided in LCO 3.7.13.

B.1.1, B.1.2, B.2

Condition B applies to the failure of two FBACS actuation logic trains, two 

radiation monitors, or two manual channels. The Required Action is to 

place one FBACS train in operation immediately. This accomplishes the 

actuation instrumentation function that may have been lost and places the 

unit in a conservative mode of operation. The applicable Conditions and 

Required Actions of LCO 3.7.13 must also be entered for the FBACS train 

made inoperable by the inoperable actuation instrumentation. This 

ensures appropriate limits are placed on train inoperability as discussed 

in the Bases for LCO 3.7.13.

Alternatively, both trains may be placed in the emergency [radiation 

protection] mode. This ensures the FBACS Function is performed even 

in the presence of a single failure.
FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-5 Rev. 4.0

BASES

ACTIONS (continued)

C.1

Condition C applies when the Required Action and associated 

Completion Time for Condition A or B have not been met and [recently] 

irradiated fuel assemblies are being moved in the fuel building. 

Movement of [recently] irradiated fuel assemblies in the fuel building must 

be suspended immediately to eliminate the potential for events that could 

require FBACS actuation.

D.1 and D.2

Condition D applies when the Required Action and associated 

Completion Time for Condition A or B have not been met and the unit is in 

MODE 1, 2, 3, or 4. The unit must be brought to a MODE in which the 

LCO requirements are not applicable. To achieve this status, the unit 

must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours. 

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE A Note has been added to the SR Table to clarify that table 3.3.8-1

REQUIREMENTS determines which SRs apply to which FBACS Actuation Functions.

SR 3.3.8.1

Performance of the CHANNEL CHECK ensures that a gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying the 

instrumentation continues to operate properly between each CHANNEL 

CALIBRATION.

Agreement criteria are determined by the unit staff, based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the sensor or the signal processing equipment has drifted outside its 

limit.
FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.8.2

A COT is performed on each required channel to ensure the entire 

channel will perform the intended function. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. This test verifies 

the capability of the instrumentation to provide the FBACS actuation. The 

SCP has controls which require verification that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology. 

[ The Frequency of 92 days is based on the known reliability of the 

monitoring equipment and has been shown to be acceptable through 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.8.3

[ SR 3.3.8.3 is the performance of an ACTUATION LOGIC TEST. All 

possible logic combinations, with and without applicable permissives, are 

tested for each protection function. [ The actuation logic is tested every 

31 days on a STAGGERED TEST BASIS. The Frequency is based on 

the known reliability of the relays and controls and the multichannel 

redundancy available, and has been shown to be acceptable through 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

SR 3.3.8.4

SR 3.3.8.4 is the performance of a TADOT. This test is a check of the 

manual actuation functions. Each manual actuation function is tested up 

to, and including, the master relay coils. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable TADOT of a relay. This is acceptable because all of the other 

required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per
FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

refueling interval with applicable extensions. In some instances, the test 

includes actuation of the end device (e.g., pump starts, valve cycles, etc.). 

[ The Frequency of 18 months is based on operating experience and is 

consistent with the typical industry refueling cycle. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note that excludes verification of setpoints during 

the TADOT. The Functions tested have no setpoints associated with 

them.

SR 3.3.8.5

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor. The test verifies that the channel responds to a 

measured parameter within the necessary range and accuracy. The SCP 

has controls which require verification that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology.

[ The Frequency of [18] months is based on operating experience and is 

consistent with the typical industry refueling cycle.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
FBACS Actuation Instrumentation (With Setpoint Control Program)

B 3.3.8B

Westinghouse STS B 3.3.8B-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 100.11.

BDPS (Without Setpoint Control Program)

B 3.3.9A

Westinghouse STS B 3.3.9A-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.9A Boron Dilution Protection System (BDPS) (Without Setpoint Control Program)

BASES

BACKGROUND The primary purpose of the BDPS is to mitigate the consequences of the 

inadvertent addition of unborated primary grade water into the Reactor 

Coolant System (RCS) when the reactor is in a shutdown condition (i.e., 

MODES 2, 3, 4, and 5).

The BDPS utilizes two channels of source range instrumentation. Each 

source range channel provides a signal to both trains of the BDPS. A unit 

computer is used to continuously record the counts per minute provided 

by these signals. At the end of each minute, an algorithm compares the 

counts per minute value (flux rate) of that 1 minute interval with the 

counts per minute value for the previous nine, 1 minute intervals. If the 

flux rate during a 1 minute interval is greater than or equal to twice the 

flux rate during any of the prior nine 1 minute intervals, the BDPS 

provides a signal to initiate mitigating actions.

Upon detection of a flux doubling by either source range instrumentation 

train, an alarm is sounded to alert the operator and valve movement is 

automatically initiated to terminate the dilution and start boration. Valves 

that isolate the refueling water storage tank (RWST) are opened to supply 

2000 ppm borated water to the suction of the charging pumps, and valves 

which isolate the Chemical and Volume Control System (CVCS) are 

closed to terminate the dilution.

APPLICABLE The BDPS senses abnormal increases in source range counts per minute

SAFETY (flux rate) and actuates CVCS and RWST valves to mitigate the

ANALYSES consequences of an inadvertent boron dilution event as described in 

FSAR, Chapter 15 (Ref. 1). The accident analyses rely on automatic 

BDPS actuation to mitigate the consequences of inadvertent boron 

dilution events.

The BDPS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO LCO 3.3.9 provides the requirements for OPERABILITY of the 

instrumentation and controls that mitigate the consequences of a boron 

dilution event. Two redundant trains are required to be OPERABLE to 

provide protection against single failure.

Because the BDPS utilizes the source range instrumentation as its

detection system, the OPERABILITY of the detection system, (i.e., the 

flux doubling algorithm, the alarms, and signals to the various valves) for 

one SRM is also required for each train in the system to be considered 

OPERABLE. Therefore, with both SRMs inoperable for supporting the 

BDPS, both trains are inoperable.
BDPS (Without Setpoint Control Program)

B 3.3.9A

Westinghouse STS B 3.3.9A-2 Rev. 4.0

BASES

APPLICABILITY The BDPS must be OPERABLE in MODES [2], 3, 4, and 5 because the 

safety analysis identifies this system as the primary means to mitigate an 

inadvertent boron dilution of the RCS.

The BDPS OPERABILITY requirements are not applicable in MODE[S] 1 

[and 2] because an inadvertent boron dilution would be terminated by a 

source range trip, a trip on the Power Range Neutron Flux - High (low 

setpoint nominally 25% RTP), or Overtemperature ∆T. These RTS 

Functions are discussed in LCO 3.3.1, "RTS Instrumentation."

In MODE 6, a dilution event is precluded by locked valves that isolate the 

RCS from the potential source of unborated water (according to 

LCO 3.9.2, "Unborated Water Source Isolation Valves").

The Applicability is modified by a Note that allows the boron dilution flux 

doubling signal to be blocked during reactor startup in MODES 2 and 3. 

Blocking the flux doubling signal is acceptable during startup while in 

MODE 3, provided the reactor trip breakers are closed with the intent to 

withdraw rods for startup.

ACTIONS The most common cause of channel inoperability is outright failure or drift 

of the bistable or process module sufficient to exceed the tolerance 

allowed by the unit specific calibration procedure. Typically, the drift is 

found to be small and results in a delay of actuation rather than a total 

loss of function. This determination of setpoint drift is generally made 

during the performance of a COT when the process instrumentation is set 

up for adjustment to bring it to within specification. If the Trip Setpoint is 

less conservative than the tolerance specified by the calibration 

procedure, the channel must be declared inoperable immediately and the 

appropriate Condition entered.

A.1

With one train of the BDPS OPERABLE, Required Action A.1 requires 

that the inoperable train must be restored to OPERABLE status within 

72 hours. In this Condition, the remaining the BDPS train is adequate to 

provide protection. The 72 hour Completion Time is based on the BDPS 

Function and is consistent with Engineered Safety Feature Actuation 

System Completion Times for loss of one redundant train. Also, the 

remaining OPERABLE train provides continuous indication of core power 

status to the operator, has an alarm function, and sends a signal to both 

trains of the BDPS to assure system actuation.
BDPS (Without Setpoint Control Program)

B 3.3.9A

Westinghouse STS B 3.3.9A-3 Rev. 4.0

BASES

ACTIONS (continued)

B.1, B.2.1, B.2.2.1, and B.2.2.2

With two trains inoperable, or the Required Action and associated 

Completion Time of Condition A not met, the initial action (Required 

Action B.1) is to suspend all operations involving positive reactivity 

additions immediately. This includes withdrawal of control or shutdown 

rods and intentional boron dilution. A Completion Time of 1 hour is 

provided to restore one train to OPERABLE status.

As an alternate to restoring one train to OPERABLE status (Required 

Action B.2.1), Required Action B.2.2.1 requires valves listed in LCO 3.9.2 

(Required Action A.2) to be secured to prevent the flow of unborated 

water into the RCS. Once it is recognized that two trains of the BDPS are 

inoperable, the operators will be aware of the possibility of a boron 

dilution, and the 1 hour Completion Time is adequate to complete the 

requirements of LCO 3.9.2.

Required Action B.2.2.2 accompanies Required Action B.2.2.1 to verify 

the SDM according to SR 3.1.1.1 within 1 hour and once per 12 hours 

thereafter. This backup action is intended to confirm that no unintended 

boron dilution has occurred while the BDPS was inoperable, and that the 

required SDM has been maintained. The specified Completion Time 

takes into consideration sufficient time for the initial determination of SDM 

and other information available in the control room related to SDM.

Required Action B.1 is modified by a Note which permits plant 

temperature changes provided the temperature change is accounted for 

in the calculated SDM. Introduction of temperature changes, including 

temperature increases when a positive MTC exists, must be evaluated to 

ensure they do not result in a loss of required SDM.

SURVEILLANCE SR 3.3.9.1

REQUIREMENTS

The BDPS trains are subject to a COT and a CHANNEL CALIBRATION.

Performance of the CHANNEL CHECK ensures that gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION.
BDPS (Without Setpoint Control Program)

B 3.3.9A

Westinghouse STS B 3.3.9A-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Agreement criteria are determined by the unit staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the senor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.9.2

SR 3.3.9.2 requires the performance of a COT to ensure that each train of 

the BDPS and associated trip setpoint are fully operational. A successful 

test of the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. This test shall 

include verification that the boron dilution alarm setpoint is equal to or 

less than an increase of twice the count rate within a 10 minute period. 

There is a plant specific program which verifies that the instrument 

channel functions as required by verifying the as-left and as-found setting 

are consistent with those established by the setpoint methodology.

[ The Frequency of [184] days is consistent with the requirements for 

source range channels in WCAP-15376 (Ref. 2).

OR
BDPS (Without Setpoint Control Program)

B 3.3.9A

Westinghouse STS B 3.3.9A-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.9.3

SR 3.3.9.3 is the performance of a CHANNEL CALIBRATION. 

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor except the neutron detector of the SRM circuit. 

There is a plant specific program which verifies that the instrument 

channel functions as required by verifying and as-left and as-found setting 

are consistent with those established by the setpoint methodology. The 

test verifies that the channel responds to a measured parameter within 

the necessary range and accuracy. For the BDPS, the CHANNEL 

CALIBRATION shall include verification that on a simulated or actual 

boron dilution flux doubling signal the centrifugal charging pump suction 

valves from the RWST open, and the normal CVCS volume control tank 

discharge valves close in the required closure time of ≤ 20 seconds.

[ The Frequency of 18 months is based on operating experience and 

consistency with the typical industry refueling cycle.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [15].

2. WCAP-15376, Revision 0, October 2000.

BDPS (With Setpoint Control Program)

B 3.3.9B

Westinghouse STS B 3.3.9B-1 Rev. 4.0

B 3.3 INSTRUMENTATION

B 3.3.9B Boron Dilution Protection System (BDPS) (With Setpoint Control Program)

BASES

BACKGROUND The primary purpose of the BDPS is to mitigate the consequences of the 

inadvertent addition of unborated primary grade water into the Reactor 

Coolant System (RCS) when the reactor is in a shutdown condition (i.e., 

MODES 2, 3, 4, and 5).

The BDPS utilizes two channels of source range instrumentation. Each 

source range channel provides a signal to both trains of the BDPS. A unit 

computer is used to continuously record the counts per minute provided 

by these signals. At the end of each minute, an algorithm compares the 

counts per minute value (flux rate) of that 1 minute interval with the 

counts per minute value for the previous nine, 1 minute intervals. If the 

flux rate during a 1 minute interval is greater than or equal to twice the 

flux rate during any of the prior nine 1 minute intervals, the BDPS 

provides a signal to initiate mitigating actions.

Upon detection of a flux doubling by either source range instrumentation 

train, an alarm is sounded to alert the operator and valve movement is 

automatically initiated to terminate the dilution and start boration. Valves 

that isolate the refueling water storage tank (RWST) are opened to supply 

2000 ppm borated water to the suction of the charging pumps, and valves 

which isolate the Chemical and Volume Control System (CVCS) are 

closed to terminate the dilution.

APPLICABLE The BDPS senses abnormal increases in source range counts per minute

SAFETY (flux rate) and actuates CVCS and RWST valves to mitigate the

ANALYSES consequences of an inadvertent boron dilution event as described in 

FSAR, Chapter 15 (Ref. 1). The accident analyses rely on automatic 

BDPS actuation to mitigate the consequences of inadvertent boron 

dilution events.

The BDPS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). 

LCO LCO 3.3.9 provides the requirements for OPERABILITY of the 

instrumentation and controls that mitigate the consequences of a boron 

dilution event. Two redundant trains are required to be OPERABLE to 

provide protection against single failure.

Because the BDPS utilizes the source range instrumentation as its 

detection system, the OPERABILITY of the detection system, (i.e., the 

flux doubling algorithm, the alarms, and signals to the various valves) for 

one SRM is also required for each train in the system to be considered 

OPERABLE. Therefore, with both SRMs inoperable for supporting the 

BDPS, both trains are inoperable.
BDPS (With Setpoint Control Program)

B 3.3.9B

Westinghouse STS B 3.3.9B-2 Rev. 4.0

BASES

APPLICABILITY The BDPS must be OPERABLE in MODES [2], 3, 4, and 5 because the 

safety analysis identifies this system as the primary means to mitigate an 

inadvertent boron dilution of the RCS.

The BDPS OPERABILITY requirements are not applicable in MODE[S] 1 

[and 2] because an inadvertent boron dilution would be terminated by a 

source range trip, a trip on the Power Range Neutron Flux - High (low 

setpoint nominally 25% RTP), or Overtemperature ∆T. These RTS 

Functions are discussed in LCO 3.3.1, "RTS Instrumentation."

In MODE 6, a dilution event is precluded by locked valves that isolate the 

RCS from the potential source of unborated water (according to 

LCO 3.9.2, "Unborated Water Source Isolation Valves").

The Applicability is modified by a Note that allows the boron dilution flux 

doubling signal to be blocked during reactor startup in MODES 2 and 3. 

Blocking the flux doubling signal is acceptable during startup while in 

MODE 3, provided the reactor trip breakers are closed with the intent to 

withdraw rods for startup.

ACTIONS The most common cause of channel inoperability is outright failure or drift 

of the bistable or process module sufficient to exceed the tolerance 

allowed by the unit specific calibration procedure. Typically, the drift is 

found to be small and results in a delay of actuation rather than a total 

loss of function. This determination of setpoint drift is generally made 

during the performance of a COT when the process instrumentation is set 

up for adjustment to bring it to within specification. If the Trip Setpoint is 

less conservative than the tolerance specified by the calibration 

procedure, the channel must be declared inoperable immediately and the 

appropriate Condition entered.

A.1

With one train of the BDPS OPERABLE, Required Action A.1 requires 

that the inoperable train must be restored to OPERABLE status within 

72 hours. In this Condition, the remaining the BDPS train is adequate to 

provide protection. The 72 hour Completion Time is based on the BDPS 

Function and is consistent with Engineered Safety Feature Actuation 

System Completion Times for loss of one redundant train. Also, the 

remaining OPERABLE train provides continuous indication of core power 

status to the operator, has an alarm function, and sends a signal to both 

trains of the BDPS to assure system actuation.
BDPS (With Setpoint Control Program)

B 3.3.9B

Westinghouse STS B 3.3.9B-3 Rev. 4.0

BASES

ACTIONS (continued)

B.1, B.2.1, B.2.2.1, and B.2.2.2

With two trains inoperable, or the Required Action and associated 

Completion Time of Condition A not met, the initial action (Required 

Action B.1) is to suspend all operations involving positive reactivity 

additions immediately. This includes withdrawal of control or shutdown 

rods and intentional boron dilution. A Completion Time of 1 hour is 

provided to restore one train to OPERABLE status.

As an alternate to restoring one train to OPERABLE status (Required 

Action B.2.1), Required Action B.2.2.1 requires valves listed in LCO 3.9.2 

(Required Action A.2) to be secured to prevent the flow of unborated 

water into the RCS. Once it is recognized that two trains of the BDPS are 

inoperable, the operators will be aware of the possibility of a boron 

dilution, and the 1 hour Completion Time is adequate to complete the 

requirements of LCO 3.9.2.

Required Action B.2.2.2 accompanies Required Action B.2.2.1 to verify 

the SDM according to SR 3.1.1.1 within 1 hour and once per 12 hours 

thereafter. This backup action is intended to confirm that no unintended 

boron dilution has occurred while the BDPS was inoperable, and that the 

required SDM has been maintained. The specified Completion Time 

takes into consideration sufficient time for the initial determination of SDM 

and other information available in the control room related to SDM.

Required Action B.1 is modified by a Note which permits plant 

temperature changes provided the temperature change is accounted for 

in the calculated SDM. Introduction of temperature changes, including 

temperature increases when a positive MTC exists, must be evaluated to 

ensure they do not result in a loss of required SDM.

SURVEILLANCE SR 3.3.9.1

REQUIREMENTS

The BDPS trains are subject to a COT and a CHANNEL CALIBRATION.

Performance of the CHANNEL CHECK ensures that gross failure of 

instrumentation has not occurred. A CHANNEL CHECK is normally a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that 

instrument channels monitoring the same parameter should read 

approximately the same value. Significant deviations between the two 

instrument channels could be an indication of excessive instrument drift in 

one of the channels or of something even more serious. A CHANNEL 

CHECK will detect gross channel failure; thus, it is key to verifying that 

the instrumentation continues to operate properly between each 

CHANNEL CALIBRATION.
BDPS (With Setpoint Control Program)

B 3.3.9B

Westinghouse STS B 3.3.9B-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Agreement criteria are determined by the unit staff based on a 

combination of the channel instrument uncertainties, including indication 

and readability. If a channel is outside the criteria, it may be an indication 

that the senor or the signal processing equipment has drifted outside its 

limit.

[ The Frequency of 12 hours is based on operating experience that 

demonstrates channel failure is rare. The CHANNEL CHECK 

supplements less formal, but more frequent, checks of channels during 

normal operational use of the displays associated with the LCO required 

channels.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.9.2

SR 3.3.9.2 requires the performance of a COT to ensure that each train of 

the BDPS and associated trip setpoint are fully operational. A successful 

test of the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. This test shall 

include verification that the boron dilution alarm setpoint is equal to or 

less than an increase of twice the count rate within a 10 minute period. 

The Setpoint Control Program (SCP) has controls which require 

verification that the instrument channel functions as required by verifying 

the as-left and as-found setting are consistent with those established by 

the setpoint methodology.

[ The Frequency of [184] days is consistent with the requirements for 

source range channels in WCAP-15376 (Ref. 2).

OR
BDPS (With Setpoint Control Program)

B 3.3.9B

Westinghouse STS B 3.3.9B-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.3.9.3

SR 3.3.9.3 is the performance of a CHANNEL CALIBRATION. 

CHANNEL CALIBRATION is a complete check of the instrument loop, 

including the sensor except the neutron detector of the SRM circuit. The 

SCP has controls which require verification that the instrument channel 

functions as required by verifying the as-left and as-found setting are 

consistent with those established by the setpoint methodology. The test 

verifies that the channel responds to a measured parameter within the 

necessary range and accuracy. For the BDPS, the CHANNEL 

CALIBRATION shall include verification that on a simulated or actual 

boron dilution flux doubling signal the centrifugal charging pump suction 

valves from the RWST open, and the normal CVCS volume control tank 

discharge valves close in the required closure time of ≤ 20 seconds.

[ The Frequency of 18 months is based on operating experience and 

consistency with the typical industry refueling cycle.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [15].

2. WCAP-15376, Revision 0, October 2000.

RCS Pressure, Temperature, and Flow DNB Limits

B 3.4.1

Westinghouse STS B 3.4.1-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB) Limits

BASES

BACKGROUND These Bases address requirements for maintaining RCS pressure, 

temperature, and flow rate within limits assumed in the safety analyses. 

The safety analyses (Ref. 1) of normal operating conditions and 

anticipated operational occurrences assume initial conditions within the 

normal steady state envelope. The limits placed on RCS pressure, 

temperature, and flow rate ensure that the minimum departure from 

nucleate boiling ratio (DNBR) will be met for each of the transients 

analyzed.

The RCS pressure limit is consistent with operation within the nominal 

operational envelope. Pressurizer pressure indications are averaged to 

come up with a value for comparison to the limit. A lower pressure will 

cause the reactor core to approach DNB limits.

The RCS coolant average temperature limit is consistent with full power 

operation within the nominal operational envelope. Indications of 

temperature are averaged to determine a value for comparison to the 

limit. A higher average temperature will cause the core to approach DNB 

limits.

The RCS flow rate normally remains constant during an operational fuel 

cycle with all pumps running. The minimum RCS flow limit corresponds 

to that assumed for DNB analyses. Flow rate indications are averaged to 

come up with a value for comparison to the limit. A lower RCS flow will 

cause the core to approach DNB limits.

Operation for significant periods of time outside these DNB limits 

increases the likelihood of a fuel cladding failure in a DNB limited event.

APPLICABLE The requirements of this LCO represent the initial conditions for DNB

SAFETY limited transients analyzed in the plant safety analyses (Ref. 1). The

ANALYSES safety analyses have shown that transients initiated from the limits of this 

LCO will result in meeting the DNBR criterion. This is the acceptance 

limit for the RCS DNB parameters. Changes to the unit that could impact 

these parameters must be assessed for their impact on the DNBR 

criteria. The transients analyzed for include loss of coolant flow events 

and dropped or stuck rod events. A key assumption for the analysis of 

these events is that the core power distribution is within the limits of 

LCO 3.1.6, "Control Bank Insertion Limits," LCO 3.2.3, "AXIAL FLUX 

DIFFERENCE (AFD)," and LCO 3.2.4, "QUADRANT POWER TILT 

RATIO (QPTR)."
RCS Pressure, Temperature, and Flow DNB Limits

B 3.4.1

Westinghouse STS B 3.4.1-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The pressurizer pressure limit and RCS average temperature limit 

specified in the COLR correspond to the analytical limits used in the 

safety analyses, with allowance for measurement uncertainty.

The RCS DNB parameters satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO specifies limits on the monitored process variables - pressurizer 

pressure, RCS average temperature, and RCS total flow rate - to ensure 

the core operates within the limits assumed in the safety analyses. These 

variables are contained in the COLR to provide operating and analysis 

flexibility from cycle to cycle. However, the minimum RCS flow, usually 

based on [maximum analyzed steam generator tube plugging], is retained 

in the TS LCO. Operating within these limits will result in meeting the 

DNBR criterion in the event of a DNB limited transient.

RCS total flow rate contains a measurement error based on performing a 

precision heat balance and using the result to calibrate the RCS flow rate 

indicators. Potential fouling of the feedwater venturi, which might not be 

detected, could bias the result from the precision heat balance in a 

nonconservative manner. Therefore, a penalty for undetected fouling of 

the feedwater venturi raises the nominal flow measurement allowance for 

no fouling.

Any fouling that might bias the flow rate measurement greater than the 

penalty for undetected fouling of the feedwater venturi can be detected by 

monitoring and trending various plant performance parameters. If 

detected, either the effect of the fouling shall be quantified and 

compensated for in the RCS flow rate measurement or the venturi shall 

be cleaned to eliminate the fouling.

The numerical values for pressure, temperature, and flow rate specified in 

the COLR are given for the measurement location and have been 

adjusted for instrument error.

APPLICABILITY In MODE 1, the limits on pressurizer pressure, RCS coolant average 

temperature, and RCS flow rate must be maintained during steady state 

operation in order to ensure DNBR criteria will be met in the event of an 

unplanned loss of forced coolant flow or other DNB limited transient. In 

all other MODES, the power level is low enough that DNB is not a 

concern.
RCS Pressure, Temperature, and Flow DNB Limits

B 3.4.1

Westinghouse STS B 3.4.1-3 Rev. 4.0

BASES

APPLICABILITY (continued)

A Note has been added to indicate the limit on pressurizer pressure is not 

applicable during short term operational transients such as a THERMAL 

POWER ramp increase > 5% RTP per minute or a THERMAL POWER 

step increase > 10% RTP. These conditions represent short term 

perturbations where actions to control pressure variations might be 

counterproductive. Also, since they represent transients initiated from 

power levels < 100% RTP, an increased DNBR margin exists to offset the 

temporary pressure variations.

The DNBR limit is provided in SL 2.1.1, "Reactor Core SLs." The 

conditions which define the DNBR limit are less restrictive than the limits 

of this LCO, but violation of a Safety Limit (SL) merits a stricter, more 

severe Required Action. Should a violation of this LCO occur, the 

operator must check whether or not an SL may have been exceeded.

ACTIONS A.1

RCS pressure and RCS average temperature are controllable and 

measurable parameters. With one or both of these parameters not within 

LCO limits, action must be taken to restore parameter(s).

RCS total flow rate is not a controllable parameter and is not expected to 

vary during steady state operation. If the indicated RCS total flow rate is 

below the LCO limit, power must be reduced, as required by Required 

Action B.1, to restore DNB margin and eliminate the potential for violation 

of the accident analysis bounds.

The 2 hour Completion Time for restoration of the parameters provides 

sufficient time to adjust plant parameters, to determine the cause for the 

off normal condition, and to restore the readings within limits, and is 

based on plant operating experience.

B.1

If Required Action A.1 is not met within the associated Completion Time, 

the plant must be brought to a MODE in which the LCO does not apply. 

To achieve this status, the plant must be brought to at least MODE 2 

within 6 hours. In MODE 2, the reduced power condition eliminates the 

potential for violation of the accident analysis bounds. The Completion 

Time of 6 hours is reasonable to reach the required plant conditions in an 

orderly manner.
RCS Pressure, Temperature, and Flow DNB Limits

B 3.4.1

Westinghouse STS B 3.4.1-4 Rev. 4.0

BASES

SURVEILLANCE SR 3.4.1.1

REQUIREMENTS

[ Since Required Action A.1 allows a Completion Time of 2 hours to restore 

parameters that are not within limits, the 12 hour Surveillance Frequency 

for pressurizer pressure is sufficient to ensure the pressure can be 

restored to a normal operation, steady state condition following load 

changes and other expected transient operations. The 12 hour interval 

has been shown by operating practice to be sufficient to regularly assess 

for potential degradation and to verify operation is within safety analysis 

assumptions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.1.2

[ Since Required Action A.1 allows a Completion Time of 2 hours to restore 

parameters that are not within limits, the 12 hour Surveillance Frequency 

for RCS average temperature is sufficient to ensure the temperature can 

be restored to a normal operation, steady state condition following load 

changes and other expected transient operations. The 12 hour interval 

has been shown by operating practice to be sufficient to regularly assess 

for potential degradation and to verify operation is within safety analysis 

assumptions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RCS Pressure, Temperature, and Flow DNB Limits

B 3.4.1

Westinghouse STS B 3.4.1-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.1.3

[ The 12 hour Surveillance Frequency for RCS total flow rate is performed 

using the installed flow instrumentation. The 12 hour interval has been 

shown by operating practice to be sufficient to regularly assess potential 

degradation and to verify operation within safety analysis assumptions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.1.4

Measurement of RCS total flow rate by performance of a precision 

calorimetric heat balance allows the installed RCS flow instrumentation to 

be calibrated and verifies the actual RCS flow rate is greater than or 

equal to the minimum required RCS flow rate.

[ The Frequency of [18] months reflects the importance of verifying flow 

after a refueling outage when the core has been altered, which may have 

caused an alteration of flow resistance.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RCS Pressure, Temperature, and Flow DNB Limits

B 3.4.1

Westinghouse STS B 3.4.1-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This SR is modified by a Note that allows entry into MODE 1, without 

having performed the SR, and placement of the unit in the best condition 

for performing the SR. The Note states that the SR is not required to be 

performed until 24 hours after ≥ [90%] RTP. This exception is appropriate 

since the heat balance requires the plant to be at a minimum of 

[90%] RTP to obtain the stated RCS flow accuracies. The Surveillance 

shall be performed within 24 hours after reaching [90%] RTP.

REFERENCES 1. FSAR, Section [15].
RCS Minimum Temperature for Criticality

B 3.4.2

Westinghouse STS B 3.4.2-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 RCS Minimum Temperature for Criticality

BASES

BACKGROUND This LCO is based upon meeting several major considerations before the 

reactor can be made critical and while the reactor is critical.

The first consideration is moderator temperature coefficient (MTC), 

LCO 3.1.3, "Moderator Temperature Coefficient (MTC)." In the transient 

and accident analyses, the MTC is assumed to be in a range from slightly 

positive to negative and the operating temperature is assumed to be 

within the nominal operating envelope while the reactor is critical. The 

LCO on minimum temperature for criticality helps ensure the plant is 

operated consistent with these assumptions.

The second consideration is the protective instrumentation. Because 

certain protective instrumentation (e.g., excore neutron detectors) can be 

affected by moderator temperature, a temperature value within the 

nominal operating envelope is chosen to ensure proper indication and 

response while the reactor is critical.

The third consideration is the pressurizer operating characteristics. The 

transient and accident analyses assume that the pressurizer is within its 

normal startup and operating range (i.e., saturated conditions and steam 

bubble present). It is also assumed that the RCS temperature is within its 

normal expected range for startup and power operation. Since the 

density of the water, and hence the response of the pressurizer to 

transients, depends upon the initial temperature of the moderator, a 

minimum value for moderator temperature within the nominal operating 

envelope is chosen.

The fourth consideration is that the reactor vessel is above its minimum 

nil ductility reference temperature when the reactor is critical.

APPLICABLE Although the RCS minimum temperature for criticality is not itself an initial

SAFETY condition assumed in Design Basis Accidents (DBAs), the closely aligned

ANALYSES temperature for hot zero power (HZP) is a process variable that is an 

initial condition of DBAs, such as the rod cluster control assembly (RCCA) 

withdrawal, RCCA ejection, and main steam line break accidents 

performed at zero power that either assumes the failure of, or presents a 

challenge to, the integrity of a fission product barrier.
RCS Minimum Temperature for Criticality

B 3.4.2

Westinghouse STS B 3.4.2-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

All low power safety analyses assume initial RCS loop temperatures ≥ the 

HZP temperature of 547°F (Ref. 1). The minimum temperature for 

criticality limitation provides a small band, 6°F, for critical operation below 

HZP. This band allows critical operation below HZP during plant startup 

and does not adversely affect any safety analyses since the MTC is not 

significantly affected by the small temperature difference between HZP 

and the minimum temperature for criticality.

The RCS minimum temperature for criticality satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO Compliance with the LCO ensures that the reactor will not be made or 

maintained critical (keff ≥ 1.0) at a temperature less than a small band 

below the HZP temperature, which is assumed in the safety analysis. 

Failure to meet the requirements of this LCO may produce initial 

conditions inconsistent with the initial conditions assumed in the safety 

analysis.

APPLICABILITY In MODE 1 and MODE 2 with keff ≥ 1.0, LCO 3.4.2 is applicable since the 

reactor can only be critical (keff ≥ 1.0) in these MODES.

The special test exception of LCO 3.1.8, "PHYSICS TESTS Exceptions -

MODE 2," permits PHYSICS TESTS to be performed at ≤ 5% RTP with 

RCS loop average temperatures slightly lower than normally allowed so 

that fundamental nuclear characteristics of the core can be verified. In 

order for nuclear characteristics to be accurately measured, it may be 

necessary to operate outside the normal restrictions of this LCO. For 

example, to measure the MTC at beginning of cycle, it is necessary to 

allow RCS loop average temperatures to fall below Tno load, which may 

cause RCS loop average temperatures to fall below the temperature limit 

of this LCO.

ACTIONS A.1

If the parameters that are outside the limit cannot be restored, the plant 

must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to MODE 2 with Keff < 1.0 

within 30 minutes. Rapid reactor shutdown can be readily and practically 

achieved within a 30 minute period. The allowed time is reasonable, 

based on operating experience, to reach MODE 2 with Keff < 1.0 in an 

orderly manner and without challenging plant systems.
RCS Minimum Temperature for Criticality

B 3.4.2

Westinghouse STS B 3.4.2-3 Rev. 4.0

BASES

SURVEILLANCE SR 3.4.2.1

REQUIREMENTS

RCS loop average temperature is required to be verified at or above 

[541]°F. [ The SR to verify RCS loop average temperatures every 

12 hours takes into account indications and alarms that are continuously 

available to the operator in the control room and is consistent with other 

routine Surveillances which are typically performed once per shift. In 

addition, operators are trained to be sensitive to RCS temperature during 

approach to criticality and will ensure that the minimum temperature for 

criticality is met as criticality is approached.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [15.0.3].

RCS P/T Limits

B 3.4.3

Westinghouse STS B 3.4.3-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 RCS Pressure and Temperature (P/T) Limits

BASES

BACKGROUND All components of the RCS are designed to withstand effects of cyclic 

loads due to system pressure and temperature changes. These loads 

are introduced by startup (heatup) and shutdown (cooldown) operations, 

power transients, and reactor trips. This LCO limits the pressure and 

temperature changes during RCS heatup and cooldown, within the design 

assumptions and the stress limits for cyclic operation.

The PTLR contains P/T limit curves for heatup, cooldown, inservice leak 

and hydrostatic (ISLH) testing, and data for the maximum rate of change 

of reactor coolant temperature (Ref. 1).

Each P/T limit curve defines an acceptable region for normal operation. 

The usual use of the curves is operational guidance during heatup or 

cooldown maneuvering, when pressure and temperature indications are 

monitored and compared to the applicable curve to determine that 

operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle 

failure of the reactor vessel and piping of the reactor coolant pressure 

boundary (RCPB). The vessel is the component most subject to brittle 

failure, and the LCO limits apply mainly to the vessel. The limits do not 

apply to the pressurizer, which has different design characteristics and 

operating functions.

10 CFR 50, Appendix G (Ref. 2), requires the establishment of P/T limits 

for specific material fracture toughness requirements of the RCPB 

materials. Reference 2 requires an adequate margin to brittle failure 

during normal operation, anticipated operational occurrences, and system 

hydrostatic tests. It mandates the use of the American Society of 

Mechanical Engineers (ASME) Code, Section III, Appendix G (Ref. 3).

The neutron embrittlement effect on the material toughness is reflected by 

increasing the nil ductility reference temperature (RTNDT) as exposure to 

neutron fluence increases.

The actual shift in the RTNDT of the vessel material will be established 

periodically by removing and evaluating the irradiated reactor vessel 

material specimens, in accordance with ASTM E 185 (Ref. 4) and 

Appendix H of 10 CFR 50 (Ref. 5). The operating P/T limit curves will be 

adjusted, as necessary, based on the evaluation findings and the 

recommendations of Regulatory Guide 1.99 (Ref. 6).
RCS P/T Limits

B 3.4.3

Westinghouse STS B 3.4.3-2 Rev. 4.0

BASES

BACKGROUND (continued)

The P/T limit curves are composite curves established by superimposing 

limits derived from stress analyses of those portions of the reactor vessel 

and head that are the most restrictive. At any specific pressure, 

temperature, and temperature rate of change, one location within the 

reactor vessel will dictate the most restrictive limit. Across the span of the 

P/T limit curves, different locations are more restrictive, and, thus, the 

curves are composites of the most restrictive regions.

The heatup curve represents a different set of restrictions than the 

cooldown curve because the directions of the thermal gradients through 

the vessel wall are reversed. The thermal gradient reversal alters the 

location of the tensile stress between the outer and inner walls.

The criticality limit curve includes the Reference 2 requirement that it be 

≥ 40°F above the heatup curve or the cooldown curve, and not less than 

the minimum permissible temperature for ISLH testing. However, the 

criticality curve is not operationally limiting; a more restrictive limit exists 

in LCO 3.4.2, "RCS Minimum Temperature for Criticality."

The consequence of violating the LCO limits is that the RCS has been 

operated under conditions that can result in brittle failure of the RCPB, 

possibly leading to a nonisolable leak or loss of coolant accident. In the 

event these limits are exceeded, an evaluation must be performed to 

determine the effect on the structural integrity of the RCPB components. 

The ASME Code, Section XI, Appendix E (Ref. 7), provides a 

recommended methodology for evaluating an operating event that causes 

an excursion outside the limits.

APPLICABLE The P/T limits are not derived from Design Basis Accident (DBA)

SAFETY analyses. They are prescribed during normal operation to avoid

ANALYSES encountering pressure, temperature, and temperature rate of change 

conditions that might cause undetected flaws to propagate and cause 

nonductile failure of the RCPB, an unanalyzed condition. Reference 1 

establishes the methodology for determining the P/T limits. Although the 

P/T limits are not derived from any DBA, the P/T limits are acceptance 

limits since they preclude operation in an unanalyzed condition.

RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).
RCS P/T Limits

B 3.4.3

Westinghouse STS B 3.4.3-3 Rev. 4.0

BASES

LCO The two elements of this LCO are:

a. The limit curves for heatup, cooldown, and ISLH testing and

b. Limits on the rate of change of temperature.

The LCO limits apply to all components of the RCS, except the 

pressurizer. These limits define allowable operating regions and permit a 

large number of operating cycles while providing a wide margin to 

nonductile failure.

The limits for the rate of change of temperature control the thermal 

gradient through the vessel wall and are used as inputs for calculating the 

heatup, cooldown, and ISLH testing P/T limit curves. Thus, the LCO for 

the rate of change of temperature restricts stresses caused by thermal 

gradients and also ensures the validity of the P/T limit curves.

Violating the LCO limits places the reactor vessel outside of the bounds of 

the stress analyses and can increase stresses in other RCPB 

components. The consequences depend on several factors, as follow:

a. The severity of the departure from the allowable operating P/T 

regime or the severity of the rate of change of temperature,

b. The length of time the limits were violated (longer violations allow the 

temperature gradient in the thick vessel walls to become more 

pronounced), and

c. The existences, sizes, and orientations of flaws in the vessel 

material.

APPLICABILITY The RCS P/T limits LCO provides a definition of acceptable operation for 

prevention of nonductile failure in accordance with 10 CFR 50, 

Appendix G (Ref. 2). Although the P/T limits were developed to provide 

guidance for operation during heatup or cooldown (MODES 3, 4, and 5) 

or ISLH testing, their Applicability is at all times in keeping with the 

concern for nonductile failure. The limits do not apply to the pressurizer.

During MODES 1 and 2, other Technical Specifications provide limits for 

operation that can be more restrictive than or can supplement these P/T 

limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure 

from Nucleate Boiling (DNB) Limits," LCO 3.4.2, "RCS Minimum 

Temperature for Criticality," and Safety Limit 2.1, "Safety Limits," also 

provide operational restrictions for pressure and temperature and 
RCS P/T Limits

B 3.4.3

Westinghouse STS B 3.4.3-4 Rev. 4.0

BASES

APPLICABILITY (continued)

maximum pressure. Furthermore, MODES 1 and 2 are above the 

temperature range of concern for nonductile failure, and stress analyses 

have been performed for normal maneuvering profiles, such as power 

ascension or descent.

ACTIONS A.1 and A.2

Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be 

corrected so that the RCPB is returned to a condition that has been 

verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the 

parameters to within the analyzed range. Most violations will not be 

severe, and the activity can be accomplished in this time in a controlled 

manner.

Besides restoring operation within limits, an evaluation is required to 

determine if RCS operation can continue. The evaluation must verify the 

RCPB integrity remains acceptable and must be completed before 

continuing operation. Several methods may be used, including 

comparison with pre-analyzed transients in the stress analyses, new 

analyses, or inspection of the components.

ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the 

evaluation. However, its use is restricted to evaluation of the vessel 

beltline.

The 72 hour Completion Time is reasonable to accomplish the evaluation. 

The evaluation for a mild violation is possible within this time, but more 

severe violations may require special, event specific stress analyses or 

inspections. A favorable evaluation must be completed before continuing 

to operate.

Condition A is modified by a Note requiring Required Action A.2 to be 

completed whenever the Condition is entered. The Note emphasizes the 

need to perform the evaluation of the effects of the excursion outside the 

allowable limits. Restoration alone per Required Action A.1 is insufficient 

because higher than analyzed stresses may have occurred and may have 

affected the RCPB integrity.
RCS P/T Limits

B 3.4.3

Westinghouse STS B 3.4.3-5 Rev. 4.0

BASES

ACTIONS (continued)

B.1 and B.2

If a Required Action and associated Completion Time of Condition A are 

not met, the plant must be placed in a lower MODE because either the 

RCS remained in an unacceptable P/T region for an extended period of 

increased stress or a sufficiently severe event caused entry into an 

unacceptable region. Either possibility indicates a need for more careful 

examination of the event, best accomplished with the RCS at reduced 

pressure and temperature. In reduced pressure and temperature 

conditions, the possibility of propagation with undetected flaws is 

decreased.

If the required restoration activity cannot be accomplished within 

30 minutes, Required Action B.1 and Required Action B.2 must be 

implemented to reduce pressure and temperature.

If the required evaluation for continued operation cannot be accomplished 

within 72 hours or the results are indeterminate or unfavorable, action 

must proceed to reduce pressure and temperature as specified in 

Required Action B.1 and Required Action B.2. A favorable evaluation 

must be completed and documented before returning to operating 

pressure and temperature conditions.

Pressure and temperature are reduced by bringing the plant to MODE 3 

within 6 hours and to MODE 5 with RCS pressure < [500] psig within 

36 hours.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems.

C.1 and C.2

Actions must be initiated immediately to correct operation outside of the 

P/T limits at times other than when in MODE 1, 2, 3, or 4, so that the 

RCPB is returned to a condition that has been verified by stress analysis.

The immediate Completion Time reflects the urgency of initiating action to 

restore the parameters to within the analyzed range. Most violations will 

not be severe, and the activity can be accomplished in this time in a 

controlled manner.
RCS P/T Limits

B 3.4.3

Westinghouse STS B 3.4.3-6 Rev. 4.0

BASES

ACTIONS (continued)

Besides restoring operation within limits, an evaluation is required to 

determine if RCS operation can continue. The evaluation must verify that 

the RCPB integrity remains acceptable and must be completed prior to 

entry into MODE 4. Several methods may be used, including comparison 

with pre-analyzed transients in the stress analyses, or inspection of the 

components.

ASME Code, Section XI, Appendix E (Ref. 7), may be used to support the 

evaluation. However, its use is restricted to evaluation of the vessel 

beltline.

Condition C is modified by a Note requiring Required Action C.2 to be 

completed whenever the Condition is entered. The Note emphasizes the 

need to perform the evaluation of the effects of the excursion outside the 

allowable limits. Restoration alone per Required Action C.1 is insufficient 

because higher than analyzed stresses may have occurred and may have 

affected the RCPB integrity.

SURVEILLANCE SR 3.4.3.1

REQUIREMENTS

Verification that operation is within the PTLR limits is required when RCS 

pressure and temperature conditions are undergoing planned changes. 

[ This Frequency of 30 minutes is considered reasonable in view of the 

control room indication available to monitor RCS status. Also, since 

temperature rate of change limits are specified in hourly increments, 

30 minutes permits assessment and correction for minor deviations within 

a reasonable time.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

Surveillance for heatup, cooldown, or ISLH testing may be discontinued 

when the definition given in the relevant plant procedure for ending the 

activity is satisfied.
RCS P/T Limits

B 3.4.3

Westinghouse STS B 3.4.3-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This SR is modified by a Note that only requires this SR to be performed 

during system heatup, cooldown, and ISLH testing. No SR is given for 

criticality operations because LCO 3.4.2 contains a more restrictive 

requirement.

REFERENCES 1. WCAP-7924-A, April 1975.

2. 10 CFR 50, Appendix G.

3. ASME, Boiler and Pressure Vessel Code, Section III, Appendix G.

4. ASTM E 185-82, July 1982.

5. 10 CFR 50, Appendix H.

6. Regulatory Guide 1.99, Revision 2, May 1988.

7. ASME, Boiler and Pressure Vessel Code, Section XI, Appendix E.

RCS Loops - MODES 1 and 2

B 3.4.4

Westinghouse STS B 3.4.4-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 RCS Loops - MODES 1 and 2

BASES

BACKGROUND The primary function of the RCS is removal of the heat generated in the 

fuel due to the fission process, and transfer of this heat, via the steam 

generators (SGs), to the secondary plant.

The secondary functions of the RCS include:

a. Moderating the neutron energy level to the thermal state, to increase 

the probability of fission,

b. Improving the neutron economy by acting as a reflector,

c. Carrying the soluble neutron poison, boric acid,

d. Providing a second barrier against fission product release to the 

environment, and

e. Removing the heat generated in the fuel due to fission product decay 

following a unit shutdown.

The reactor coolant is circulated through [four] loops connected in parallel 

to the reactor vessel, each containing an SG, a reactor coolant pump 

(RCP), and appropriate flow and temperature instrumentation for both 

control and protection. The reactor vessel contains the clad fuel. The 

SGs provide the heat sink to the isolated secondary coolant. The RCPs 

circulate the coolant through the reactor vessel and SGs at a sufficient 

rate to ensure proper heat transfer and prevent fuel damage. This forced 

circulation of the reactor coolant ensures mixing of the coolant for proper 

boration and chemistry control.

APPLICABLE Safety analyses contain various assumptions for the design bases

SAFETY accident initial conditions including RCS pressure, RCS temperature,

ANALYSES reactor power level, core parameters, and safety system setpoints. The 

important aspect for this LCO is the reactor coolant forced flow rate, 

which is represented by the number of RCS loops in service.

Both transient and steady state analyses have been performed to 

establish the effect of flow on the departure from nucleate boiling (DNB). 

The transient and accident analyses for the plant have been performed 

assuming [four] RCS loops are in operation. The majority of the plant 
RCS Loops - MODES 1 and 2

B 3.4.4

Westinghouse STS B 3.4.4-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

safety analyses are based on initial conditions at high core power or zero 

power. The accident analyses that are most important to RCP operation 

are the [four] pump coastdown, single pump locked rotor, single pump 

(broken shaft or coastdown), and rod withdrawal events (Ref. 1).

Steady state DNB analysis has been performed for the [four] RCS loop 

operation. For [four] RCS loop operation, the steady state DNB analysis, 

which generates the pressure and temperature Safety Limit (SL) (i.e., the 

departure from nucleate boiling ratio (DNBR) limit) assumes a maximum 

power level of 109% RTP. This is the design overpower condition for 

[four] RCS loop operation. The value for the accident analysis setpoint of 

the nuclear overpower (high flux) trip is 107% and is based on an analysis 

assumption that bounds possible instrumentation errors. The DNBR limit 

defines a locus of pressure and temperature points that result in a 

minimum DNBR greater than or equal to the critical heat flux correlation 

limit.

The plant is designed to operate with all RCS loops in operation to 

maintain DNBR above the SL, during all normal operations and 

anticipated transients. By ensuring heat transfer in the nucleate boiling 

region, adequate heat transfer is provided between the fuel cladding and 

the reactor coolant.

RCS Loops - MODES 1 and 2 satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The purpose of this LCO is to require an adequate forced flow rate for 

core heat removal. Flow is represented by the number of RCPs in 

operation for removal of heat by the SGs. To meet safety analysis 

acceptance criteria for DNB, [four] pumps are required at rated power.

An OPERABLE RCS loop consists of an OPERABLE RCP in operation 

providing forced flow for heat transport and an OPERABLE SG.

APPLICABILITY In MODES 1 and 2, the reactor is critical and thus has the potential to 

produce maximum THERMAL POWER. Thus, to ensure that the 

assumptions of the accident analyses remain valid, all RCS loops are 

required to be OPERABLE and in operation in these MODES to prevent 

DNB and core damage.

The decay heat production rate is much lower than the full power heat 

rate. As such, the forced circulation flow and heat sink requirements are 

reduced for lower, noncritical MODES as indicated by the LCOs for 

MODES 3, 4, and 5.
RCS Loops - MODES 1 and 2

B 3.4.4

Westinghouse STS B 3.4.4-3 Rev. 4.0

BASES

APPLICABILITY (continued)

Operation in other MODES is covered by:

LCO 3.4.5, "RCS Loops - MODE 3,"

LCO 3.4.6, "RCS Loops - MODE 4,"

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled,"

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation -

High Water Level" (MODE 6), and

LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation -

Low Water Level" (MODE 6).

ACTIONS A.1

If the requirements of the LCO are not met, the Required Action is to 

reduce power and bring the plant to MODE 3. This lowers power level 

and thus reduces the core heat removal needs and minimizes the 

possibility of violating DNB limits.

The Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power conditions in an orderly 

manner and without challenging safety systems.

SURVEILLANCE SR 3.4.4.1

REQUIREMENTS

This SR requires verification that each RCS loop is in operation. 

Verification includes flow rate, temperature, or pump status monitoring, 

which help ensure that forced flow is providing heat removal while 

maintaining the margin to DNB. [ The Frequency of 12 hours is sufficient 

considering other indications and alarms available to the operator in the 

control room to monitor RCS loop performance.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [ ].

RCS Loops - MODE 3

B 3.4.5

Westinghouse STS B 3.4.5-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.5 RCS Loops - MODE 3

BASES

BACKGROUND In MODE 3, the primary function of the reactor coolant is removal of 

decay heat and transfer of this heat, via the steam generator (SG), to the 

secondary plant fluid. The secondary function of the reactor coolant is to 

act as a carrier for soluble neutron poison, boric acid.

The reactor coolant is circulated through [four] RCS loops, connected in 

parallel to the reactor vessel, each containing an SG, a reactor coolant 

pump (RCP), and appropriate flow, pressure, level, and temperature 

instrumentation for control, protection, and indication. The reactor vessel 

contains the clad fuel. The SGs provide the heat sink. The RCPs 

circulate the water through the reactor vessel and SGs at a sufficient rate 

to ensure proper heat transfer and prevent fuel damage.

In MODE 3, RCPs are used to provide forced circulation for heat removal 

during heatup and cooldown. The MODE 3 decay heat removal 

requirements are low enough that a single RCS loop with one RCP 

running is sufficient to remove core decay heat. However, [two] RCS 

loops are required to be OPERABLE to ensure redundant capability for 

decay heat removal.

APPLICABLE Whenever the reactor trip breakers (RTBs) are in the closed position and

SAFETY the control rod drive mechanisms (CRDMs) are energized, an

ANALYSES inadvertent rod withdrawal from subcritical, resulting in a power 

excursion, is possible. Such a transient could be caused by a malfunction 

of the rod control system. In addition, the possibility of a power excursion 

due to the ejection of an inserted control rod is possible with the breakers 

closed or open. Such a transient could be caused by the mechanical 

failure of a CRDM.

Therefore, in MODE 3 with the Rod Control System capable of rod 

withdrawal, accidental control rod withdrawal from subcritical is postulated 

and requires at least [two] RCS loops to be OPERABLE and in operation 

to ensure that the accident analyses limits are met. For those conditions 

when the Rod Control System is not capable of rod withdrawal, two RCS 

loops are required to be OPERABLE, but only one RCS loop is required 

to be in operation to be consistent with MODE 3 accident analyses.
RCS Loops - MODE 3

B 3.4.5

Westinghouse STS B 3.4.5-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

Failure to provide decay heat removal may result in challenges to a 

fission product barrier. The RCS loops are part of the primary success 

path that functions or actuates to prevent or mitigate a Design Basis 

Accident or transient that either assumes the failure of, or presents a 

challenge to, the integrity of a fission product barrier.

RCS Loops - MODE 3 satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The purpose of this LCO is to require that at least [two] RCS loops be 

OPERABLE. In MODE 3 with the Rod Control System capable of rod 

withdrawal, [two] RCS loops must be in operation. [Two] RCS loops are 

required to be in operation in MODE 3 with the Rod Control System 

capable of rod withdrawal due to the postulation of a power excursion 

because of an inadvertent control rod withdrawal. The required number 

of RCS loops in operation ensures that the Safety Limit criteria will be met 

for all of the postulated accidents.

When the Rod Control System is not capable of rod withdrawal, only one 

RCS loop in operation is necessary to ensure removal of decay heat from 

the core and homogenous boron concentration throughout the RCS. An 

additional RCS loop is required to be OPERABLE to ensure that safety 

analyses limits are met.

The Note permits all RCPs to be removed from operation for ≤ 1 hour per 

8 hour period. The purpose of the Note is to perform tests that are 

designed to validate various accident analyses values. One of these 

tests is validation of the pump coastdown curve used as input to a 

number of accident analyses including a loss of flow accident. This test is 

generally performed in MODE 3 during the initial startup testing program, 

and as such should only be performed once. If, however, changes are 

made to the RCS that would cause a change to the flow characteristics of 

the RCS, the input values of the coastdown curve must be revalidated by 

conducting the test again. Another test performed during the startup 

testing program is the validation of rod drop times during cold conditions, 

both with and without flow.

The no flow test may be performed in MODE 3, 4, or 5 and requires that 

the pumps be stopped for a short period of time. The Note permits the 

stopping of the pumps in order to perform this test and validate the 

assumed analysis values. As with the validation of the pump coastdown 

curve, this test should be performed only once unless the flow 

characteristics of the RCS are changed. The 1 hour time period specified

is adequate to perform the desired tests, and operating experience has 

shown that boron stratification is not a problem during this short period 

with no forced flow.
RCS Loops - MODE 3

B 3.4.5

Westinghouse STS B 3.4.5-3 Rev. 4.0

BASES

LCO (continued)

Utilization of the Note is permitted provided the following conditions are 

met, along with any other conditions imposed by initial startup test 

procedures:

a. No operations are permitted that would dilute the RCS boron 

concentration with coolant at boron concentrations less than required 

to assure the SDM of LCO 3.1.1, thereby maintaining the margin to 

criticality. Boron reduction with coolant at boron concentrations less 

than required to assure SDM is maintained is prohibited because a 

uniform concentration distribution throughout the RCS cannot be 

ensured when in natural circulation and

b. Core outlet temperature is maintained at least 10°F below saturation 

temperature, so that no vapor bubble may form and possibly cause a 

natural circulation flow obstruction.

An OPERABLE RCS loop consists of one OPERABLE RCP and one 

OPERABLE SG, which has the minimum water level specified in 

SR 3.4.5.2. An RCP is OPERABLE if it is capable of being powered and 

is able to provide forced flow if required.

APPLICABILITY In MODE 3, this LCO ensures forced circulation of the reactor coolant to 

remove decay heat from the core and to provide proper boron mixing. 

The most stringent condition of the LCO, that is, two RCS loops 

OPERABLE and two RCS loops in operation, applies to MODE 3 with the 

Rod Control System capable of rod withdrawal. The least stringent 

condition, that is, two RCS loops OPERABLE and one RCS loop in 

operation, applies to MODE 3 with the Rod Control System not capable of 

rod withdrawal.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops - MODES 1 and 2,"

LCO 3.4.6, "RCS Loops - MODE 4,"

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled,"

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation -

High Water Level" (MODE 6), and

LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation -

Low Water Level" (MODE 6).
RCS Loops - MODE 3

B 3.4.5

Westinghouse STS B 3.4.5-4 Rev. 4.0

BASES

ACTIONS A.1

If one [required] RCS loop is inoperable, redundancy for heat removal is 

lost. The Required Action is restoration of the required RCS loop to 

OPERABLE status within the Completion Time of 72 hours. This time 

allowance is a justified period to be without the redundant, nonoperating 

loop because a single loop in operation has a heat transfer capability 

greater than that needed to remove the decay heat produced in the 

reactor core and because of the low probability of a failure in the 

remaining loop occurring during this period.

B.1

If restoration for Required Action A.1 is not possible within 72 hours, the 

unit must be brought to MODE 4. In MODE 4, the unit may be placed on 

the Residual Heat Removal System. The additional Completion Time of 

12 hours is compatible with required operations to achieve cooldown and 

depressurization from the existing plant conditions in an orderly manner 

and without challenging plant systems.

[ C.1 and C.2

If one required RCS loop is not in operation, and the Rod Control System 

is capable of rod withdrawal, the Required Action is either to restore the 

required RCS loop to operation or to place the Rod Control System in a 

condition incapable of rod withdrawal (e.g., de-energize all CRDMs by 

opening the RTBs or de-energizing the motor generator (MG) sets). 

When the Rod Control System is capable of rod withdrawal, it is 

postulated that a power excursion could occur in the event of an 

inadvertent control rod withdrawal. This mandates having the heat 

transfer capacity of two RCS loops in operation. If only one loop is in 

operation, the Rod Control System must be rendered incapable of rod 

withdrawal. The Completion Times of 1 hour, to restore the required RCS 

loop to operation or defeat the Rod Control System is adequate to 

perform these operations in an orderly manner without exposing the unit 

to risk for an undue time period. ]

D.1, D.2, and D.3

If [two] [required] RCS loops are inoperable or a required RCS loop is not 

in operation, except as during conditions permitted by the Note in the 

LCO section, the Rod Control System must be placed in a condition 

incapable of rod withdrawal (e.g., all CRDMs must be de-energized by 

opening the RTBs or de-energizing the MG sets). All operations involving 
RCS Loops - MODE 3

B 3.4.5

Westinghouse STS B 3.4.5-5 Rev. 4.0

BASES

ACTIONS (continued)

introduction of coolant into the RCS with boron concentration less than 

required to meet the minimum SDM of LCO 3.1.1 must be suspended, 

and action to restore one of the RCS loops to OPERABLE status and 

operation must be initiated. Boron dilution requires forced circulation for 

proper mixing, and opening the RTBs or de-energizing the MG sets 

removes the possibility of an inadvertent rod withdrawal. Suspending the 

introduction of coolant into the RCS of coolant with boron concentration 

less than required to meet the minimum SDM of LCO 3.1.1 is required to 

assure continued safe operation. With coolant added without forced 

circulation, unmixed coolant could be introduced to the core, however 

coolant added with boron concentration meeting the minimum SDM 

maintains acceptable margin to subcritical operations. The immediate 

Completion Time reflects the importance of maintaining operation for heat 

removal. The action to restore must be continued until one loop is 

restored to OPERABLE status and operation.

SURVEILLANCE SR 3.4.5.1

REQUIREMENTS

This SR requires verification that the required loops are in operation. 

Verification includes flow rate, temperature, and pump status monitoring, 

which help ensure that forced flow is providing heat removal. [ The 

Frequency of 12 hours is sufficient considering other indications and 

alarms available to the operator in the control room to monitor RCS loop 

performance.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.5.2

SR 3.4.5.2 requires verification of SG OPERABILITY. SG OPERABILITY 

is verified by ensuring that the secondary side narrow range water level is 

≥ [17]% for required RCS loops. If the SG secondary side narrow range 

water level is < [17]%, the tubes may become uncovered and the 

associated loop may not be capable of providing the heat sink for removal
RCS Loops - MODE 3

B 3.4.5

Westinghouse STS B 3.4.5-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

of the decay heat. [ The 12 hour Frequency is considered adequate in 

view of other indications available in the control room to alert the operator 

to a loss of SG level.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.5.3

Verification that each required RCP is OPERABLE ensures that safety 

analyses limits are met. The requirement also ensures that an additional 

RCP can be placed in operation, if needed, to maintain decay heat 

removal and reactor coolant circulation. Verification is performed by 

verifying proper breaker alignment and power availability to each required 

RCP. Alternatively, verification that a pump is in operation also verifies 

proper breaker alignment and power availability. [ The Frequency of 

7 days is considered reasonable in view of other administrative controls 

available and has been shown to be acceptable by operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note that states the SR is not required to be 

performed until 24 hours after a required pump is not in operation.
RCS Loops - MODE 3

B 3.4.5

Westinghouse STS B 3.4.5-7 Rev. 4.0

BASES

REFERENCES None.

RCS Loops - MODE 4

B 3.4.6

Westinghouse STS B 3.4.6-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Loops - MODE 4

BASES

BACKGROUND In MODE 4, the primary function of the reactor coolant is the removal of 

decay heat and the transfer of this heat to either the steam generator 

(SG) secondary side coolant or the component cooling water via the 

residual heat removal (RHR) heat exchangers. The secondary function of 

the reactor coolant is to act as a carrier for soluble neutron poison, boric 

acid.

The reactor coolant is circulated through [four] RCS loops connected in 

parallel to the reactor vessel, each loop containing an SG, a reactor 

coolant pump (RCP), and appropriate flow, pressure, level, and 

temperature instrumentation for control, protection, and indication. The 

RCPs circulate the coolant through the reactor vessel and SGs at a 

sufficient rate to ensure proper heat transfer and to prevent boric acid 

stratification.

In MODE 4, either RCPs or RHR loops can be used to provide forced 

circulation. The intent of this LCO is to provide forced flow from at least 

one RCP or one RHR loop for decay heat removal and transport. The 

flow provided by one RCP loop or RHR loop is adequate for decay heat 

removal. The other intent of this LCO is to require that two paths be 

available to provide redundancy for decay heat removal.

APPLICABLE In MODE 4, RCS circulation is considered in the determination of the time

SAFETY available for mitigation of the accidental boron dilution event. The RCS

ANALYSES and RHR loops provide this circulation.

RCS Loops - MODE 4 satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO The purpose of this LCO is to require that at least two loops be 

OPERABLE in MODE 4 and that one of these loops be in operation. The 

LCO allows the two loops that are required to be OPERABLE to consist of 

any combination of RCS loops and RHR loops. Any one loop in operation 

provides enough flow to remove the decay heat from the core with forced 

circulation. An additional loop is required to be OPERABLE to provide 

redundancy for heat removal.

Note 1 permits all RCPs or RHR pumps to be removed from operation for 

≤ 1 hour per 8 hour period. The purpose of the Note is to permit tests that 

are designed to validate various accident analyses values. One of the 

tests performed during the startup testing program is the validation of rod 

drop times during cold conditions, both with and without flow. The no flow 

test may be performed in MODE 3, 4, or 5 and requires that the pumps be 
RCS Loops - MODE 4

B 3.4.6

Westinghouse STS B 3.4.6-2 Rev. 4.0

BASES

LCO (continued)

stopped for a short period of time. The Note permits the stopping of the 

pumps in order to perform this test and validate the assumed analysis 

values. If changes are made to the RCS that would cause a change to 

the flow characteristics of the RCS, the input values must be revalidated 

by conducting the test again. The 1 hour time period is adequate to 

perform the test, and operating experience has shown that boron 

stratification is not a problem during this short period with no forced flow.

Utilization of Note 1 is permitted provided the following conditions are met 

along with any other conditions imposed by initial startup test procedures:

a. No operations are permitted that would dilute the RCS boron 

concentration with coolant with boron concentrations less than 

required to meet SDM of LCO 3.1.1, therefore maintaining the margin 

to criticality. Boron reduction with coolant at boron concentrations 

less than required to assure SDM is maintained is prohibited because 

a uniform concentration distribution throughout the RCS cannot be 

ensured when in natural circulation and

b. Core outlet temperature is maintained at least 10°F below saturation 

temperature, so that no vapor bubble may form and possibly cause a 

natural circulation flow obstruction.

Note 2 requires that the secondary side water temperature of each SG be 

≤ [50]°F above each of the RCS cold leg temperatures before the start of 

an RCP with any RCS cold leg temperature ≤ [275°F] [Low Temperature 

Overpressure Protection (LTOP) arming temperature specified in the 

PTLR]. This restraint is to prevent a low temperature overpressure event 

due to a thermal transient when an RCP is started.

An OPERABLE RCS loop comprises an OPERABLE RCP and an 

OPERABLE SG, which has the minimum water level specified in 

SR 3.4.6.2.

Similarly for the RHR System, an OPERABLE RHR loop comprises an 

OPERABLE RHR pump capable of providing forced flow to an 

OPERABLE RHR heat exchanger. RCPs and RHR pumps are 

OPERABLE if they are capable of being powered and are able to provide 

forced flow if required.
RCS Loops - MODE 4

B 3.4.6

Westinghouse STS B 3.4.6-3 Rev. 4.0

BASES

APPLICABILITY In MODE 4, this LCO ensures forced circulation of the reactor coolant to 

remove decay heat from the core and to provide proper boron mixing. 

One loop of either RCS or RHR provides sufficient circulation for these 

purposes. However, two loops consisting of any combination of RCS and 

RHR loops are required to be OPERABLE to meet single failure 

considerations.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops - MODES 1 and 2,"

LCO 3.4.5, "RCS Loops - MODE 3,"

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled,"

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation -

High Water Level" (MODE 6), and

LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation -

Low Water Level" (MODE 6).

ACTIONS A.1

If one required loop is inoperable, redundancy for heat removal is lost. 

Action must be initiated to restore a second RCS or RHR loop to 

OPERABLE status. The immediate Completion Time reflects the 

importance of maintaining the availability of two paths for heat removal.

A.2

If restoration is not accomplished and an RHR loop is OPERABLE, the 

unit must be brought to MODE 5 within 24 hours. Bringing the unit to 

MODE 5 is a conservative action with regard to decay heat removal. With 

only one RHR loop OPERABLE, redundancy for decay heat removal is 

lost and, in the event of a loss of the remaining RHR loop, it would be 

safer to initiate that loss from MODE 5 rather than MODE 4. The 

Completion Time of 24 hours is a reasonable time, based on operating 

experience, to reach MODE 5 from MODE 4 in an orderly manner and 

without challenging plant systems.

This Required Action is modified by a Note which indicates that the unit 

must be placed in MODE 5 only if a RHR loop is OPERABLE. With no 

RHR loop OPERABLE, the unit is in a condition with only limited 

cooldown capabilities. Therefore, the actions are to be concentrated on 

the restoration of a RHR loop, rather than a cooldown of extended 

duration.
RCS Loops - MODE 4

B 3.4.6

Westinghouse STS B 3.4.6-4 Rev. 4.0

BASES

ACTIONS (continued)

B.1 and B.2

If two required loops are inoperable or a required loop is not in operation, 

except during conditions permitted by Note 1 in the LCO section, all 

operations involving introduction of coolant into the RCS with boron 

concentration less than required to meet the minimum SDM of LCO 3.1.1 

must be suspended and action to restore one RCS or RHR loop to 

OPERABLE status and operation must be initiated. The required margin 

to criticality must not be reduced in this type of operation. Suspending 

the introduction of coolant into the RCS of coolant with boron 

concentration less than required to meet the minimum SDM of LCO 3.1.1 

is required to assure continued safe operation. With coolant added 

without forced circulation, unmixed coolant could be introduced to the 

core, however coolant added with boron concentration meeting the 

minimum SDM maintains acceptable margin to subcritical operations. 

The immediate Completion Times reflect the importance of maintaining 

operation for decay heat removal. The action to restore must be 

continued until one loop is restored to OPERABLE status and operation.

SURVEILLANCE SR 3.4.6.1

REQUIREMENTS

This SR requires verification that the required RCS or RHR loop is in 

operation. Verification includes flow rate, temperature, or pump status 

monitoring, which help ensure that forced flow is providing heat removal. 

[ The Frequency of 12 hours is sufficient considering other indications and 

alarms available to the operator in the control room to monitor RCS and 

RHR loop performance.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RCS Loops - MODE 4

B 3.4.6

Westinghouse STS B 3.4.6-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.6.2

SR 3.4.6.2 requires verification of SG OPERABILITY. SG OPERABILITY 

is verified by ensuring that the secondary side narrow range water level is 

≥ [17]%. If the SG secondary side narrow range water level is < [17]%, 

the tubes may become uncovered and the associated loop may not be 

capable of providing the heat sink necessary for removal of decay heat. 

[ The 12 hour Frequency is considered adequate in view of other 

indications available in the control room to alert the operator to the loss of 

SG level.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.6.3

Verification that each required pump is OPERABLE ensures that an 

additional RCS or RHR pump can be placed in operation, if needed, to 

maintain decay heat removal and reactor coolant circulation. Verification 

is performed by verifying proper breaker alignment and power available to 

each required pump. Alternatively, verification that a pump is in operation 

also verifies proper breaker alignment and power availability. [ The 

Frequency of 7 days is considered reasonable in view of other 

administrative controls available and has been shown to be acceptable by 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RCS Loops - MODE 4

B 3.4.6

Westinghouse STS B 3.4.6-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note that states the SR is not required to be 

performed until 24 hours after a required pump is not in operation.

REFERENCES None.
RCS Loops - MODE 5, Loops Filled

B 3.4.7

Westinghouse STS B 3.4.7-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 RCS Loops - MODE 5, Loops Filled

BASES

BACKGROUND In MODE 5 with the RCS loops filled, the primary function of the reactor 

coolant is the removal of decay heat and transfer this heat either to the 

steam generator (SG) secondary side coolant via natural circulation 

(Ref. 1) or the component cooling water via the residual heat removal 

(RHR) heat exchangers. While the principal means for decay heat 

removal is via the RHR System, the SGs via natural circulation (Ref. 1) 

are specified as a backup means for redundancy. Even though the SGs 

cannot produce steam in this MODE, they are capable of being a heat 

sink due to their large contained volume of secondary water. As long as 

the SG secondary side water is at a lower temperature than the reactor 

coolant, heat transfer will occur. The rate of heat transfer is directly 

proportional to the temperature difference. The secondary function of the 

reactor coolant is to act as a carrier for soluble neutron poison, boric acid.

In MODE 5 with RCS loops filled, the reactor coolant is circulated by 

means of two RHR loops connected to the RCS, each loop containing an 

RHR heat exchanger, an RHR pump, and appropriate flow and 

temperature instrumentation for control, protection, and indication. One 

RHR pump circulates the water through the RCS at a sufficient rate to 

prevent boric acid stratification.

The number of loops in operation can vary to suit the operational needs. 

The intent of this LCO is to provide forced flow from at least one RHR 

loop for decay heat removal and transport. The flow provided by one 

RHR loop is adequate for decay heat removal. The other intent of this 

LCO is to require that a second path be available to provide redundancy 

for heat removal.

The LCO provides for redundant paths of decay heat removal capability. 

The first path can be an RHR loop that must be OPERABLE and in 

operation. The second path can be another OPERABLE RHR loop or 

maintaining two SGs with secondary side water levels ≥ [17]% to provide 

an alternate method for decay heat removal via natural circulation 

(Ref. 1).

APPLICABLE In MODE 5, RCS circulation is considered in the determination of the time

SAFETY available for mitigation of the accidental boron dilution event. The RHR

ANALYSES loops provide this circulation.

RCS Loops - MODE 5 (Loops Filled) satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii).
RCS Loops - MODE 5, Loops Filled

B 3.4.7

Westinghouse STS B 3.4.7-2 Rev. 4.0

BASES

LCO The purpose of this LCO is to require that at least one of the RHR loops 

be OPERABLE and in operation with an additional RHR loop OPERABLE 

or two SGs with secondary side water level ≥ [17]%. One RHR loop 

provides sufficient forced circulation to perform the safety functions of the 

reactor coolant under these conditions. An additional RHR loop is 

required to be OPERABLE to meet single failure considerations. 

However, if the standby RHR loop is not OPERABLE, an acceptable 

alternate method is two SGs with their secondary side water levels 

≥ [17]%. Should the operating RHR loop fail, the SGs could be used to 

remove the decay heat via natural circulation.

Note 1 permits all RHR pumps to be removed from operation ≤ 1 hour per 

8 hour period. The purpose of the Note is to permit tests designed to 

validate various accident analyses values. One of the tests performed 

during the startup testing program is the validation of rod drop times 

during cold conditions, both with and without flow. The no flow test may 

be performed in MODE 3, 4, or 5 and requires that the pumps be stopped 

for a short period of time. The Note permits stopping of the pumps in 

order to perform this test and validate the assumed analysis values. If 

changes are made to the RCS that would cause a change to the flow 

characteristics of the RCS, the input values must be revalidated by 

conducting the test again. The 1 hour time period is adequate to perform 

the test, and operating experience has shown that boron stratification is 

not likely during this short period with no forced flow.

Utilization of Note 1 is permitted provided the following conditions are 

met, along with any other conditions imposed by initial startup test

procedures:

a. No operations are permitted that would dilute the RCS boron 

concentration with coolant with boron concentrations less than 

required to meet SDM of LCO 3.1.1, therefore maintaining the margin 

to criticality. Boron reduction with coolant at boron concentrations 

less than required to assure SDM is maintained is prohibited because 

a uniform concentration distribution throughout the RCS cannot be 

ensured when in natural circulation and

b. Core outlet temperature is maintained at least 10°F below saturation 

temperature, so that no vapor bubble may form and possibly cause a 

natural circulation flow obstruction.

Note 2 allows one RHR loop to be inoperable for a period of up to 

2 hours, provided that the other RHR loop is OPERABLE and in 

operation. This permits periodic surveillance tests to be performed on the 

inoperable loop during the only time when such testing is safe and 

possible.
RCS Loops - MODE 5, Loops Filled

B 3.4.7

Westinghouse STS B 3.4.7-3 Rev. 4.0

BASES

LCO (continued)

Note 3 requires that the secondary side water temperature of each SG be 

≤ [50]°F above each of the RCS cold leg temperatures before the start of 

a reactor coolant pump (RCP) with an RCS cold leg temperature 

≤ [275°F] [Low Temperature Overpressure Protection (LTOP) arming 

temperature specified in the PTLR]. This restriction is to prevent a low 

temperature overpressure event due to a thermal transient when an RCP 

is started.

Note 4 provides for an orderly transition from MODE 5 to MODE 4 during 

a planned heatup by permitting removal of RHR loops from operation 

when at least one RCS loop is in operation. This Note provides for the 

transition to MODE 4 where an RCS loop is permitted to be in operation 

and replaces the RCS circulation function provided by the RHR loops.

RHR pumps are OPERABLE if they are capable of being powered and 

are able to provide flow if required. A SG can perform as a heat sink via 

natural circulation when it has an adequate water level and is 

OPERABLE.

APPLICABILITY In MODE 5 with RCS loops filled, this LCO requires forced circulation of 

the reactor coolant to remove decay heat from the core and to provide 

proper boron mixing. One loop of RHR provides sufficient circulation for 

these purposes. However, one additional RHR loop is required to be 

OPERABLE, or the secondary side water level of at least [two] SGs is 

required to be ≥ [17]%.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops - MODES 1 and 2;"

LCO 3.4.5, "RCS Loops - MODE 3;"

LCO 3.4.6, "RCS Loops - MODE 4;"

LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled;"

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation -

High Water Level" (MODE 6)," and

LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation -

Low Water Level" (MODE 6)."

ACTIONS A.1, A.2, B.1 and B.2

If one RHR loop is OPERABLE and either the required SGs have 

secondary side water levels < [17]%, or one required RHR loop is 

inoperable, redundancy for heat removal is lost. Action must be initiated 

immediately to restore a second RHR loop to OPERABLE status or to 

restore the required SG secondary side water levels. Either Required
RCS Loops - MODE 5, Loops Filled

B 3.4.7

Westinghouse STS B 3.4.7-4 Rev. 4.0

BASES

ACTIONS Action will restore redundant heat removal paths. The immediate 

Completion Time reflects the importance of maintaining the availability of 

two paths for heat removal.

C.1 and C.2

If a required RHR loop is not in operation, except during conditions 

permitted by Note 1, or if no required loop is OPERABLE, all operations 

involving introduction of coolant into the RCS with boron concentration 

less than required to meet the minimum SDM of LCO 3.1.1 must be 

suspended and action to restore one RHR loop to OPERABLE status and 

operation must be initiated. Suspending the introduction of coolant into 

the RCS of coolant with boron concentration less than required to meet 

the minimum SDM of LCO 3.1.1 is required to assure continued safe 

operation. With coolant added without forced circulation, unmixed coolant 

could be introduced to the core, however coolant added with boron 

concentration meeting the minimum SDM maintains acceptable margin to 

subcritical operations. The immediate Completion Times reflect the 

importance of maintaining operation for heat removal.

SURVEILLANCE SR 3.4.7.1

REQUIREMENTS

This SR requires verification that the required loop is in operation. 

Verification includes flow rate, temperature, or pump status monitoring, 

which help ensure that forced flow is providing heat removal. [ The 

Frequency of 12 hours is sufficient considering other indications and 

alarms available to the operator in the control room to monitor RHR loop 

performance.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RCS Loops - MODE 5, Loops Filled

B 3.4.7

Westinghouse STS B 3.4.7-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.7.2

Verifying that at least two SGs are OPERABLE by ensuring their 

secondary side narrow range water levels are ≥ [17]% ensures an 

alternate decay heat removal method via natural circulation in the event 

that the second RHR loop is not OPERABLE. If both RHR loops are 

OPERABLE, this Surveillance is not needed. [ The 12 hour Frequency is 

considered adequate in view of other indications available in the control 

room to alert the operator to the loss of SG level.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.7.3

Verification that each required RHR pump is OPERABLE ensures that an 

additional pump can be placed in operation, if needed, to maintain decay 

heat removal and reactor coolant circulation. Verification is performed by 

verifying proper breaker alignment and power available to each required 

RHR pump. Alternatively, verification that a pump is in operation also 

verifies proper breaker alignment and power availability. If secondary 

side water level is ≥ [17]% in at least two SGs, this Surveillance is not 

needed. [ The Frequency of 7 days is considered reasonable in view of 

other administrative controls available and has been shown to be 

acceptable by operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RCS Loops - MODE 5, Loops Filled

B 3.4.7

Westinghouse STS B 3.4.7-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note that states the SR is not required to be 

performed until 24 hours after a required pump is not in operation.

REFERENCES 1. NRC Information Notice 95-35, "Degraded Ability of Steam 

Generators to Remove Decay Heat by Natural Circulation."
RCS Loops - MODE 5, Loops Not Filled

B 3.4.8

Westinghouse STS B 3.4.8-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.8 RCS Loops - MODE 5, Loops Not Filled

BASES

BACKGROUND In MODE 5 with the RCS loops not filled, the primary function of the 

reactor coolant is the removal of decay heat generated in the fuel, and the 

transfer of this heat to the component cooling water via the residual heat 

removal (RHR) heat exchangers. The steam generators (SGs) are not 

available as a heat sink when the loops are not filled. The secondary 

function of the reactor coolant is to act as a carrier for the soluble neutron 

poison, boric acid.

In MODE 5 with loops not filled, only RHR pumps can be used for coolant 

circulation. The number of pumps in operation can vary to suit the 

operational needs. The intent of this LCO is to provide forced flow from at 

least one RHR pump for decay heat removal and transport and to require 

that two paths be available to provide redundancy for heat removal.

APPLICABLE In MODE 5, RCS circulation is considered in the determination of the time

SAFETY available for mitigation of the accidental boron dilution event. The RHR

ANALYSES loops provide this circulation. The flow provided by one RHR loop is 

adequate for heat removal and for boron mixing.

RCS loops in MODE 5 (loops not filled) satisfies Criterion 4 of 

10 CFR 50.36(c)(2)(ii).

LCO The purpose of this LCO is to require that at least two RHR loops be 

OPERABLE and one of these loops be in operation. An OPERABLE loop 

is one that has the capability of transferring heat from the reactor coolant 

at a controlled rate. Heat cannot be removed via the RHR System unless 

forced flow is used. A minimum of one running RHR pump meets the 

LCO requirement for one loop in operation. An additional RHR loop is 

required to be OPERABLE to meet single failure considerations.

Note 1 permits all RHR pumps to be removed from operation for 

≤ 15 minutes when switching from one loop to another. The 

circumstances for stopping both RHR pumps are to be limited to 

situations when the outage time is short [and core outlet temperature is 

maintained > 10°F below saturation temperature]. The Note prohibits 

boron dilution with coolant at boron concentrations less than required to 

assure SDM of LCO 3.1.1 is maintained or draining operations when RHR 

forced flow is stopped.
RCS Loops - MODE 5, Loops Not Filled

B 3.4.8

Westinghouse STS B 3.4.8-2 Rev. 4.0

BASES

LCO (continued)

Note 2 allows one RHR loop to be inoperable for a period of ≤ 2 hours, 

provided that the other loop is OPERABLE and in operation. This permits 

periodic surveillance tests to be performed on the inoperable loop during 

the only time when these tests are safe and possible.

An OPERABLE RHR loop is comprised of an OPERABLE RHR pump 

capable of providing forced flow to an OPERABLE RHR heat exchanger. 

RHR pumps are OPERABLE if they are capable of being powered and 

are able to provide flow if required.

APPLICABILITY In MODE 5 with loops not filled, this LCO requires core heat removal and 

coolant circulation by the RHR System.

Operation in other MODES is covered by:

LCO 3.4.4, "RCS Loops - MODES 1 and 2,"

LCO 3.4.5, "RCS Loops - MODE 3,"

LCO 3.4.6, "RCS Loops - MODE 4,"

LCO 3.4.7, "RCS Loops - MODE 5, Loops Filled,"

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation -

High Water Level" (MODE 6),” and

LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation -

Low Water Level" (MODE 6)”.

ACTIONS A.1

If one required RHR loop is inoperable, redundancy for RHR is lost. 

Action must be initiated to restore a second loop to OPERABLE status. 

The immediate Completion Time reflects the importance of maintaining 

the availability of two paths for heat removal.

B.1 and B.2

If no required loop is OPERABLE or the required loop is not in operation, 

except during conditions permitted by Note 1, all operations involving 

introduction of coolant into the RCS with boron concentration less than 

required to meet the minimum SDM of LCO 3.1.1 must be suspended and 

action must be initiated immediately to restore an RHR loop to 

OPERABLE status and operation. The required margin to criticality must 

not be reduced in this type of operation. Suspending the introduction of 

coolant into the RCS of coolant with boron concentration less than 

required to meet the minimum SDM of LCO 3.1.1 is required to assure 

continued safe operation. With coolant added without forced circulation, 

unmixed coolant could be introduced to the core, however coolant added 

with boron concentration meeting the minimum SDM maintains 
RCS Loops - MODE 5, Loops Not Filled

B 3.4.8

Westinghouse STS B 3.4.8-3 Rev. 4.0

BASES

ACTIONS (continued)

acceptable margin to subcritical operations. The immediate Completion 

Time reflects the importance of maintaining operation for heat removal. 

The action to restore must continue until one loop is restored to 

OPERABLE status and operation.

SURVEILLANCE SR 3.4.8.1

REQUIREMENTS

This SR requires verification that the required loop is in operation. 

Verification includes flow rate, temperature, or pump status monitoring, 

which help ensure that forced flow is providing heat removal. [ The 

Frequency of 12 hours is sufficient considering other indications and 

alarms available to the operator in the control room to monitor RHR loop 

performance.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.8.2

Verification that each required pump is OPERABLE ensures that an 

additional pump can be placed in operation, if needed, to maintain decay 

heat removal and reactor coolant circulation. Verification is performed by 

verifying proper breaker alignment and power available to each required 

pump. Alternatively, verification that a pump is in operation also verifies 

proper breaker alignment and power availability. [ The Frequency of 

7 days is considered reasonable in view of other administrative controls 

available and has been shown to be acceptable by operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RCS Loops - MODE 5, Loops Not Filled

B 3.4.8

Westinghouse STS B 3.4.8-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note that states the SR is not required to be 

performed until 24 hours after a required pump is not in operation.

REFERENCES None.
Pressurizer

B 3.4.9

Westinghouse STS B 3.4.9-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 Pressurizer

BASES

BACKGROUND The pressurizer provides a point in the RCS where liquid and vapor are 

maintained in equilibrium under saturated conditions for pressure control 

purposes to prevent bulk boiling in the remainder of the RCS. Key 

functions include maintaining required primary system pressure during 

steady state operation, and limiting the pressure changes caused by 

reactor coolant thermal expansion and contraction during normal load 

transients.

The pressure control components addressed by this LCO include the 

pressurizer water level, the required heaters, and their controls and 

emergency power supplies. Pressurizer safety valves and pressurizer 

power operated relief valves are addressed by LCO 3.4.10, "Pressurizer 

Safety Valves," and LCO 3.4.11, "Pressurizer Power Operated Relief 

Valves (PORVs)," respectively.

The intent of the LCO is to ensure that a steam bubble exists in the 

pressurizer prior to power operation to minimize the consequences of 

potential overpressure transients. The presence of a steam bubble is 

consistent with analytical assumptions. Relatively small amounts of 

noncondensible gases can inhibit the condensation heat transfer between 

the pressurizer spray and the steam, and diminish the spray effectiveness 

for pressure control.

Electrical immersion heaters, located in the lower section of the 

pressurizer vessel, keep the water in the pressurizer at saturation 

temperature and maintain a constant operating pressure. A minimum 

required available capacity of pressurizer heaters ensures that the RCS 

pressure can be maintained. The capability to maintain and control 

system pressure is important for maintaining subcooled conditions in the 

RCS and ensuring the capability to remove core decay heat by either 

forced or natural circulation of reactor coolant. Unless adequate heater 

capacity is available, the hot, high pressure condition cannot be 

maintained indefinitely and still provide the required subcooling margin in 

the primary system. Inability to control the system pressure and maintain 

subcooling under conditions of natural circulation flow in the primary 

system could lead to a loss of single phase natural circulation and 

decreased capability to remove core decay heat.
Pressurizer

B 3.4.9

Westinghouse STS B 3.4.9-2 Rev. 4.0

BASES

APPLICABLE In MODES 1, 2, and 3, the LCO requirement for a steam bubble is

SAFETY reflected implicitly in the accident analyses. Safety analyses performed

ANALYSES for lower MODES are not limiting. All analyses performed from a critical 

reactor condition assume the existence of a steam bubble and saturated 

conditions in the pressurizer. In making this assumption, the analyses 

neglect the small fraction of noncondensible gases normally present.

Safety analyses presented in the FSAR (Ref. 1) do not take credit for 

pressurizer heater operation; however, an implicit initial condition 

assumption of the safety analyses is that the RCS is operating at normal 

pressure.

The maximum pressurizer water level limit, which ensures that a steam 

bubble exists in the pressurizer, satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii). Although the heaters are not specifically used in 

accident analysis, the need to maintain subcooling in the long term during 

loss of offsite power, as indicated in NUREG-0737 (Ref. 2), is the reason 

for providing an LCO.

LCO -----------------------------------REVIEWER’S NOTE-----------------------------------

Plants licensed prior to the issuance of NUREG-0737 may not have a 

requirement on the number of pressurizer groups.

--------------------------------------------------------------------------------------------------

The LCO requirement for the pressurizer to be OPERABLE with a water 

volume ≤ [1240] cubic feet, which is equivalent to [92]%, ensures that a 

steam bubble exists. Limiting the LCO maximum operating water level 

preserves the steam space for pressure control. The LCO has been 

established to ensure the capability to establish and maintain pressure 

control for steady state operation and to minimize the consequences of 

potential overpressure transients. Requiring the presence of a steam 

bubble is also consistent with analytical assumptions.

The LCO requires [two groups of] OPERABLE pressurizer heaters, [each] 

with a capacity ≥ [125] kW, [capable of being powered from either the 

offsite power source or the emergency power supply]. The minimum 

heater capacity required is sufficient to maintain the RCS near normal 

operating pressure when accounting for heat losses through the 

pressurizer insulation. By maintaining the pressure near the operating 

conditions, a wide margin to subcooling can be obtained in the loops. 

The exact design value of [125 kW is derived from the use of seven 

heaters rated at 17.9 kW each]. The amount needed to maintain 

pressure is dependent on the heat losses.
Pressurizer

B 3.4.9

Westinghouse STS B 3.4.9-3 Rev. 4.0

BASES

APPLICABILITY The need for pressure control is most pertinent when core heat can cause 

the greatest effect on RCS temperature, resulting in the greatest effect on 

pressurizer level and RCS pressure control. Thus, applicability has been 

designated for MODES 1 and 2. The applicability is also provided for 

MODE 3. The purpose is to prevent solid water RCS operation during 

heatup and cooldown to avoid rapid pressure rises caused by normal 

operational perturbation, such as reactor coolant pump startup.

In MODES 1, 2, and 3, there is need to maintain the availability of 

pressurizer heaters, capable of being powered from an emergency power 

supply. In the event of a loss of offsite power, the initial conditions of 

these MODES give the greatest demand for maintaining the RCS in a hot 

pressurized condition with loop subcooling for an extended period. For 

MODE 4, 5, or 6, it is not necessary to control pressure (by heaters) to 

ensure loop subcooling for heat transfer when the Residual Heat 

Removal (RHR) System is in service, and therefore, the LCO is not 

applicable.

ACTIONS A.1, A.2, A.3, and A.4

Pressurizer water level control malfunctions or other plant evolutions may 

result in a pressurizer water level above the nominal upper limit, even 

with the plant at steady state conditions. Normally the plant will trip in this 

event since the upper limit of this LCO is the same as the Pressurizer 

Water Level - High Trip.

If the pressurizer water level is not within the limit, action must be taken to 

bring the plant to a MODE in which the LCO does not apply. To achieve 

this status, within 6 hours the unit must be brought to MODE 3 with all 

rods fully inserted and incapable of withdrawal. Additionally, the unit must 

be brought to MODE 4 within 12 hours. This takes the unit out of the 

applicable MODES.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems.

B.1

If one [required] group of pressurizer heaters is inoperable, restoration is 

required within 72 hours. The Completion Time of 72 hours is reasonable 

considering the anticipation that a demand caused by loss of offsite 

power would be unlikely in this period. Pressure control may be 

maintained during this time using normal station powered heaters.
Pressurizer

B 3.4.9

Westinghouse STS B 3.4.9-4 Rev. 4.0

BASES

ACTIONS (continued)

C.1 and C.2

If one group of pressurizer heaters are inoperable and cannot be restored 

in the allowed Completion Time of Required Action B.1, the plant must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to MODE 3 within 6 hours and to 

MODE 4 within 12 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required plant conditions 

from full power conditions in an orderly manner and without challenging 

plant systems.

SURVEILLANCE SR 3.4.9.1

REQUIREMENTS

This SR requires that during steady state operation, pressurizer level is 

maintained below the nominal upper limit to provide a minimum space for 

a steam bubble. The Surveillance is performed by observing the 

indicated level. [ The Frequency of 12 hours corresponds to verifying the 

parameter each shift. The 12 hour interval has been shown by operating 

practice to be sufficient to regularly assess level for any deviation and 

verify that operation is within safety analyses assumption of ensuring that 

a steam bubble exists in the pressurizer. Alarms are also available for 

early detection of abnormal level indications.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.9.2

-----------------------------------REVIEWER’S NOTE-----------------------------------

The frequency for performing Pressurizer heater capacity testing shall be 

either 18 months or 92 days, depending on whether or not the plant has 

dedicated safety-related heaters. For dedicated safety-related heaters, 

which do not normally operate, 92 days is applied. For non-dedicated 

safety-related heaters, which normally operate, 18 months is applied.

--------------------------------------------------------------------------------------------------
Pressurizer

B 3.4.9

Westinghouse STS B 3.4.9-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The SR is satisfied when the power supplies are demonstrated to be 

capable of producing the minimum power and the associated pressurizer 

heaters are verified to be at their design rating. This may be done by 

testing the power supply output and by performing an electrical check on 

heater element continuity and resistance. [ The Frequency of [18] months 

is considered adequate to detect heater degradation and has been shown 

by operating experience to be acceptable.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.4.9.3

This SR is not applicable if the heaters are permanently powered by 

Class 1E power supplies.

This Surveillance demonstrates that the heaters can be manually 

transferred from the normal to the emergency power supply and 

energized. [ The Frequency of 18 months is based on a typical fuel cycle 

and is consistent with similar verifications of emergency power supplies.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]
Pressurizer

B 3.4.9

Westinghouse STS B 3.4.9-6 Rev. 4.0

BASES

REFERENCES 1. FSAR, Section [ ].

2. NUREG-0737, November 1980.
Pressurizer Safety Valves

B 3.4.10

Westinghouse STS B 3.4.10-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.10 Pressurizer Safety Valves

BASES

BACKGROUND The pressurizer safety valves provide, in conjunction with the Reactor 

Protection System, overpressure protection for the RCS. The pressurizer 

safety valves are totally enclosed pop type, spring loaded, self actuated 

valves with backpressure compensation. The safety valves are designed 

to prevent the system pressure from exceeding the system Safety Limit 

(SL), [2735] psig, which is 110% of the design pressure.

Because the safety valves are totally enclosed and self actuating, they 

are considered independent components. The relief capacity for each 

valve, [380,000] lb/hr, is based on postulated overpressure transient 

conditions resulting from a complete loss of steam flow to the turbine. 

This event results in the maximum surge rate into the pressurizer, which 

specifies the minimum relief capacity for the safety valves. The discharge 

flow from the pressurizer safety valves is directed to the pressurizer relief 

tank. This discharge flow is indicated by an increase in temperature 

downstream of the pressurizer safety valves or increase in the pressurizer 

relief tank temperature or level.

Overpressure protection is required in MODES 1, 2, 3, 4, and 5; however, 

in MODE 4, with one or more RCS cold leg temperatures ≤ [275°F] [Low 

Temperature Overpressure Protection (LTOP) arming temperature 

specified in the PTLR], and MODE 5 and MODE 6 with the reactor vessel 

head on, overpressure protection is provided by operating procedures 

and by meeting the requirements of LCO 3.4.12, "Low Temperature 

Overpressure Protection (LTOP) System."

The upper and lower pressure limits are based on the ± 1% tolerance 

requirement (Ref. 1) for lifting pressures above 1000 psig. The lift setting 

is for the ambient conditions associated with MODES 1, 2, and 3. This 

requires either that the valves be set hot or that a correlation between hot 

and cold settings be established.

The pressurizer safety valves are part of the primary success path and 

mitigate the effects of postulated accidents. OPERABILITY of the safety 

valves ensures that the RCS pressure will be limited to 110% of design 

pressure. The consequences of exceeding the American Society of 

Mechanical Engineers (ASME) pressure limit (Ref. 1) could include 

damage to RCS components, increased leakage, or a requirement to 

perform additional stress analyses prior to resumption of reactor 

operation.
Pressurizer Safety Valves

B 3.4.10

Westinghouse STS B 3.4.10-2 Rev. 4.0

BASES

APPLICABLE All accident and safety analyses in the FSAR (Ref. 2) that require safety

SAFETY valve actuation assume operation of three pressurizer safety valves to

ANALYSES limit increases in RCS pressure. The overpressure protection analysis 

(Ref. 3) is also based on operation of [three] safety valves. Accidents that 

could result in overpressurization if not properly terminated include:

a. Uncontrolled rod withdrawal from full power,

b. Loss of reactor coolant flow,

c. Loss of external electrical load,

d. Loss of normal feedwater,

e. Loss of all AC power to station auxiliaries, and

f. Locked rotor.

Detailed analyses of the above transients are contained in Reference 2. 

Safety valve actuation is required in events c, d, and e (above) to limit the 

pressure increase. Compliance with this LCO is consistent with the 

design bases and accident analyses assumptions.

Pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The [three] pressurizer safety valves are set to open at the RCS design 

pressure (2500 psia), and within the ASME specified tolerance, to avoid 

exceeding the maximum design pressure SL, to maintain accident 

analyses assumptions, and to comply with ASME requirements. The 

upper and lower pressure tolerance limits are based on the ± 1% 

tolerance requirements (Ref. 1) for lifting pressures above 1000 psig. 

The limit protected by this Specification is the reactor coolant pressure 

boundary (RCPB) SL of 110% of design pressure. Inoperability of one or 

more valves could result in exceeding the SL if a transient were to occur. 

The consequences of exceeding the ASME pressure limit could include 

damage to one or more RCS components, increased leakage, or 

additional stress analysis being required prior to resumption of reactor 

operation.

APPLICABILITY In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP arming 

temperature, OPERABILITY of [three] valves is required because the 

combined capacity is required to keep reactor coolant pressure below 

110% of its design value during certain accidents. MODE 3 and portions 

of MODE 4 are conservatively included, although the listed accidents may 

not require the safety valves for protection.
Pressurizer Safety Valves

B 3.4.10

Westinghouse STS B 3.4.10-3 Rev. 4.0

BASES

APPLICABILITY (continued)

The LCO is not applicable in MODE 4 when any RCS cold leg 

temperatures are ≤ [275°F] [Low Temperature Overpressure Protection 

(LTOP) arming temperature specified in the PTLR] or in MODE 5 

because LTOP is provided. Overpressure protection is not required in 

MODE 6 with reactor vessel head detensioned.

The Note allows entry into MODES 3 and 4 with the lift settings outside 

the LCO limits. This permits testing and examination of the safety valves 

at high pressure and temperature near their normal operating range, but 

only after the valves have had a preliminary cold setting. The cold setting 

gives assurance that the valves are OPERABLE near their design 

condition. Only one valve at a time will be removed from service for 

testing. The [54] hour exception is based on 18 hour outage time for 

each of the [three] valves. The 18 hour period is derived from operating 

experience that hot testing can be performed in this timeframe.

ACTIONS A.1

With one pressurizer safety valve inoperable, restoration must take place 

within 15 minutes. The Completion Time of 15 minutes reflects the 

importance of maintaining the RCS Overpressure Protection System. An 

inoperable safety valve coincident with an RCS overpressure event could 

challenge the integrity of the pressure boundary.

B.1 and B.2

If the Required Action of A.1 cannot be met within the required 

Completion Time or if two or more pressurizer safety valves are 

inoperable, the plant must be brought to a MODE in which the 

requirement does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 4 with any RCS 

cold leg temperatures ≤ [275°F] [Low Temperature Overpressure 

Protection (LTOP) arming temperature specified in the PTLR] within 

[24] hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. With any RCS cold leg temperatures at or below [275°F] [Low 

Temperature Overpressure (LTOP) arming temperature specified in the 

PTLR], overpressure protection is provided by the LTOP System. The 

change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core 

power and pressure), lowers the potential for large pressurizer insurges, 

and thereby removes the need for overpressure protection by [three] 

pressurizer safety valves.
Pressurizer Safety Valves

B 3.4.10

Westinghouse STS B 3.4.10-4 Rev. 4.0

BASES

SURVEILLANCE SR 3.4.10.1

REQUIREMENTS

SRs are specified in the Inservice Testing Program. Pressurizer safety 

valves are to be tested in accordance with the requirements of the ASME 

Code (Ref. 4), which provides the activities and Frequencies necessary to 

satisfy the SRs. No additional requirements are specified.

The pressurizer safety valve setpoint is ± [3]% for OPERABILITY; 

however, the valves are reset to ± 1% during the Surveillance to allow for 

drift.

REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Section III.

2. FSAR, Chapter [15].

3. WCAP-7769, Rev. 1, June 1972.

4. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)

BASES

BACKGROUND The pressurizer is equipped with two types of devices for pressure relief: 

pressurizer safety valves and PORVs. The PORVs are air operated 

valves that are controlled to open at a specific set pressure when the 

pressurizer pressure increases and close when the pressurizer pressure 

decreases. The PORVs may also be manually operated from the control

room.

Block valves, which are normally open, are located between the 

pressurizer and the PORVs. The block valves are used to isolate the 

PORVs in case of excessive leakage or a stuck open PORV. Block valve 

closure is accomplished manually using controls in the control room. A 

stuck open PORV is, in effect, a small break loss of coolant accident 

(LOCA). As such, block valve closure terminates the RCS 

depressurization and coolant inventory loss.

The PORVs and their associated block valves may be used by plant 

operators to depressurize the RCS to recover from certain transients if 

normal pressurizer spray is not available. Additionally, the series 

arrangement of the PORVs and their block valves permit performance of 

surveillances on the valves during power operation.

The PORVs may also be used for feed and bleed core cooling in the case 

of multiple equipment failure events that are not within the design basis, 

such as a total loss of feedwater.

The PORVs, their block valves, and their controls are powered from the 

vital buses that normally receive power from offsite power sources, but 

are also capable of being powered from emergency power sources in the 

event of a loss of offsite power. Two PORVs and their associated block 

valves are powered from two separate safety trains (Ref. 1).

The plant has two PORVs, each having a relief capacity of 210,000 lb/hr 

at 2335 psig. The functional design of the PORVs is based on 

maintaining pressure below the Pressurizer Pressure - High reactor trip 

setpoint following a step reduction of 50% of full load with steam dump. 

In addition, the PORVs minimize challenges to the pressurizer safety 

valves and also may be used for low temperature overpressure protection 

(LTOP). See LCO 3.4.12, "Low Temperature Overpressure Protection 

(LTOP) System."
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-2 Rev. 4.0

BASES

APPLICABLE Plant operators employ the PORVs to depressurize the RCS in response

SAFETY to certain plant transients if normal pressurizer spray is not available. 

ANALYSES For the Steam Generator Tube Rupture (SGTR) event, the safety 

analysis assumes that manual operator actions are required to mitigate 

the event. A loss of offsite power is assumed to accompany the event, 

and thus, normal pressurizer spray is unavailable to reduce RCS 

pressure. The PORVs are assumed to be used for RCS 

depressurization, which is one of the steps performed to equalize the 

primary and secondary pressures in order to terminate the primary to 

secondary break flow and the radioactive releases from the affected 

steam generator.

The PORVs are also modeled in safety analyses for events that result in 

increasing RCS pressure for which departure from nucleate boiling ratio 

(DNBR) criteria are critical (Ref. 2). By assuming PORV actuation, the 

primary pressure remains below the high pressurizer pressure trip 

setpoint; thus, the DNBR calculation is more conservative. As such, this 

actuation is not required to mitigate these events, and PORV automatic 

operation is, therefore, not an assumed safety function.

Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO requires the PORVs and their associated block valves to be 

OPERABLE for manual operation to mitigate the effects associated with 

an SGTR.

By maintaining two PORVs and their associated block valves 

OPERABLE, the single failure criterion is satisfied. An OPERABLE block 

valve may be either open and energized with the capability to be closed, 

or closed and energized with the capability to be opened, since the 

required safety function is accomplished by manual operation. Although 

typically open to allow PORV operation, the block valves may be 

OPERABLE when closed to isolate the flow path of an inoperable PORV 

that is capable of being manually cycled (e.g., as in the case of excessive 

PORV leakage). Similarly, isolation of an OPERABLE PORV does not 

render that PORV or block valve inoperable provided the relief function 

remains available with manual action.

An OPERABLE PORV is required to be capable of manually opening and 

closing, and not experiencing excessive seat leakage. Excessive seat 

leakage, although not associated with a specific acceptance criteria, 

exists when conditions dictate closure of the block valve to limit leakage.

Satisfying the LCO helps minimize challenges to fission product barriers.
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-3 Rev. 4.0

BASES

APPLICABILITY In MODES 1, 2, and 3, the PORV and its block valve are required to be 

OPERABLE to limit the potential for a small break LOCA through the flow 

path. The most likely cause for a PORV small break LOCA is a result of a 

pressure increase transient that causes the PORV to open. Imbalances 

in the energy output of the core and heat removal by the secondary 

system can cause the RCS pressure to increase to the PORV opening 

setpoint. The most rapid increases will occur at the higher operating 

power and pressure conditions of MODES 1 and 2. The PORVs are also 

required to be OPERABLE in MODES 1, 2, and 3 for manual actuation to 

mitigate a steam generator tube rupture event.

Pressure increases are less prominent in MODE 3 because the core input 

energy is reduced, but the RCS pressure is high. Therefore, the LCO is 

applicable in MODES 1, 2, and 3. The LCO is not applicable in 

MODES 4, 5, and 6 with the reactor vessel head in place when both 

pressure and core energy are decreased and the pressure surges 

become much less significant. LCO 3.4.12 addresses the PORV 

requirements in these MODES.

ACTIONS Note 1 has been added to clarify that all pressurizer PORVs and block 

valves are treated as separate entities, each with separate Completion 

Times (i.e., the Completion Time is on a component basis). 

-----------------------------------REVIEWER’S NOTE-----------------------------------

The bracketed options in Conditions B, C, E, and F are to accommodate 

plants with three PORVs and associated block valves.

--------------------------------------------------------------------------------------------------

A.1

PORVs may be inoperable and capable of being manually cycled (e.g., 

excessive seat leakage). In this condition, either the PORVs must be 

restored or the flow path isolated within 1 hour. The associated block 

valve is required to be closed, but power must be maintained to the 

associated block valve, since removal of power would render the block 

valve inoperable. This permits operation of the plant until the next 

refueling outage (MODE 6) so that maintenance can be performed on the 

PORVs to eliminate the problem condition.

Quick access to the PORV for pressure control can be made when power 

remains on the closed block valve. The Completion Time of 1 hour is 

based on plant operating experience that has shown that minor problems 

can be corrected or closure accomplished in this time period.
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-4 Rev. 4.0

BASES

ACTIONS (continued)

B.1, B.2, and B.3

If one [or two] PORV[s] is inoperable and not capable of being manually 

cycled, it must be either restored, or isolated by closing the associated 

block valve and removing the power to the associated block valve. The 

Completion Times of 1 hour are reasonable, based on challenges to the 

PORVs during this time period, and provide the operator adequate time to 

correct the situation. If the inoperable valve cannot be restored to 

OPERABLE status, it must be isolated within the specified time. Because 

there is at least one PORV that remains OPERABLE, an additional 

72 hours is provided to restore the inoperable PORV to OPERABLE 

status. If the PORV cannot be restored within this additional time, the 

plant must be brought to a MODE in which the LCO does not apply, as 

required by Condition D.

C.1 and C.2

If one [or two] block valve(s) are inoperable, then it is necessary to either 

restore the block valve(s) to OPERABLE status within the Completion 

Time of 1 hour or place the associated PORV in manual control. The 

prime importance for the capability to close the block valve(s) is to isolate 

a stuck open PORV. Therefore, if the block valve(s) cannot be restored 

to OPERABLE status within 1 hour, the Required Action is to place the 

PORV in manual control to preclude its automatic opening for an 

overpressure event and to avoid the potential for a stuck open PORV at a 

time that the block valve(s) are inoperable. The Completion Time of 

1 hour is reasonable, based on the small potential for challenges to the 

system during this time period, and provides the operator time to correct 

the situation. Because at least one PORV remains OPERABLE, the 

operator is permitted a Completion Time of 72 hours to restore the 

inoperable block valve(s) to OPERABLE status. The time allowed to 

restore the block valve(s) is based upon the Completion Time for 

restoring an inoperable PORV in Condition B, since the PORVs may not 

be capable of mitigating an event if the inoperable block valve(s) are not 

full open. If the block valve(s) are restored within the Completion Time of 

72 hours, the PORV may be restored to automatic operation. If it cannot 

be restored within this additional time, the plant must be brought to a 

MODE in which the LCO does not apply, as required by Condition D.
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-5 Rev. 4.0

BASES

ACTIONS (continued)

The Required Actions C.1 and C.2 are modified by a Note stating that the 

Required Actions do not apply if the sole reason for the block valve being 

declared inoperable is as a result of power being removed to comply with 

other Required Actions. In this event, the Required Actions for inoperable 

PORV(s) (which require the block valve power to be removed once it is 

closed) are adequate to address the condition. While it may be desirable 

to also place the PORV(s) in manual control, this may not be possible for 

all causes of Condition B or E entry with PORV(s) inoperable and not 

capable of being manually cycled (e.g., as a result of failed control power 

fuse(s) or control switch malfunctions(s)).

D.1 and D.2

If the Required Action of Condition A, B, or C is not met, then the plant 

must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

6 hours and to MODE 4 within 12 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required 

plant conditions from full power conditions in an orderly manner and 

without challenging plant systems. In MODES 4 and 5, automatic PORV 

OPERABILITY may be required. See LCO 3.4.12.

E.1, E.2, E.3, and E.4

If more than one PORV is inoperable and not capable of being manually 

cycled, it is necessary to either restore at least one valve within the 

Completion Time of 1 hour or isolate the flow path by closing and 

removing the power to the associated block valves. The Completion 

Time of 1 hour is reasonable, based on the small potential for challenges 

to the system during this time and provides the operator time to correct 

the situation. If no PORVs are restored within the Completion Time, then 

the plant must be brought to a MODE in which the LCO does not apply. 

To achieve this status, the plant must be brought to at least MODE 3 

within 6 hours and to MODE 4 within 12 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required plant conditions from full power conditions in an orderly manner 

and without challenging plant systems. In MODES 4 and 5, automatic 

PORV OPERABILITY may be required. See LCO 3.4.12.
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-6 Rev. 4.0

BASES

ACTIONS (continued)

F.1

If two [or three] block valve(s) are inoperable, it is necessary to restore at 

least one block valve within 2 hours. The Completion Time is reasonable, 

based on the small potential for challenges to the system during this time 

and provide the operator time to correct the situation.

Required Action F.1 is modified by a Note stating that the Required Action 

does not apply if the sole reason for the block valve being declared 

inoperable is a result of power being removed to comply with other 

Required Actions. In this event, the Required Actions for inoperable 

PORV(s) (which require the block valve power to be removed once it is 

closed) are adequate to address the condition. While it may be desirable 

to also place the PORV(s) in manual control, this may not be possible for 

all causes of Condition B or E entry with PORV(s) inoperable and not 

capable of being manually cycled (e.g., as a result of failed control power 

fuse(s) or control switch malfunctions(s)).

G.1 and G.2

If the Required Action of Condition F is not met, then the plant must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 6 hours and 

to MODE 4 within 12 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems. In MODES 4 and 5, automatic PORV 

OPERABILITY may be required. See LCO 3.4.12.

SURVEILLANCE SR 3.4.11.1

REQUIREMENTS

Block valve cycling verifies that the valve(s) can be opened and closed if 

needed. [ The basis for the Frequency of 92 days is the ASME Code 

(Ref. 3). 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by two Notes. Note 1 modifies this SR by stating that 

it is not required to be performed with the block valve closed in 

accordance with the Required Actions of this LCO. Opening the block 

valve in this condition increases the risk of an unisolable leak from the 

RCS since the PORV is already inoperable. Note 2 modifies this SR to 

allow entry into and operation in MODE 3 prior to performing the SR. 

This allows the test to be performed in MODE 3 under operating 

temperature and pressure conditions, prior to entering MODE 1 or 2. [In 

accordance with Reference 4, administrative controls require this test be 

performed in MODE 3 or 4 to adequately simulate operating temperature 

and pressure effects on PORV operation.]

SR 3.4.11.2

SR 3.4.11.2 requires a complete cycle of each PORV. Operating a 

PORV through one complete cycle ensures that the PORV can be 

manually actuated for mitigation of an SGTR. [ The Frequency of 

[18] months is based on a typical refueling cycle and industry accepted 

practice.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Note modifies this SR to allow entry into and operation in MODE 3 

prior to performing the SR. This allows the test to be performed in 

MODE 3 under operating temperature and pressure conditions, prior to 

entering MODE 1 or 2. [In accordance with Reference 4, administrative 

controls require this test be performed in MODE 3 or 4 to adequately 

simulate operating temperature and pressure effects on PORV operation.] 

[ SR 3.4.11.3

Operating the solenoid air control valves and check valves on the air 

accumulators ensures the PORV control system actuates properly when 

called upon. [ The Frequency of [18] months is based on a typical 

refueling cycle and the Frequency of the other Surveillances used to 

demonstrate PORV OPERABILITY.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

[ SR 3.4.11.4

This Surveillance is not required for plants with permanent 1E power 

supplies to the valves.

The Surveillance demonstrates that emergency power can be provided 

and is performed by transferring power from normal to emergency supply 

and cycling the valves. [ The Frequency of [18] months is based on a 

typical refueling cycle and industry accepted practice.
Pressurizer PORVs

B 3.4.11

Westinghouse STS B 3.4.11-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

REFERENCES 1. Regulatory Guide 1.32, February 1977.

2. FSAR, Section [15.2].

3. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

[ 4. Generic Letter 90-06, "Resolution of Generic Issue 70, 'PowerOperated Relief Valve and Block Valve Reliability,' and Generic Issue 

94, 'Additional Low-Temperature Overpressure for Light-Water 

Reactors,' Pursuant to 10 CFR 50.54(f)," June 25, 1990.]

LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Low Temperature Overpressure Protection (LTOP) System

BASES

BACKGROUND The LTOP System controls RCS pressure at low temperatures so the 

integrity of the reactor coolant pressure boundary (RCPB) is not 

compromised by violating the pressure and temperature (P/T) limits of 

10 CFR 50, Appendix G (Ref. 1). The reactor vessel is the limiting RCPB 

component for demonstrating such protection. The PTLR provides the 

maximum allowable actuation logic setpoints for the power operated relief 

valves (PORVs) and the maximum RCS pressure for the existing RCS 

cold leg temperature during cooldown, shutdown, and heatup to meet the 

Reference 1 requirements during the LTOP MODES.

The reactor vessel material is less tough at low temperatures than at 

normal operating temperature. As the vessel neutron exposure 

accumulates, the material toughness decreases and becomes less 

resistant to pressure stress at low temperatures (Ref. 2). RCS pressure, 

therefore, is maintained low at low temperatures and is increased only as 

temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is 

water solid, occurring only while shutdown; a pressure fluctuation can

occur more quickly than an operator can react to relieve the condition. 

Exceeding the RCS P/T limits by a significant amount could cause brittle 

cracking of the reactor vessel. LCO 3.4.3, "RCS Pressure and 

Temperature (P/T) Limits," requires administrative control of RCS 

pressure and temperature during heatup and cooldown to prevent 

exceeding the PTLR limits.

This LCO provides RCS overpressure protection by having a minimum 

coolant input capability and having adequate pressure relief capacity. 

Limiting coolant input capability requires all but [one] [high pressure 

injection (HPI)] pump [and one charging pump] incapable of injection into 

the RCS and isolating the accumulators. The pressure relief capacity 

requires either two redundant RCS relief valves or a depressurized RCS 

and an RCS vent of sufficient size. One RCS relief valve or the open 

RCS vent is the overpressure protection device that acts to terminate an 

increasing pressure event.

With minimum coolant input capability, the ability to provide core coolant 

addition is restricted. The LCO does not require the makeup control 

system deactivated or the safety injection (SI) actuation circuits blocked. 

Due to the lower pressures in the LTOP MODES and the expected core 
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-2 Rev. 4.0

BASES

BACKGROUND (continued)

decay heat levels, the makeup system can provide adequate flow via the 

makeup control valve. If conditions require the use of more than one [HPI 

or] charging pump for makeup in the event of loss of inventory, then 

pumps can be made available through manual actions.

The LTOP System for pressure relief consists of two PORVs with reduced 

lift settings, or two residual heat removal (RHR) suction relief valves, or 

one PORV and one RHR suction relief valve, or a depressurized RCS 

and an RCS vent of sufficient size. Two RCS relief valves are required 

for redundancy. One RCS relief valve has adequate relieving capability 

to keep from overpressurization for the required coolant input capability.

PORV Requirements

As designed for the LTOP System, each PORV is signaled to open if the 

RCS pressure approaches a limit determined by the LTOP actuation 

logic. The LTOP actuation logic monitors both RCS temperature and 

RCS pressure and determines when a condition not acceptable in the 

PTLR limits is approached. The wide range RCS temperature indications 

are auctioneered to select the lowest temperature signal.

The lowest temperature signal is processed through a function generator 

that calculates a pressure limit for that temperature. The calculated 

pressure limit is then compared with the indicated RCS pressure from a 

wide range pressure channel. If the indicated pressure meets or exceeds 

the calculated value, a PORV is signaled to open.

The PTLR presents the PORV setpoints for LTOP. The setpoints are 

normally staggered so only one valve opens during a low temperature 

overpressure transient. Having the setpoints of both valves within the 

limits in the PTLR ensures that the Reference 1 limits will not be 

exceeded in any analyzed event.

When a PORV is opened in an increasing pressure transient, the release 

of coolant will cause the pressure increase to slow and reverse. As the 

PORV releases coolant, the RCS pressure decreases until a reset 

pressure is reached and the valve is signaled to close. The pressure 

continues to decrease below the reset pressure as the valve closes.
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-3 Rev. 4.0

BASES

BACKGROUND (continued)

[ RHR Suction Relief Valve Requirements

During LTOP MODES, the RHR System is operated for decay heat 

removal and low pressure letdown control. Therefore, the RHR suction 

isolation valves are open in the piping from the RCS hot legs to the inlets 

of the RHR pumps. While these valves are open and the RHR suction 

valves are open, the RHR suction relief valves are exposed to the RCS 

and are able to relieve pressure transients in the RCS.

The RHR suction isolation valves and the RHR suction valves must be 

open to make the RHR suction relief valves OPERABLE for RCS 

overpressure mitigation. Autoclosure interlocks are not permitted to 

cause the RHR suction isolation valves to close. The RHR suction relief 

valves are spring loaded, bellows type water relief valves with pressure 

tolerances and accumulation limits established by Section III of the 

American Society of Mechanical Engineers (ASME) Code (Ref. 3) for 

Class 2 relief valves. ]

RCS Vent Requirements

Once the RCS is depressurized, a vent exposed to the containment 

atmosphere will maintain the RCS at containment ambient pressure in an 

RCS overpressure transient, if the relieving requirements of the transient 

do not exceed the capabilities of the vent. Thus, the vent path must be 

capable of relieving the flow resulting from the limiting LTOP mass or heat 

input transient, and maintaining pressure below the P/T limits. The 

required vent capacity may be provided by one or more vent paths.

For an RCS vent to meet the flow capacity requirement, it requires 

removing a pressurizer safety valve, removing a PORV's internals, and 

disabling its block valve in the open position, or similarly establishing a

vent by opening an RCS vent valve. The vent path(s) must be above the 

level of reactor coolant, so as not to drain the RCS when open.

APPLICABLE Safety analyses (Ref. 4) demonstrate that the reactor vessel is

SAFETY adequately protected against exceeding the Reference 1 P/T limits. In

ANALYSES MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature 

exceeding [275°F] [LTOP arming temperature specified in the PTLR], the 

pressurizer safety valves will prevent RCS pressure from exceeding the 

Reference 1 limits. At about [275°F] [LTOP arming temperature specified 

in the PTLR] and below, overpressure prevention falls to two OPERABLE 

RCS relief valves or to a depressurized RCS and a sufficient sized RCS 

vent. Each of these means has a limited overpressure relief capability.
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The actual temperature at which the pressure in the P/T limit curve falls 

below the pressurizer safety valve setpoint increases as the reactor 

vessel material toughness decreases due to neutron embrittlement. Each 

time the PTLR curves are revised, the LTOP System must be reevaluated to ensure its functional requirements can still be met using the 

RCS relief valve method or the depressurized and vented RCS condition.

The PTLR contains the acceptance limits that define the LTOP 

requirements. Any change to the RCS must be evaluated against the 

Reference 4 analyses to determine the impact of the change on the LTOP 

acceptance limits.

Transients that are capable of overpressurizing the RCS are categorized 

as either mass or heat input transients, examples of which follow:

Mass Input Type Transients

a. Inadvertent safety injection or

b. Charging/letdown flow mismatch.

Heat Input Type Transients

a. Inadvertent actuation of pressurizer heaters,

b. Loss of RHR cooling, or

c. Reactor coolant pump (RCP) startup with temperature asymmetry 

within the RCS or between the RCS and steam generators.

The following are required during the LTOP MODES to ensure that mass 

and heat input transients do not occur, which either of the LTOP 

overpressure protection means cannot handle:

a. Rendering all but [one] [HPI] pump [and one charging pump] 

incapable of injection,

b. Deactivating the accumulator discharge isolation valves in their 

closed positions, and

c. Disallowing start of an RCP if secondary temperature is more than 

[50]°F above primary temperature in any one loop. LCO 3.4.6, "RCS 

Loops - MODE 4," and LCO 3.4.7, "RCS Loops - MODE 5, Loops 

Filled," provide this protection.
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-5 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The Reference 4 analyses demonstrate that either one RCS relief valve 

or the depressurized RCS and RCS vent can maintain RCS pressure 

below limits when only one [HPI] pump [and one charging pump are] is 

[are] actuated. Thus, the LCO allows only [one] [HPI] pump [and one 

charging pump] OPERABLE during the LTOP MODES. Since neither 

one RCS relief valve nor the RCS vent can handle the pressure transient 

need from accumulator injection, when RCS temperature is low, the LCO 

also requires the accumulators isolation when accumulator pressure is 

greater than or equal to the maximum RCS pressure for the existing RCS 

cold leg temperature allowed in the PTLR.

The isolated accumulators must have their discharge valves closed and 

the valve power supply breakers fixed in their open positions. The 

analyses show the effect of accumulator discharge is over a narrower 

RCS temperature range ([175]°F and below) than that of the 

LCO ([275]°F and below).

Fracture mechanics analyses established the temperature of LTOP 

Applicability at [275°F] [LTOP arming temperature specified in the PTLR].

The consequences of a small break loss of coolant accident (LOCA) in 

LTOP MODE 4 conform to 10 CFR 50.46 and 10 CFR 50, Appendix K 

(Refs. 5 and 6), requirements by having a maximum of [one] [HPI] pump 

[and one charging pump] OPERABLE and SI actuation enabled.

PORV Performance

The fracture mechanics analyses show that the vessel is protected when 

the PORVs are set to open at or below the limit shown in the PTLR. The 

setpoints are derived by analyses that model the performance of the 

LTOP System, assuming the limiting LTOP transient of [one] [HPI] pump 

[and one charging pump] injecting into the RCS. These analyses 

consider pressure overshoot and undershoot beyond the PORV opening 

and closing, resulting from signal processing and valve stroke times. The 

PORV setpoints at or below the derived limit ensures the Reference 1 P/T 

limits will be met.

The PORV setpoints in the PTLR will be updated when the revised P/T 

limits conflict with the LTOP analysis limits. The P/T limits are periodically 

modified as the reactor vessel material toughness decreases due to 

neutron embrittlement caused by neutron irradiation. Revised limits are 

determined using neutron fluence projections and the results of 
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-6 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

examinations of the reactor vessel material irradiation surveillance 

specimens. The Bases for LCO 3.4.3, "RCS Pressure and Temperature 

(P/T) Limits," discuss these examinations.

The PORVs are considered active components. Thus, the failure of one 

PORV is assumed to represent the worst case, single active failure.

[ RHR Suction Relief Valve Performance

The RHR suction relief valves do not have variable pressure and 

temperature lift setpoints like the PORVs. Analyses must show that one 

RHR suction relief valve with a setpoint at or between [436.5] psig and 

[463.5] psig will pass flow greater than that required for the limiting LTOP 

transient while maintaining RCS pressure less than the P/T limit curve. 

Assuming all relief flow requirements during the limiting LTOP event, an 

RHR suction relief valve will maintain RCS pressure to within the valve 

rated lift setpoint, plus an accumulation ≤ 10% of the rated lift setpoint.

Although each RHR suction relief valve may itself meet single failure 

criteria, its inclusion and location within the RHR System does not allow it 

to meet single failure criteria when spurious RHR suction isolation valve 

closure is postulated. Also, as the RCS P/T limits are decreased to 

reflect the loss of toughness in the reactor vessel materials due to 

neutron embrittlement, the RHR suction relief valves must be analyzed to 

still accommodate the design basis transients for LTOP.

The RHR suction relief valves are considered active components. Thus, 

the failure of one valve is assumed to represent the worst case single 

active failure. ]

RCS Vent Performance

With the RCS depressurized, analyses show a vent size of 2.07 square 

inches is capable of mitigating the allowed LTOP overpressure transient. 

The capacity of a vent this size is greater than the flow of the limiting 

transient for the LTOP configuration, [one] HPI pump [and one charging 

pump] OPERABLE, maintaining RCS pressure less than the maximum 

pressure on the P/T limit curve.

The RCS vent size will be re-evaluated for compliance each time the P/T 

limit curves are revised based on the results of the vessel material 

surveillance.
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-7 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The RCS vent is passive and is not subject to active failure.

The LTOP System satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO requires that the LTOP System is OPERABLE. The LTOP 

System is OPERABLE when the minimum coolant input and pressure 

relief capabilities are OPERABLE. Violation of this LCO could lead to the 

loss of low temperature overpressure mitigation and violation of the 

Reference 1 limits as a result of an operational transient.

To limit the coolant input capability, the LCO requires that a maximum of 

[one] [HPI] pump [and one charging pump] be capable of injecting into the 

RCS, and all accumulator discharge isolation valves be closed and 

immobilized (when accumulator pressure is greater than or equal to the 

maximum RCS pressure for the existing RCS cold leg temperature 

allowed in the PTLR).

The LCO is modified by two Notes. Note 1 allows [two charging pumps] 

to be made capable of injecting for ≤ 1 hour during pump swap 

operations. One hour provides sufficient time to safely complete the 

actual transfer and to complete the administrative controls and 

Surveillance Requirements associated with the swap. The intent is to 

minimize the actual time that more than [one] charging pump is physically 

capable of injection. Note 2 states that accumulator isolation is only 

required when the accumulator pressure is more than or at the maximum 

RCS pressure for the existing temperature, as allowed by the P/T limit 

curves. This Note permits the accumulator discharge isolation valve 

Surveillance to be performed only under these pressure and temperature 

conditions.

The elements of the LCO that provide low temperature overpressure 

mitigation through pressure relief are:

a. Two OPERABLE PORVs,

A PORV is OPERABLE for LTOP when its block valve is open, its lift 

setpoint is set to the limit required by the PTLR and testing proves its 

ability to open at this setpoint, and motive power is available to the 

two valves and their control circuits.
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-8 Rev. 4.0

BASES

LCO (continued)

[ b. Two OPERABLE RHR suction relief valves,

An RHR suction relief valve is OPERABLE for LTOP when its RHR 

suction isolation valve and its RHR suction valve are open, its 

setpoint is at or between [436.5] psig and [463.5] psig, and testing 

has proven its ability to open at this setpoint.

c. One OPERABLE PORV and one OPERABLE RHR suction relief 

valve, or ]

d. A depressurized RCS and an RCS vent.

An RCS vent is OPERABLE when open with an area of ≥ [2.07] square 

inches.

Each of these methods of overpressure prevention is capable of 

mitigating the limiting LTOP transient.

APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is 

≤ [275°F] [LTOP arming temperature specified in the PTLR], in MODE 5, 

and in MODE 6 when the reactor vessel head is on. The pressurizer 

safety valves provide overpressure protection that meets the Reference 1 

P/T limits above [275°F] [LTOP arming temperature specified in the

PTLR]. When the reactor vessel head is off, overpressurization cannot 

occur.

LCO 3.4.3 provides the operational P/T limits for all MODES. 

LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of 

the pressurizer safety valves that provide overpressure protection during 

MODES 1, 2, and 3, and MODE 4 above [275°F] [LTOP arming 

temperature specified in the PTLR].

Low temperature overpressure prevention is most critical during 

shutdown when the RCS is water solid, and a mass or heat input 

transient can cause a very rapid increase in RCS pressure when little or 

no time allows operator action to mitigate the event.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable LTOP 

System. There is an increased risk associated with entering MODE 4 

from MODE 5 with LTOP inoperable and the provisions of LCO 3.0.4.b, 

which allow entry into a MODE or other specified condition in the 

Applicability with the LCO not met after performance of a risk assessment 

addressing inoperable systems and components, should not be applied in 

this circumstance.
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-9 Rev. 4.0

BASES

ACTIONS (continued)

A.1 and [B.1]

With two or more HPI pumps capable of injecting into the RCS, RCS 

overpressurization is possible.

To immediately initiate action to restore restricted coolant input capability 

to the RCS reflects the urgency of removing the RCS from this condition.

C.1, D.1, and D.2

An unisolated accumulator requires isolation within 1 hour. This is only 

required when the accumulator pressure is at or more than the maximum 

RCS pressure for the existing temperature allowed by the P/T limit 

curves.

If isolation is needed and cannot be accomplished in 1 hour, Required 

Action D.1 and Required Action D.2 provide two options, either of which 

must be performed in the next 12 hours. By increasing the RCS 

temperature to > [275°F] [LTOP arming temperature specified in the 

PTLR], an accumulator pressure of [600] psig cannot exceed the LTOP 

limits if the accumulators are fully injected. Depressurizing the 

accumulators below the LTOP limit from the PTLR also gives this 

protection.

The Completion Times are based on operating experience that these 

activities can be accomplished in these time periods and on engineering 

evaluations indicating that an event requiring LTOP is not likely in the 

allowed times.

E.1

In MODE 4 when any RCS cold leg temperature is ≤ [275°F] [LTOP 

arming temperature specified in the PTLR], with one required RCS relief 

valve inoperable, the RCS relief valve must be restored to OPERABLE 

status within a Completion Time of 7 days. Two RCS relief valves [in any 

combination of the PORVS and the RHR suction relief valves] are 

required to provide low temperature overpressure mitigation while 

withstanding a single failure of an active component.

The Completion Time considers the facts that only one of the RCS relief 

valves is required to mitigate an overpressure transient and that the 

likelihood of an active failure of the remaining valve path during this time 

period is very low.
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-10 Rev. 4.0

BASES

ACTIONS (continued)

F.1

The consequences of operational events that will overpressurize the RCS 

are more severe at lower temperature (Ref. 7). Thus, with one of the two 

RCS relief valves inoperable in MODE 5 or in MODE 6 with the head on, 

the Completion Time to restore two valves to OPERABLE status is 

24 hours.

The Completion Time represents a reasonable time to investigate and 

repair several types of relief valve failures without exposure to a lengthy 

period with only one OPERABLE RCS relief valve to protect against 

overpressure events.

G.1

The RCS must be depressurized and a vent must be established within 

12 hours when:

a. Both required RCS relief valves are inoperable,

b. A Required Action and associated Completion Time of Condition A, 

[B], D, E, or F is not met, or

c. The LTOP System is inoperable for any reason other than 

Condition A, [B], C, D, E, or F.

The vent must be sized ≥ [2.07] square inches to ensure that the flow 

capacity is greater than that required for the worst case mass input 

transient reasonable during the applicable MODES. This action is 

needed to protect the RCPB from a low temperature overpressure event 

and a possible brittle failure of the reactor vessel.

The Completion Time considers the time required to place the plant in this 

Condition and the relatively low probability of an overpressure event 

during this time period due to increased operator awareness of 

administrative control requirements.

SURVEILLANCE SR 3.4.12.1, [SR 3.4.12.2], and SR 3.4.12.3

REQUIREMENTS

To minimize the potential for a low temperature overpressure event by 

limiting the mass input capability, a maximum of [one] [HPI] pump [and a 

maximum of one charging pump] are verified incapable of injecting into 

the RCS and the accumulator discharge isolation valves are verified 

closed and locked out. 
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-11 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The [HPI] pump[s] and charging pump[s] are rendered incapable of 

injecting into the RCS through removing the power from the pumps by 

racking the breakers out under administrative control. An alternate 

method of LTOP control may be employed using at least two independent 

means to prevent a pump start such that a single failure or single action 

will not result in an injection into the RCS. This may be accomplished 

through the pump control switch being placed in [pull to lock] and at least 

one valve in the discharge flow path being closed.

[ The Frequency of 12 hours is sufficient, considering other indications and 

alarms available to the operator in the control room, to verify the required 

status of the equipment.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.4.12.4

Each required RHR suction relief valve shall be demonstrated 

OPERABLE by verifying its RHR suction valve and RHR suction isolation 

valves are open and by testing it in accordance with the Inservice Testing 

Program. (Refer to SR 3.4.12.7 for the RHR suction isolation valve 

Surveillance.) This Surveillance is only required to be performed if the 

RHR suction relief valve is being used to meet this LCO.

The RHR suction valve is verified to be opened. [ The Frequency of 

12 hours is considered adequate in view of other administrative controls 

such as valve status indications available to the operator in the control 

room that verify the RHR suction valve remains open.

OR
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-12 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The ASME Code (Ref. 8), test per Inservice Testing Program verifies 

OPERABILITY by proving proper relief valve mechanical motion and by 

measuring and, if required, adjusting the lift setpoint. ]

SR 3.4.12.5

The RCS vent of ≥ [2.07] square inches is proven OPERABLE by 

verifying its open condition [ either:

a. Once every 12 hours for a valve that is not locked (valves that are 

sealed or secured in the open position are considered "locked" in this 

context) or

b. Once every 31 days for other vent path(s) (e.g., a vent valve that is 

locked, sealed, or secured in position). A removed pressurizer safety 

valve or open manway also fits this category.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-13 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The passive vent path arrangement must only be open to be OPERABLE. 

This Surveillance is required to be met if the vent is being used to satisfy 

the pressure relief requirements of the LCO 3.4.12d.

SR 3.4.12.6

The PORV block valve must be verified open to provide the flow path for 

each required PORV to perform its function when actuated. The valve 

must be remotely verified open in the main control room. [This 

Surveillance is performed if the PORV satisfies the LCO.]

The block valve is a remotely controlled, motor operated valve. The 

power to the valve operator is not required removed, and the manual 

operator is not required locked in the inactive position. Thus, the block 

valve can be closed in the event the PORV develops excessive leakage 

or does not close (sticks open) after relieving an overpressure situation.

[ The 72 hour Frequency is considered adequate in view of other 

administrative controls available to the operator in the control room, such 

as valve position indication, that verify that the PORV block valve remains 

open.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.4.12.7

Each required RHR suction relief valve shall be demonstrated 

OPERABLE by verifying its RHR suction valve and RHR suction isolation 

valve are open and by testing it in accordance with the Inservice Testing 

Program. (Refer to SR 3.4.12.4 for the RHR suction valve Surveillance 

and for a description of the requirements of the Inservice Testing 

Program.) This Surveillance is only performed if the RHR suction relief 

valve is being used to satisfy this LCO. ]
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-14 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The RHR suction isolation valve is verified locked open, with power to the 

valve operator removed, to ensure that accidental closure will not occur. 

The "locked open" valve must be locally verified in its open position with 

the manual actuator locked in its inactive position. [ The 31 day 

Frequency is based on engineering judgment, is consistent with the 

procedural controls governing valve operation, and ensures correct valve 

position.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.12.8

Performance of a COT is required within 12 hours after decreasing RCS 

temperature to ≤ [275°F] [LTOP arming temperature specified in the 

PTLR] and every 31 days on each required PORV to verify and, as 

necessary, adjust its lift setpoint. A successful test of the required 

contact(s) of a channel relay may be performed by the verification of the 

change of state of a single contact of the relay. This clarifies what is an 

acceptable COT of a relay. This is acceptable because all of the other 

required contacts of the relay are verified by other Technical 

Specifications and non-Technical Specifications tests at least once per 

refueling interval with applicable extensions. The COT will verify the 

setpoint is within the PTLR allowed maximum limits in the PTLR. PORV 

actuation could depressurize the RCS and is not required.

The 12 hour Frequency considers the unlikelihood of a low temperature 

overpressure event during this time. [ The 31 day Frequency considers 

experience with equipment reliability. 

OR
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-15 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

A Note has been added indicating that this SR is required to be 

performed 12 hours after decreasing RCS cold leg temperature to 

≤ [275°F] [LTOP arming temperature specified in the PTLR]. The COT 

cannot be performed until in the LTOP MODES when the PORV lift 

setpoint can be reduced to the LTOP setting. The test must be performed 

within 12 hours after entering the LTOP MODES.

SR 3.4.12.9

Performance of a CHANNEL CALIBRATION on each required PORV 

actuation channel is required every [18] months to adjust the whole 

channel so that it responds and the valve opens within the required range 

and accuracy to known input. [ The [18] month Frequency considers 

operating experience with equipment reliability and matches the typical 

refueling outage schedule.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix G.

2. Generic Letter 88-11.
LTOP System

B 3.4.12

Westinghouse STS B 3.4.12-16 Rev. 4.0

BASES

REFERENCES (continued)

3. ASME, Boiler and Pressure Vessel Code, Section III.

4. FSAR, Chapter [15].

5. 10 CFR 50, Section 50.46.

6. 10 CFR 50, Appendix K.

7. Generic Letter 90-06.

8. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.
RCS Operational LEAKAGE

B 3.4.13

Westinghouse STS B 3.4.13-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.13 RCS Operational LEAKAGE

BASES

BACKGROUND Components that contain or transport the coolant to or from the reactor 

core make up the RCS. Component joints are made by welding, bolting, 

rolling, or pressure loading, and valves isolate connecting systems from 

the RCS.

During plant life, the joint and valve interfaces can produce varying 

amounts of reactor coolant LEAKAGE, through either normal operational 

wear or mechanical deterioration. The purpose of the RCS Operational 

LEAKAGE LCO is to limit system operation in the presence of LEAKAGE 

from these sources to amounts that do not compromise safety. This LCO 

specifies the types and amounts of LEAKAGE.

10 CFR 50, Appendix A, GDC 30 (Ref. 1), requires means for detecting 

and, to the extent practical, identifying the source of reactor coolant 

LEAKAGE. Regulatory Guide 1.45 (Ref. 2) describes acceptable 

methods for selecting leakage detection systems.

The safety significance of RCS LEAKAGE varies widely depending on its 

source, rate, and duration. Therefore, detecting and monitoring reactor 

coolant LEAKAGE into the containment area is necessary. Quickly 

separating the identified LEAKAGE from the unidentified LEAKAGE is 

necessary to provide quantitative information to the operators, allowing 

them to take corrective action should a leak occur that is detrimental to 

the safety of the facility and the public.

A limited amount of leakage inside containment is expected from auxiliary 

systems that cannot be made 100% leaktight. Leakage from these 

systems should be detected, located, and isolated from the containment 

atmosphere, if possible, to not interfere with RCS leakage detection.

This LCO deals with protection of the reactor coolant pressure boundary 

(RCPB) from degradation and the core from inadequate cooling, in 

addition to preventing the accident analyses radiation release 

assumptions from being exceeded. The consequences of violating this 

LCO include the possibility of a loss of coolant accident (LOCA).
RCS Operational LEAKAGE

B 3.4.13

Westinghouse STS B 3.4.13-2 Rev. 4.0

BASES

APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses do not

SAFETY address operational LEAKAGE. However, other operational LEAKAGE

ANALYSES is related to the safety analyses for LOCA; the amount of leakage can 

affect the probability of such an event. The safety analysis for an event 

resulting in steam discharge to the atmosphere assumes that primary to 

secondary LEAKAGE from all steam generators (SGs) is [1 gallon per 

minute] or increases to [1 gallon per minute] as a result of accident 

induced conditions. The LCO requirement to limit primary to secondary 

LEAKAGE through any one SG to less than or equal to 150 gallons per 

day is significantly less than the conditions assumed in the safety 

analysis.

Primary to secondary LEAKAGE is a factor in the dose releases outside 

containment resulting from a steam line break (SLB) accident. To a 

lesser extent, other accidents or transients involve secondary steam 

release to the atmosphere, such as a steam generator tube rupture 

(SGTR). The leakage contaminates the secondary fluid.

The FSAR (Ref. 3) analysis for SGTR assumes the contaminated 

secondary fluid is only briefly released via safety valves and the majority 

is steamed to the condenser. The [1 gpm] primary to secondary 

LEAKAGE safety analysis assumption is relatively inconsequential.

The SLB is more limiting for site radiation releases. The safety analysis 

for the SLB accident assumes the entire [1 gpm] primary to secondary 

LEAKAGE is through the affected generator as an initial condition. The 

dose consequences resulting from the SLB accident are well within the 

limits defined in 10 CFR 100 or the staff approved licensing basis (i.e., a 

small fraction of these limits).

The RCS operational LEAKAGE satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE

No pressure boundary LEAKAGE is allowed, being indicative of 

material deterioration. LEAKAGE of this type is unacceptable as the 

leak itself could cause further deterioration, resulting in higher 

LEAKAGE. Violation of this LCO could result in continued 

degradation of the RCPB. LEAKAGE past seals and gaskets is not 

pressure boundary LEAKAGE.
RCS Operational LEAKAGE

B 3.4.13

Westinghouse STS B 3.4.13-3 Rev. 4.0

BASES

LCO (continued)

b. Unidentified LEAKAGE

One gallon per minute (gpm) of unidentified LEAKAGE is allowed as 

a reasonable minimum detectable amount that the containment air 

monitoring and containment sump level monitoring equipment can 

detect within a reasonable time period. Violation of this LCO could 

result in continued degradation of the RCPB, if the LEAKAGE is from 

the pressure boundary.

c. Identified LEAKAGE

Up to 10 gpm of identified LEAKAGE is considered allowable 

because LEAKAGE is from known sources that do not interfere with 

detection of unidentified LEAKAGE and is well within the capability of 

the RCS Makeup System. Identified LEAKAGE includes LEAKAGE 

to the containment from specifically known and located sources, but 

does not include pressure boundary LEAKAGE or controlled reactor 

coolant pump (RCP) seal leakoff (a normal function not considered 

LEAKAGE). Violation of this LCO could result in continued 

degradation of a component or system.

d. Primary to Secondary LEAKAGE Through Any One SG

The limit of 150 gallons per day per SG is based on the operational 

LEAKAGE performance criterion in NEI 97-06, Steam Generator 

Program Guidelines (Ref. 4). The Steam Generator Program 

operational LEAKAGE performance criterion in NEI 97-06 states, 

"The RCS operational primary to secondary leakage through any one 

SG shall be limited to 150 gallons per day." The limit is based on 

operating experience with SG tube degradation mechanisms that 

result in tube leakage. The operational leakage rate criterion in 

conjunction with the implementation of the Steam Generator Program 

is an effective measure for minimizing the frequency of steam 

generator tube ruptures.

APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest 

when the RCS is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the reactor 

coolant pressure is far lower, resulting in lower stresses and reduced 

potentials for LEAKAGE.
RCS Operational LEAKAGE

B 3.4.13

Westinghouse STS B 3.4.13-4 Rev. 4.0

BASES

APPLICABILITY (continued)

LCO 3.4.14, "RCS Pressure Isolation Valve (PIV) Leakage," measures 

leakage through each individual PIV and can impact this LCO. Of the two 

PIVs in series in each isolated line, leakage measured through one PIV 

does not result in RCS LEAKAGE when the other is leak tight. If both 

valves leak and result in a loss of mass from the RCS, the loss must be 

included in the allowable identified LEAKAGE.

ACTIONS A.1

Unidentified LEAKAGE or identified LEAKAGE in excess of the LCO

limits must be reduced to within limits within 4 hours. This Completion 

Time allows time to verify leakage rates and either identify unidentified 

LEAKAGE or reduce LEAKAGE to within limits before the reactor must be 

shut down. This action is necessary to prevent further deterioration of the 

RCPB.

B.1 and B.2

If any pressure boundary LEAKAGE exists, or primary to secondary 

LEAKAGE is not within limit, or if unidentified or identified LEAKAGE 

cannot be reduced to within limits within 4 hours, the reactor must be 

brought to lower pressure conditions to reduce the severity of the 

LEAKAGE and its potential consequences. It should be noted that 

LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. 

The reactor must be brought to MODE 3 within 6 hours and MODE 5 

within 36 hours. This action reduces the LEAKAGE and also reduces the 

factors that tend to degrade the pressure boundary.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems. 

In MODE 5, the pressure stresses acting on the RCPB are much lower, 

and further deterioration is much less likely.

SURVEILLANCE SR 3.4.13.1

REQUIREMENTS

Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity 

of the RCPB is maintained. Pressure boundary LEAKAGE would at first 

appear as unidentified LEAKAGE and can only be positively identified by 

inspection. It should be noted that LEAKAGE past seals and gaskets is 

not pressure boundary LEAKAGE. Unidentified LEAKAGE and identified 

LEAKAGE are determined by performance of an RCS water inventory 

balance. 
RCS Operational LEAKAGE

B 3.4.13

Westinghouse STS B 3.4.13-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The RCS water inventory balance must be met with the reactor at steady 

state operating conditions (stable temperature, power level, pressurizer 

and makeup tank levels, makeup and letdown, [and RCP seal injection 

and return flows]). The Surveillance is modified by two Notes. Note 1 

states that this SR is not required to be performed until 12 hours after 

establishing steady state operation. The 12 hour allowance provides 

sufficient time to collect and process all necessary data after stable plant 

conditions are established.

Steady state operation is required to perform a proper inventory balance 

since calculations during maneuvering are not useful. For RCS 

operational LEAKAGE determination by water inventory balance, steady 

state is defined as stable RCS pressure, temperature, power level, 

pressurizer and makeup tank levels, makeup and letdown, and RCP seal 

injection and return flows.

An early warning of pressure boundary LEAKAGE or unidentified 

LEAKAGE is provided by the automatic systems that monitor the 

containment atmosphere radioactivity and the containment sump level. It 

should be noted that LEAKAGE past seals and gaskets is not pressure 

boundary LEAKAGE. These leakage detection systems are specified in 

LCO 3.4.15, "RCS Leakage Detection Instrumentation."

Note 2 states that this SR is not applicable to primary to secondary 

LEAKAGE because LEAKAGE of 150 gallons per day cannot be 

measured accurately by an RCS water inventory balance.

[ The 72 hour Frequency is a reasonable interval to trend LEAKAGE and 

recognizes the importance of early leakage detection in the prevention of 

accidents.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RCS Operational LEAKAGE

B 3.4.13

Westinghouse STS B 3.4.13-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.13.2

This SR verifies that primary to secondary LEAKAGE is less or equal to 

150 gallons per day through any one SG. Satisfying the primary to 

secondary LEAKAGE limit ensures that the operational LEAKAGE 

performance criterion in the Steam Generator Program is met. If this SR 

is not met, compliance with LCO 3.4.20, "Steam Generator Tube 

Integrity," should be evaluated. The 150 gallons per day limit is 

measured at room temperature as described in Reference 5. The 

operational LEAKAGE rate limit applies to LEAKAGE through any one 

SG. If it is not practical to assign the LEAKAGE to an individual SG, all 

the primary to secondary LEAKAGE should be conservatively assumed to 

be from one SG.

The Surveillance is modified by a Note which states that the Surveillance 

is not required to be performed until 12 hours after establishment of 

steady state operation. For RCS primary to secondary LEAKAGE 

determination, steady state is defined as stable RCS pressure, 

temperature, power level, pressurizer and makeup tank levels, makeup 

and letdown, and RCP seal injection and return flows. 

[ The Surveillance Frequency of 72 hours is a reasonable interval to trend 

primary to secondary LEAKAGE and recognizes the importance of early 

leakage detection in the prevention of accidents. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The primary to secondary LEAKAGE is determined using continuous 

process radiation monitors or radiochemical grab sampling in accordance 

with the EPRI guidelines (Ref. 5).
RCS Operational LEAKAGE

B 3.4.13

Westinghouse STS B 3.4.13-7 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30.

2. Regulatory Guide 1.45, May 1973.

3. FSAR, Section [15].

4. NEI 97-06, "Steam Generator Program Guidelines."

5. EPRI, "Pressurized Water Reactor Primary-to-Secondary Leak 

Guidelines."

RCS PIV Leakage

B 3.4.14

Westinghouse STS B 3.4.14-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.14 RCS Pressure Isolation Valve (PIV) Leakage

BASES

BACKGROUND 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A 

(Refs. 1, 2, and 3), define RCS PIVs as any two normally closed valves in 

series within the reactor coolant pressure boundary (RCPB), which 

separate the high pressure RCS from an attached low pressure system. 

During their lives, these valves can produce varying amounts of reactor 

coolant leakage through either normal operational wear or mechanical 

deterioration. The RCS PIV Leakage LCO allows RCS high pressure 

operation when leakage through these valves exists in amounts that do 

not compromise safety.

The PIV leakage limit applies to each individual valve. Leakage through 

both series PIVs in a line must be included as part of the identified 

LEAKAGE, governed by LCO 3.4.13, "RCS Operational LEAKAGE." This 

is true during operation only when the loss of RCS mass through two 

series valves is determined by a water inventory balance (SR 3.4.13.1). 

A known component of the identified LEAKAGE before operation begins 

is the least of the two individual leak rates determined for leaking series 

PIVs during the required surveillance testing; leakage measured through 

one PIV in a line is not RCS operational LEAKAGE if the other is 

leaktight.

Although this specification provides a limit on allowable PIV leakage rate, 

its main purpose is to prevent overpressure failure of the low pressure 

portions of connecting systems. The leakage limit is an indication that the 

PIVs between the RCS and the connecting systems are degraded or 

degrading. PIV leakage could lead to overpressure of the low pressure 

piping or components. Failure consequences could be a loss of coolant 

accident (LOCA) outside of containment, an unanalyzed accident, that 

could degrade the ability for low pressure injection.

The basis for this LCO is the 1975 NRC "Reactor Safety Study" (Ref. 4) 

that identified potential intersystem LOCAs as a significant contributor to 

the risk of core melt. A subsequent study (Ref. 5) evaluated various PIV 

configurations to determine the probability of intersystem LOCAs.

PIVs are provided to isolate the RCS from the following typically 

connected systems:

a. Residual Heat Removal (RHR) System,
RCS PIV Leakage

B 3.4.14

Westinghouse STS B 3.4.14-2 Rev. 4.0

BASES

BACKGROUND (continued)

b. Safety Injection System, and

c. Chemical and Volume Control System.

The PIVs are listed in the FSAR, Section [ ] (Ref. 6).

Violation of this LCO could result in continued degradation of a PIV, which 

could lead to overpressurization of a low pressure system and the loss of 

the integrity of a fission product barrier.

APPLICABLE Reference 4 identified potential intersystem LOCAs as a significant

SAFETY contributor to the risk of core melt. The dominant accident sequence in

ANALYSES the intersystem LOCA category is the failure of the low pressure portion 

of the RHR System outside of containment. The accident is the result of 

a postulated failure of the PIVs, which are part of the RCPB, and the 

subsequent pressurization of the RHR System downstream of the PIVs 

from the RCS. Because the low pressure portion of the RHR System is 

typically designed for 600 psig, overpressurization failure of the RHR low 

pressure line would result in a LOCA outside containment and 

subsequent risk of core melt.

Reference 5 evaluated various PIV configurations, leakage testing of the 

valves, and operational changes to determine the effect on the probability 

of intersystem LOCAs. This study concluded that periodic leakage testing 

of the PIVs can substantially reduce the probability of an intersystem 

LOCA.

RCS PIV leakage satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO RCS PIV leakage is identified LEAKAGE into closed systems connected 

to the RCS. Isolation valve leakage is usually on the order of drops per 

minute. Leakage that increases significantly suggests that something is 

operationally wrong and corrective action must be taken.

The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with 

a maximum limit of 5 gpm. The previous criterion of 1 gpm for all valve 

sizes imposed an unjustified penalty on the larger valves without 

providing information on potential valve degradation and resulted in 

higher personnel radiation exposures. A study concluded a leakage rate 

limit based on valve size was superior to a single allowable value.
RCS PIV Leakage

B 3.4.14

Westinghouse STS B 3.4.14-3 Rev. 4.0

BASES

LCO (continued)

Reference 7 permits leakage testing at a lower pressure differential than 

between the specified maximum RCS pressure and the normal pressure 

of the connected system during RCS operation (the maximum pressure 

differential) in those types of valves in which the higher service pressure 

will tend to diminish the overall leakage channel opening. In such cases, 

the observed rate may be adjusted to the maximum pressure differential 

by assuming leakage is directly proportional to the pressure differential to 

the one half power.

APPLICABILITY In MODES 1, 2, 3, and 4, this LCO applies because the PIV leakage 

potential is greatest when the RCS is pressurized. In MODE 4, valves in 

the RHR flow path are not required to meet the requirements of this LCO 

when in, or during the transition to or from, the RHR mode of operation.

In MODES 5 and 6, leakage limits are not provided because the lower 

reactor coolant pressure results in a reduced potential for leakage and for 

a LOCA outside the containment.

ACTIONS The Actions are modified by two Notes. Note 1 provides clarification that 

each flow path allows separate entry into a Condition. This is allowed 

based upon the functional independence of the flow path. Note 2 

requires an evaluation of affected systems if a PIV is inoperable. The 

leakage may have affected system operability, or isolation of a leaking 

flow path with an alternate valve may have degraded the ability of the 

interconnected system to perform its safety function.

A.1 and A.2

The flow path must be isolated by two valves. Required Actions A.1 

and A.2 are modified by a Note that the valves used for isolation must 

meet the same leakage requirements as the PIVs and must be within the 

RCPB [or the high pressure portion of the system].

Required Action A.1 requires that the isolation with one valve must be 

performed within 4 hours. Four hours provides time to reduce leakage in 

excess of the allowable limit and to isolate the affected system if leakage 

cannot be reduced. The 4 hour Completion Time allows the actions and 

restricts the operation with leaking isolation valves.
RCS PIV Leakage

B 3.4.14

Westinghouse STS B 3.4.14-4 Rev. 4.0

BASES

ACTIONS (continued)

[ Required Action A.2 specifies that the double isolation barrier of two 

valves be restored by closing some other valve qualified for isolation or 

restoring one leaking PIV. The 72 hour Completion Time after exceeding 

the limit considers the time required to complete the Action and the low 

probability of a second valve failing during this time period.

[or]

The 72 hour Completion Time after exceeding the limit allows for the 

restoration of the leaking PIV to OPERABLE status. This timeframe 

considers the time required to complete this Action and the low probability 

of a second valve failing during this period. ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

Two options are provided for Required Action A.2. The second option 

(72 hour restoration) is appropriate if isolation of a second valve would 

place the unit in an unanalyzed condition.

--------------------------------------------------------------------------------------------------

B.1 and B.2

If leakage cannot be reduced, [the system can not be isolated,] or the 

other Required Actions accomplished, the plant must be brought to a 

MODE in which the requirement does not apply. To achieve this status, 

the plant must be brought to MODE 3 within 6 hours and MODE 5 within 

36 hours. This Action may reduce the leakage and also reduces the 

potential for a LOCA outside the containment. The allowed Completion 

Times are reasonable based on operating experience, to reach the 

required plant conditions from full power conditions in an orderly manner 

and without challenging plant systems.

C.1

The inoperability of the RHR autoclosure interlock renders the RHR 

suction isolation valves incapable of isolating in response to a high 

pressure condition and preventing inadvertent opening of the valves at 

RCS pressures in excess of the RHR systems design pressure. If the 

RHR autoclosure interlock is inoperable, operation may continue as long 

as the affected RHR suction penetration is closed by at least one closed 

manual or deactivated automatic valve within 4 hours. This Action 

accomplishes the purpose of the autoclosure function.
RCS PIV Leakage

B 3.4.14

Westinghouse STS B 3.4.14-5 Rev. 4.0

BASES

SURVEILLANCE SR 3.4.14.1

REQUIREMENTS

Performance of leakage testing on each RCS PIV or isolation valve used 

to satisfy Required Action A.1 and Required Action A.2 is required to 

verify that leakage is below the specified limit and to identify each leaking 

valve. The leakage limit of 0.5 gpm per inch of nominal valve diameter up 

to 5 gpm maximum applies to each valve. Leakage testing requires a 

stable pressure condition.

For the two PIVs in series, the leakage requirement applies to each valve 

individually and not to the combined leakage across both valves. If the 

PIVs are not individually leakage tested, one valve may have failed 

completely and not be detected if the other valve in series meets the 

leakage requirement. In this situation, the protection provided by 

redundant valves would be lost.

Testing is to be performed every [9] months, but may be extended, if the 

plant does not go into MODE 5 for at least 7 days. [ The [18 month] 

Frequency is consistent with 10 CFR 50.55a(g) (Ref. 8) as contained in 

the Inservice Testing Program, is within frequency allowed by the 

American Society of Mechanical Engineers (ASME) Code (Ref. 7), and is 

based on the need to perform such surveillances under the conditions 

that apply during an outage and the potential for an unplanned transient if 

the Surveillance were performed with the reactor at power.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

In addition, testing must be performed once after the valve has been 

opened by flow or exercised to ensure tight reseating. PIVs disturbed in 

the performance of this Surveillance should also be tested unless 

documentation shows that an infinite testing loop cannot practically be 

avoided. Testing must be performed within 24 hours after the valve has 

been reseated. Within 24 hours is a reasonable and practical time limit 

for performing this test after opening or reseating a valve.
RCS PIV Leakage

B 3.4.14

Westinghouse STS B 3.4.14-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The leakage limit is to be met at the RCS pressure associated with 

MODES 1 and 2. This permits leakage testing at high differential 

pressures with stable conditions not possible in the MODES with lower 

pressures.

Entry into MODES 3 and 4 is allowed to establish the necessary 

differential pressures and stable conditions to allow for performance of 

this Surveillance. The Note that allows this provision is complementary to 

the Frequency of prior to entry into MODE 2 whenever the unit has been 

in MODE 5 for 7 days or more, if leakage testing has not been performed 

in the previous 9 months. In addition, this Surveillance is not required to 

be performed on the RHR System when the RHR System is aligned to 

the RCS in the shutdown cooling mode of operation. PIVs contained in 

the RHR shutdown cooling flow path must be leakage rate tested after 

RHR is secured and stable unit conditions and the necessary differential 

pressures are established.

[ SR 3.4.14.2 and SR 3.4.14.3

Verifying that the RHR autoclosure interlocks are OPERABLE ensures 

that RCS pressure will not pressurize the RHR system beyond 125% of 

its design pressure of [600] psig. The interlock setpoint that prevents the 

valves from being opened is set so the actual RCS pressure must be 

< [425] psig to open the valves. This setpoint ensures the RHR design 

pressure will not be exceeded and the RHR relief valves will not lift. [ The 

[18] month Frequency is based on the need to perform the Surveillance 

under conditions that apply during a plant outage. The [18] month 

Frequency is also acceptable based on consideration of the design 

reliability (and confirming operating experience) of the equipment.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RCS PIV Leakage

B 3.4.14

Westinghouse STS B 3.4.14-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

These SRs are modified by Notes allowing the RHR autoclosure function 

to be disabled when using the RHR System suction relief valves for cold 

overpressure protection in accordance with SR 3.4.12.7. ]

REFERENCES 1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).

3. 10 CFR 50, Appendix A, Section V, GDC 55.

4. WASH-1400 (NUREG-75/014), Appendix V, October 1975.

5. NUREG-0677, May 1980.

[ 6. Document containing list of PIVs. ]

7. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

8. 10 CFR 50.55a(g).

RCS Leakage Detection Instrumentation

B 3.4.15

Westinghouse STS B 3.4.15-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.15 RCS Leakage Detection Instrumentation

BASES

BACKGROUND GDC 30 of Appendix A to 10 CFR 50 (Ref. 1) requires means for 

detecting and, to the extent practical, identifying the location of the source 

of RCS LEAKAGE. Regulatory Guide 1.45, Revision 0, (Ref. 2) describes 

acceptable methods for selecting leakage detection systems.

Leakage detection systems must have the capability to detect significant 

reactor coolant pressure boundary (RCPB) degradation as soon after 

occurrence as practical to minimize the potential for propagation to a 

gross failure. Thus, an early indication or warning signal is necessary to 

permit proper evaluation of all unidentified LEAKAGE. [In addition to 

meeting the OPERABILITY requirements, the monitors are typically set to 

provide the most sensitive response without causing an excessive 

number of spurious alarms.]

The containment sump used to collect unidentified LEAKAGE [is] [(or) 

and the containment air cooler condensate flow rate monitor] [are] 

instrumented to alarm for increases above the normal flow rates. 

The reactor coolant contains radioactivity that, when released to the 

containment, may be detected by radiation monitoring instrumentation. 

Radioactivity detection systems are included for monitoring both 

particulate and gaseous activities because of their sensitivities and rapid 

responses to RCS LEAKAGE.

Other indications may be used to detect an increase in unidentified 

LEAKAGE; however, they are not required to be OPERABLE by this 

LCO. An increase in humidity of the containment atmosphere would 

indicate release of water vapor to the containment. Dew point 

temperature measurements can thus be used to monitor humidity levels 

of the containment atmosphere as an indicator of potential RCS 

LEAKAGE. 

Since the humidity level is influenced by several factors, a quantitative 

evaluation of an indicated leakage rate by this means may be 

questionable and should be compared to observed increases in liquid 

flow into or from the containment sump [and condensate flow from air 

coolers]. Humidity level monitoring is considered most useful as an 

indirect alarm or indication to alert the operator to a potential problem. 

Humidity monitors are not required by this LCO.
RCS Leakage Detection Instrumentation

B 3.4.15

Westinghouse STS B 3.4.15-2 Rev. 4.0

BASES

BACKGROUND (continued)

Air temperature and pressure monitoring methods may also be used to 

infer unidentified LEAKAGE to the containment. Containment 

temperature and pressure fluctuate slightly during plant operation, but a 

rise above the normally indicated range of values may indicate RCS 

leakage into the containment. The relevance of temperature and 

pressure measurements is affected by containment free volume and, for 

temperature, detector location. [Alarm signals from these instruments 

can be valuable in recognizing rapid and sizable leakage to the 

containment. Temperature and pressure monitors are not required by 

this LCO.]

The above-mentioned LEAKAGE detection methods or systems differ in 

sensitivity and response time. [Some of these systems could service as 

early alarm systems signaling the operations that closer examination of 

other detection systems is necessary to determine the extent of any 

corrective action that may be required.]

APPLICABLE The need to evaluate the severity of an alarm or an indication is important

SAFETY to the operators, and the ability to compare and verify with indications

ANALYSES from other systems is necessary. 

The safety significance of RCS LEAKAGE varies widely depending on its 

source, rate, and duration. Therefore, detecting and monitoring RCS 

LEAKAGE into the containment area is necessary. Quickly separating 

the identified LEAKAGE from the unidentified LEAKAGE provides 

quantitative information to the operators, allowing them to take corrective 

action should a leakage occur detrimental to the safety of the unit and the 

public.

RCS leakage detection instrumentation satisfies Criterion 1 of 

10 CFR 50.36(c)(2)(ii).

LCO This LCO requires instruments of diverse monitoring principles to be 

OPERABLE to provide confidence that small amounts of unidentified 

LEAKAGE are detected in time to allow actions to place the plant in a 

safe condition, when RCS LEAKAGE indicates possible RCPB 

degradation.

The LCO requires [three] instruments to be OPERABLE.

The containment sump is used to collect unidentified LEAKAGE. [The 

containment sump consists of the normal sump and the emergency 

sump. The LCO requirements apply to the total amount of unidentified 

LEAKAGE collected in [the][both] sump[s].] The monitor on the 

containment sump detects [level or flow rate or the operating frequency of 

a pump] and is instrumented to detect when there is [leakage of] [an 
RCS Leakage Detection Instrumentation

B 3.4.15

Westinghouse STS B 3.4.15-3 Rev. 4.0

BASES

LCO (continued)

increase above the normal value by] 1 gpm. The identification of [an 

increase in] unidentified LEAKAGE will be delayed by the time required 

for the unidentified LEAKAGE to travel to the containment sump and it 

may take longer than one hour to detect a 1 gpm increase in unidentified 

LEAKAGE, depending on the origin and magnitude of the LEAKAGE. 

This sensitivity is acceptable for containment sump monitor 

OPERABILITY.

The reactor coolant contains radioactivity that, when released to the 

containment, can be detected by the gaseous or particulate containment 

atmosphere radioactivity monitor. Only one of the two detectors is 

required to be OPERABLE. Radioactivity detection systems are included 

for monitoring both particulate and gaseous activities because of their 

sensitivities and rapid responses to RCS LEAKAGE, but have recognized 

limitations. Reactor coolant radioactivity levels will be low during initial 

reactor startup and for a few weeks thereafter, until activated corrosion 

products have been formed and fission products appear from fuel 

element cladding contamination or cladding defects. If there are few fuel 

element cladding defects and low levels of activation products, it may not 

be possible for the gaseous or particulate containment atmosphere 

radioactivity monitors to detect a 1 gpm increase within 1 hour during 

normal operation. However, the gaseous or particulate containment 

atmosphere radioactivity monitor is OPERABLE when it is capable of 

detecting a 1 gpm increase in unidentified LEAKAGE within 1 hour given 

an RCS activity equivalent to that assumed in the design calculations for 

the monitors (Reference 3).

[ An increase in humidity of the containment atmosphere could indicate the 

release of water vapor to the containment. Condensate flow from air 

coolers is instrumented to detect when there is an increase above the 

normal value by 1 gpm. The time required to detect a 1 gpm increase 

above the normal value varies based on environmental and system 

conditions and may take longer than 1 hour. This sensitivity is acceptable 

for containment air cooler condensate flow rate monitor OPERABILITY.]

The LCO is satisfied when monitors of diverse measurement means are 

available. Thus, the containment sump monitor, in combination with a 

gaseous or particulate radioactivity monitor [and a containment air cooler 

condensate flow rate monitor], provides an acceptable minimum.

APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, 

and 4, RCS leakage detection instrumentation is required to be 

OPERABLE.
RCS Leakage Detection Instrumentation

B 3.4.15

Westinghouse STS B 3.4.15-4 Rev. 4.0

BASES

APPLICABILITY (continued)

In MODE 5 or 6, the temperature is to be ≤ 200°F and pressure is 

maintained low or at atmospheric pressure. Since the temperatures and 

pressures are far lower than those for MODES 1, 2, 3, and 4, the 

likelihood of leakage and crack propagation are much smaller. Therefore, 

the requirements of this LCO are not applicable in MODES 5 and 6.

ACTIONS A.1 and A.2

With the required containment sump monitor inoperable, no other form of 

sampling can provide the equivalent information; however, the 

containment atmosphere radioactivity monitor will provide indications of 

changes in leakage. Together with the containment atmosphere 

radioactivity monitor, the periodic surveillance for RCS water inventory 

balance, SR 3.4.13.1, must be performed at an increased frequency of 

24 hours to provide information that is adequate to detect leakage. A 

Note is added allowing that SR 3.4.13.1 is not required to be performed 

until 12 hours after establishing steady state operation (stable 

temperature, power level, pressurizer and makeup tank levels, makeup 

and letdown, [and RCP seal injection and return flows]). The 12 hour 

allowance provides sufficient time to collect and process all necessary 

data after stable plant conditions are established.

Restoration of the required sump monitor to OPERABLE status within a 

Completion Time of 30 days is required to regain the function after the 

monitor's failure. This time is acceptable, considering the Frequency and 

adequacy of the RCS water inventory balance required by Required 

Action A.1.

B.1.1, B.1.2, B.2.1, and B.2.2

With both gaseous and particulate containment atmosphere radioactivity 

monitoring instrumentation channels inoperable, alternative action is 

required. Either grab samples of the containment atmosphere must be 

taken and analyzed or water inventory balances, in accordance with 

SR 3.4.13.1, must be performed to provide alternate periodic information.

With a sample obtained and analyzed or water inventory balance 

performed every 24 hours, the reactor may be operated for up to 30 days 

to allow restoration of the required containment atmosphere radioactivity 

monitors. [Alternatively, continued operation is allowed if the air cooler 

condensate flow rate monitoring system is OPERABLE, provided grab 

samples are taken or water inventory balances performed every 

24 hours.]
RCS Leakage Detection Instrumentation

B 3.4.15

Westinghouse STS B 3.4.15-5 Rev. 4.0

BASES

ACTIONS (continued)

The 24 hour interval provides periodic information that is adequate to 

detect leakage. A Note is added allowing that SR 3.4.13.1 is not required 

to be performed until 12 hours after establishing steady state operation 

(stable temperature, power level, pressurizer and makeup tank levels, 

makeup and letdown, [and RCP seal injection and return flows]). The 

12 hour allowance provides sufficient time to collect and process all 

necessary data after stable plant conditions are established. The 30 day 

Completion Time recognizes at least one other form of leakage detection 

is available.

[ C.1 and C.2

With the containment air cooler condensate flow rate monitor inoperable, 

alternative action is again required. Either SR 3.4.15.1 must be 

performed or water inventory balances, in accordance with SR 3.4.13.1, 

must be performed to provide alternate periodic information. Provided a 

CHANNEL CHECK is performed every 8 hours or a water inventory 

balance is performed every 24 hours, reactor operation may continue 

while awaiting restoration of the containment air cooler condensate flow 

rate monitor to OPERABLE status.

The 24 hour interval provides periodic information that is adequate to 

detect RCS LEAKAGE. A Note is added allowing that SR 3.4.13.1 is not 

required to be performed until 12 hours after establishing steady state 

operation (stable temperature, power level, pressurizer and makeup tank 

levels, makeup and letdown, [and RCP seal injection and return flows]). 

The 12 hour allowance provides sufficient time to collect and process all 

necessary data after stable plant conditions are established. ]

D.1, D.2.1, and D.2.2

With the required containment sump monitor [and the containment air 

cooler condensate flow rate monitor] inoperable, the only means of 

detecting LEAKAGE is the required containment atmosphere radiation 

monitor. A Note clarifies that this Condition is only applicable when the 

only OPERABLE monitor is the required containment atmosphere 

gaseous radiation monitor. The containment atmosphere gaseous 

radioactivity monitor typically cannot detect a 1 gpm leak within one hour 

when RCS activity is low. In addition, this configuration does not provide 

the required diverse means of leakage detection. Indirect methods of 

monitoring RCS leakage must be implemented. Grab samples of the 

containment atmosphere must be taken to provide alternate periodic 

information. The 12 hour interval is sufficient to detect increasing RCS 
RCS Leakage Detection Instrumentation

B 3.4.15

Westinghouse STS B 3.4.15-6 Rev. 4.0

BASES

ACTIONS (continued)

leakage. The Required Action provides 7 days to restore another RCS 

leakage monitor to OPERABLE status to regain the intended leakage 

detection diversity. The 7 day Completion Time ensures that the plant will 

not be operated in a degraded configuration for a lengthy time period.

[ E.1 and E.2

With the required containment atmosphere radioactivity monitor [and the 

containment air cooler condensate flow rate monitor] inoperable, the only 

means of detecting leakage is the containment sump monitor. This 

Condition does not provide the required diverse means of leakage 

detection. The Required Action is to restore either of the inoperable 

required monitors to OPERABLE status within 30 days to regain the 

intended leakage detection diversity. The 30 day Completion Time 

ensures that the plant will not be operated in a reduced configuration for a 

lengthy time period. ]

F.1 and F.2

If a Required Action of Condition A, B, [C], [D] or [E] cannot be met, the 

plant must be brought to a MODE in which the requirement does not 

apply. To achieve this status, the plant must be brought to at least 

MODE 3 within 6 hours and to MODE 5 within 36 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required plant conditions from full power conditions in an 

orderly manner and without challenging plant systems.

G.1

With all required monitors inoperable, no automatic means of monitoring 

leakage are available, and immediate plant shutdown in accordance with 

LCO 3.0.3 is required.
RCS Leakage Detection Instrumentation

B 3.4.15

Westinghouse STS B 3.4.15-7 Rev. 4.0

BASES

SURVEILLANCE SR 3.4.15.1

REQUIREMENTS

SR 3.4.15.1 requires the performance of a CHANNEL CHECK of the 

required containment atmosphere radioactivity monitor. The check gives 

reasonable confidence that the channel is operating properly. [ The 

Frequency of 12 hours is based on instrument reliability and is reasonable 

for detecting off normal conditions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.15.2

SR 3.4.15.2 requires the performance of a COT on the required 

containment atmosphere radioactivity monitor. The test ensures that the 

monitor can perform its function in the desired manner. A successful test 

of the required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The test verifies 

the alarm setpoint and relative accuracy of the instrument string. [ The 

Frequency of 92 days considers instrument reliability, and operating 

experience has shown that it is proper for detecting degradation.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RCS Leakage Detection Instrumentation

B 3.4.15

Westinghouse STS B 3.4.15-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.15.3, [SR 3.4.15.4, and SR 3.4.15.5]

These SRs require the performance of a CHANNEL CALIBRATION for 

each of the RCS leakage detection instrumentation channels. The 

calibration verifies the accuracy of the instrument string, including the 

instruments located inside containment. [ The Frequency of [18] months 

is a typical refueling cycle and considers channel reliability. Again, 

operating experience has proven that this Frequency is acceptable.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, Section IV, GDC 30.

2. Regulatory Guide 1.45, Revision 0, "Reactor Coolant Pressure 

Boundary Leakage Detection Systems," May 1973.

3. FSAR, Section [ ].
RCS Specific Activity

B 3.4.16

Westinghouse STS B 3.4.16-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.16 RCS Specific Activity

BASES

BACKGROUND The maximum dose to the whole body and the thyroid that an individual at 

the site boundary can receive for 2 hours during an accident is specified 

in 10 CFR 100 (Ref. 1). The limits on specific activity ensure that the 

doses are held to a small fraction of the 10 CFR 100 limits during 

analyzed transients and accidents.

The RCS specific activity LCO limits the allowable concentration level of 

radionuclides in the reactor coolant. The LCO limits are established to 

minimize the offsite radioactivity dose consequences in the event of a 

steam generator tube rupture (SGTR) accident.

The LCO contains specific activity limits for both DOSE EQUIVALENT I131 and gross specific activity. The allowable levels are intended to limit 

the 2 hour dose at the site boundary to a small fraction of the 10 CFR 100 

dose guideline limits. The limits in the LCO are standardized, based on 

parametric evaluations of offsite radioactivity dose consequences for 

typical site locations.

The parametric evaluations showed the potential offsite dose levels for a 

SGTR accident were an appropriately small fraction of the 10 CFR 100 

dose guideline limits. Each evaluation assumes a broad range of site 

applicable atmospheric dispersion factors in a parametric evaluation.

APPLICABLE The LCO limits on the specific activity of the reactor coolant ensures that

SAFETY the resulting 2 hour doses at the site boundary will not exceed a small

ANALYSES fraction of the 10 CFR 100 dose guideline limits following a SGTR 

accident. The SGTR safety analysis (Ref. 2) assumes the specific activity 

of the reactor coolant at the LCO limit and an existing reactor coolant 

steam generator (SG) tube leakage rate of 1 gpm. The safety analysis 

assumes the specific activity of the secondary coolant at its limit of 

0.1 Ci/gm DOSE EQUIVALENT I-131 from LCO 3.7.6, "Secondary 

Specific Activity."

The analysis for the SGTR accident establishes the acceptance limits for 

RCS specific activity. Reference to this analysis is used to assess 

changes to the unit that could affect RCS specific activity, as they relate 

to the acceptance limits.
RCS Specific Activity

B 3.4.16

Westinghouse STS B 3.4.16-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The analysis is for two cases of reactor coolant specific activity. One 

case assumes specific activity at 1.0 Ci/gm DOSE EQUIVALENT I-131 

with a concurrent large iodine spike that increases the I-131 activity in the 

reactor coolant by a factor of about 50 immediately after the accident. 

The second case assumes the initial reactor coolant iodine activity at 

60.0 Ci/gm DOSE EQUIVALENT I-131 due to a pre-accident iodine 

spike caused by an RCS transient. In both cases, the noble gas activity 

in the reactor coolant assumes 1% failed fuel, which closely equals the 

LCO limit of 100/Ē Ci/gm for gross specific activity.

The analysis also assumes a loss of offsite power at the same time as the 

SGTR event. The SGTR causes a reduction in reactor coolant inventory. 

The reduction initiates a reactor trip from a low pressurizer pressure 

signal or an RCS overtemperature ∆T signal.

The coincident loss of offsite power causes the steam dump valves to 

close to protect the condenser. The rise in pressure in the ruptured SG 

discharges radioactively contaminated steam to the atmosphere through

the SG power operated relief valves and the main steam safety valves. 

The unaffected SGs remove core decay heat by venting steam to the 

atmosphere until the cooldown ends.

The safety analysis shows the radiological consequences of an SGTR 

accident are within a small fraction of the Reference 1 dose guideline 

limits. Operation with iodine specific activity levels greater than the LCO 

limit is permissible, if the activity levels do not exceed the limits shown in 

Figure 3.4.16-1, in the applicable specification, for more than 48 hours. 

The safety analysis has concurrent and pre-accident iodine spiking levels 

up to 60.0 Ci/gm DOSE EQUIVALENT I-131.

The remainder of the above limit permissible iodine levels shown in 

Figure 3.4.16-1 are acceptable because of the low probability of a SGTR 

accident occurring during the established 48 hour time limit. The 

occurrence of an SGTR accident at these permissible levels could 

increase the site boundary dose levels, but still be within 10 CFR 100 

dose guideline limits.

The limits on RCS specific activity are also used for establishing 

standardization in radiation shielding and plant personnel radiation 

protection practices.

RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).
RCS Specific Activity

B 3.4.16

Westinghouse STS B 3.4.16-3 Rev. 4.0

BASES

LCO The specific iodine activity is limited to 1.0 Ci/gm DOSE EQUIVALENT I131, and the gross specific activity in the reactor coolant is limited to the 

number of Ci/gm equal to 100 divided by Ē (average disintegration 

energy of the sum of the average beta and gamma energies of the 

coolant nuclides). The limit on DOSE EQUIVALENT I-131 ensures the 

2 hour thyroid dose to an individual at the site boundary during the Design 

Basis Accident (DBA) will be a small fraction of the allowed thyroid dose. 

The limit on gross specific activity ensures the 2 hour whole body dose to 

an individual at the site boundary during the DBA will be a small fraction 

of the allowed whole body dose.

The SGTR accident analysis (Ref. 2) shows that the 2 hour site boundary 

dose levels are within acceptable limits. Violation of the LCO may result 

in reactor coolant radioactivity levels that could, in the event of an SGTR, 

lead to site boundary doses that exceed the 10 CFR 100 dose guideline 

limits.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS average temperature 

≥ 500°F, operation within the LCO limits for DOSE EQUIVALENT I-131 

and gross specific activity are necessary to contain the potential 

consequences of an SGTR to within the acceptable site boundary dose 

values.

For operation in MODE 3 with RCS average temperature < 500°F, and in 

MODES 4 and 5, the release of radioactivity in the event of a SGTR is 

unlikely since the saturation pressure of the reactor coolant is below the 

lift pressure settings of the main steam safety valves.

ACTIONS A.1 and A.2

With the DOSE EQUIVALENT I-131 greater than the LCO limit, samples 

at intervals of 4 hours must be taken to demonstrate that the limits of 

Figure 3.4.16-1 are not exceeded. The Completion Time of 4 hours is 

required to obtain and analyze a sample. Sampling is done to continue to 

provide a trend.

The DOSE EQUIVALENT I-131 must be restored to within limits within 

48 hours. The Completion Time of 48 hours is required, if the limit 

violation resulted from normal iodine spiking.

A Note permits the use of the provisions of LCO 3.0.4.c. This allowance 

permits entry into the applicable MODE(S) while relying on the ACTIONS. 

This allowance is acceptable due to the significant conservatism 

incorporated into the specific activity limit, the low probability of an event 

which is limiting due to exceeding this limit, and the ability to restore 

transient specific activity excursions while the plant remains at, or 

proceeds to power operation.
RCS Specific Activity

B 3.4.16

Westinghouse STS B 3.4.16-4 Rev. 4.0

BASES

ACTIONS (continued)

B.1

With the gross specific activity in excess of the allowed limit, the unit must 

be placed in a MODE in which the requirement does not apply.

The change within 6 hours to MODE 3 and RCS average temperature 

< 500°F lowers the saturation pressure of the reactor coolant below the 

setpoints of the main steam safety valves and prevents venting the SG to 

the environment in an SGTR event. The allowed Completion Time of 

6 hours is reasonable, based on operating experience, to reach MODE 3 

below 500°F from full power conditions in an orderly manner and without 

challenging plant systems.

C.1

If a Required Action and the associated Completion Time of Condition A 

is not met or if the DOSE EQUIVALENT I-131 is in the unacceptable 

region of Figure 3.4.16-1, the reactor must be brought to MODE 3 with 

RCS average temperature < 500°F within 6 hours. The Completion Time 

of 6 hours is reasonable, based on operating experience, to reach 

MODE 3 below 500°F from full power conditions in an orderly manner and 

without challenging plant systems.

SURVEILLANCE SR 3.4.16.1

REQUIREMENTS

SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure 

of the gross specific activity of the reactor coolant. While basically a 

quantitative measure of radionuclides with half lives longer than 

15 minutes, excluding iodines, this measurement is the sum of the 

degassed gamma activities and the gaseous gamma activities in the 

sample taken. This Surveillance provides an indication of any increase in 

gross specific activity.

Trending the results of this Surveillance allows proper remedial action to 

be taken before reaching the LCO limit under normal operating 

conditions. The Surveillance is applicable in MODES 1 and 2, and in 

MODE 3 with Tavg at least 500°F. [ The 7 day Frequency considers the 

unlikelihood of a gross fuel failure during the time.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RCS Specific Activity

B 3.4.16

Westinghouse STS B 3.4.16-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.16.2

This Surveillance is performed in MODE 1 only to ensure iodine remains 

within limit during normal operation and following fast power changes 

when fuel failure is more apt to occur. [ The 14 day Frequency is 

adequate to trend changes in the iodine activity level, considering gross 

activity is monitored every 7 days. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The Frequency, between 2 and 6 hours after a power change ≥ 15% RTP 

within a 1 hour period, is established because the iodine levels peak 

during this time following fuel failure; samples at other times would 

provide inaccurate results.

SR 3.4.16.3

A radiochemical analysis for Ē determination is required with the plant 

operating in MODE 1 equilibrium conditions. The Ē determination directly 

relates to the LCO and is required to verify plant operation within the 

specified gross activity LCO limit. The analysis for Ē is a measurement of 

the average energies per disintegration for isotopes with half lives longer 

than 15 minutes, excluding iodines. [ The Frequency of 184 days 

recognizes Ē does not change rapidly.
RCS Specific Activity

B 3.4.16

Westinghouse STS B 3.4.16-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR has been modified by a Note that indicates sampling is required 

to be performed within 31 days after a minimum of 2 effective full power 

days and 20 days of MODE 1 operation have elapsed since the reactor 

was last subcritical for at least 48 hours. This ensures that the 

radioactive materials are at equilibrium so the analysis for Ē is 

representative and not skewed by a crud burst or other similar abnormal 

event.

REFERENCES 1. 10 CFR 100.11, 1973.

2. FSAR, Section [15.6.3].
RCS Loop Isolation Valves

B 3.4.17

Westinghouse STS B 3.4.17-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.17 RCS Loop Isolation Valves

BASES

BACKGROUND The reactor coolant loops are equipped with loop isolation valves that 

permit any loop to be isolated from the reactor vessel. One valve is 

installed on each hot leg and one on each cold leg. The loop isolation 

valves are used to perform maintenance on an isolated loop. Power 

operation with a loop isolated is not permitted.

To ensure that inadvertent closure of a loop isolation valve does not 

occur, the valves must be open with power to the valve operators 

removed in MODES 1, 2, 3, and 4. If the valves are closed, a set of 

administrative controls and equipment interlocks must be satisfied prior to 

opening the isolation valves as described in LCO 3.4.18, "RCS Isolated 

Loop Startup."

APPLICABLE The safety analyses performed for the reactor at power assume that all

SAFETY reactor coolant loops are initially in operation and the loop isolation

ANALYSES valves are open. This LCO places controls on the loop isolation valves to 

ensure that the valves are not inadvertently closed in MODES 1, 2, 3, and 

4. The inadvertent closure of a loop isolation valve when the Reactor 

Coolant Pumps (RCPs) are operating will result in a partial loss of forced 

reactor coolant flow (Ref. 1). If the reactor is at power at the time of the 

event, the effect of the partial loss of forced coolant flow is a rapid 

increase in the coolant temperature which could result in DNB with 

subsequent fuel damage if the reactor is not tripped by the Low Flow 

reactor trip. If the reactor is shutdown and an RCS loop is in operation 

removing decay heat, closure of the loop isolation valve associated with 

the operating loop could also result in increasing coolant temperature and 

the possibility of fuel damage.

RCS Loop Isolation Valves satisfy Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO ensures that the loop isolation valves are open and power to 

the valve operators is removed. Loop isolation valves are used for 

performing maintenance in MODES 5 and 6. The safety analyses 

assume that the loop isolation valves are open in any RCS loops required 

to be OPERABLE by LCO 3.4.4, "RCS Loops - MODES 1 and 2," 

LCO 3.4.5, "RCS Loops - MODE 3," or LCO 3.4.6, "RCS Loops –

MODE 4."
RCS Loop Isolation Valves

B 3.4.17

Westinghouse STS B 3.4.17-2 Rev. 4.0

BASES

APPLICABILITY In MODES 1 through 4, this LCO ensures that the loop isolation valves 

are open and power to the valve operators is removed. The safety 

analyses assume that the loop isolation valves are open in any RCS 

loops required to be OPERABLE.

In MODES 5 and 6, the loop isolation valves may be closed. Controlled 

startup of an isolated loop is governed by the requirements of 

LCO 3.4.18, "RCS Isolated Loop Startup."

ACTIONS The Actions have been provided with a Note to clarify that all RCS loop 

isolation valves for this LCO are treated as separate entities, each with 

separate Completion Times, i.e., the Completion Time is on a component 

basis.

A.1

If power is inadvertently restored to one or more loop isolation valve 

operators, the potential exists for accidental isolation of a loop. The loop 

isolation valves have motor operators. Therefore, these valves will 

maintain their last position when power is removed from the valve 

operator. With power applied to the valve operators, only the interlocks 

prevent the valve from being operated. Although operating procedures 

and interlocks make the occurrence of this event unlikely, the prudent 

action is to remove power from the loop isolation valve operators. The 

Completion Time of 30 minutes to remove power from the loop isolation 

valve operators is sufficient considering the complexity of the task.

B.1, B.2, and B.3

Should a loop isolation valve be closed in MODES 1 through 4, the 

affected loop must be fully isolated immediately and the plant placed in 

MODE 5. Once in MODE 5, the isolated loop may be started in a 

controlled manner in accordance with LCO 3.4.18, "RCS Isolated Loop 

Startup." Opening the closed isolation valve in MODES 1 through 4 could 

result in colder water or water at a lower boron concentration being mixed 

with the operating RCS loops resulting in positive reactivity insertion. The 

Completion Time of Required Action B.1 allows time for borating the 

operating loops to a shutdown boration level such that the plant can be 

brought to MODE 3 within 6 hours and MODE 5 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems.
RCS Loop Isolation Valves

B 3.4.17

Westinghouse STS B 3.4.17-3 Rev. 4.0

BASES

SURVEILLANCE SR 3.4.17.1

REQUIREMENTS

The Surveillance is performed to ensure that the RCS loop isolation 

valves are open, with power removed from the loop isolation valve 

operators. The primary function of this Surveillance is to ensure that 

power is removed from the valve operators, since SR 3.4.4.1 of 

LCO 3.4.4, "RCS Loops - MODES 1 and 2," ensures that the loop 

isolation valves are open by verifying every 12 hours that all loops are 

operating and circulating reactor coolant. [ The Frequency of 31 days 

ensures that the required flow can be made available, is based on 

engineering judgment, and has proven to be acceptable. Operating 

experience has shown that the failure rate is so low that the 31 day 

Frequency is justified.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [15.2.6].

RCS Isolated Loop Startup

B 3.4.18

Westinghouse STS B 3.4.18-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.18 RCS Isolated Loop Startup

BASES

BACKGROUND The RCS may be operated with loops isolated in MODES 5 and 6 in order 

to perform maintenance. While operating with a loop isolated, there is 

potential for inadvertently opening the isolation valves in the isolated loop. 

In this event, the coolant in the isolated loop would suddenly begin to mix 

with the coolant in the operating loops. This situation has the potential of 

causing a positive reactivity addition with a corresponding reduction of 

SDM if:

a. The temperature in the isolated loop is lower than the temperature in 

the operating loops (cold water incident) or

b. The boron concentration in the isolated loop is lower than the boron 

concentration required to meet the SDM of LCO 3.1.1 or boron 

concentration of LCO 3.9.1 (boron dilution incident).

As discussed in the FSAR (Ref. 1), the startup of an isolated loop is done 

in a controlled manner that virtually eliminates any sudden reactivity 

addition from cold water or boron dilution because:

a. This LCO and plant operating procedures require that the boron 

concentration in the isolated loop be maintained higher than the 

boron concentration of the operating loops, thus eliminating the 

potential for introducing coolant from the isolated loop that could 

dilute the boron concentration in the operating loops,

b. The cold leg loop isolation valve cannot be opened unless the 

temperatures of both the hot leg and cold leg of the isolated loop are 

within 20°F of the operating loops. Compliance with the temperature 

requirement is ensured by operating procedures and automatic 

interlocks, and

c. Other automatic interlocks prevent opening the hot leg loop isolation 

valve unless the cold leg loop isolation valve is fully closed. All of the 

interlocks are part of the Reactor Protection System.
RCS Isolated Loop Startup

B 3.4.18

Westinghouse STS B 3.4.18-2 Rev. 4.0

BASES

APPLICABLE During startup of an isolated loop, the cold leg loop isolation valve

SAFETY interlocks and operating procedures prevent opening the valve until the

ANALYSES isolated loop and operating loop boron concentrations and temperatures 

are equalized. This ensures that any undesirable reactivity effect from 

the isolated loop does not occur.

The safety analyses assume a minimum SDM as an initial condition for 

Design Basis Accidents. Violation of this LCO could result in the SDM 

being reduced in the operating loops to less than that assumed in the 

safety analyses.

The boron concentration of an isolated loop may affect SDM and 

therefore RCS isolated loop startup satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO Loop isolation valves are used for performing maintenance when the 

plant is in MODE 5 or 6. This LCO ensures that the loop isolation valves 

remain closed until the differentials of temperature and boron 

concentration between the operating loops and the isolated loops are 

within acceptable limits.

APPLICABILITY In MODES 5 and 6, the SDM of the operating loops is large enough to 

permit operation with isolated loops. Controlled startup of isolated loops 

is possible without significant risk of inadvertent criticality. This LCO is 

applicable under these conditions.

ACTIONS A.1 and A.2

Required Action A.1 and Required Action A.2 assume that the 

prerequisites of the LCO are not met and a loop isolation valve has been 

inadvertently opened. Therefore, the Actions require immediate closure 

of isolation valves to preclude a boron dilution event or a cold water 

event. However, each Required Action is preceded by a Note that states 

that Action is required only when a specific concentration or temperature 

requirement is not met.

SURVEILLANCE SR 3.4.18.1

REQUIREMENTS

This Surveillance is performed to ensure that the temperature differential 

between the isolated loop and the operating loops is ≤ [20]°F. Performing 

the Surveillance 30 minutes prior to opening the cold leg isolation valve in 

the isolated loop provides reasonable assurance, based 
RCS Isolated Loop Startup

B 3.4.18

Westinghouse STS B 3.4.18-3 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

on engineering judgment, that the temperature differential will stay within 

limits until the cold leg isolation valve is opened. This Frequency has 

been shown to be acceptable through operating experience.

SR 3.4.18.2

To ensure that the boron concentration of the isolated loop is greater than 

or equal to the boron concentration required to meet the SDM of 

LCO 3.1.1 or boron concentration of LCO 3.9.1, a Surveillance is 

performed 2 hours prior to opening either the hot or cold leg isolation 

valve. Performing the Surveillance 2 hours prior to opening either the hot 

or cold leg isolation valve provides reasonable assurance the boron 

concentration difference will stay within acceptable limits until the loop is 

unisolated. This Frequency has been shown to be acceptable through 

operating experience.

REFERENCES 1. FSAR, Section [15.2.6].

RCS Loops - Test Exceptions

B 3.4.19

Westinghouse STS B 3.4.19-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.19 RCS Loops - Test Exceptions

BASES

BACKGROUND The primary purpose of this test exception is to provide an exception to 

LCO 3.4.4, "RCS Loops - MODES 1 and 2," to permit reactor criticality 

under no flow conditions during certain PHYSICS TESTS (natural 

circulation demonstration, station blackout, and loss of offsite power) to 

be performed while at low THERMAL POWER levels. Section XI of 

10 CFR 50, Appendix B (Ref. 1), requires that a test program be 

established to ensure that structures, systems, and components will 

perform satisfactorily in service. All functions necessary to ensure that 

the specified design conditions are not exceeded during normal operation 

and anticipated operational occurrences must be tested. This testing is 

an integral part of the design, construction, and operation of the power 

plant as specified in GDC 1, "Quality Standards and Records" (Ref. 2).

The key objectives of a test program are to provide assurance that the 

facility has been adequately designed to validate the analytical models 

used in the design and analysis, to verify the assumptions used to predict 

plant response, to provide assurance that installation of equipment at the 

unit has been accomplished in accordance with the design, and to verify 

that the operating and emergency procedures are adequate. Testing is 

performed prior to initial criticality, during startup, and following low power 

operations.

The tests will include verifying the ability to establish and maintain natural 

circulation following a plant trip between 10% and 20% RTP, performing 

natural circulation cooldown on emergency power, and during the 

cooldown, showing that adequate boron mixture occurs and that pressure 

can be controlled using auxiliary spray and pressurizer heaters powered 

from the emergency power sources.

APPLICABLE The tests described above require operating the plant without forced

SAFETY convection flow and as such are not bounded by any safety analyses. 

ANALYSES However, operating experience has demonstrated this exception to be 

safe under the present applicability.

As describe in LCO 3.0.7, compliance with Test Exception LCOs is 

optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test 

Exception LCOs provide flexibility to perform certain operations by 

appropriately modifying requirements of other LCOs. A discussion of the 

criteria satisfied for the other LCOs is provided in their respective Bases.
RCS Loops - Test Exceptions

B 3.4.19

Westinghouse STS B 3.4.19-2 Rev. 4.0

BASES

LCO This LCO provides an exemption to the requirements of LCO 3.4.4.

The LCO is provided to allow for the performance of PHYSICS TESTS in 

MODE 2 (after a refueling), where the core cooling requirements are 

significantly different than after the core has been operating. Without the 

LCO, plant operations would be held bound to the normal operating LCOs 

for reactor coolant loops and circulation (MODES 1 and 2), and the 

appropriate tests could not be performed.

In MODE 2, where core power level is considerably lower and the 

associated PHYSICS TESTS must be performed, operation is allowed 

under no flow conditions provided THERMAL POWER is ≤ P-7 and the 

reactor trip setpoints of the OPERABLE power level channels are set 

≤ 25% RTP. This ensures, if some problem caused the plant to enter 

MODE 1 and start increasing plant power, the Reactor Trip System (RTS) 

would automatically shut it down before power became too high, and 

thereby prevent violation of fuel design limits.

The exemption is allowed even though there are no bounding safety 

analyses. However, these tests are performed under close supervision 

during the test program and provide valuable information on the plant's 

capability to cool down without offsite power available to the reactor 

coolant pumps.

APPLICABILITY This LCO is applicable when performing low power PHYSICS TESTS 

without any forced convection flow. This testing is performed to establish 

that heat input from nuclear heat does not exceed the natural circulation 

heat removal capabilities. Therefore, no safety or fuel design limits will be 

violated as a result of the associated tests.

ACTIONS A.1

When THERMAL POWER is ≥ the P-7 interlock setpoint 10%, the only 

acceptable action is to ensure the reactor trip breakers (RTBs) are 

opened immediately in accordance with Required Action A.1 to prevent 

operation of the fuel beyond its design limits. Opening the RTBs will shut 

down the reactor and prevent operation of the fuel outside of its design 

limits.

SURVEILLANCE SR 3.4.19.1

REQUIREMENTS

Verification that the power level is < the P-7 interlock setpoint (10%) will 

ensure that the fuel design criteria are not violated during the 

performance of the PHYSICS TESTS. [ The Frequency of once per hour 

is adequate to ensure that the power level does not exceed the limit. 

Plant operations are conducted slowly during the performance of 

PHYSICS TESTS and monitoring the power level once per hour is 

sufficient to ensure that the power level does not exceed the limit.
RCS Loops - Test Exceptions

B 3.4.19

Westinghouse STS B 3.4.19-3 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.4.19.2

The power range and intermediate range neutron detectors. P-10, and 

the P-13 interlock setpoint must be verified to be OPERABLE and 

adjusted to the proper value. The Low Power Reactor Trips Block, P-7 

interlock, is actuated from either the Power Range Neutron Flux, P-10, or 

the Turbine Impulse Chamber Pressure, P-13 interlock. The P-7 interlock 

is a logic Function with train, not channel identity. A COT is performed 

prior to initiation of the PHYSICS TESTS. This will ensure that the RTS is 

properly aligned to provide the required degree of core protection during 

the performance of the PHYSICS TESTS. A successful test of the 

required contact(s) of a channel relay may be performed by the 

verification of the change of state of a single contact of the relay. This 

clarifies what is an acceptable COT of a relay. This is acceptable 

because all of the other required contacts of the relay are verified by other 

Technical Specifications and non-Technical Specifications tests at least 

once per refueling interval with applicable extensions. The SR 3.3.1.8 

Frequency is sufficient for the power range and intermediate range 

neutron detectors to ensure that the instrumentation is OPERABLE 

before initiating PHYSICS TESTS.

SR 3.4.19.3

The Low Power Reactor Trips Block, P-7 interlock, must be verified to be 

OPERABLE in MODE 1 by LCO 3.3.1, “Reactor Trip System 

Instrumentation.” The P-7 interlock is actuated from either the Power 

Range Neutron Flux, P-10, or the Turbine Impulse Chamber Pressure, 

P-13 interlock. The P-7 interlock is a logic Function. An ACTUATION 
RCS Loops - Test Exceptions

B 3.4.19

Westinghouse STS B 3.4.19-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

LOGIC TEST is performed to verify OPERABILITY of the P-7 interlock 

prior to initiation of startup and PHYSICS TESTS. This will ensure that 

the RTS is properly functioning to provide the required degree of core 

protection during the performance of the PHYSICS TESTS.

REFERENCES 1. 10 CFR 50, Appendix B, Section XI.

2. 10 CFR 50, Appendix A, GDC 1, 1988.
SG Tube Integrity

B 3.4.20

Westinghouse STS B 3.4.20-1 Rev. 4.0

B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.20 Steam Generator (SG) Tube Integrity

BASES

BACKGROUND Steam generator (SG) tubes are small diameter, thin walled tubes that 

carry primary coolant through the primary to secondary heat exchangers. 

The SG tubes have a number of important safety functions. Steam 

generator tubes are an integral part of the reactor coolant pressure 

boundary (RCPB) and, as such, are relied on to maintain the primary 

system’s pressure and inventory. The SG tubes isolate the radioactive 

fission products in the primary coolant from the secondary system. In 

addition, as part of the RCPB, the SG tubes are unique in that they act as 

the heat transfer surface between the primary and secondary systems to 

remove heat from the primary system. This Specification addresses only 

the RCPB integrity function of the SG. The SG heat removal function is 

addressed by LCO 3.4.4, "RCS Loops – MODES 1 and 2," LCO 3.4.5, 

"RCS Loops – MODE 3," LCO 3.4.6, "RCS Loops – MODE 4," and 

LCO 3.4.7, "RCS Loops – MODE 5, Loops Filled."

SG tube integrity means that the tubes are capable of performing their 

intended RCPB safety function consistent with the licensing basis, 

including applicable regulatory requirements.

Steam generator tubing is subject to a variety of degradation 

mechanisms. Steam generator tubes may experience tube degradation 

related to corrosion phenomena, such as wastage, pitting, intergranular 

attack, and stress corrosion cracking, along with other mechanically 

induced phenomena such as denting and wear. These degradation 

mechanisms can impair tube integrity if they are not managed effectively. 

The SG performance criteria are used to manage SG tube degradation.

Specification 5.5.9, "Steam Generator (SG) Program," requires that a 

program be established and implemented to ensure that SG tube integrity 

is maintained. Pursuant to Specification 5.5.9, tube integrity is 

maintained when the SG performance criteria are met. There are three 

SG performance criteria: structural integrity, accident induced leakage, 

and operational LEAKAGE. The SG performance criteria are described in 

Specification 5.5.9. Meeting the SG performance criteria provides 

reasonable assurance of maintaining tube integrity at normal and 

accident conditions. 

The processes used to meet the SG performance criteria are defined by 

the Steam Generator Program Guidelines (Ref. 1).
SG Tube Integrity

B 3.4.20

Westinghouse STS B 3.4.20-2 Rev. 4.0

BASES

APPLICABLE The steam generator tube rupture (SGTR) accident is the limiting design 

SAFETY basis event for SG tubes and avoiding an SGTR is the basis for this 

ANALYSES Specification. The analysis of a SGTR event assumes a bounding 

primary to secondary LEAKAGE rate equal to the operational LEAKAGE 

rate limits in LCO 3.4.13, "RCS Operational LEAKAGE," plus the leakage 

rate associated with a double-ended rupture of a single tube. The 

accident analysis for a SGTR assumes the contaminated secondary fluid 

is only briefly released to the atmosphere via safety valves and the 

majority is discharged to the main condenser.

The analysis for design basis accidents and transients other than a SGTR 

assume the SG tubes retain their structural integrity (i.e., they are 

assumed not to rupture.) In these analyses, the steam discharge to the 

atmosphere is based on the total primary to secondary LEAKAGE from all 

SGs of [1 gallon per minute] or is assumed to increase to [1 gallon per 

minute] as a result of accident induced conditions. For accidents that do 

not involve fuel damage, the primary coolant activity level of DOSE 

EQUIVALENT I-131 is assumed to be equal to the LCO 3.4.16, "RCS 

Specific Activity," limits. For accidents that assume fuel damage, the 

primary coolant activity is a function of the amount of activity released 

from the damaged fuel. The dose consequences of these events are 

within the limits of GDC 19 (Ref. 2), 10 CFR 100 (Ref. 3) or the NRC 

approved licensing basis (e.g., a small fraction of these limits). 

Steam generator tube integrity satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO The LCO requires that SG tube integrity be maintained. The LCO also

requires that all SG tubes that satisfy the repair criteria be plugged [or 

repaired] in accordance with the Steam Generator Program.

During an SG inspection, any inspected tube that satisfies the Steam 

Generator Program repair criteria is [repaired or] removed from service by 

plugging. If a tube was determined to satisfy the repair criteria but was 

not plugged [or repaired], the tube may still have tube integrity.

In the context of this Specification, a SG tube is defined as the entire 

length of the tube, including the tube wall [and any repairs made to it], 

between the tube-to-tubesheet weld at the tube inlet and the tube-totubesheet weld at the tube outlet. The tube-to-tubesheet weld is not 

considered part of the tube.

A SG tube has tube integrity when it satisfies the SG performance criteria. 

The SG performance criteria are defined in Specification 5.5.9, "Steam 

Generator Program," and describe acceptable SG tube performance. 

The Steam Generator Program also provides the evaluation process for 

determining conformance with the SG performance criteria.
SG Tube Integrity

B 3.4.20

Westinghouse STS B 3.4.20-3 Rev. 4.0

BASES

LCO (continued)

There are three SG performance criteria: structural integrity, accident 

induced leakage, and operational LEAKAGE. Failure to meet any one of 

these criteria is considered failure to meet the LCO.

The structural integrity performance criterion provides a margin of safety 

against tube burst or collapse under normal and accident conditions, and 

ensures structural integrity of the SG tubes under all anticipated 

transients included in the design specification. Tube burst is defined as, 

"The gross structural failure of the tube wall. The condition typically 

corresponds to an unstable opening displacement (e.g., opening area 

increased in response to constant pressure) accompanied by ductile 

(plastic) tearing of the tube material at the ends of the degradation." Tube 

collapse is defined as, "For the load displacement curve for a given 

structure, collapse occurs at the top of the load versus displacement 

curve where the slope of the curve becomes zero." The structural 

integrity performance criterion provides guidance on assessing loads that 

have a significant effect on burst or collapse. In that context, the term 

"significant" is defined as "An accident loading condition other than

differential pressure is considered significant when the addition of such 

loads in the assessment of the structural integrity performance criterion 

could cause a lower structural limit or limiting burst/collapse condition to 

be established." For tube integrity evaluations, except for circumferential 

degradation, axial thermal loads are classified as secondary loads. For 

circumferential degradation, the classification of axial thermal loads as 

primary or secondary loads will be evaluated on a case-by-case basis. 

The division between primary and secondary classifications will be based 

on detailed analysis and/or testing.

Structural integrity requires that the primary membrane stress intensity in 

a tube not exceed the yield strength for all ASME Code, Section III, 

Service Level A (normal operating conditions) and Service Level B (upset 

or abnormal conditions) transients included in the design specification. 

This includes safety factors and applicable design basis loads based on 

ASME Code, Section III, Subsection NB (Ref. 4) and Draft Regulatory 

Guide 1.121 (Ref. 5).

The accident induced leakage performance criterion ensures that the 

primary to secondary LEAKAGE caused by a design basis accident, other 

than a SGTR, is within the accident analysis assumptions. The accident 

analysis assumes that accident induced leakage does not exceed [1 gpm 

per SG, except for specific types of degradation at specific locations 

where the NRC has approved greater accident induced leakage.] The 

accident induced leakage rate includes any primary to secondary 

LEAKAGE existing prior to the accident in addition to primary to 

secondary LEAKAGE induced during the accident.
SG Tube Integrity

B 3.4.20

Westinghouse STS B 3.4.20-4 Rev. 4.0

BASES

LCO (continued)

The operational LEAKAGE performance criterion provides an observable 

indication of SG tube conditions during plant operation. The limit on 

operational LEAKAGE is contained in LCO 3.4.13, "RCS Operational 

LEAKAGE," and limits primary to secondary LEAKAGE through any one 

SG to 150 gallons per day. This limit is based on the assumption that a 

single crack leaking this amount would not propagate to a SGTR under 

the stress conditions of a LOCA or a main steam line break. If this 

amount of LEAKAGE is due to more than one crack, the cracks are very 

small, and the above assumption is conservative.

APPLICABILITY Steam generator tube integrity is challenged when the pressure 

differential across the tubes is large. Large differential pressures across 

SG tubes can only be experienced in MODE 1, 2, 3, or 4.

RCS conditions are far less challenging in MODES 5 and 6 than during 

MODES 1, 2, 3, and 4. In MODES 5 and 6, primary to secondary 

differential pressure is low, resulting in lower stresses and reduced 

potential for LEAKAGE.

ACTIONS The ACTIONS are modified by a Note clarifying that the Conditions may 

be entered independently for each SG tube. This is acceptable because 

the Required Actions provide appropriate compensatory actions for each 

affected SG tube. Complying with the Required Actions may allow for 

continued operation, and subsequent affected SG tubes are governed by 

subsequent Condition entry and application of associated Required 

Actions.

A.1 and A.2

Condition A applies if it is discovered that one or more SG tubes 

examined in an inservice inspection satisfy the tube repair criteria but 

were not plugged [or repaired] in accordance with the Steam Generator 

Program as required by SR 3.4.20.2. An evaluation of SG tube integrity 

of the affected tube(s) must be made. Steam generator tube integrity is 

based on meeting the SG performance criteria described in the Steam 

Generator Program. The SG repair criteria define limits on SG tube 

degradation that allow for flaw growth between inspections while still 

providing assurance that the SG performance criteria will continue to be 

met. In order to determine if a SG tube that should have been plugged 

[or repaired] has tube integrity, an evaluation must be completed that 

demonstrates that the SG performance criteria will continue to be met 

until the next refueling outage or SG tube inspection. The tube integrity 
SG Tube Integrity

B 3.4.20

Westinghouse STS B 3.4.20-5 Rev. 4.0

BASES

ACTIONS (continued)

determination is based on the estimated condition of the tube at the time 

the situation is discovered and the estimated growth of the degradation 

prior to the next SG tube inspection. If it is determined that tube integrity 

is not being maintained, Condition B applies.

A Completion Time of 7 days is sufficient to complete the evaluation while 

minimizing the risk of plant operation with a SG tube that may not have 

tube integrity. 

If the evaluation determines that the affected tube(s) have tube integrity, 

Required Action A.2 allows plant operation to continue until the next 

refueling outage or SG inspection provided the inspection interval 

continues to be supported by an operational assessment that reflects the 

affected tubes. However, the affected tube(s) must be plugged [or 

repaired] prior to entering MODE 4 following the next refueling outage or 

SG inspection. This Completion Time is acceptable since operation until 

the next inspection is supported by the operational assessment.

B.1 and B.2

If the Required Actions and associated Completion Times of Condition A 

are not met or if SG tube integrity is not being maintained, the reactor 

must be brought to MODE 3 within 6 hours and MODE 5 within 36 hours.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the desired plant conditions from full power 

conditions in an orderly manner and without challenging plant systems. 

SURVEILLANCE SR 3.4.20.1

REQUIREMENTS

During shutdown periods the SGs are inspected as required by this SR 

and the Steam Generator Program. NEI 97-06, Steam Generator 

Program Guidelines (Ref. 1), and its referenced EPRI Guidelines, 

establish the content of the Steam Generator Program. Use of the Steam 

Generator Program ensures that the inspection is appropriate and 

consistent with accepted industry practices.

During SG inspections a condition monitoring assessment of the SG 

tubes is performed. The condition monitoring assessment determines the 

"as found" condition of the SG tubes. The purpose of the condition 

monitoring assessment is to ensure that the SG performance criteria have 

been met for the previous operating period. 
SG Tube Integrity

B 3.4.20

Westinghouse STS B 3.4.20-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Steam Generator Program determines the scope of the inspection 

and the methods used to determine whether the tubes contain flaws 

satisfying the tube repair criteria. Inspection scope (i.e., which tubes or 

areas of tubing within the SG are to be inspected) is a function of existing 

and potential degradation locations. The Steam Generator Program also 

specifies the inspection methods to be used to find potential degradation. 

Inspection methods are a function of degradation morphology, nondestructive examination (NDE) technique capabilities, and inspection 

locations.

The Steam Generator Program defines the Frequency of SR 3.4.20.1. 

The Frequency is determined by the operational assessment and other 

limits in the SG examination guidelines (Ref. 6). The Steam Generator 

Program uses information on existing degradations and growth rates to 

determine an inspection Frequency that provides reasonable assurance 

that the tubing will meet the SG performance criteria at the next 

scheduled inspection. In addition, Specification 5.5.9 contains 

prescriptive requirements concerning inspection intervals to provide 

added assurance that the SG performance criteria will be met between

scheduled inspections.

SR 3.4.20.2

During an SG inspection, any inspected tube that satisfies the Steam 

Generator Program repair criteria is [repaired or] removed from service by 

plugging. The tube repair criteria delineated in Specification 5.5.9 are 

intended to ensure that tubes accepted for continued service satisfy the 

SG performance criteria with allowance for error in the flaw size 

measurement and for future flaw growth. In addition, the tube repair 

criteria, in conjunction with other elements of the Steam Generator 

Program, ensure that the SG performance criteria will continue to be met 

until the next inspection of the subject tube(s). Reference 1 provides 

guidance for performing operational assessments to verify that the tubes 

remaining in service will continue to meet the SG performance criteria.

[Steam generator tube repairs are only performed using approved repair 

methods as described in the Steam Generator Program.] 

The Frequency of prior to entering MODE 4 following a SG inspection 

ensures that the Surveillance has been completed and all tubes meeting 

the repair criteria are plugged [or repaired] prior to subjecting the SG 

tubes to significant primary to secondary pressure differential.
SG Tube Integrity

B 3.4.20

Westinghouse STS B 3.4.20-7 Rev. 4.0 

BASES

REFERENCES 1. NEI 97-06, "Steam Generator Program Guidelines."

2. 10 CFR 50 Appendix A, GDC 19.

3. 10 CFR 100.

4. ASME Boiler and Pressure Vessel Code, Section III, Subsection NB.

5. Draft Regulatory Guide 1.121, "Basis for Plugging Degraded Steam 

Generator Tubes," August 1976.

6. EPRI, "Pressurized Water Reactor Steam Generator Examination 

Guidelines."

Accumulators

B 3.5.1

Westinghouse STS B 3.5.1-1 Rev. 4.0

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.1 Accumulators

BASES

BACKGROUND The functions of the ECCS accumulators are to supply water to the 

reactor vessel during the blowdown phase of a loss of coolant accident 

(LOCA), to provide inventory to help accomplish the refill phase that 

follows thereafter, and to provide Reactor Coolant System (RCS) makeup 

for a small break LOCA.

The blowdown phase of a large break LOCA is the initial period of the 

transient during which the RCS departs from equilibrium conditions, and 

heat from fission product decay, hot internals, and the vessel continues to 

be transferred to the reactor coolant. The blowdown phase of the 

transient ends when the RCS pressure falls to a value approaching that of 

the containment atmosphere.

In the refill phase of a LOCA, which immediately follows the blowdown 

phase, reactor coolant inventory has vacated the core through steam 

flashing and ejection out through the break. The core is essentially in 

adiabatic heatup. The balance of accumulator inventory is then available 

to help fill voids in the lower plenum and reactor vessel downcomer so as 

to establish a recovery level at the bottom of the core and ongoing reflood 

of the core with the addition of safety injection (SI) water.

The accumulators are pressure vessels partially filled with borated water 

and pressurized with nitrogen gas. The accumulators are passive 

components, since no operator or control actions are required in order for 

them to perform their function. Internal accumulator tank pressure is 

sufficient to discharge the accumulator contents to the RCS, if RCS 

pressure decreases below the accumulator pressure.

Each accumulator is piped into an RCS cold leg via an accumulator line 

and is isolated from the RCS by a motor operated isolation valve and two 

check valves in series.

The accumulator size, water volume, and nitrogen cover pressure are 

selected so that three of the four accumulators are sufficient to partially 

cover the core before significant clad melting or zirconium water reaction 

can occur following a LOCA. The need to ensure that three accumulators 

are adequate for this function is consistent with the LOCA assumption 

that the entire contents of one accumulator will be lost via the RCS pipe 

break during the blowdown phase of the LOCA.
Accumulators

B 3.5.1

Westinghouse STS B 3.5.1-2 Rev. 4.0

BASES

APPLICABLE The accumulators are assumed OPERABLE in both the large and small

SAFETY break LOCA analyses at full power (Ref. 1). These are the Design Basis

ANALYSES Accidents (DBAs) that establish the acceptance limits for the 

accumulators. Reference to the analyses for these DBAs is used to 

assess changes in the accumulators as they relate to the acceptance 

limits.

In performing the LOCA calculations, conservative assumptions are made 

concerning the availability of ECCS flow. In the early stages of a LOCA, 

with or without a loss of offsite power, the accumulators provide the sole 

source of makeup water to the RCS. The assumption of loss of offsite 

power is required by regulations and conservatively imposes a delay 

wherein the ECCS pumps cannot deliver flow until the emergency diesel 

generators start, come to rated speed, and go through their timed loading 

sequence. In cold leg break scenarios, the entire contents of one 

accumulator are assumed to be lost through the break.

The limiting large break LOCA is a double ended guillotine break at the 

discharge of the reactor coolant pump. During this event, the 

accumulators discharge to the RCS as soon as RCS pressure decreases 

to below accumulator pressure.

As a conservative estimate, no credit is taken for ECCS pump flow until 

an effective delay has elapsed. This delay accounts for the diesels 

starting and the pumps being loaded and delivering full flow. The delay 

time is conservatively set with an additional 2 seconds to account for SI 

signal generation. During this time, the accumulators are analyzed as 

providing the sole source of emergency core cooling. No operator action 

is assumed during the blowdown stage of a large break LOCA.

The worst case small break LOCA analyses also assume a time delay 

before pumped flow reaches the core. For the larger range of small 

breaks, the rate of blowdown is such that the increase in fuel clad 

temperature is terminated solely by the accumulators, with pumped flow 

then providing continued cooling. As break size decreases, the 

accumulators and centrifugal charging pumps both play a part in 

terminating the rise in clad temperature. As break size continues to 

decrease, the role of the accumulators continues to decrease until they 

are not required and the centrifugal charging pumps become solely 

responsible for terminating the temperature increase.

This LCO helps to ensure that the following acceptance criteria 

established for the ECCS by 10 CFR 50.46 (Ref. 2) will be met following a 

LOCA:
Accumulators

B 3.5.1

Westinghouse STS B 3.5.1-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

a. Maximum fuel element cladding temperature is ≤ 2200°F,

b. Maximum cladding oxidation is ≤ 0.17 times the total cladding 

thickness before oxidation,

c. Maximum hydrogen generation from a zirconium water reaction is 

≤ 0.01 times the hypothetical amount that would be generated if all of 

the metal in the cladding cylinders surrounding the fuel, excluding the 

cladding surrounding the plenum volume, were to react, and

d. Core is maintained in a coolable geometry.

Since the accumulators discharge during the blowdown phase of a LOCA, 

they do not contribute to the long term cooling requirements of 

10 CFR 50.46.

For both the large and small break LOCA analyses, a nominal contained 

accumulator water volume is used. The contained water volume is the 

same as the deliverable volume for the accumulators, since the 

accumulators are emptied, once discharged. For small breaks, an 

increase in water volume is a peak clad temperature penalty. For large 

breaks, an increase in water volume can be either a peak clad 

temperature penalty or benefit, depending on downcomer filling and 

subsequent spill through the break during the core reflooding portion of 

the transient. The analysis makes a conservative assumption with 

respect to ignoring or taking credit for line water volume from the 

accumulator to the check valve. The safety analysis assumes values of 

[6468] gallons and [6879] gallons. To allow for instrument inaccuracy, 

values of [6520] gallons and [6820] gallons are specified.

The minimum boron concentration setpoint is used in the post LOCA 

boron concentration calculation. The calculation is performed to assure 

reactor subcriticality in a post LOCA environment. Of particular interest is 

the large break LOCA, since no credit is taken for control rod assembly 

insertion. A reduction in the accumulator minimum boron concentration 

would produce a subsequent reduction in the available containment sump 

concentration for post LOCA shutdown and an increase in the maximum 

sump pH. The maximum boron concentration is used in determining the 

cold leg to hot leg recirculation injection switchover time and minimum 

sump pH.
Accumulators

B 3.5.1

Westinghouse STS B 3.5.1-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The large and small break LOCA analyses are performed at the minimum 

nitrogen cover pressure, since sensitivity analyses have demonstrated 

that higher nitrogen cover pressure results in a computed peak clad 

temperature benefit. The maximum nitrogen cover pressure limit 

prevents accumulator relief valve actuation, and ultimately preserves 

accumulator integrity.

The effects on containment mass and energy releases from the 

accumulators are accounted for in the appropriate analyses (Refs. 1 

and 3).

The accumulators satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO establishes the minimum conditions required to ensure that the 

accumulators are available to accomplish their core cooling safety 

function following a LOCA. Four accumulators are required to ensure that 

100% of the contents of three of the accumulators will reach the core 

during a LOCA. This is consistent with the assumption that the contents 

of one accumulator spill through the break. If less than three 

accumulators are injected during the blowdown phase of a LOCA, the 

ECCS acceptance criteria of 10 CFR 50.46 (Ref. 2) could be violated.

For an accumulator to be considered OPERABLE, the isolation valve 

must be fully open, power removed above [2000] psig, and the limits 

established in the SRs for contained volume, boron concentration, and 

nitrogen cover pressure must be met.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure > 1000 psig, the 

accumulator OPERABILITY requirements are based on full power 

operation. Although cooling requirements decrease as power decreases, 

the accumulators are still required to provide core cooling as long as 

elevated RCS pressures and temperatures exist.

This LCO is only applicable at pressures > 1000 psig. At pressures 

≤ 1000 psig, the rate of RCS blowdown is such that the ECCS pumps can 

provide adequate injection to ensure that peak clad temperature remains 

below the 10 CFR 50.46 (Ref. 2) limit of 2200°F.

In MODE 3, with RCS pressure ≤ 1000 psig, and in MODES 4, 5, and 6, 

the accumulator motor operated isolation valves are closed to isolate the 

accumulators from the RCS. This allows RCS cooldown and 

depressurization without discharging the accumulators into the RCS or 

requiring depressurization of the accumulators.
Accumulators

B 3.5.1

Westinghouse STS B 3.5.1-5 Rev. 4.0

BASES

ACTIONS A.1

If the boron concentration of one accumulator is not within limits, it must 

be returned to within the limits within 72 hours. In this Condition, ability to 

maintain subcriticality or minimum boron precipitation time may be 

reduced. The boron in the accumulators contributes to the assumption 

that the combined ECCS water in the partially recovered core during the 

early reflooding phase of a large break LOCA is sufficient to keep that 

portion of the core subcritical. One accumulator below the minimum 

boron concentration limit, however, will have no effect on available ECCS 

water and an insignificant effect on core subcriticality during reflood. 

Boiling of ECCS water in the core during reflood concentrates boron in 

the saturated liquid that remains in the core. In addition, current analysis 

techniques demonstrate that the accumulators do not discharge following 

a large main steam line break for the majority of plants. Even if they do 

discharge, their impact is minor and not a design limiting event. Thus, 

72 hours is allowed to return the boron concentration to within limits.

B.1

If one accumulator is inoperable for a reason other than boron 

concentration, the accumulator must be returned to OPERABLE status 

within 24 hours. In this Condition, the required contents of three 

accumulators cannot be assumed to reach the core during a LOCA. Due 

to the severity of the consequences should a LOCA occur in these 

conditions, the 24 hour Completion Time to open the valve, remove 

power to the valve, or restore the proper water volume or nitrogen cover 

pressure ensures that prompt action will be taken to return the inoperable 

accumulator to OPERABLE status. The Completion Time minimizes the 

potential for exposure of the plant to a LOCA under these conditions. The 

24 hours allowed to restore an inoperable accumulator to OPERABLE 

status is justified in WCAP-15049-A, Rev. 1 (Ref. 4).

C.1 and C.2

If the accumulator cannot be returned to OPERABLE status within the 

associated Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to MODE 3 within 6 hours and RCS pressure reduced to 

≤ 1000 psig within 12 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems.
Accumulators

B 3.5.1

Westinghouse STS B 3.5.1-6 Rev. 4.0

BASES

ACTIONS (continued)

D.1

If more than one accumulator is inoperable, the plant is in a condition 

outside the accident analyses; therefore, LCO 3.0.3 must be entered 

immediately.

SURVEILLANCE SR 3.5.1.1

REQUIREMENTS

Each accumulator valve should be verified to be fully open. This 

verification ensures that the accumulators are available for injection and 

ensures timely discovery if a valve should be less than fully open. If an 

isolation valve is not fully open, the rate of injection to the RCS would be 

reduced. Although a motor operated valve position should not change 

with power removed, a closed valve could result in not meeting accident 

analyses assumptions. [ The Frequency of 12 hours is considered 

reasonable in view of other administrative controls that ensure a 

mispositioned isolation valve is unlikely.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.5.1.2 and SR 3.5.1.3

Borated water volume and nitrogen cover pressure are verified for each 

accumulator. [ The Frequency of 12 hours is sufficient to ensure 

adequate injection during a LOCA. Because of the static design of the 

accumulator, a 12 hour Frequency usually allows the operator to identify 

changes before limits are reached. Operating experience has shown this 

Frequency to be appropriate for early detection and correction of off 

normal trends.

OR
Accumulators

B 3.5.1

Westinghouse STS B 3.5.1-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.5.1.4

The boron concentration should be verified to be within required limits for 

each accumulator since the static design of the accumulators limits the 

ways in which the concentration can be changed. [ The 31 day 

Frequency is adequate to identify changes that could occur from 

mechanisms such as stratification or inleakage. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

Sampling the affected accumulator within 6 hours after a 1% volume 

increase will identify whether inleakage has caused a reduction in boron 

concentration to below the required limit. It is not necessary to verify 

boron concentration if the added water inventory is from the refueling 

water storage tank (RWST), because the water contained in the RWST is 

within the accumulator boron concentration requirements. This is 

consistent with the recommendation of NUREG-1366 (Ref. 5).
Accumulators

B 3.5.1

Westinghouse STS B 3.5.1-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.1.5

Verification that power is removed from each accumulator isolation valve 

operator when the RCS pressure is ≥ [2000] psig ensures that an active 

failure could not result in the undetected closure of an accumulator motor 

operated isolation valve. If this were to occur, only two accumulators 

would be available for injection given a single failure coincident with a 

LOCA. [ Since power is removed under administrative control, the 31 day 

Frequency will provide adequate assurance that power is removed.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR allows power to be supplied to the motor operated isolation 

valves when RCS pressure is < 2000 psig, thus allowing operational 

flexibility by avoiding unnecessary delays to manipulate the breakers 

during plant startups or shutdowns.

REFERENCES 1. FSAR, Chapter [6].

2. 10 CFR 50.46.

3. FSAR, Chapter [15].

4. WCAP-15049-A, Rev. 1, April 1999.

5. NUREG-1366, February 1990.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-1 Rev. 4.0

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 ECCS - Operating

BASES

BACKGROUND The function of the ECCS is to provide core cooling and negative 

reactivity to ensure that the reactor core is protected after any of the 

following accidents:

a. Loss of coolant accident (LOCA), coolant leakage greater than the 

capability of the normal charging system,

b. Rod ejection accident,

c. Loss of secondary coolant accident, including uncontrolled steam 

release or loss of feedwater, and

d. Steam generator tube rupture (SGTR).

The addition of negative reactivity is designed primarily for the loss of 

secondary coolant accident where primary cooldown could add enough 

positive reactivity to achieve criticality and return to significant power.

There are three phases of ECCS operation: injection, cold leg 

recirculation, and hot leg recirculation. In the injection phase, water is 

taken from the refueling water storage tank (RWST) and injected into the 

Reactor Coolant System (RCS) through the cold legs. When sufficient 

water is removed from the RWST to ensure that enough boron has been 

added to maintain the reactor subcritical and the containment sumps 

have enough water to supply the required net positive suction head to the 

ECCS pumps, suction is switched to the containment sump for cold leg 

recirculation. After approximately 24 hours, the ECCS flow is shifted to 

the hot leg recirculation phase to provide a backflush, which would reduce 

the boiling in the top of the core and any resulting boron precipitation.

The ECCS consists of three separate subsystems: centrifugal charging 

(high head), safety injection (SI) (intermediate head), and residual heat 

removal (RHR) (low head). Each subsystem consists of two redundant, 

100% capacity trains. The ECCS accumulators and the RWST are also 

part of the ECCS, but are not considered part of an ECCS flow path as 

described by this LCO.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-2 Rev. 4.0

BASES

BACKGROUND (continued)

The ECCS flow paths consist of piping, valves, heat exchangers, and 

pumps such that water from the RWST can be injected into the RCS 

following the accidents described in this LCO. The major components of 

each subsystem are the centrifugal charging pumps, the RHR pumps, 

heat exchangers, and the SI pumps. Each of the three subsystems 

consists of two 100% capacity trains that are interconnected and 

redundant such that either train is capable of supplying 100% of the flow 

required to mitigate the accident consequences. This interconnecting and 

redundant subsystem design provides the operators with the ability to 

utilize components from opposite trains to achieve the required 100% flow 

to the core.

During the injection phase of LOCA recovery, a suction header supplies 

water from the RWST to the ECCS pumps. Separate piping supplies 

each subsystem and each train within the subsystem. The discharge 

from the centrifugal charging pumps combines prior to entering the boron 

injection tank (BIT) (if the plant utilizes a BIT) and then divides again into 

four supply lines, each of which feeds the injection line to one RCS cold 

leg. The discharge from the SI and RHR pumps divides and feeds an 

injection line to each of the RCS cold legs. Control valves are set to 

balance the flow to the RCS. This balance ensures sufficient flow to the 

core to meet the analysis assumptions following a LOCA in one of the 

RCS cold legs.

For LOCAs that are too small to depressurize the RCS below the shutoff 

head of the SI pumps, the centrifugal charging pumps supply water until 

the RCS pressure decreases below the SI pump shutoff head. During 

this period, the steam generators are used to provide part of the core 

cooling function.

During the recirculation phase of LOCA recovery, RHR pump suction is 

transferred to the containment sump. The RHR pumps then supply the 

other ECCS pumps. Initially, recirculation is through the same paths as 

the injection phase. Subsequently, recirculation alternates injection 

between the hot and cold legs.

The centrifugal charging subsystem of the ECCS also functions to supply 

borated water to the reactor core following increased heat removal 

events, such as a main steam line break (MSLB). The limiting design 

conditions occur when the negative moderator temperature coefficient is 

highly negative, such as at the end of each cycle.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-3 Rev. 4.0

BASES

BACKGROUND (continued)

During low temperature conditions in the RCS, limitations are placed on 

the maximum number of ECCS pumps that may be OPERABLE. Refer to 

the Bases for LCO 3.4.12, "Low Temperature Overpressure Protection 

(LTOP) System," for the basis of these requirements.

The ECCS subsystems are actuated upon receipt of an SI signal. The 

actuation of safeguard loads is accomplished in a programmed time 

sequence. If offsite power is available, the safeguard loads start 

immediately in the programmed sequence. If offsite power is not 

available, the Engineered Safety Feature (ESF) buses shed normal 

operating loads and are connected to the emergency diesel generators 

(EDGs). Safeguard loads are then actuated in the programmed time 

sequence. The time delay associated with diesel starting, sequenced 

loading, and pump starting determines the time required before pumped 

flow is available to the core following a LOCA.

The active ECCS components, along with the passive accumulators and 

the RWST covered in LCO 3.5.1, "Accumulators," and LCO 3.5.4, 

"Refueling Water Storage Tank (RWST)," provide the cooling water 

necessary to meet GDC 35 (Ref. 1).

APPLICABLE The LCO helps to ensure that the following acceptance criteria for the

SAFETY ECCS, established by 10 CFR 50.46 (Ref. 2), will be met following a

ANALYSES LOCA:

a. Maximum fuel element cladding temperature is ≤ 2200°F,

b. Maximum cladding oxidation is ≤ 0.17 times the total cladding 

thickness before oxidation,

c. Maximum hydrogen generation from a zirconium water reaction is 

≤ 0.01 times the hypothetical amount generated if all of the metal in 

the cladding cylinders surrounding the fuel, excluding the cladding 

surrounding the plenum volume, were to react,

d. Core is maintained in a coolable geometry, and

e. Adequate long term core cooling capability is maintained.

The LCO also limits the potential for a post trip return to power following 

an MSLB event and ensures that containment temperature limits are met.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

Each ECCS subsystem is taken credit for in a large break LOCA event at 

full power (Refs. 3 and 4). This event establishes the requirement for 

runout flow for the ECCS pumps, as well as the maximum response time 

for their actuation. The centrifugal charging pumps and SI pumps are 

credited in a small break LOCA event. This event establishes the flow 

and discharge head at the design point for the centrifugal charging 

pumps. The SGTR and MSLB events also credit the centrifugal charging 

pumps. The OPERABILITY requirements for the ECCS are based on the 

following LOCA analysis assumptions:

a. A large break LOCA event, with loss of offsite power and a single 

failure disabling one RHR pump (both EDG trains are assumed to 

operate due to requirements for modeling full active containment heat 

removal system operation) and

b. A small break LOCA event, with a loss of offsite power and a single 

failure disabling one ECCS train.

During the blowdown stage of a LOCA, the RCS depressurizes as 

primary coolant is ejected through the break into the containment. The 

nuclear reaction is terminated either by moderator voiding during large 

breaks or control rod insertion for small breaks. Following 

depressurization, emergency cooling water is injected into the cold legs, 

flows into the downcomer, fills the lower plenum, and refloods the core.

The effects on containment mass and energy releases are accounted for 

in appropriate analyses (Refs. 3 and 4). The LCO ensures that an ECCS 

train will deliver sufficient water to match boiloff rates soon enough to 

minimize the consequences of the core being uncovered following a large 

LOCA. It also ensures that the centrifugal charging and SI pumps will 

deliver sufficient water and boron during a small LOCA to maintain core 

subcriticality. For smaller LOCAs, the centrifugal charging pump delivers 

sufficient fluid to maintain RCS inventory. For a small break LOCA, the 

steam generators continue to serve as the heat sink, providing part of the 

required core cooling.

The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are 

required to ensure that sufficient ECCS flow is available, assuming a 

single failure affecting either train. Additionally, individual components 

within the ECCS trains may be called upon to mitigate the consequences 

of other transients and accidents.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-5 Rev. 4.0

BASES

LCO (continued)

In MODES 1, 2, and 3, an ECCS train consists of a centrifugal charging 

subsystem, an SI subsystem, and an RHR subsystem. Each train 

includes the piping, instruments, and controls to ensure an OPERABLE 

flow path capable of taking suction from the RWST upon an SI signal and 

automatically transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to 

provide an abundant supply of water from the RWST to the RCS via the 

ECCS pumps and their respective supply headers to each of the four cold 

leg injection nozzles. In the long term, this flow path may be switched to 

take its supply from the containment sump and to supply its flow to the 

RCS hot and cold legs.

The flow path for each train must maintain its designed independence to 

ensure that no single failure can disable both ECCS trains.

As indicated in Note 1, the SI flow paths may be isolated for 2 hours in 

MODE 3, under controlled conditions, to perform pressure isolation valve 

testing per SR 3.4.14.1. The flow path is readily restorable from the 

control room.

As indicated in Note 2, operation in MODE 3 with ECCS trains made 

incapable of injecting in order to facilitate entry into or exit from the 

Applicability of LCO 3.4.12, "Low Temperature Overpressure Protection 

(LTOP) System," is necessary for plants with an LTOP arming 

temperature at or near the MODE 3 boundary temperature of 350°F. 

LCO 3.4.12 requires that certain pumps be rendered incapable of 

injecting at and below the LTOP arming temperature. When this 

temperature is at or near the MODE 3 boundary temperature, time is 

needed to make pumps incapable of injecting prior to entering the LTOP 

Applicability, and provide time to restore the inoperable pumps to 

OPERABLE status on exiting the LTOP Applicability.

APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the 

limiting Design Basis Accident, a large break LOCA, are based on full 

power operation. Although reduced power would not require the same 

level of performance, the accident analysis does not provide for reduced 

cooling requirements in the lower MODES. The centrifugal charging 

pump performance is based on a small break LOCA, which establishes 

the pump performance curve and has less dependence on power. The SI 

pump performance requirements are based on a small break LOCA. 

MODE 2 and MODE 3 requirements are bounded by the MODE 1 

analysis.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-6 Rev. 4.0

BASES

APPLICABILITY (continued)

This LCO is only applicable in MODE 3 and above. Below MODE 3, the 

SI signal setpoint is manually bypassed by operator control, and system 

functional requirements are relaxed as described in LCO 3.5.3, "ECCS -

Shutdown."

In MODES 5 and 6, plant conditions are such that the probability of an 

event requiring ECCS injection is extremely low. Core cooling 

requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -

MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops 

Not Filled." MODE 6 core cooling requirements are addressed by 

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High 

Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and 

Coolant Circulation - Low Water Level."

ACTIONS A.1

With one or more trains inoperable and at least 100% of the ECCS flow 

equivalent to a single OPERABLE ECCS train available, the inoperable 

components must be returned to OPERABLE status within 72 hours. The 

72 hour Completion Time is based on an NRC reliability evaluation 

(Ref. 5) and is a reasonable time for repair of many ECCS components.

An ECCS train is inoperable if it is not capable of delivering design flow to 

the RCS. Individual components are inoperable if they are not capable of 

performing their design function or supporting systems are not available.

The LCO requires the OPERABILITY of a number of independent 

subsystems. Due to the redundancy of trains and the diversity of 

subsystems, the inoperability of one component in a train does not render 

the ECCS incapable of performing its function. Neither does the 

inoperability of two different components, each in a different train, 

necessarily result in a loss of function for the ECCS. This allows 

increased flexibility in plant operations under circumstances when 

components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of an 

EDG can disable one ECCS train until power is restored. A reliability 

analysis (Ref. 5) has shown that the impact of having one full ECCS train 

inoperable is sufficiently small to justify continued operation for 72 hours.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-7 Rev. 4.0

BASES

ACTIONS (continued)

Reference 6 describes situations in which one component, such as an 

RHR crossover valve, can disable both ECCS trains. With one or more 

component(s) inoperable such that 100% of the flow equivalent to a 

single OPERABLE ECCS train is not available, the facility is in a condition 

outside the accident analysis. Therefore, LCO 3.0.3 must be immediately 

entered.

B.1 and B.2

If the inoperable trains cannot be returned to OPERABLE status within 

the associated Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to MODE 3 within 6 hours and MODE 4 within 12 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems.

C.1

Condition A is applicable with one or more trains inoperable. The allowed 

Completion Time is based on the assumption that at least 100% of the 

ECCS flow equivalent to a single OPERABLE ECCS train is available. 

With less than 100% of the ECCS flow equivalent to a single OPERABLE 

ECCS train available, the facility is in a condition outside of the accident 

analyses. Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.5.2.1

REQUIREMENTS

Verification of proper valve position ensures that the flow path from the 

ECCS pumps to the RCS is maintained. Misalignment of these valves 

could render both ECCS trains inoperable. Securing these valves in 

position by removal of power or by key locking the control in the correct 

position ensures that they cannot change position as a result of an active 

failure or be inadvertently misaligned. These valves are of the type, 

described in Reference 6, that can disable the function of both ECCS 

trains and invalidate the accident analyses. [ A 12 hour Frequency is 

considered reasonable in view of other administrative controls that will 

ensure a mispositioned valve is unlikely.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.5.2.2

Verifying the correct alignment for manual, power operated, and 

automatic valves in the ECCS flow paths provides assurance that the 

proper flow paths will exist for ECCS operation. This SR does not apply 

to valves that are locked, sealed, or otherwise secured in position, since 

these were verified to be in the correct position prior to locking, sealing, or 

securing. A valve that receives an actuation signal is allowed to be in a 

nonaccident position provided the valve will automatically reposition 

within the proper stroke time. This Surveillance does not require any 

testing or valve manipulation. Rather, it involves verification that those 

valves capable of being mispositioned are in the correct position. [ The 

31 day Frequency is appropriate because the valves are operated under 

administrative control, and an improper valve position would only affect a 

single train. This Frequency has been shown to be acceptable through 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.2.3

With the exception of the operating centrifugal charging pump, the ECCS 

pumps are normally in a standby, nonoperating mode. As such, flow path 

piping has the potential to develop voids and pockets of entrained gases. 

Maintaining the piping from the ECCS pumps to the RCS full of water 

ensures that the system will perform properly, injecting its full capacity 

into the RCS upon demand. This will also prevent water hammer, pump 

cavitation, and pumping of noncondensible gas (e.g., air, nitrogen, or 

hydrogen) into the reactor vessel following an SI signal or during 

shutdown cooling. [ The 31 day Frequency takes into consideration the 

gradual nature of gas accumulation in the ECCS piping and the 

procedural controls governing system operation.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.5.2.4

Periodic surveillance testing of ECCS pumps to detect gross degradation 

caused by impeller structural damage or other hydraulic component 

problems is required by the ASME Code. This type of testing may be 

accomplished by measuring the pump developed head at only one point 

of the pump characteristic curve. This verifies both that the measured 

performance is within an acceptable tolerance of the original pump 

baseline performance and that the performance at the test flow is greater 

than or equal to the performance assumed in the plant safety analysis. 

SRs are specified in the Inservice Testing Program of the ASME Code. 

The ASME Code provides the activities and Frequencies necessary to 

satisfy the requirements.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.2.5 and SR 3.5.2.6

These Surveillances demonstrate that each automatic ECCS valve 

actuates to the required position on an actual or simulated SI signal and 

that each ECCS pump starts on receipt of an actual or simulated SI 

signal. This Surveillance is not required for valves that are locked, 

sealed, or otherwise secured in the required position under administrative 

controls. [ The 18 month Frequency is based on the need to perform 

these Surveillances under the conditions that apply during a plant outage 

and the potential for unplanned plant transients if the Surveillances were 

performed with the reactor at power. The 18 month Frequency is also 

acceptable based on consideration of the design reliability (and 

confirming operating experience) of the equipment. The actuation logic is 

tested as part of ESF Actuation System testing, and equipment 

performance is monitored as part of the Inservice Testing Program.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.5.2.7

Realignment of valves in the flow path on an SI signal is necessary for 

proper ECCS performance. These valves have stops to allow proper 

positioning for restricted flow to a ruptured cold leg, ensuring that the 

other cold legs receive at least the required minimum flow. This 

Surveillance is not required for plants with flow limiting orifices. [ The 

18 month Frequency is based on the same reasons as those stated in 

SR 3.5.2.5 and SR 3.5.2.6.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
ECCS - Operating

B 3.5.2

Westinghouse STS B 3.5.2-11 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.5.2.8

Periodic inspections of the containment sump suction inlet ensure that it 

is unrestricted and stays in proper operating condition. [ The 18 month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a plant outage, on the need to have access to 

the location, and because of the potential for an unplanned transient if the 

Surveillance were performed with the reactor at power. This Frequency 

has been found to be sufficient to detect abnormal degradation and is 

confirmed by operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 35.

2. 10 CFR 50.46.

3. FSAR, Section [ ].

4. FSAR, Chapter [15], "Accident Analysis."

5. NRC Memorandum to V. Stello, Jr., from R.L. Baer, "Recommended 

Interim Revisions to LCOs for ECCS Components," 

December 1, 1975.

6. IE Information Notice No. 87-01.

ECCS - Shutdown

B 3.5.3

Westinghouse STS B 3.5.3-1 Rev. 4.0

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 ECCS - Shutdown

BASES

BACKGROUND The Background section for Bases 3.5.2, "ECCS - Operating," is 

applicable to these Bases, with the following modifications.

In MODE 4, the required ECCS train consists of two separate 

subsystems: centrifugal charging (high head) and residual heat removal 

(RHR) (low head).

The ECCS flow paths consist of piping, valves, heat exchangers, and 

pumps such that water from the refueling water storage tank (RWST) can 

be injected into the Reactor Coolant System (RCS) following the 

accidents described in Bases 3.5.2.

APPLICABLE The Applicable Safety Analyses section of Bases 3.5.2 also applies to this

SAFETY Bases section.

ANALYSES

Due to the stable conditions associated with operation in MODE 4 and the 

reduced probability of occurrence of a Design Basis Accident (DBA), the 

ECCS operational requirements are reduced. It is understood in these 

reductions that certain automatic safety injection (SI) actuation is not 

available. In this MODE, sufficient time exists for manual actuation of the 

required ECCS to mitigate the consequences of a DBA.

Only one train of ECCS is required for MODE 4. This requirement 

dictates that single failures are not considered during this MODE of 

operation. The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO In MODE 4, one of the two independent (and redundant) ECCS trains is 

required to be OPERABLE to ensure that sufficient ECCS flow is 

available to the core following a DBA.

In MODE 4, an ECCS train consists of a centrifugal charging subsystem 

and an RHR subsystem. Each train includes the piping, instruments, and 

controls to ensure an OPERABLE flow path capable of taking suction 

from the RWST and transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to 

provide an abundant supply of water from the RWST to the RCS via the 

ECCS pumps and their respective supply headers to each of the four cold 

leg injection nozzles. In the long term, this flow path may be switched to 

take its supply from the containment sump and to deliver its flow to the 

RCS hot and cold legs.
ECCS - Shutdown

B 3.5.3

Westinghouse STS B 3.5.3-2 Rev. 4.0

BASES

LCO (continued)

This LCO is modified by a Note that allows an RHR train to be considered 

OPERABLE during alignment and operation for decay heat removal, if 

capable of being manually realigned (remote or local) to the ECCS mode 

of operation and not otherwise inoperable. This allows operation in the 

RHR mode during MODE 4.

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are 

covered by LCO 3.5.2.

In MODE 4 with RCS temperature below 350°F, one OPERABLE ECCS 

train is acceptable without single failure consideration, on the basis of the 

stable reactivity of the reactor and the limited core cooling requirements.

In MODES 5 and 6, plant conditions are such that the probability of an 

event requiring ECCS injection is extremely low. Core cooling 

requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -

MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops 

Not Filled." MODE 6 core cooling requirements are addressed by 

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High 

Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and 

Coolant Circulation - Low Water Level."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable ECCS 

high head subsystem when entering MODE 4. There is an increased risk 

associated with entering MODE 4 from MODE 5 with an inoperable ECCS 

high head subsystem and the provisions of LCO 3.0.4.b, which allow 

entry into a MODE or other specified condition in the Applicability with the 

LCO not met after performance of a risk assessment addressing 

inoperable systems and components, should not be applied in this 

circumstance.

A.1

With no ECCS RHR subsystem OPERABLE, the plant is not prepared to 

respond to a loss of coolant accident or to continue a cooldown using the 

RHR pumps and heat exchangers. The Completion Time of immediately 

to initiate actions that would restore at least one ECCS RHR subsystem 

to OPERABLE status ensures that prompt action is taken to restore the 

required cooling capacity. Normally, in MODE 4, reactor decay heat is 

removed from the RCS by an RHR loop. If no RHR loop is OPERABLE 

for this function, reactor decay heat must be removed by some alternate 

method, such as use of the steam generators. The alternate means of 

heat removal must continue until the inoperable RHR loop components 

can be restored to operation so that decay heat removal is continuous.
ECCS - Shutdown

B 3.5.3

Westinghouse STS B 3.5.3-3 Rev. 4.0

BASES

ACTIONS (continued)

With both RHR pumps and heat exchangers inoperable, it would be 

unwise to require the plant to go to MODE 5, where the only available 

heat removal system is the RHR. Therefore, the appropriate action is to 

initiate measures to restore one ECCS RHR subsystem and to continue 

the actions until the subsystem is restored to OPERABLE status.

B.1

With no ECCS high head subsystem OPERABLE, due to the inoperability 

of the centrifugal charging pump or flow path from the RWST, the plant is 

not prepared to provide high pressure response to Design Basis Events 

requiring SI. The 1 hour Completion Time to restore at least one ECCS 

high head subsystem to OPERABLE status ensures that prompt action is 

taken to provide the required cooling capacity or to initiate actions to 

place the plant in MODE 5, where an ECCS train is not required.

C.1

When the Required Actions of Condition B cannot be completed within 

the required Completion Time, a controlled shutdown should be initiated. 

Twenty-four hours is a reasonable time, based on operating experience, 

to reach MODE 5 in an orderly manner and without challenging plant 

systems or operators.

SURVEILLANCE SR 3.5.3.1

REQUIREMENTS

The applicable Surveillance descriptions from Bases 3.5.2 apply.

REFERENCES The applicable references from Bases 3.5.2 apply.

RWST

B 3.5.4

Westinghouse STS B 3.5.4-1 Rev. 4.0

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.4 Refueling Water Storage Tank (RWST)

BASES

BACKGROUND The RWST supplies borated water to the Chemical and Volume Control 

System (CVCS) during abnormal operating conditions, to the refueling 

pool during refueling, and to the ECCS and the Containment Spray 

System during accident conditions.

The RWST supplies both trains of the ECCS and the Containment Spray 

System through separate, redundant supply headers during the injection 

phase of a loss of coolant accident (LOCA) recovery. A motor operated 

isolation valve is provided in each header to isolate the RWST from the 

ECCS once the system has been transferred to the recirculation mode. 

The recirculation mode is entered when pump suction is transferred to the 

containment sump following receipt of the RWST - Low Low (Level 1) 

signal. Use of a single RWST to supply both trains of the ECCS and 

Containment Spray System is acceptable since the RWST is a passive 

component, and passive failures are not required to be assumed to occur 

coincidentally with Design Basis Events.

The switchover from normal operation to the injection phase of ECCS 

operation requires changing centrifugal charging pump suction from the 

CVCS volume control tank (VCT) to the RWST through the use of 

isolation valves. Each set of isolation valves is interlocked so that the 

VCT isolation valves will begin to close once the RWST isolation valves 

are fully open. Since the VCT is under pressure, the preferred pump 

suction will be from the VCT until the tank is isolated. This will result in a 

delay in obtaining the RWST borated water. The effects of this delay are 

discussed in the Applicable Safety Analyses section of these Bases.

During normal operation in MODES 1, 2, and 3, the safety injection (SI) 

and residual heat removal (RHR) pumps are aligned to take suction from 

the RWST.

The ECCS and Containment Spray System pumps are provided with 

recirculation lines that ensure each pump can maintain minimum flow 

requirements when operating at or near shutoff head conditions.

When the suction for the ECCS and Containment Spray System pumps is 

transferred to the containment sump, the RWST flow paths must be 

isolated to prevent a release of the containment sump contents to the 

RWST, which could result in a release of contaminants to the atmosphere 

and the eventual loss of suction head for the ECCS pumps.
RWST

B 3.5.4

Westinghouse STS B 3.5.4-2 Rev. 4.0

BASES

BACKGROUND (continued)

This LCO ensures that:

a. The RWST contains sufficient borated water to support the ECCS 

during the injection phase,

b. Sufficient water volume exists in the containment sump to support 

continued operation of the ECCS and Containment Spray System 

pumps at the time of transfer to the recirculation mode of cooling, and

c. The reactor remains subcritical following a LOCA.

Insufficient water in the RWST could result in insufficient cooling capacity 

when the transfer to the recirculation mode occurs. Improper boron 

concentrations could result in a reduction of SDM or excessive boric acid 

precipitation in the core following the LOCA, as well as excessive caustic 

stress corrosion of mechanical components and systems inside the 

containment.

APPLICABLE During accident conditions, the RWST provides a source of borated water

SAFETY to the ECCS and Containment Spray System pumps. As such, it

ANALYSES provides containment cooling and depressurization, core cooling, and 

replacement inventory and is a source of negative reactivity for reactor 

shutdown (Ref. 1). The design basis transients and applicable safety 

analyses concerning each of these systems are discussed in the 

Applicable Safety Analyses section of B 3.5.2, "ECCS - Operating," 

B 3.5.3, "ECCS - Shutdown," and B 3.6.6, "Containment Spray and 

Cooling Systems." These analyses are used to assess changes to the 

RWST in order to evaluate their effects in relation to the acceptance limits 

in the analyses.

The RWST must also meet volume, boron concentration, and 

temperature requirements for non-LOCA events. The volume is not an 

explicit assumption in non-LOCA events since the required volume is a 

small fraction of the available volume. The deliverable volume limit is set 

by the LOCA and containment analyses. For the RWST, the deliverable 

volume is different from the total volume contained since, due to the 

design of the tank, more water can be contained than can be delivered. 

The minimum boron concentration is an explicit assumption in the main 

steam line break (MSLB) analysis to ensure the required shutdown 

capability. The importance of its value is small for units with a boron 

injection tank (BIT) with a high boron concentration. For units with no BIT 

or reduced BIT boron requirements, the minimum boron concentration 

limit is an important assumption in ensuring the required shutdown 
RWST

B 3.5.4

Westinghouse STS B 3.5.4-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

capability. The maximum boron concentration is an explicit assumption in 

the inadvertent ECCS actuation analysis, although it is typically a 

nonlimiting event and the results are very insensitive to boron 

concentrations. The maximum temperature ensures that the amount of 

cooling provided from the RWST during the heatup phase of a feedline 

break is consistent with safety analysis assumptions; the minimum is an 

assumption in both the MSLB and inadvertent ECCS actuation analyses, 

although the inadvertent ECCS actuation event is typically nonlimiting.

The MSLB analysis has considered a delay associated with the interlock 

between the VCT and RWST isolation valves, and the results show that 

the departure from nucleate boiling design basis is met. The delay has 

been established as [27] seconds, with offsite power available, or 

[37] seconds without offsite power. This response time includes 

[2] seconds for electronics delay, a [15] second stroke time for the RWST 

valves, and a [10] second stroke time for the VCT valves. Plants with a 

BIT need not be concerned with the delay since the BIT will supply highly 

borated water prior to RWST switchover, provided the BIT is between the 

pumps and the core.

For a large break LOCA analysis, the minimum water volume limit of 

[466,200] gallons and the lower boron concentration limit of [2000] ppm 

are used to compute the post LOCA sump boron concentration necessary 

to assure subcriticality. The large break LOCA is the limiting case since 

the safety analysis assumes that all control rods are out of the core.

The upper limit on boron concentration of [2200] ppm is used to 

determine the maximum allowable time to switch to hot leg recirculation 

following a LOCA. The purpose of switching from cold leg to hot leg 

injection is to avoid boron precipitation in the core following the accident.

In the ECCS analysis, the containment spray temperature is assumed to 

be equal to the RWST lower temperature limit of [35]°F. If the lower 

temperature limit is violated, the containment spray further reduces 

containment pressure, which decreases the rate at which steam can be 

vented out the break and increases peak clad temperature. The upper 

temperature limit of [100]°F is used in the small break LOCA analysis and 

containment OPERABILITY analysis. Exceeding this temperature will 

result in a higher peak clad temperature, because there is less heat 

transfer from the core to the injected water for the small break LOCA and 

higher containment pressures due to reduced containment spray cooling 

capacity. For the containment response following an MSLB, the lower 
RWST

B 3.5.4

Westinghouse STS B 3.5.4-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

limit on boron concentration and the upper limit on RWST water 

temperature are used to maximize the total energy release to 

containment.

The RWST satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The RWST ensures that an adequate supply of borated water is available 

to cool and depressurize the containment in the event of a Design Basis 

Accident (DBA), to cool and cover the core in the event of a LOCA, to 

maintain the reactor subcritical following a DBA, and to ensure adequate 

level in the containment sump to support ECCS and Containment Spray 

System pump operation in the recirculation mode.

To be considered OPERABLE, the RWST must meet the water volume, 

boron concentration, and temperature limits established in the SRs.

APPLICABILITY In MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are 

dictated by ECCS and Containment Spray System OPERABILITY 

requirements. Since both the ECCS and the Containment Spray System 

must be OPERABLE in MODES 1, 2, 3, and 4, the RWST must also be 

OPERABLE to support their operation. Core cooling requirements in 

MODE 5 are addressed by LCO 3.4.7, "RCS Loops - MODE 5, Loops 

Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled." 

MODE 6 core cooling requirements are addressed by LCO 3.9.5, 

"Residual Heat Removal (RHR) and Coolant Circulation - High Water 

Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant 

Circulation - Low Water Level."

ACTIONS A.1

With RWST boron concentration or borated water temperature not within 

limits, they must be returned to within limits within 8 hours. Under these 

conditions neither the ECCS nor the Containment Spray System can 

perform its design function. Therefore, prompt action must be taken to 

restore the tank to OPERABLE condition. The 8 hour limit to restore the 

RWST temperature or boron concentration to within limits was developed 

considering the time required to change either the boron concentration or 

temperature and the fact that the contents of the tank are still available for 

injection.

B.1

With the RWST inoperable for reasons other than Condition A (e.g., water 

volume), it must be restored to OPERABLE status within 1 hour.
RWST

B 3.5.4

Westinghouse STS B 3.5.4-5 Rev. 4.0

BASES

ACTIONS (continued)

In this Condition, neither the ECCS nor the Containment Spray System 

can perform its design function. Therefore, prompt action must be taken 

to restore the tank to OPERABLE status or to place the plant in a MODE 

in which the RWST is not required. The short time limit of 1 hour to 

restore the RWST to OPERABLE status is based on this condition 

simultaneously affecting redundant trains.

C.1 and C.2

If the RWST cannot be returned to OPERABLE status within the 

associated Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.5.4.1

REQUIREMENTS

The RWST borated water temperature should be verified to be within the 

limits assumed in the accident analyses band. [ The Frequency of 

24 hours is sufficient to identify a temperature change that would 

approach either limit and has been shown to be acceptable through 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note that eliminates the requirement to perform 

this Surveillance when ambient air temperatures are within the operating 

limits of the RWST. With ambient air temperatures within the band, the 

RWST temperature should not exceed the limits.
RWST

B 3.5.4

Westinghouse STS B 3.5.4-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.4.2

The RWST water volume should be verified to be above the required 

minimum level in order to ensure that a sufficient initial supply is available 

for injection and to support continued ECCS and Containment Spray 

System pump operation on recirculation. [ Since the RWST volume is 

normally stable and is protected by an alarm, a 7 day Frequency is 

appropriate and has been shown to be acceptable through operating 

experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.5.4.3

The boron concentration of the RWST should be verified to be within the 

required limits. This SR ensures that the reactor will remain subcritical 

following a LOCA. Further, it assures that the resulting sump pH will be 

maintained in an acceptable range so that boron precipitation in the core 

will not occur and the effect of chloride and caustic stress corrosion on 

mechanical systems and components will be minimized. [ Since the 

RWST volume is normally stable, a 7 day sampling Frequency to verify 

boron concentration is appropriate and has been shown to be acceptable 

through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
RWST

B 3.5.4

Westinghouse STS B 3.5.4-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [6] and Chapter [15].

Seal Injection Flow

B 3.5.5

Westinghouse STS B 3.5.5-1 Rev. 4.0

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.5 Seal Injection Flow

BASES

BACKGROUND This LCO is applicable only to those units that utilize the centrifugal 

charging pumps for safety injection (SI). The function of the seal injection 

throttle valves during an accident is similar to the function of the ECCS 

throttle valves in that each restricts flow from the centrifugal charging 

pump header to the Reactor Coolant System (RCS).

The restriction on reactor coolant pump (RCP) seal injection flow limits 

the amount of ECCS flow that would be diverted from the injection path 

following an accident. This limit is based on safety analysis assumptions 

that are required because RCP seal injection flow is not isolated during 

SI.

The RCP seal injection flow is restricted by the seal injection line flow 

[resistance] which is adjusted through positioning of the manual RCP seal 

injection throttle valves. The RCP seal injection flow [resistance] is 

determined by measuring the pressurizer pressure, the centrifugal 

charging pump discharge header pressure, and the RCP seal injection 

flow rate.

The charging flow control valve throttles the centrifugal charging pump 

discharge header flow as necessary to maintain the programmed level in 

the pressurizer. The charging flow control valve fails open to ensure that, 

in the event of either loss of air or loss of control signal to the valve, when 

the centrifugal charging pumps are supplying charging flow, seal injection 

flow to the RCP seals is maintained. Positioning of the charging flow 

control valve may vary during normal plant operating conditions, resulting 

in a proportional change to RCP seal injection flow. The flow [resistance] 

provided by RCP seal injection throttle valves will remain fixed when the 

charging flow control valve is repositioned provided the throttle valve(s) 

position are not adjusted. 

APPLICABLE All ECCS subsystems are taken credit for in the large break loss of

SAFETY coolant accident (LOCA) at full power (Ref. 1). The LOCA analysis

ANALYSES establishes the minimum flow for the ECCS pumps. The centrifugal 

charging pumps are also credited in the small break LOCA analysis. This 

analysis establishes the flow and discharge head at the design point for 

the centrifugal charging pumps. The steam generator tube rupture and 

main steam line break event analyses also credit the centrifugal charging 

pumps, but are not limiting in their design. Reference to these analyses 

is made in assessing changes to the Seal Injection System for evaluation 

of their effects in relation to the acceptance limits in these analyses.
Seal Injection Flow

B 3.5.5

Westinghouse STS B 3.5.5-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

This LCO ensures that seal injection flow [resistance] will be sufficient for 

RCP seal integrity but limited so that the ECCS trains will be capable of 

delivering sufficient water to match boiloff rates soon enough to minimize 

uncovering of the core following a large LOCA. It also ensures that the 

centrifugal charging pumps will deliver sufficient water for a small LOCA 

and sufficient boron to maintain the core subcritical. For smaller LOCAs, 

the charging pumps alone deliver sufficient fluid to overcome the loss and 

maintain RCS inventory. Seal injection flow satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO The intent of the LCO limit on seal injection flow is to make sure that flow 

through the RCP seal water injection line is low enough to ensure that 

sufficient centrifugal charging pump injection flow is directed to the RCS 

via the injection points (Ref. 2).

[ The LCO is not strictly a flow limit, but rather a flow limit based on a flow 

line resistance. In order to establish the proper flow line resistance, a 

pressure and flow must be known. The flow line resistance is determined 

by assuming that the RCS pressure is at normal operating pressure and 

that the centrifugal charging pump discharge pressure is greater than or 

equal to the value specified in this LCO. The centrifugal charging pump 

discharge header pressure remains essentially constant through all the 

applicable MODES of this LCO. A reduction in RCS pressure would 

result in more flow being diverted to the RCP seal injection line than at 

normal operating pressure. The valve settings established at the 

prescribed centrifugal charging pump discharge header pressure result in 

a conservative valve position should RCS pressure decrease. The 

additional modifier of this LCO, the control valve (charging flow for four 

loop units and air operated seal injection for three loop units) being full 

open, is required since the valve is designed to fail open for the accident 

condition. With the discharge pressure and control valve position as 

specified by the LCO, a flow limit is established. It is this flow limit that is 

used in the accident analyses. 

OR

This is accomplished by limiting the seal injection line resistance to a 

value consistent with the assumptions in the accident analysis. The limit 

on RCP seal injection flow resistance must be met to assure that the 

ECCS is OPERABLE. If this limit is not met, the ECCS flow may not be 

as assumed in the accident analysis. The restriction on seal injection flow 

is accomplished by maintaining the seal water injection flow resistance 

≥ [0.2117] ft/gpm2. With the seal injection flow resistances within limit, the 

resulting total seal injection flow will be within the assumptions made for 

seal flow during accident conditions.
Seal Injection Flow

B 3.5.5

Westinghouse STS B 3.5.5-3 Rev. 4.0

BASES

LCO (continued)

In order to establish the proper flow line resistance, the centrifugal 

charging pump discharge header pressure, the RCP seal injection flow 

rate, and the pressurizer pressure are measured. The line resistance is 

then determined from those inputs. A reduction in RCP pressure with no 

concurrent decrease in centrifugal charging pump discharge header 

pressure would increase the differential pressure across the manual 

throttle valves, and result in more flow being discharged through the RCP 

seal injection line. The flow resistance limit assures that when RCS 

pressure drops during a LOCA and seal injection flow increases in 

response to the higher differential pressure, the resulting flow will be 

consistent with the accident analysis.

OR

The LCO is not strictly a flow limit, but rather a flow limit based on a flow 

line resistance. In order to establish the proper flow line resistance, a 

pressure and flow must be known. The flow line resistance is established 

by adjusting the RCP seal injection flow in the acceptable region of 

Figure 3.5.5-1 at a given pressure differential between the charging 

header and the RCS. The centrifugal charging pump discharge header 

pressure remains essentially constant through all the applicable MODES 

of this LCO. A reduction in RCS pressure would result in more flow being 

diverted to the RCP seal injection line than at normal operating pressure. 

The valve settings established at the prescribed centrifugal charging 

pump discharge header pressure result in a conservative valve position 

should RCS pressure decrease. The flow limits established by 

Figure 3.5.5-1 ensures that the minimum ECCS flow assumed in the 

safety analyses is maintained.]

The limit on seal injection flow [resistance] must be met to render the 

ECCS OPERABLE. If these conditions are not met, the ECCS flow will 

not be as assumed in the accident analyses.

APPLICABILITY In MODES 1, 2, and 3, the seal injection flow [resistance] limit is dictated 

by ECCS flow requirements, which are specified for MODES 1, 2, 3, 

and 4. The seal injection flow [resistance] limit is not applicable for 

MODE 4 and lower, however, because high seal injection flow is less 

critical as a result of the lower initial RCS pressure and decay heat 

removal requirements in these MODES. Therefore, RCP seal injection 

flow [resistance] must be limited in MODES 1, 2, and 3 to ensure 

adequate ECCS performance.
Seal Injection Flow

B 3.5.5

Westinghouse STS B 3.5.5-4 Rev. 4.0

BASES

ACTIONS A.1

With the seal injection flow [resistance] not within its limit, the amount of 

charging flow available to the RCS may be reduced. Under this 

Condition, action must be taken to restore the flow [resistance] to within 

its limit. The operator has 4 hours from the time the flow [resistance] is 

known to not be within the limit to correctly position the manual valves 

and thus be in compliance with the accident analysis. The Completion 

Time minimizes the potential exposure of the plant to a LOCA with 

insufficient injection flow and provides a reasonable time to restore seal 

injection flow [resistance] within limits. This time is conservative with 

respect to the Completion Times of other ECCS LCOs; it is based on 

operating experience and is sufficient for taking corrective actions by 

operations personnel.

B.1 and B.2

When the Required Actions cannot be completed within the required 

Completion Time, a controlled shutdown must be initiated. The 

Completion Time of 6 hours for reaching MODE 3 from MODE 1 is a 

reasonable time for a controlled shutdown, based on operating 

experience and normal cooldown rates, and does not challenge plant 

safety systems or operators. Continuing the plant shutdown begun in 

Required Action B.1, an additional 6 hours is a reasonable time, based on 

operating experience and normal cooldown rates, to reach MODE 4, 

where this LCO is no longer applicable.

SURVEILLANCE SR 3.5.5.1

REQUIREMENTS

Verification that the manual seal injection throttle valves are adjusted to 

give a flow [resistance] within the limit ensures that the ECCS injection 

flows stay within the safety analysis. A differential pressure is established 

between the charging header and the RCS, and the total seal injection 

flow is verified to within the limit determined in accordance with the ECCS 

safety analysis. [The flow [resistance] shall be verified by confirming seal 

injection flow ≤ [40] gpm with the RCS at normal operating pressure, the 

charging flow control valve full open, and the charging header pressure 

≥ [2480]. 

OR 

The flow [resistance] shall be verified by confirming seal injection flow and 

differential pressure within the acceptable region of Figure 3.5.5-1. 
Seal Injection Flow

B 3.5.5

Westinghouse STS B 3.5.5-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The flow resistance shall be ≥ [0.2117] ft/gpm2.] Control valves in the flow 

path between the charging header and the RCS pressure sensing points 

must be in their post accident position (e.g., charging flow control valve 

open) during this Surveillance to correlate with the acceptance criteria.

[ The Frequency of 31 days is based on engineering judgment and is 

consistent with other ECCS valve Surveillance Frequencies. The 

Frequency has proven to be acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

As noted, the Surveillance is not required to be performed until 4 hours 

after the RCS pressure has stabilized within a ± 20 psig range of normal 

operating pressure. The RCS pressure requirement is specified since 

this configuration will produce the required pressure conditions necessary 

to assure that the manual valves are set correctly. The exception is 

limited to 4 hours to ensure that the Surveillance is timely.

REFERENCES 1. FSAR, Chapter [6] and Chapter [15].

2. 10 CFR 50.46.

BIT

B 3.5.6

Westinghouse STS B 3.5.6-1 Rev. 4.0

B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.6 Boron Injection Tank (BIT)

BASES

BACKGROUND The BIT is part of the Boron Injection System, which is the primary means 

of quickly introducing negative reactivity into the Reactor Coolant System 

(RCS) on a safety injection (SI) signal.

The main flow path through the Boron Injection System is from the 

discharge of the centrifugal charging pumps through lines equipped with a 

flow element and two valves in parallel that open on an SI signal. The 

valves can be operated from the main control board. The valves and flow 

elements have main control board indications. Downstream of these 

valves, the flow enters the BIT (Ref. 1).

The BIT is a stainless steel tank containing concentrated boric acid. Two 

trains of strip heaters are mounted on the tank to keep the temperature of 

the boric acid solution above the precipitation point. The strip heaters are 

controlled by temperature elements located near the bottom of the BIT. 

The temperature elements also activate High and Low alarms on the 

main control board. In addition to the strip heaters on the BIT, there is a 

recirculation system with a heat tracing system, including the piping 

section between the motor operated isolation valves, which further 

ensures that the boric acid stays in solution. The BIT is also equipped 

with a High Pressure alarm on the main control board. The entire 

contents of the BIT are injected when required; thus, the contained and 

deliverable volumes are the same.

During normal operation, one of the two BIT recirculation pumps takes 

suction from the boron injection surge tank (BIST) and discharges to the 

BIT. The solution then returns to the BIST. Normally, one pump is 

running and one is shut off. On receipt of an SI signal, the running pump 

shuts off and the air operated valves close. Flow to the BIT is then 

supplied from the centrifugal charging pumps. The solution of the BIT is 

injected into the RCS through the RCS cold legs.

APPLICABLE During a main steam line break (MSLB) or loss of coolant accident

SAFETY (LOCA), the BIT provides an immediate source of concentrated boric

ANALYSES acid that quickly introduces negative reactivity into the RCS.

The contents of the BIT are not credited for core cooling or immediate 

boration in the LOCA analysis, but for post LOCA recovery. The BIT 

maximum boron concentration of [22,500] ppm is used to determine the 

minimum time for hot leg recirculation switchover. The minimum boron 
BIT

B 3.5.6

Westinghouse STS B 3.5.6-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

concentration of [20,000] ppm is used to determine the minimum mixed 

mean sump boron concentration for post LOCA shutdown requirements.

For the MSLB analysis, the BIT is the primary mechanism for injecting 

boron into the core to counteract any positive increases in reactivity 

caused by an RCS cooldown. The analysis uses the minimum boron 

concentration of the BIT, which also affects both the departure from 

nucleate boiling and containment design analyses. Reference to the 

LOCA and MSLB analyses is used to assess changes to the BIT to 

evaluate their effect on the acceptance limits contained in these analyses.

The minimum temperature limit of [145]°F for the BIT ensures that the 

solution does not reach the boric acid precipitation point. The 

temperature of the solution is monitored and alarmed on the main control 

board.

The BIT boron concentration limits are established to ensure that the core 

remains subcritical during post LOCA recovery. The BIT will counteract 

any positive increases in reactivity caused by an RCS cooldown.

The BIT minimum water volume limit of [1100] gallons is used to ensure 

that the appropriate quantity of highly borated water with sufficient 

negative reactivity is injected into the RCS to shut down the core following 

an MSLB, to determine the hot leg recirculation switchover time, and to 

safeguard against boron precipitation.

The BIT satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO establishes the minimum requirements for contained volume, 

boron concentration, and temperature of the BIT inventory (Ref. 2). This 

ensures that an adequate supply of borated water is available in the event 

of a LOCA or MSLB to maintain the reactor subcritical following these 

accidents.

To be considered OPERABLE, the limits established in the SR for water 

volume, boron concentration, and temperature must be met.

If the equipment used to verify BIT parameters (temperature, volume, and 

boron concentration) is determined to be inoperable, then the BIT is also 

inoperable.
BIT

B 3.5.6

Westinghouse STS B 3.5.6-3 Rev. 4.0

BASES

APPLICABILITY In MODES 1, 2, and 3, the BIT OPERABILITY requirements are 

consistent with those of LCO 3.5.2, "ECCS - Operating."

In MODES 4, 5, and 6, the respective accidents are less severe, so the 

BIT is not required in these lower MODES.

ACTIONS A.1

If the required volume is not present in the BIT, both the hot leg 

recirculation switchover time analysis and the boron precipitation analysis 

would not be met. Under these conditions, prompt action must be taken 

to restore the volume to above its required limit to declare the tank 

OPERABLE, or the plant must be placed in a MODE in which the BIT is 

not required.

The BIT boron concentration is considered in the hot leg recirculation 

switchover time analysis, the boron precipitation analysis, and the 

reactivity analysis for an MSLB. If the concentration were not within the 

required limits, these analyses could not be relied on. Under these 

conditions, prompt action must be taken to restore the concentration to 

within its required limits, or the plant must be placed in a MODE in which 

the BIT is not required.

The BIT temperature limit is established to ensure that the solution does 

not reach the boric acid crystallization point. If the temperature of the 

solution drops below the minimum, prompt action must be taken to raise 

the temperature and declare the tank OPERABLE, or the plant must be 

placed in a MODE in which the BIT is not required.

The 1 hour Completion Time to restore the BIT to OPERABLE status is 

consistent with other Completion Times established for loss of a safety 

function and ensures that the plant will not operate for long periods 

outside of the safety analyses.

B.1, B.2, and B.3

When Required Action A.1 cannot be completed within the required 

Completion Time, a controlled shutdown should be initiated. Six hours is 

a reasonable time, based on operating experience, to reach MODE 3 

from full power conditions and to be borated to the required SDM without 

challenging plant systems or operators. Borating to the required SDM 

assures that the plant is in a safe condition, without need for any 

additional boration.
BIT

B 3.5.6

Westinghouse STS B 3.5.6-4 Rev. 4.0

BASES

ACTIONS (continued)

After determining that the BIT is inoperable and the Required Actions of 

B.1 and B.2 have been completed, the tank must be returned to 

OPERABLE status within 7 days. These actions ensure that the plant will 

not be operated with an inoperable BIT for a lengthy period of time. It 

should be noted, however, that changes to applicable MODES cannot be 

made until the BIT is restored to OPERABLE status pursuant to the 

provisions of LCO 3.0.4.

C.1

Even though the RCS has been borated to a safe and stable condition as 

a result of Required Action B.2, either the BIT must be restored to 

OPERABLE status (Required Action C.1) or the plant must be placed in a 

condition in which the BIT is not required (MODE 4). The 12 hour 

Completion Time to reach MODE 4 is reasonable, based on operating 

experience and normal cooldown rates, and does not challenge plant 

safety systems or operators.

SURVEILLANCE SR 3.5.6.1

REQUIREMENTS

Verification that the BIT water temperature is at or above the specified 

minimum temperature will identify a temperature change that would 

approach the acceptable limit. The solution temperature is also 

monitored by an alarm that provides further assurance of protection 

against low temperature. [ The Frequency of 24 hours has been shown 

to be acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
BIT

B 3.5.6

Westinghouse STS B 3.5.6-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.6.2

Verification that the BIT contained volume is above the required limit 

assures that this volume will be available for quick injection into the RCS. 

If the volume is too low, the BIT would not provide enough borated water 

to ensure subcriticality during recirculation or to shut down the core 

following an MSLB. [ Since the BIT volume is normally stable, a 7 day 

Frequency is appropriate and has been shown to be acceptable through 

operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.5.6.3

Verification that the boron concentration of the BIT is within the required 

band ensures that the reactor remains subcritical following a LOCA; it 

limits return to power following an MSLB, and maintains the resulting 

sump pH in an acceptable range so that boron precipitation will not occur 

in the core. In addition, the effect of chloride and caustic stress corrosion 

on mechanical systems and components will be minimized.

The BIT is in a recirculation loop that provides continuous circulation of 

the boric acid solution through the BIT and the boric acid tank (BAT). 

There are a number of points along the recirculation loop where local 

samples can be taken. The actual location used to take a sample of the 

solution is specified in the plant Surveillance procedures. Sampling from 

the BAT to verify the concentration of the BIT is not recommended, since 

this sample may not be homogenous and the boron concentration of the 

two tanks may differ.

The sample should be taken from the BIT or from a point in the flow path 

of the BIT recirculation loop.
BIT

B 3.5.6

Westinghouse STS B 3.5.6-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Frequency of 7 days is appropriate and has been shown to be 

acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [6] and Chapter [15].

2. 10 CFR 50.46.
Containment (Atmospheric)

B 3.6.1A

Westinghouse STS B 3.6.1A-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.1A Containment (Atmospheric)

BASES

BACKGROUND The containment consists of the concrete reactor building, its steel liner, 

and the penetrations through this structure. The structure is designed to 

contain radioactive material that may be released from the reactor core 

following a design basis loss of coolant accident (LOCA). Additionally, 

this structure provides shielding from the fission products that may be 

present in the containment atmosphere following accident conditions.

The containment is a reinforced concrete structure with a cylindrical wall, 

a flat foundation mat, and a shallow dome roof. The inside surface of the 

containment is lined with a carbon steel liner to ensure a high degree of 

leak tightness during operating and accident conditions.

For containments with ungrouted tendons, the cylinder wall is prestressed 

with a post tensioning system in the vertical and horizontal directions, and 

the dome roof is prestressed utilizing a three way post tensioning system.

The concrete reactor building is required for structural integrity of the 

containment under Design Basis Accident (DBA) conditions. The steel 

liner and its penetrations establish the leakage limiting boundary of the 

containment. Maintaining the containment OPERABLE limits the leakage 

of fission product radioactivity from the containment to the environment. 

SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, 

Appendix J, Option [A][B] (Ref. 1), as modified by approved exemptions.

The isolation devices for the penetrations in the containment boundary 

are a part of the containment leak tight barrier. To maintain this leak tight 

barrier:

a. All penetrations required to be closed during accident conditions are 

either:

1. Capable of being closed by an OPERABLE automatic 

containment isolation system or

2. Closed by manual valves, blind flanges, or de-activated 

automatic valves secured in their closed positions, except as 

provided in LCO 3.6.3, "Containment Isolation Valves,"
Containment (Atmospheric)

B 3.6.1A

Westinghouse STS B 3.6.1A-2 Rev. 4.0

BASES

BACKGROUND (continued)

b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, 

"Containment Air Locks,"

c. All equipment hatches are closed, and

[d. The pressurized sealing mechanism associated with a penetration is 

OPERABLE, except as provided in LCO 3.6.[ ]. ]

APPLICABLE The safety design basis for the containment is that the containment must

SAFETY withstand the pressures and temperatures of the limiting Design Basis

ANALYSES Accident (DBA) without exceeding the design leakage rate.

The DBAs that result in a challenge to containment OPERABILITY from 

high pressures and temperatures are a LOCA, a steam line break, and a 

rod ejection accident (REA) (Ref. 2). In addition, release of significant 

fission product radioactivity within containment can occur from a LOCA or 

REA. In the DBA analyses, it is assumed that the containment is 

OPERABLE such that, for the DBAs involving release of fission product 

radioactivity, release to the environment is controlled by the rate of 

containment leakage. The containment was designed with an allowable 

leakage rate of [0.1]% of containment air weight per day (Ref. 3). This 

leakage rate, used to evaluate offsite doses resulting from accidents, is 

defined in 10 CFR 50, Appendix J, Option [A][B] (Ref. 1), as La: the 

maximum allowable containment leakage rate at the calculated peak 

containment internal pressure (Pa) resulting from the limiting design basis 

LOCA. The allowable leakage rate represented by La forms the basis for 

the acceptance criteria imposed on all containment leakage rate testing. 

La is assumed to be [0.1]% per day in the safety analysis at 

Pa = [44.1] psig (Ref. 3).

Satisfactory leakage rate test results are a requirement for the 

establishment of containment OPERABILITY.

The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Containment OPERABILITY is maintained by limiting leakage to 1.0 La, 

except prior to the first startup after performing a required Containment 

Leakage Rate Testing Program leakage test. At this time the applicable 

leakage limits must be met.

Compliance with this LCO will ensure a containment configuration, 

including equipment hatches, that is structurally sound and that will limit 

leakage to those leakage rates assumed in the safety analysis.
Containment (Atmospheric)

B 3.6.1A

Westinghouse STS B 3.6.1A-3 Rev. 4.0

BASES

LCO (continued)

Individual leakage rates specified for the containment air lock (LCO 3.6.2) 

[and purge valves with resilient seals (LCO 3.6.3)] are not specifically part 

of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage 

rates exceeding these individual limits only result in the containment 

being inoperable when the leakage results in exceeding the overall 

acceptance criteria of 1.0 La.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material into containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, containment is not 

required to be OPERABLE in MODE 5 to prevent leakage of radioactive 

material from containment. The requirements for containment during 

MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations."

ACTIONS A.1

In the event containment is inoperable, containment must be restored to 

OPERABLE status within 1 hour. The 1 hour Completion Time provides a 

period of time to correct the problem commensurate with the importance 

of maintaining containment during MODES 1, 2, 3, and 4. This time 

period also ensures that the probability of an accident (requiring 

containment OPERABILITY) occurring during periods when containment 

is inoperable is minimal.

B.1 and B.2

If containment cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.
Containment (Atmospheric)

B 3.6.1A

Westinghouse STS B 3.6.1A-4 Rev. 4.0

BASES 

SURVEILLANCE SR 3.6.1.1

REQUIREMENTS

Maintaining the containment OPERABLE requires compliance with the 

visual examinations and leakage rate test requirements of the 

Containment Leakage Rate Testing Program. The containment concrete 

visual examinations may be performed during either power operation, 

e.g., performed concurrently with other containment inspection-related 

activities such as tendon testing, or during a maintenance or refueling 

outage. The visual examinations of the steel liner plate inside 

containment are performed during maintenance or refueling outages 

since this is the only time the liner plate is fully accessible.

Failure to meet air lock [and purge valve with resilient seal] leakage limits 

specified in LCO 3.6.2 [and LCO 3.6.3] does not invalidate the 

acceptability of these overall leakage determinations unless their 

contribution to overall Type A, B, and C leakage causes that to exceed 

limits. As left leakage prior to the first startup after performing a required 

Containment Leakage Rate Testing Program leakage test is required to 

be < 0.6 La for combined Type B and C leakage, and [< 0.75 La for 

Option A] [≤0.75 La for Option B] for overall Type A leakage. At all other 

times between required leakage rate tests, the acceptance criteria is 

based on an overall Type A leakage limit of ≤ 1.0 La. At ≤ 1.0 La the 

offsite dose consequences are bounded by the assumptions of the safety 

analysis.

SR Frequencies are as required by the Containment Leakage Rate 

Testing Program. These periodic testing requirements verify that the 

containment leakage rate does not exceed the leakage rate assumed in 

the safety analysis.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Regulatory Guide 1.163 and NEI 94-01 include acceptance criteria for asleft and as-found Type A leakage rates and combined Type B and C 

leakage rates, which may be reflected in the Bases.

--------------------------------------------------------------------------------------------------

[ SR 3.6.1.2

For ungrouted, post tensioned tendons, this SR ensures that the 

structural integrity of the containment will be maintained in accordance 

with the provisions of the Containment Tendon Surveillance Program. 

Testing and Frequency are in accordance with the ASME Code, 

Section XI, Subsection IWL (Ref. 4), and applicable addenda as required 

by 10 CFR 50.55a. ]
Containment (Atmospheric)

B 3.6.1A

Westinghouse STS B 3.6.1A-5 Rev. 4.0

BASES 

REFERENCES 1. 10 CFR 50, Appendix J, Option [A][B].

2. FSAR, Chapter [15].

3. FSAR, Section [6.2].

4. ASME Code, Section XI, Subsection IWL.

Containment (Dual)

B 3.6.1B

Westinghouse STS B 3.6.1B-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.1B Containment (Dual)

BASES

BACKGROUND The containment is a free standing steel pressure vessel surrounded by a 

reinforced concrete shield building. The containment vessel, including all 

its penetrations, is a low leakage steel shell designed to contain 

radioactive material that may be released from the reactor core following 

a design basis loss of coolant accident (LOCA). Additionally, the 

containment and shield building provide shielding from the fission 

products that may be present in the containment atmosphere following 

accident conditions.

The containment vessel is a vertical cylindrical steel pressure vessel with 

a hemispherical dome and ellipsoidal bottom, completely enclosed by a 

reinforced concrete shield building. A 4 ft wide annular space exists 

between the walls and domes of the steel containment vessel and the 

concrete shield building to permit inservice inspection and collection of 

containment outleakage. Dual containments utilize an outer concrete 

building for shielding and an inner steel containment for leak tightness.

Containment piping penetration assemblies provide for the passage of 

process, service, sampling and instrumentation pipelines into the 

containment vessel while maintaining containment OPERABILITY. The 

shield building provides shielding and allows controlled release of the 

annulus atmosphere under accident conditions, as well as environmental 

missile protection for the containment vessel and the Nuclear Steam 

Supply System.

The inner steel containment and its penetrations establish the leakage 

limiting boundary of the containment. Maintaining the containment 

OPERABLE limits the leakage of fission product radioactivity from the 

containment to the environment. SR 3.6.1.1 leakage rate requirements 

comply with 10 CFR 50, Appendix J, Option [A][B] (Ref. 1), as modified by 

approved exemptions.

The isolation devices for the penetrations in the containment boundary 

are a part of the containment leak tight barrier. To maintain this leak tight 

barrier:
Containment (Dual)

B 3.6.1B

Westinghouse STS B 3.6.1B-2 Rev. 4.0

BASES

BACKGROUND (continued)

a. All penetrations required to be closed during accident conditions are 

either:

1. Capable of being closed by an OPERABLE automatic 

containment isolation system or

2. Closed by manual valves, blind flanges, or de-activated 

automatic valves secured in their closed positions, except as 

provided in LCO 3.6.3, "Containment Isolation Valves,"

b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, 

"Containment Air Locks,"

c. All equipment hatches are closed, and

[d. The pressurized sealing mechanism associated with a penetration is 

OPERABLE, except as provided in LCO 3.6.[ ]. ]

APPLICABLE The safety design basis for the containment is that the containment must

SAFETY withstand the pressures and temperatures of the limiting Design Basis

ANALYSES Accident (DBA) without exceeding the design leakage rate.

The DBAs that result in a challenge to containment OPERABILITY from 

high pressures and temperatures are a LOCA, a steam line break, and a 

rod ejection accident (REA) (Ref. 2). In addition, release of significant 

fission product radioactivity within containment can occur from a LOCA or 

REA. In the DBA analyses, it is assumed that the containment is 

OPERABLE such that, for the DBAs involving release of fission product 

radioactivity, release to the environment is controlled by the rate of 

containment leakage. The containment was designed with an allowable 

leakage rate of [0.1]% of containment air weight per day (Ref. 3). This 

leakage rate, used in the evaluation of offsite doses resulting from 

accidents, is defined in 10 CFR 50, Appendix J, Option [A][B] (Ref. 1), as 

La: the maximum allowable containment leakage rate at the calculated 

peak containment internal pressure (Pa) resulting from the limiting design 

basis LOCA. The allowable leakage rate represented by La forms the 

basis for the acceptance criteria imposed on all containment leakage rate 

testing. La is assumed to be [0.1]% per day in the safety analysis at 

Pa = [46.3] psig (Ref. 3).

Satisfactory leakage rate test results are a requirement for the 

establishment of containment OPERABILITY.

The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Containment (Dual)

B 3.6.1B

Westinghouse STS B 3.6.1B-3 Rev. 4.0

BASES 

LCO Containment OPERABILITY is maintained by limiting leakage to ≤ 1.0 La, 

except prior to the first startup after performing a required Containment 

Leakage Rate Testing Program leakage test. At this time the applicable 

leakage limits must be met.

Compliance with this LCO will ensure a containment configuration, 

including equipment hatches, that is structurally sound and that will limit 

leakage to those leakage rates assumed in the safety analysis.

Individual leakage rates specified for the containment air lock (LCO 3.6.2) 

[, purge valves with resilient seals, and secondary bypass leakage 

(LCO 3.6.3)] are not specifically part of the acceptance criteria of 

10 CFR 50, Appendix J. Therefore, leakage rates exceeding these 

individual limits only result in the containment being inoperable when the 

leakage results in exceeding the overall acceptance criteria of 1.0 La.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material into containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, containment is not 

required to be OPERABLE in MODE 5 to prevent leakage of radioactive 

material from containment. The requirements for containment during 

MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations."

ACTIONS A.1

In the event containment is inoperable, containment must be restored to 

OPERABLE status within 1 hour. The 1 hour Completion Time provides a 

period of time to correct the problem commensurate with the importance 

of maintaining containment OPERABLE during MODES 1, 2, 3, and 4. 

This time period also ensures that the probability of an accident (requiring 

containment OPERABILITY) occurring during periods when containment 

is inoperable is minimal.

B.1 and B.2

If containment cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.
Containment (Dual)

B 3.6.1B

Westinghouse STS B 3.6.1B-4 Rev. 4.0

BASES 

SURVEILLANCE SR 3.6.1.1

REQUIREMENTS

Maintaining the containment OPERABLE requires compliance with the 

visual examinations and leakage rate test requirements of the 

Containment Leakage Rate Testing Program. The containment concrete 

visual examinations may be performed during either power operation, 

e.g., performed concurrently with other containment inspection-related 

activities such as tendon testing, or during a maintenance or refueling 

outage. The visual examinations of the steel liner plate inside 

containment are performed during maintenance or refueling outages 

since this is the only time the liner plate is fully accessible.

Failure to meet air lock [, secondary containment bypass leakage path 

and purge valve with resilient seal] leakage limits specified in LCO 3.6.2 

[and LCO 3.6.3] does not invalidate the acceptability of these overall 

leakage determinations unless their contribution to overall Type A, B, 

and C leakage causes that to exceed limits. As left leakage prior to the 

first startup after performing a required Containment Leakage Rate 

Testing Program leakage test is required to be < 0.6 La for combined 

Type B and C leakage, and [< 0.75 La for Option A][≤ 0.75 La for Option B] 

for overall Type A leakage. At all other times between required 

Containment Leakage Rate Testing Program leakage rate tests, the 

acceptance criteria is based on an overall Type A leakage limit of 

≤ 1.0 La. At ≤ 1.0 La the offsite dose consequences are bounded by the 

assumptions of the safety analysis.

SR Frequencies are as required by the Containment Leakage Rate 

Testing Program. These periodic testing requirements verify that the 

containment leakage rate does not exceed the leakage rate assumed in 

the safety analysis.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Regulatory Guide 1.163 and NEI 94-01 include acceptance criteria for asleft and as-found Type A leakage rates and combined Type B and C 

leakage rates, which may be reflected in the Bases.

--------------------------------------------------------------------------------------------------

[ SR 3.6.1.2

For ungrouted, post tensioned tendons, this SR ensures that the 

structural integrity of the containment will be maintained in accordance 

with the provisions of the Containment Tendon Surveillance Program. 

Testing and Frequency are in accordance with the ASME Code, 

Section XI, Subsection IWL (Ref. 4), and applicable addenda as required 

by 10 CFR 50.55a. ]
Containment (Dual)

B 3.6.1B

Westinghouse STS B 3.6.1B-5 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50, Appendix J, Option [A][B].

2. FSAR, Chapter [15].

3. FSAR, Section [6.2].

4. ASME Code, Section XI, Subsection IWL.

Containment (Ice Condenser)

B 3.6.1C

Westinghouse STS B 3.6.1C-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.1C Containment (Ice Condenser)

BASES

BACKGROUND The containment is a free standing steel pressure vessel surrounded by a 

reinforced concrete shield building. The containment vessel, including all 

its penetrations, is a low leakage steel shell designed to contain the 

radioactive material that may be released from the reactor core following 

a design basis loss of coolant accident (LOCA). Additionally, the 

containment and shield building provide shielding from the fission 

products that may be present in the containment atmosphere following 

accident conditions.

The containment vessel is a vertical cylindrical steel pressure vessel with 

hemispherical dome and a concrete base mat with steel membrane. It is 

completely enclosed by a reinforced concrete shield building. An annular 

space exists between the walls and domes of the steel containment 

vessel and the concrete shield building to provide for the collection, 

mixing, holdup, and controlled release of containment out leakage. Ice 

condenser containments utilize an outer concrete building for shielding 

and an inner steel containment for leak tightness.

Containment piping penetration assemblies provide for the passage of 

process, service, sampling, and instrumentation pipelines into the 

containment vessel while maintaining containment integrity. The shield 

building provides shielding and allows controlled release of the annulus 

atmosphere under accident conditions, as well as environmental missile 

protection for the containment vessel and Nuclear Steam Supply System.

The inner steel containment and its penetrations establish the leakage 

limiting boundary of the containment. Maintaining the containment 

OPERABLE limits the leakage of fission product radioactivity from the 

containment to the environment. SR 3.6.1.1 leakage rate requirements 

comply with 10 CFR 50, Appendix J, Option [A][B] (Ref. 1), as modified by 

approved exemptions.

The isolation devices for the penetrations in the containment boundary 

are a part of the containment leak tight barrier. To maintain this leak tight 

barrier:
Containment (Ice Condenser)

B 3.6.1C

Westinghouse STS B 3.6.1C-2 Rev. 4.0

BASES

BACKGROUND (continued)

a. All penetrations required to be closed during accident conditions are 

either:

1. Capable of being closed by an OPERABLE automatic 

containment isolation system or

2. Closed by manual valves, blind flanges, or de-activated 

automatic valves secured in their closed positions, except as 

provided in LCO 3.6.3, "Containment Isolation Valves,"

b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, 

"Containment Air Locks,"

c. All equipment hatches are closed, and

[d. The pressurized sealing mechanism associated with a penetration is 

operable, except as provided in LCO 3.6.[ ]. ]

APPLICABLE The safety design basis for the containment is that the containment must

SAFETY withstand the pressures and temperatures of the limiting Design Basis

ANALYSES Accident (DBA) without exceeding the design leakage rates.

The DBAs that result in a challenge to containment OPERABILITY from 

high pressures and temperatures are a LOCA, a steam line break, and a 

rod ejection accident (REA) (Ref. 2). In addition, release of significant 

fission product radioactivity within containment can occur from a LOCA or 

REA. In the DBA analyses, it is assumed that the containment is 

OPERABLE such that, for the DBAs involving release of fission product 

radioactivity, release to the environment is controlled by the rate of 

containment leakage. The containment was designed with an allowable 

leakage rate of [0.1]% of containment air weight per day (Ref. 3). This 

leakage rate, used in the evaluation of offsite doses resulting from 

accidents, is defined in 10 CFR 50, Appendix J, Option [A][B] (Ref. 1), as 

La: the maximum allowable containment leakage rate at the calculated 

peak containment internal pressure (Pa) resulting from the limiting design 

basis LOCA. The allowable leakage rate represented by La forms the 

basis for the acceptance criteria imposed on all containment leakage rate 

testing. La is assumed to be [0.1]% per day in the safety analysis at 

Pa = [14.4] psig (Ref. 3).

Satisfactory leakage rate test results are a requirement for the 

establishment of containment OPERABILITY.

The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Containment (Ice Condenser)

B 3.6.1C

Westinghouse STS B 3.6.1C-3 Rev. 4.0

BASES 

LCO Containment OPERABILITY is maintained by limiting leakage to ≤ 1.0 La, 

except prior to the first startup after performing a required Containment 

Leakage Rate Testing Program leakage test. At this time the applicable 

leakage limits must be met.

Compliance with this LCO will ensure a containment configuration, 

including equipment hatches, that is structurally sound and that will limit 

leakage to those leakage rates assumed in the safety analysis.

Individual leakage rates specified for the containment air lock (LCO 3.6.2) 

[, purge valves with resilient seals, and secondary bypass leakage 

(LCO 3.6.3)] are not specifically part of the acceptance criteria of 

10 CFR 50, Appendix J. Therefore, leakage rates exceeding these 

individual limits only result in the containment being inoperable when the 

leakage results in exceeding the overall acceptance criteria of 1.0 La.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material into containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, containment is not 

required to be OPERABLE in MODE 5 to prevent leakage of radioactive 

material from containment. The requirements for containment during 

MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations."

ACTIONS A.1

In the event containment is inoperable, containment must be restored to 

OPERABLE status within 1 hour. The 1 hour Completion Time provides a 

period of time to correct the problem commensurate with the importance 

of maintaining containment OPERABLE during MODES 1, 2, 3, and 4. 

This time period also ensures that the probability of an accident (requiring 

containment OPERABILITY) occurring during periods when containment 

is inoperable is minimal.

B.1 and B.2

If containment cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.
Containment (Ice Condenser)

B 3.6.1C

Westinghouse STS B 3.6.1C-4 Rev. 4.0

BASES 

SURVEILLANCE SR 3.6.1.1

REQUIREMENTS

Maintaining the containment OPERABLE requires compliance with the 

visual examinations and leakage rate test requirements of the 

Containment Leakage Rate Testing Program. The containment concrete 

visual examinations may be performed during either power operation, 

e.g., performed concurrently with other containment inspection-related 

activities such as tendon testing, or during a maintenance or refueling 

outage. The visual examinations of the steel liner plate inside 

containment are performed during maintenance or refueling outages 

since this is the only time the liner plate is fully accessible.

Failure to meet air lock [, secondary containment bypass leakage path, 

and purge valve with resilient seal] leakage limits specified in LCO 3.6.2 

[and LCO 3.6.3] does not invalidate the acceptability of these overall 

leakage determinations unless their contribution to overall Type A, B, 

and C leakage causes that to exceed limits. As left leakage prior to the 

first startup after performing a required Containment Leakage Rate 

Testing Program leakage test is required to be < 0.6 La for combined 

Type B and C leakage, and [< 0.75 La for Option A] [≤ 0.75 La for 

Option B] for overall Type A leakage. At all other times between required 

leakage rate tests, the acceptance criteria is based on an overall Type A 

leakage limit of ≤ 1.0 La. At ≤ 1.0 La the offsite dose consequences are 

bounded by the assumptions of the safety analysis. 

SR Frequencies are as required by the Containment Leakage Rate 

Testing Program. These periodic testing requirements verify that the 

containment leakage rate does not exceed the leakage rate assumed in 

the safety analysis.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Regulatory Guide 1.163 and NEI 94-01 include acceptance criteria for asleft and as-found Type A leakage rates and combined Type B and C 

leakage rates, which may be reflected in the Bases.

--------------------------------------------------------------------------------------------------

[ SR 3.6.1.2

For ungrouted, post tensioned tendons, this SR ensures that the 

structural integrity of the containment will be maintained in accordance 

with the provisions of the Containment Tendon Surveillance Program. 

Testing and Frequency are in accordance with the ASME Code, 

Section XI, Subsection IWL (Ref. 4), and applicable addenda as required 

by 10CFR 50.55a. ]
Containment (Ice Condenser)

B 3.6.1C

Westinghouse STS B 3.6.1C-5 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50, Appendix J, Option [A][B].

2. FSAR, Chapter [15].

3. FSAR, Section [6.2].

4. ASME Code, Section XI, Subsection IWL.

Containment (Subatmospheric)

B 3.6.1D

Westinghouse STS B 3.6.1D-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.1D Containment (Subatmospheric)

BASES

BACKGROUND The containment consists of the concrete reactor building, its steel liner, 

and the penetrations through this structure. The structure is designed to 

contain radioactive material that may be released from the reactor core 

following a design basis loss of coolant accident (LOCA). Additionally, 

this structure provides shielding from the fission products that may be 

present in the containment atmosphere following accident conditions.

The containment is a reinforced concrete structure with a cylindrical wall, 

a flat foundation mat, and a shallow dome roof. The inside surface of the 

containment is lined with a carbon steel liner to ensure a high degree of 

leak tightness during operating and accident conditions.

For containments with ungrouted tendons, the cylinder wall is prestressed 

with a post tensioning system in the vertical and horizontal directions, and 

the dome roof is prestressed utilizing a three way post tensioning system.

The concrete reactor building is required for structural integrity of the 

containment under Design Basis Accident (DBA) conditions. The steel 

liner and its penetrations establish the leakage limiting boundary of the 

containment. Maintaining the containment OPERABLE limits the leakage 

of fission product radioactivity from the containment to the environment. 

SR 3.6.1.1 leakage rate requirements comply with 10 CFR 50, 

Appendix J, Option [A][B] (Ref. 1), as modified by approved exemptions.

The isolation devices for the penetrations in the containment boundary 

are a part of the containment leak tight barrier. To maintain this leak tight 

barrier:

a. All penetrations required to be closed during accident conditions are 

either:

1. Capable of being closed by an OPERABLE automatic 

containment isolation system or

2. Closed by manual valves, blind flanges, or de-activated 

automatic valves secured in their closed positions, except as 

provided in LCO 3.6.3, "Containment Isolation Valves,"
Containment (Subatmospheric)

B 3.6.1D

Westinghouse STS B 3.6.1D-2 Rev. 4.0

BASES

BACKGROUND (continued)

b. Each air lock is OPERABLE, except as provided in LCO 3.6.2, 

"Containment Air Locks,"

c. All equipment hatches are closed, and

[d. The pressurized sealing mechanism associated with a 

penetration is OPERABLE, except as provided in LCO 3.6.[ ]. ]

APPLICABLE The safety design basis for the containment is that the containment must

SAFETY withstand the pressures and temperatures of the limiting DBA without

ANALYSES exceeding the design leakage rate.

The DBAs that result in a challenge to containment OPERABILITY from 

high pressures and temperatures are a LOCA, a steam line break, and a 

rod ejection accident (REA) (Ref. 2). In addition, release of significant 

fission product radioactivity within containment can occur from a LOCA or 

REA. In the DBA analyses, it is assumed that the containment is 

OPERABLE such that, for the DBAs involving release of fission product 

radioactivity, release to the environment is controlled by the rate of 

containment leakage. The containment was designed with an allowable 

leakage rate of [0.1]% of containment air weight per day (Ref. 3). This 

leakage rate, used to evaluate offsite doses resulting from accidents, is 

defined in 10 CFR 50, Appendix J, Option [A][B] (Ref. 1), as La: the 

maximum allowable containment leakage rate at the calculated peak 

containment internal pressure (Pa) resulting from the limiting design basis 

LOCA. The allowable leakage rate represented by La forms the basis for 

the acceptance criteria imposed on all containment leakage rate testing. 

La is assumed to be [0.1]% per day in the safety analyses at 

Pa = [40.4] psig (Ref. 3).

Satisfactory leakage rate test results are a requirement for the 

establishment of containment OPERABILITY.

The containment satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Containment OPERABILITY is maintained by limiting leakage to ≤ 1.0 La, 

except prior to the first startup after performing a required Containment 

Leakage Rate Testing Program leakage test. At this time the applicable 

leakage limits must be met.
Containment (Subatmospheric)

B 3.6.1D

Westinghouse STS B 3.6.1D-3 Rev. 4.0

BASES

LCO (continued)

Compliance with this LCO will ensure a containment configuration, 

including equipment hatches, that is structurally sound and that will limit 

leakage to those leakage rates assumed in the safety analysis.

Individual leakage rates specified for the containment air lock (LCO 3.6.2) 

[and purge valves with resilient seals (LCO 3.6.3)] are not specifically part 

of the acceptance criteria of 10 CFR 50, Appendix J. Therefore, leakage 

rates exceeding these individual limits only result in the containment 

being inoperable when the leakage results in exceeding the overall 

acceptance criteria of 1.0 La.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material into containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, containment is not 

required to be OPERABLE in MODE 5 to prevent leakage of radioactive 

material from containment. The requirements for containment during 

MODE 6 are addressed in LCO 3.9.4, "Containment Penetrations."

ACTIONS A.1

In the event containment is inoperable, containment must be restored to 

OPERABLE status within 1 hour. The 1 hour Completion Time provides a 

period of time to correct the problem commensurate with the importance 

of maintaining containment during MODES 1, 2, 3, and 4. This time 

period also ensures that the probability of an accident (requiring 

containment OPERABILITY) occurring during periods when containment 

is inoperable is minimal.

B.1 and B.2

If containment cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.
Containment (Subatmospheric)

B 3.6.1D

Westinghouse STS B 3.6.1D-4 Rev. 4.0

BASES 

SURVEILLANCE SR 3.6.1.1

REQUIREMENTS

Maintaining the containment OPERABLE requires compliance with the 

visual examinations and leakage rate test requirements of the 

Containment Leakage Rate Testing Program. The containment concrete 

visual examinations may be performed during either power operation, 

e.g., performed concurrently with other containment inspection-related 

activities such as tendon testing, or during a maintenance or refueling 

outage. The visual examinations of the steel liner plate inside 

containment are performed during maintenance or refueling outages 

since this is the only time the liner plate is fully accessible.

Failure to meet air lock [and purge valve with resilient seal] leakage limits 

specified in LCO 3.6.2 [and LCO 3.6.3] does not invalidate the 

acceptability of these overall leakage determinations unless their 

contribution to overall Type A, B, and C leakage causes that to exceed 

limits. As left leakage prior to the first startup after performing a required 

Containment Leakage Rate Testing Program leakage test is required to 

be < 0.6 La for combined Type B and C leakage, and [< 0.75 La for Option 

A] [≤ 0.75 La for Option B] for overall Type A leakage. At all other times 

between required leakage rate tests, the acceptance criteria is based on 

an overall Type A leakage limit of ≤ 1.0 La. At ≤ 1.0 La the offsite dose 

consequences are bounded by the assumptions of the safety analysis.

SR Frequencies are as required by the Containment Leakage Rate 

Testing Program. These periodic testing requirements verify that the 

containment leakage rate does not exceed the leakage rate assumed in 

the safety analysis.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Regulatory Guide 1.163 and NEI 94-01 include acceptance criteria for asleft and as-found Type A leakage rates and combined Type B and C 

leakage rates, which may be reflected in the Bases.

--------------------------------------------------------------------------------------------------

[ SR 3.6.1.2

For ungrouted post tensioned tendons, this SR ensures that the structural 

integrity of the containment will be maintained in accordance with the 

provisions of the Containment Tendon Surveillance Program. Testing 

and Frequency are in accordance with the ASME Code, Section XI, 

Subsection IWL (Ref. 4), and applicable addenda as required by 

10CFR 50.55a. ]
Containment (Subatmospheric)

B 3.6.1D

Westinghouse STS B 3.6.1D-5 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50, Appendix J, Option [A][B].

2. FSAR, Chapter [15].

3. FSAR, Section [6.2].

4. ASME Code, Section XI, Subsection IWL.

Containment Air Locks (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.2

Westinghouse STS B 3.6.2-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.2 Containment Air Locks (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

BASES

BACKGROUND Containment air locks form part of the containment pressure boundary 

and provide a means for personnel access during all MODES of 

operation.

Each air lock is nominally a right circular cylinder, 10 ft in diameter, with a 

door at each end. The doors are interlocked to prevent simultaneous 

opening. During periods when containment is not required to be 

OPERABLE, the door interlock mechanism may be disabled, allowing 

both doors of an air lock to remain open for extended periods when 

frequent containment entry is necessary. Each air lock door has been 

designed and tested to certify its ability to withstand a pressure in excess 

of the maximum expected pressure following a Design Basis Accident 

(DBA) in containment. As such, closure of a single door supports 

containment OPERABILITY. Each of the doors contains double gasketed 

seals and local leakage rate testing capability to ensure pressure 

integrity. To effect a leak tight seal, the air lock design uses pressure 

seated doors (i.e., an increase in containment internal pressure results in 

increased sealing force on each door).

Each personnel air lock is provided with limit switches on both doors that 

provide control room indication of door position. Additionally, control 

room indication is provided to alert the operator whenever an air lock door 

interlock mechanism is defeated.

The containment air locks form part of the containment pressure 

boundary. As such, air lock integrity and leak tightness is essential for 

maintaining the containment leakage rate within limit in the event of a 

DBA. Not maintaining air lock integrity or leak tightness may result in a 

leakage rate in excess of that assumed in the unit safety analyses.

APPLICABLE The DBAs that result in a release of radioactive material within

SAFETY containment are a loss of coolant accident and a rod ejection accident

ANALYSES (Ref. 2). In the analysis of each of these accidents, it is assumed that 

containment is OPERABLE such that release of fission products to the 

environment is controlled by the rate of containment leakage. The 

containment was designed with an allowable leakage rate of [0.1]% of 

containment air weight per day (Ref. 2). This leakage rate is defined in 

10 CFR 50, Appendix J, Option A (Ref. 1), as La = [0.1]% of containment 

air weight per day, the maximum allowable containment leakage rate at 

the calculated peak containment internal pressure Pa = [14.4] psig
Containment Air Locks (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.2

Westinghouse STS B 3.6.2-2 Rev. 4.0

BASES 

APPLICABLE SAFETY ANALYSES (continued)

following a design basis LOCA. This allowable leakage rate forms the 

basis for the acceptance criteria imposed on the SRs associated with the 

air locks.

The containment air locks satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Each containment air lock forms part of the containment pressure 

boundary. As part of the containment pressure boundary, the air lock 

safety function is related to control of the containment leakage rate 

resulting from a DBA. Thus, each air lock's structural integrity and leak 

tightness are essential to the successful mitigation of such an event.

Each air lock is required to be OPERABLE. For the air lock to be 

considered OPERABLE, the air lock interlock mechanism must be 

OPERABLE, the air lock must be in compliance with the Type B air lock 

leakage test, and both air lock doors must be OPERABLE. The interlock 

allows only one air lock door of an air lock to be opened at one time. This 

provision ensures that a gross breach of containment does not exist when 

containment is required to be OPERABLE. Closure of a single door in 

each air lock is sufficient to provide a leak tight barrier following 

postulated events. Nevertheless, both doors are kept closed when the air 

lock is not being used for normal entry into or exit from containment.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, the containment air 

locks are not required in MODE 5 to prevent leakage of radioactive 

material from containment. The requirements for the containment air 

locks during MODE 6 are addressed in LCO 3.9.3, "Containment 

Penetrations."

ACTIONS The ACTIONS are modified by a Note that allows entry and exit to 

perform repairs on the affected air lock component. If the outer door is 

inoperable, then it may be easily accessed for most repairs. It is 

preferred that the air lock be accessed from inside primary containment 

by entering through the other OPERABLE air lock. However, if this is not 

practicable, or if repairs on either door must be performed from the barrel 

side of the door then it is permissible to enter the air lock through the 

OPERABLE door, which means there is a short time during which the 

containment boundary is not intact (during access through the 

OPERABLE door). The ability to open the OPERABLE door, even if it 

means the containment boundary is temporarily not intact, is acceptable 

due to the low probability of an event that could pressurize the 

containment during the short time in which the OPERABLE door is
Containment Air Locks (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.2

Westinghouse STS B 3.6.2-3 Rev. 4.0

BASES

ACTIONS (continued)

expected to be open. After each entry and exit, the OPERABLE door 

must be immediately closed. If ALARA conditions permit, entry and exit 

should be via an OPERABLE air lock.

A second Note has been added to provide clarification that, for this LCO, 

separate Condition entry is allowed for each air lock. This is acceptable, 

since the Required Actions for each Condition provide appropriate 

compensatory actions for each inoperable air lock. Complying with the 

Required Actions may allow for continued operation, and a subsequent 

inoperable air lock is governed by subsequent Condition entry and 

application of associated Required Actions.

In the event the air lock leakage results in exceeding the overall 

containment leakage rate, Note 3 directs entry into the applicable 

Conditions and Required Actions of LCO 3.6.1, "Containment."

A.1, A.2, and A.3

With one air lock door in one or more containment air locks inoperable, 

the OPERABLE door must be verified closed (Required Action A.1) in 

each affected containment air lock. This ensures that a leak tight 

containment barrier is maintained by the use of an OPERABLE air lock 

door. This action must be completed within 1 hour. This specified time 

period is consistent with the ACTIONS of LCO 3.6.1, which requires 

containment be restored to OPERABLE status within 1 hour.

In addition, the affected air lock penetration must be isolated by locking 

closed the OPERABLE air lock door within the 24 hour Completion Time. 

The 24 hour Completion Time is reasonable for locking the OPERABLE 

air lock door, considering the OPERABLE door of the affected air lock is 

being maintained closed.

Required Action A.3 verifies that an air lock with an inoperable door has 

been isolated by the use of a locked and closed OPERABLE air lock 

door. This ensures that an acceptable containment leakage boundary is 

maintained. The Completion Time of once per 31 days is based on 

engineering judgment and is considered adequate in view of the low 

likelihood of a locked door being mispositioned and other administrative 

controls. Required Action A.3 is modified by a Note that applies to air 

lock doors located in high radiation areas and allows these doors to be 

verified locked closed by use of administrative means. Allowing 

verification by administrative means is considered acceptable, since 

access to these areas is typically restricted. Therefore, the probability of 

misalignment of the door, once it has been verified to be in the proper 

position, is small.
Containment Air Locks (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.2

Westinghouse STS B 3.6.2-4 Rev. 4.0

BASES

ACTIONS (continued)

The Required Actions have been modified by two Notes. Note 1 ensures 

that only the Required Actions and associated Completion Times of 

Condition C are required if both doors in the same air lock are inoperable. 

With both doors in the same air lock inoperable, an OPERABLE door is 

not available to be closed. Required Actions C.1 and C.2 are the 

appropriate remedial actions. The exception of Note 1 does not affect 

tracking the Completion Time from the initial entry into Condition A; only 

the requirement to comply with the Required Actions. Note 2 allows use 

of the air lock for entry and exit for 7 days under administrative controls if 

both air locks have an inoperable door. This 7 day restriction begins 

when the second air lock is discovered inoperable. Containment entry 

may be required on a periodic basis to perform Technical Specifications 

(TS) Surveillances and Required Actions, as well as other activities on 

equipment inside containment that are required by TS or activities on 

equipment that support TS-required equipment. This Note is not intended 

to preclude performing other activities (i.e., non-TS required activities) if 

the containment is entered, using the inoperable air lock, to perform an 

allowed activity listed above. This allowance is acceptable due to the low 

probability of an event that could pressurize the containment during the 

short time that the OPERABLE door is expected to be open.

B.1, B.2, and B.3

With an air lock interlock mechanism inoperable in one or more air locks, 

the Required Actions and associated Completion Times are consistent 

with those specified in Condition A.

The Required Actions have been modified by two Notes. Note 1 ensures 

that only the Required Actions and associated Completion Times of 

Condition C are required if both doors in the same air lock are inoperable. 

With both doors in the same air lock inoperable, an OPERABLE door is 

not available to be closed. Required Actions C.1 and C.2 are the 

appropriate remedial actions. Note 2 allows entry into and exit from 

containment under the control of a dedicated individual stationed at the 

air lock to ensure that only one door is opened at a time (i.e., the 

individual performs the function of the interlock).

Required Action B.3 is modified by a Note that applies to air lock doors 

located in high radiation areas and allows these doors to be verified 

locked closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since access to these 

areas is typically restricted. Therefore, the probability of misalignment of 

the door, once it has been verified to be in the proper position, is small.
Containment Air Locks (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.2

Westinghouse STS B 3.6.2-5 Rev. 4.0

BASES

ACTIONS (continued)

C.1, C.2, and C.3

With one or more air locks inoperable for reasons other than those 

described in Condition A or B, Required Action C.1 requires action to be 

initiated immediately to evaluate previous combined leakage rates using 

current air lock test results. An evaluation is acceptable, since it is overly 

conservative to immediately declare the containment inoperable if both 

doors in an air lock have failed a seal test or if the overall air lock leakage 

is not within limits. In many instances (e.g., only one seal per door has 

failed), containment remains OPERABLE, yet only 1 hour (per LCO 3.6.1) 

would be provided to restore the air lock door to OPERABLE status prior 

to requiring a plant shutdown. In addition, even with both doors failing the 

seal test, the overall containment leakage rate can still be within limits.

Required Action C.2 requires that one door in the affected containment air 

lock must be verified to be closed within the 1 hour Completion Time. 

This specified time period is consistent with the ACTIONS of LCO 3.6.1, 

which requires that containment be restored to OPERABLE status within 

1 hour.

Additionally, the affected air lock(s) must be restored to OPERABLE 

status within the 24 hour Completion Time. The specified time period is 

considered reasonable for restoring an inoperable air lock to OPERABLE 

status, assuming that at least one door is maintained closed in each 

affected air lock.

D.1 and D.2

If the inoperable containment air lock cannot be restored to OPERABLE 

status within the required Completion Time, the plant must be brought to 

a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 6 hours and to MODE 5 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.2.1

REQUIREMENTS

Maintaining containment air locks OPERABLE requires compliance with 

the leakage rate test requirements of the Containment Leakage Rate 

Testing Program. This SR reflects the leakage rate testing requirements 

with regard to air lock leakage (Type B leakage tests). The acceptance 

criteria were established during initial air lock and containment 

OPERABILITY testing. The periodic testing requirements verify that the 
Containment Air Locks (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.2

Westinghouse STS B 3.6.2-6 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

air lock leakage does not exceed the allowed fraction of the overall 

containment leakage rate. The Frequency is required by the Containment 

Leakage Rate Testing Program.

The SR has been modified by two Notes. Note 1 states that an 

inoperable air lock door does not invalidate the previous successful 

performance of the overall air lock leakage test. This is considered 

reasonable since either air lock door is capable of providing a fission 

product barrier in the event of a DBA. Note 2 has been added to this SR 

requiring the results to be evaluated against the acceptance criteria which 

is applicable to SR 3.6.1.1. This ensures that air lock leakage is properly 

accounted for in determining the combined Type B and C containment 

leakage rate.

[ SR 3.6.2.2

The air lock interlock is designed to prevent simultaneous opening of both 

doors in a single air lock. Since both the inner and outer doors of an air 

lock are designed to withstand the maximum expected post accident 

containment pressure, closure of either door will support containment 

OPERABILITY. Thus, the door interlock feature supports containment 

OPERABILITY while the air lock is being used for personnel transit in and 

out of the containment. Periodic testing of this interlock demonstrates 

that the interlock will function as designed and that simultaneous opening 

of the inner and outer doors will not inadvertently occur. [ Due to the 

purely mechanical nature of this interlock, and given that the interlock 

mechanism is not normally challenged when the containment air lock 

door is used for entry and exit (procedures require strict adherence to 

single door opening), this test is only required to be performed every 

24 months. The 24 month Frequency is based on the need to perform 

this Surveillance under the conditions that apply during a plant outage, 

and the potential for loss of containment OPERABILITY if the 

Surveillance were performed with the reactor at power. The 24 month 

Frequency for the interlock is justified based on generic operating 

experience. The 24 month Frequency is based on engineering judgment 

and is considered adequate given that the interlock is not challenged 

during the use of the airlock.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Containment Air Locks (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.2

Westinghouse STS B 3.6.2-7 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix J, Option [A][B].

2. FSAR, Section [6.2].

Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.3 Containment Isolation Valves (Atmospheric, Subatmospheric, Ice Condenser, and 

 Dual)

BASES

BACKGROUND The containment isolation valves form part of the containment pressure 

boundary and provide a means for fluid penetrations not serving accident 

consequence limiting systems to be provided with two isolation barriers 

that are closed on a containment isolation signal. These isolation devices 

are either passive or active (automatic). Manual valves, de-activated 

automatic valves secured in their closed position (including check valves 

with flow through the valve secured), blind flanges, and closed systems 

are considered passive devices. Check valves, or other automatic valves 

designed to close without operator action following an accident, are 

considered active devices. Two barriers in series are provided for each 

penetration so that no single credible failure or malfunction of an active 

component can result in a loss of isolation or leakage that exceeds limits 

assumed in the safety analyses. One of these barriers may be a closed 

system. These barriers (typically containment isolation valves) make up 

the Containment Isolation System.

Automatic isolation signals are produced during accident conditions. 

Containment Phase "A" isolation occurs upon receipt of a safety injection 

signal. The Phase "A" isolation signal isolates nonessential process lines 

in order to minimize leakage of fission product radioactivity. Containment 

Phase "B" isolation occurs upon receipt of a containment pressure HighHigh signal and isolates the remaining process lines, except systems 

required for accident mitigation. In addition to the isolation signals listed 

above, the purge and exhaust valves receive an isolation signal on a 

containment high radiation condition. As a result, the containment 

isolation valves (and blind flanges) help ensure that the containment 

atmosphere will be isolated from the environment in the event of a 

release of fission product radioactivity to the containment atmosphere as 

a result of a Design Basis Accident (DBA).

The OPERABILITY requirements for containment isolation valves help 

ensure that containment is isolated within the time limits assumed in the 

safety analyses. Therefore, the OPERABILITY requirements provide 

assurance that the containment function assumed in the safety analyses 

will be maintained.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-2 Rev. 4.0

BASES

BACKGROUND (continued)

Shutdown Purge System ([42] inch purge valves)

The Shutdown Purge System operates to supply outside air into the 

containment for ventilation and cooling or heating and may also be used 

to reduce the concentration of noble gases within containment prior to 

and during personnel access. The supply and exhaust lines each contain 

two isolation valves. Because of their large size, the [42] inch purge 

valves in some units are not qualified for automatic closure from their 

open position under DBA conditions. Therefore, the [42] inch purge 

valves are normally maintained closed in MODES 1, 2, 3, and 4 to ensure 

the containment boundary is maintained.

Minipurge System ([8] inch purge valves)

The Minipurge System operates to:

a. Reduce the concentration of noble gases within containment prior to 

and during personnel access and

b. Equalize internal and external pressures.

Since the valves used in the Minipurge System are designed to meet the 

requirements for automatic containment isolation valves, these valves 

may be opened as needed in MODES 1, 2, 3, and 4.

APPLICABLE The containment isolation valve LCO was derived from the assumptions

SAFETY related to minimizing the loss of reactor coolant inventory and

ANALYSES establishing the containment boundary during major accidents. As part of 

the containment boundary, containment isolation valve OPERABILITY 

supports leak tightness of the containment. Therefore, the safety 

analyses of any event requiring isolation of containment is applicable to 

this LCO.

The DBAs that result in a release of radioactive material within 

containment are a loss of coolant accident (LOCA) and a rod ejection 

accident (Ref. 1). In the analyses for each of these accidents, it is 

assumed that containment isolation valves are either closed or function to 

close within the required isolation time following event initiation. This 

ensures that potential paths to the environment through containment 

isolation valves (including containment purge valves) are minimized. The 

safety analyses assume that the [42] inch purge valves are closed at 

event initiation.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The DBA analysis assumes that, within 60 seconds after the accident, 

isolation of the containment is complete and leakage terminated except 

for the design leakage rate, La. The containment isolation total response 

time of 60 seconds includes signal delay, diesel generator startup (for 

loss of offsite power), and containment isolation valve stroke times.

[ The single failure criterion required to be imposed in the conduct of plant 

safety analyses was considered in the original design of the containment 

purge valves. Two valves in series on each purge line provide assurance 

that both the supply and exhaust lines could be isolated even if a single 

failure occurred. The inboard and outboard isolation valves on each line 

are provided with diverse power sources, motor operated and 

pneumatically operated spring closed, respectively. This arrangement 

was designed to preclude common mode failures from disabling both 

valves on a purge line. ]

[ The purge valves may be unable to close in the environment following a 

LOCA. Therefore, each of the purge valves is required to remain sealed 

closed during MODES 1, 2, 3, and 4. In this case, the single failure 

criterion remains applicable to the containment purge valves due to failure 

in the control circuit associated with each valve. Again, the purge system 

valve design precludes a single failure from compromising the 

containment boundary as long as the system is operated in accordance 

with the subject LCO. ]

The containment isolation valves satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO Containment isolation valves form a part of the containment boundary. 

The containment isolation valves' safety function is related to minimizing 

the loss of reactor coolant inventory and establishing the containment 

boundary during a DBA.

The automatic power operated isolation valves are required to have 

isolation times within limits and to actuate on an automatic isolation 

signal. The [42] inch purge valves must be maintained sealed closed [or 

have blocks installed to prevent full opening]. [Blocked purge valves also 

actuate on an automatic signal.] The valves covered by this LCO are 

listed along with their associated stroke times in the FSAR (Ref. 2).

The normally closed isolation valves are considered OPERABLE when 

manual valves are closed, automatic valves are de-activated and secured 

in their closed position, blind flanges are in place, and closed systems are 

intact. These passive isolation valves/devices are those listed in 

Reference 2.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-4 Rev. 4.0

BASES

LCO (continued)

Purge valves with resilient seals [and secondary containment bypass 

valves] must meet additional leakage rate requirements. The other 

containment isolation valve leakage rates are addressed by LCO 3.6.1, 

"Containment," as Type C testing.

This LCO provides assurance that the containment isolation valves and 

purge valves will perform their designed safety functions to minimize the 

loss of reactor coolant inventory and establish the containment boundary 

during accidents.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, the containment 

isolation valves are not required to be OPERABLE in MODE 5. The 

requirements for containment isolation valves during MODE 6 are 

addressed in LCO 3.9.4, "Containment Penetrations."

ACTIONS The ACTIONS are modified by a Note allowing penetration flow paths, 

except for [42] inch purge valve penetration flow paths, to be unisolated 

intermittently under administrative controls. These administrative controls 

consist of stationing a dedicated operator at the valve controls, who is in 

continuous communication with the control room. In this way, the 

penetration can be rapidly isolated when a need for containment isolation 

is indicated. Due to the size of the containment purge line penetration 

and the fact that those penetrations exhaust directly from the containment 

atmosphere to the environment, the penetration flow path containing 

these valves may not be opened under administrative controls. A single 

purge valve in a penetration flow path may be opened to effect repairs to 

an inoperable valve, as allowed by SR 3.6.3.1.

A second Note has been added to provide clarification that, for this LCO, 

separate Condition entry is allowed for each penetration flow path. This 

is acceptable, since the Required Actions for each Condition provide 

appropriate compensatory actions for each inoperable containment 

isolation valve. Complying with the Required Actions may allow for 

continued operation, and subsequent inoperable containment isolation 

valves are governed by subsequent Condition entry and application of 

associated Required Actions.

The ACTIONS are further modified by a third Note, which ensures 

appropriate remedial actions are taken, if necessary, if the affected 

systems are rendered inoperable by an inoperable containment isolation 

valve.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-5 Rev. 4.0

BASES

ACTIONS (continued)

In the event the isolation valve leakage results in exceeding the overall 

containment leakage rate, Note 4 directs entry into the applicable 

Conditions and Required Actions of LCO 3.6.1.

----------------------------------REVIEWERS NOTE-------------------------------------

Conditions A and B may be combined into one Condition that addresses 

both the containment isolation valve pressure boundary intact and 

containment isolation valve pressure boundary not intact by specifying the 

limiting Completion Time for each configuration identified in Tables D-1, 

D-2, and D-3 of Reference 4.

--------------------------------------------------------------------------------------------------

[ A.1 and A.2

Condition A is applicable to penetration flow paths with two [or more] 

containment isolation valves, and penetration flow paths with only one 

containment isolation valve and a closed system. The closed system 

must meet the requirements of Reference 3. 

In the event one containment isolation valve in one or more penetration 

flow paths is inoperable, [except for purge valve or shield building bypass 

leakage not within limit], and the containment isolation valve pressure 

boundary is intact, the affected penetration flow path must be isolated. 

The containment isolation valve pressure boundary is considered to be 

intact when the inoperable containment isolation valve is capable of 

maintaining the boundary between the contained fluid and the 

containment or outside atmosphere. An example of when a containment 

isolation valve would be inoperable and the pressure boundary is 

considered to be intact is when work is being performed on a valve 

actuator. The method of isolation must include the use of at least one 

isolation barrier that cannot be adversely affected by a single active 

failure. Isolation barriers that meet this criterion are a closed and deactivated automatic containment isolation valve, a closed manual valve, a 

blind flange, and a check valve with flow through the valve secured. For 

a penetration flow path isolated in accordance with Required Action A.1, 

the device used to isolate the penetration should be the closest available 

one to containment. Required Action A.1 must be completed within the 

Completion Time specified for each Category of containment isolation 

valve identified in [a licensee controlled document]. The Completion Time 

is justified in Reference 4.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-6 Rev. 4.0

BASES

ACTIONS (continued)

----------------------------------REVIEWERS NOTE-------------------------------------

Conditions A and B may be combined into one Condition that addresses 

both the containment isolation valve pressure boundary intact and 

containment isolation valve pressure boundary not intact by specifying the 

limiting Completion Time for each configuration identified in Tables D-1, 

D-2, and D-3 of Reference 4.

The plant specific determination of the containment isolation valve 

Completion Time categories is performed by comparing the plant specific 

penetration types to the generic penetration types evaluated that are 

identified in Tables D-1, D-2, and D-3 of Reference 4. 

The plant specific application of the generic analysis that justified the 

generic Completion Time categories is discussed in Section 9.0 of 

Reference 4.

Plant specific Completion Time categories may also be calculated in lieu 

of the generic Completion Time categories. This approach is discussed 

in Section 10.0 of Reference 4.

For plants not adopting the risk-informed extended Completion Time for 

containment isolation valves, a Completion Time of 4 hours is maintained. 

The 4 hour Completion Time is reasonable, considering the time required 

to isolate the penetration and the relative importance of supporting 

containment OPERABILITY during MODES 1, 2, 3, and 4. A Condition 

for one or more penetration flow paths with one containment isolation 

valve inoperable for penetrations with one containment isolation valve

and a closed system would be required.

--------------------------------------------------------------------------------------------------

For affected penetration flow paths that cannot be restored to 

OPERABLE status within the specified Completion Time and that have 

been isolated in accordance with Required Action A.1, the affected 

penetration flow paths must be verified to be isolated on a periodic basis. 

This is necessary to ensure that containment penetrations required to be 

isolated following an accident and no longer capable of being 

automatically isolated will be in the isolation position should an event 

occur. This Required Action does not require any testing or device 

manipulation. Rather, it involves verification that those isolation devices 

outside containment and capable of being mispositioned are in the correct 

position. The Completion Time of "once per 31 days for isolation devices 

outside containment" is appropriate considering the fact that the devices 

are operated under administrative controls and the probability of their 

misalignment is low. For the isolation devices inside containment, the 

time period specified as "prior to entering MODE 4 from MODE 5 if not 
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-7 Rev. 4.0

BASES

ACTIONS (continued)

performed within the previous 92 days" is based on engineering judgment 

and is considered reasonable in view of the inaccessibility of the isolation 

devices and other administrative controls that will ensure that isolation 

device misalignment is an unlikely possibility.

Required Action A.2 is modified by two Notes. Note 1 applies to isolation 

devices located in high radiation areas and allows these devices to be 

verified closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since access to these 

areas is typically restricted. Note 2 applies to isolation devices that are 

locked, sealed, or otherwise secured in position and allows these devices 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. Therefore, the probability of 

misalignment of these devices once they have been verified to be in the 

proper position, is small. ]

[ B.1 and B.2

Condition B is applicable to penetration flow paths with two [or more] 

containment isolation valves, and penetration flow paths with only one 

containment isolation valve and a closed system. The closed system 

must meet the requirements of Reference 3.

In the event one containment isolation valve in one or more penetration 

flow paths is inoperable, [except for purge valve or shield building bypass 

leakage not within limit,] and the containment isolation valve pressure 

boundary is not intact, the affected penetration flow path must be isolated. 

The containment isolation valve pressure boundary is considered not to 

be intact when the inoperable containment isolation valve is not capable 

of maintaining the boundary between the contained fluid and the 

containment or outside atmosphere. The method of isolation must 

include the use of at least one isolation barrier that cannot be adversely 

affected by a single active failure. Isolation barriers that meet this 

criterion are a closed and de-activated automatic containment isolation 

valve, a closed manual valve, a blind flange, and a check valve with flow 

through the valve secured. For a penetration flow path isolated in 

accordance with Required Action B.1, the device used to isolate the 

penetration should be the closest available one to containment. Required 

Action B.1 must be completed within [the Completion Time specified for 

each Category of containment isolation valve identified in [a licensee 

controlled document]. The Completion Time is justified in Reference 4.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-8 Rev. 4.0

BASES

ACTIONS (continued)

----------------------------------REVIEWERS NOTE-------------------------------------

Conditions A and B may be combined into one Condition that addresses 

both the containment isolation valve pressure boundary intact and 

containment isolation valve pressure boundary not intact by specifying the 

limiting Completion Time for each configuration identified in Tables D-1, 

D-2, and D-3 of Reference 4.

The plant specific determination of the containment isolation valve 

Completion Time categories is performed by comparing the plant specific 

penetration types to the generic penetration types evaluated that are 

identified in Tables D-1, D-2, and D-3 of Reference 4. 

The plant specific application of the generic analysis that justified the 

generic Completion Time categories is discussed in Section 9.0 of 

Reference 4.

Plant specific Completion Time categories may also be calculated in lieu 

of the generic Completion Time categories. This approach is discussed 

in Section 10.0 of Reference 4.

For plants not adopting the risk-informed extended Completion Time for 

containment isolation valves, a Completion Time of 4 hours is maintained. 

The 4 hour Completion Time is reasonable, considering the time required 

to isolate the penetration and the relative importance of supporting 

containment OPERABILITY during MODES 1, 2, 3, and 4. A Condition 

for one or more penetration flow paths with one containment isolation 

valve inoperable for penetrations with one containment isolation valve 

and a closed system would be required.

--------------------------------------------------------------------------------------------------

For affected penetration flow paths that cannot be restored to 

OPERABLE status within the specified Completion Time and that have 

been isolated in accordance with Required Action B.1, the affected 

penetration flow paths must be verified to be isolated on a periodic basis. 

This is necessary to ensure that containment penetrations required to be 

isolated following an accident and no longer capable of being 

automatically isolated, will be in an isolated position should an event 

occur. This Required Action does not require any testing or device 

manipulation. Rather, it involves verification that those isolation devices 

outside containment and capable of being mispositioned, are in the 

correct position. The Completion Time of "once per 31 days for isolation 

devices outside containment" is appropriate considering the fact that the

devices are operated under administrative controls and the probability of 

their misalignment is low. For isolation devices inside containment, the 

time period specified as "prior to entering MODE 4 from MODE 5 if not 
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-9 Rev. 4.0

BASES

ACTIONS (continued)

performed within the previous 92 days" is based on engineering 

judgment, and is considered reasonable in view of the inaccessibility of 

the isolation devices and other administrative controls that will ensure that 

isolation device misalignment is an unlikely possibility. 

Required Action B.2 is modified by two Notes. Note 1 applies to isolation 

devices located in high radiation areas and allows these devices to be 

verified closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since access to these 

areas is typically restricted. Note 2 applies to isolation devices that are 

locked, sealed, or otherwise secured in position and allows these devices 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that the devices are 

not inadvertently repositioned. Therefore, the probability of misalignment 

of these devices once they have been verified to be in the proper position 

is small. ]

C.1

With two [or more] containment isolation valves in one or more 

penetration flow paths inoperable, [except for purge valve or shield 

building bypass leakage not within limit,] the affected penetration flow 

path must be isolated within 1 hour. The method of isolation must include 

the use of at least one isolation barrier that cannot be adversely affected 

by a single active failure. Isolation barriers that meet this criterion are a 

closed and de-activated automatic valve, a closed manual valve, and a 

blind flange. The 1 hour Completion Time is consistent with the 

ACTIONS of LCO 3.6.1. In the event the affected penetration is isolated 

in accordance with Required Action C.1, the affected penetration must be 

verified to be isolated on a periodic basis per Required Action A.2 or B.2, 

which remains in effect. This periodic verification is necessary to assure 

leak tightness of containment and that penetrations requiring isolation 

following an accident are isolated. The Completion Time of once per 

31 days for verifying each affected penetration flow path is isolated is 

appropriate considering the fact that the valves are operated under 

administrative control and the probability of their misalignment is low.

Condition C is modified by a Note indicating this Condition is only 

applicable to penetration flow paths with two [or more] containment 

isolation valves. 
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-10 Rev. 4.0

BASES

ACTIONS (continued)

D.1

----------------------------------REVIEWERS NOTE-------------------------------------

The analysis in Reference 4 evaluated each CIV in each penetration 

individually and determines an acceptable Completion Time based on the 

ICLERP and ΔLERF for each CIV. It is assumed that only a single CIV is

inoperable in one penetration flow path. If plant specific analyses are 

performed to evaluate multiple inoperable CIVs in separate penetration 

flow paths, Condition D should be revised to reflect the plant specific 

analyses.

--------------------------------------------------------------------------------------------------

In the event one containment isolation valve in two or more penetration 

flow paths is inoperable [except for purge valve or shield building bypass 

leakage not within limit], all but one of the affected penetration flow 

path(s) must be isolated. The method of isolation must include the use of 

at least one isolation barrier that cannot be adversely affected by a single 

active failure. Isolation barriers that meet this criterion are a closed and 

de-activated automatic containment isolation valve, a closed manual 

valve, a blind flange, and a check valve with flow through the valve 

secured. For a penetration flow path isolated in accordance with 

Required Action D.1, the device used to isolate the penetration should be 

the closest available one to containment. Required Action D.1 must be

completed within 4 hours. For subsequent containment isolation valve 

inoperabilities, the Required Action and Completion Time continue to 

apply to each additional containment isolation valve inoperability, with the 

Completion Time based on each subsequent entry into the Condition 

consistent with Note 2 to the ACTIONS Table (e.g., for each entry into the 

Condition). Each containment isolation valve(s) that is (are) declared 

inoperable for subsequent Condition D entries shall meet the Required 

Action and Completion Time. For the penetration flow paths isolated in 

accordance with Required Action D.1, the affected penetration(s) must be 

verified to be isolated on a periodic basis per Required Action A.2 

[or B.2], which remains in effect. This periodic verification is necessary to 

assure that the penetrations requiring isolation following an accident are 

isolated. The 4 hour Completion Time is reasonable, considering the time 

required to isolate the penetration and the relative importance of 

supporting Containment OPERABILITY during MODES 1, 2, 3, and 4.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-11 Rev. 4.0

BASES

ACTIONS (continued)

[ E.1

With the shield building bypass leakage rate (SR 3.6.3.11) [or purge valve 

leakage rate (SR 3.6.3.7)] not within limit, the assumptions of the safety 

analyses are not met. Therefore, the leakage must be restored to within 

limit. Restoration can be accomplished by isolating the penetration(s) 

that caused the limit to be exceeded by use of one closed and deactivated automatic valve, closed manual valve, or blind flange. When a 

penetration is isolated the leakage rate for the isolated penetration is 

assumed to be the actual pathway leakage through the isolation device. 

If two isolation devices are used to isolate the penetration, the leakage 

rate is assumed to be the lesser actual pathway leakage of the two 

devices. The 4 hour Completion Time for shield building bypass leakage 

is reasonable considering the time required to restore the leakage by 

isolating the penetration(s) and the relative importance of secondary 

containment bypass leakage to the overall containment function. [The 24 

hour Completion time for purge valve leakage is acceptable considering 

the purge valves remain closed so that a gross breach of the containment 

does not exist.]

-----------------------------------REVIEWER’S NOTE-----------------------------------

[The bracketed options provided in ACTION E reflect options in plant 

design and options in adopting the associated leakage rate Surveillances.

The options (in both ACTION E and ACTION F) for purge valve leakage, 

are based primarily on the design - if leakage rates can be measured 

separately for each purge valve, ACTION F is intended to apply. This 

would be required to be able to implement Required Action F.3. Should 

the design allow only for leak testing both purge valves simultaneously, 

then the Completion Time for ACTION E should include the "24 hours for 

purge valve leakage" and ACTION F should be eliminated.] ]

--------------------------------------------------------------------------------------------------

[ F.1, F.2, and F.3

In the event one or more containment purge valves in one or more 

penetration flow paths are not within the purge valve leakage limits, purge 

valve leakage must be restored to within limits, or the affected penetration 

flow path must be isolated. The method of isolation must be by the use of 

at least one isolation barrier that cannot be adversely affected by a single 

active failure. Isolation barriers that meet this criterion are a [closed and 

de-activated automatic valve, closed manual valve, or blind flange]. A 

purge valve with resilient seals utilized to satisfy Required Action F.1
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-12 Rev. 4.0

BASES

ACTIONS (continued)

must have been demonstrated to meet the leakage requirements of 

SR 3.6.3.7. The specified Completion Time is reasonable, considering 

that one containment purge valve remains closed so that a gross breach 

of containment does not exist.

In accordance with Required Action F.2, this penetration flow path must 

be verified to be isolated on a periodic basis. The periodic verification is 

necessary to ensure that containment penetrations required to be isolated 

following an accident, which are no longer capable of being automatically 

isolated, will be in the isolation position should an event occur. This 

Required Action does not require any testing or valve manipulation. 

Rather, it involves verification that those isolation devices outside 

containment capable of being mispositioned are in the correct position. 

For the isolation devices inside containment, the time period specified as 

"prior to entering MODE 4 from MODE 5 if not performed within the 

previous 92 days" is based on engineering judgment and is considered 

reasonable in view of the inaccessibility of the isolation devices and other 

administrative controls that will ensure that isolation device misalignment 

is an unlikely possibility.

For the containment purge valve with resilient seal that is isolated in 

accordance with Required Action F.1, SR 3.6.3.7 must be performed at 

least once every [92] days. This assures that degradation of the resilient 

seal is detected and confirms that the leakage rate of the containment 

purge valve does not increase during the time the penetration is isolated. 

The normal Frequency for SR 3.6.3.7, 184 days, is based on an NRC 

initiative, Generic Issue B-20 (Ref. 5). Since more reliance is placed on a 

single valve while in this Condition, it is prudent to perform the SR more 

often. Therefore, a Frequency of once per [92] days was chosen and has 

been shown to be acceptable based on operating experience.

Required Action F.2 is modified by two Notes. Note 1 applies to isolation 

devices located in high radiation areas and allows these devices to be 

verified closed by use of administrative means. Allowing verification by 

administrative means is considered acceptable, since access to these 

areas is typically restricted. Note 2 applies to isolation devices that are 

locked, sealed, or otherwise secured in position and allows these devices 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since the function of 

locking, sealing, or securing components is to ensure that these devices 

are not inadvertently repositioned. ]
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-13 Rev. 4.0

BASES

ACTIONS (continued)

G.1 and G.2

If the Required Actions and associated Completion Times are not met, 

the plant must be brought to a MODE in which the LCO does not apply. 

To achieve this status, the plant must be brought to at least MODE 3 

within 6 hours and to MODE 5 within 36 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required plant conditions from full power conditions in an orderly manner 

and without challenging plant systems.

SURVEILLANCE [ SR 3.6.3.1

REQUIREMENTS

Each [42] inch containment purge valve is required to be verified sealed 

closed. This Surveillance is designed to ensure that a gross breach of 

containment is not caused by an inadvertent or spurious opening of a 

containment purge valve. Detailed analysis of the purge valves failed to 

conclusively demonstrate their ability to close during a LOCA in time to 

limit offsite doses. Therefore, these valves are required to be in the 

sealed closed position during MODES 1, 2, 3, and 4. A containment 

purge valve that is sealed closed must have motive power to the valve 

operator removed. This can be accomplished by de-energizing the 

source of electric power or by removing the air supply to the valve 

operator. In this application, the term "sealed" has no connotation of leak 

tightness. [ The Frequency of 31 days is a result of an NRC initiative, 

Generic Issue B-24 (Ref. 6), related to containment purge valve use 

during plant operations. In the event purge valve leakage requires entry 

into Condition E, the Surveillance permits opening one purge valve in a 

penetration flow path to perform repairs.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-14 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.6.3.2

This SR ensures that the minipurge valves are closed as required or, if 

open, open for an allowable reason. If a purge valve is open in violation 

of this SR, the valve is considered inoperable. If the inoperable valve is 

not otherwise known to have excessive leakage when closed, it is not 

considered to have leakage outside of limits. The SR is not required to 

be met when the minipurge valves are open for the reasons stated. The 

valves may be opened for pressure control, ALARA or air quality 

considerations for personnel entry, or for Surveillances that require the 

valves to be open. The minipurge valves are capable of closing in the 

environment following a LOCA. Therefore, these valves are allowed to be 

open for limited periods of time. [ The 31 day Frequency is consistent 

with other containment isolation valve requirements discussed in 

SR 3.6.3.3.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

SR 3.6.3.3

This SR requires verification that each containment isolation manual 

valve and blind flange located outside containment and not locked, 

sealed, or otherwise secured and required to be closed during accident 

conditions is closed. The SR helps to ensure that post accident leakage 

of radioactive fluids or gases outside of the containment boundary is 

within design limits. This SR does not require any testing or valve 

manipulation. Rather, it involves verification that those containment 

isolation valves outside containment and capable of being mispositioned 

are in the correct position. [ Since verification of valve position for 

containment isolation valves outside containment is relatively easy, the 

31 day Frequency is based on engineering judgment and was chosen to 

provide added assurance of the correct positions. 
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-15 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR specifies that containment isolation valves that are open under 

administrative controls are not required to meet the SR during the time 

the valves are open. This SR does not apply to valves that are locked, 

sealed, or otherwise secured in the closed position, since these were 

verified to be in the correct position upon locking, sealing, or securing.

The Note applies to valves and blind flanges located in high radiation 

areas and allows these devices to be verified closed by use of 

administrative means. Allowing verification by administrative means is 

considered acceptable, since access to these areas is typically restricted 

during MODES 1, 2, 3, and 4 for ALARA reasons. Therefore, the 

probability of misalignment of these containment isolation valves, once 

they have been verified to be in the proper position, is small.

SR 3.6.3.4

This SR requires verification that each containment isolation manual 

valve and blind flange located inside containment and not locked, sealed, 

or otherwise secured and required to be closed during accident conditions 

is closed. The SR helps to ensure that post accident leakage of 

radioactive fluids or gases outside of the containment boundary is within 

design limits. For containment isolation valves inside containment, the 

Frequency of "prior to entering MODE 4 from MODE 5 if not performed 

within the previous 92 days" is appropriate since these containment 

isolation valves are operated under administrative controls and the 

probability of their misalignment is low. The SR specifies that 

containment isolation valves that are open under administrative controls 

are not required to meet the SR during the time they are open. This SR 

does not apply to valves that are locked, sealed, or otherwise secured in 

the closed position, since these were verified to be in the correct position 

upon locking, sealing, or securing.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-16 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This Note allows valves and blind flanges located in high radiation areas 

to be verified closed by use of administrative means. Allowing verification 

by administrative means is considered acceptable, since access to these 

areas is typically restricted during MODES 1, 2, 3, and 4, for ALARA 

reasons. Therefore, the probability of misalignment of these containment 

isolation valves, once they have been verified to be in their proper 

position, is small.

SR 3.6.3.5

Verifying that the isolation time of each automatic power operated 

containment isolation valve is within limits is required to demonstrate 

OPERABILITY. The isolation time test ensures the valve will isolate in a 

time period less than or equal to that assumed in the safety analyses. 

-----------------------------------REVIEWER’S NOTE-----------------------------------

If the testing is within the scope of the licensee's Inservice Testing 

Program, the Frequency "In accordance with the Inservice Testing 

Program" should be used. Otherwise, the periodic Frequency of 92 days 

or the reference to the Surveillance Frequency Control Program should 

be used.

--------------------------------------------------------------------------------------------------

[ The [isolation time and] Frequency of this SR is in accordance with [the 

Inservice Testing Program] [92 days.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.] ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.6.3.6

In subatmospheric containments, the check valves that serve a 

containment isolation function are weight or spring loaded to provide 

positive closure in the direction of flow. This ensures that these check 

valves will remain closed when the inside containment atmosphere 
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-17 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

returns to subatmospheric conditions following a DBA. SR 3.6.3.6 

requires verification of the operation of the check valves that are testable 

during unit operation. [ The Frequency of 92 days is consistent with the 

Inservice Testing Program requirement for valve testing on a 92 day 

Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

[ SR 3.6.3.7

For containment purge valves with resilient seals, additional leakage rate 

testing beyond the test requirements of 10 CFR 50, Appendix J, Option 

[A][B], is required to ensure OPERABILITY. Operating experience has 

demonstrated that this type of seal has the potential to degrade in a 

shorter time period than do other seal types. [ Based on this observation 

and the importance of maintaining this penetration leak tight (due to the 

direct path between containment and the environment), a Frequency of 

184 days was established as part of the NRC resolution of Generic 

Issue B-20, "Containment Leakage Due to Seal Deterioration" (Ref. 5).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

Additionally, this SR must be performed within 92 days after opening the 

valve. The 92 day Frequency was chosen recognizing that cycling the 
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-18 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

valve could introduce additional seal degradation (beyond that occurring 

to a valve that has not been opened). Thus, decreasing the interval is a 

prudent measure after a valve has been opened. ]

SR 3.6.3.8

Automatic containment isolation valves close on a containment isolation 

signal to prevent leakage of radioactive material from containment 

following a DBA. This SR ensures that each automatic containment 

isolation valve will actuate to its isolation position on a containment 

isolation signal. This surveillance is not required for valves that are 

locked, sealed, or otherwise secured in the required position under 

administrative controls. [ The [18] month Frequency is based on the need

to perform this Surveillance under the conditions that apply during a plant 

outage and the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. Operating experience has 

shown that these components usually pass this Surveillance when 

performed at the [18] month Frequency. Therefore, the Frequency was 

concluded to be acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.6.3.9

In subatmospheric containments, the check valves that serve a 

containment isolation function are weight or spring loaded to provide 

positive closure in the direction of flow. This ensures that these check 

valves will remain closed when the inside containment atmosphere 

returns to subatmospheric conditions following a DBA. SR 3.6.3.9 verifies 

the operation of the check valves that are not testable during unit 

operation. [ The Frequency of 18 months is based on such factors as the 

inaccessibility of these valves, the fact that the unit must be shut down to 

perform the tests, and the successful results of the tests on an 18 month 

basis during past unit operation.
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-19 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

[ SR 3.6.3.10

-----------------------------------REVIEWER’S NOTE-----------------------------------

This SR is only required for those units with resilient seal purge valves 

allowed to be open during [MODE 1, 2, 3, or 4] and having blocking 

devices on the valves that are not permanently installed.

--------------------------------------------------------------------------------------------------

Verifying that each [42] inch containment purge valve is blocked to restrict 

opening to ≤ [50]% is required to ensure that the valves can close under 

DBA conditions within the times assumed in the analyses of References 1 

and 2. If a LOCA occurs, the purge valves must close to maintain 

containment leakage within the values assumed in the accident analysis. 

At other times when purge valves are required to be capable of closing 

(e.g., during movement of [recently] irradiated fuel assemblies), 

pressurization concerns are not present, thus the purge valves can be 

fully open. [ The 18 month Frequency is appropriate because the 

blocking devices are typically removed only during a refueling outage. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]
Containment Isolation Valves (Atmosperic, Subatmospheric, Ice Condenser, and Dual)

B 3.6.3

Westinghouse STS B 3.6.3-20 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.6.3.11

This SR ensures that the combined leakage rate of all shield building 

bypass leakage paths is less than or equal to the specified leakage rate. 

This provides assurance that the assumptions in the safety analysis are 

met. The leakage rate of each bypass leakage path is assumed to be the 

maximum pathway leakage (leakage through the worse of the two 

isolation valves) unless the penetration is isolated by use of one closed 

and de-activated automatic valve, closed manual valve, or blind flange. 

In this case, the leakage rate of the isolated bypass leakage path is 

assumed to be the actual pathway leakage through the isolation device. 

If both isolation valves in the penetration are closed, the actual leakage 

rate is the lesser leakage rate of the two valves. The Frequency is 

required by the Containment Leakage Rate Testing Program. This SR 

simply imposes additional acceptance criteria.

[Bypass leakage is considered part of La.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Unless specifically exempted.] ]

--------------------------------------------------------------------------------------------------

REFERENCES 1. FSAR, Section [15].

2. FSAR, Section [6.2].

3. Standard Review Plan 6.2.4.

4. WCAP-15791-A, Rev. 2, "Risk-Informed Evaluation of Extensions to 

Containment Isolation Valve Completion Times," [Date to be supplied 

later].

5. Generic Issue B-20, "Containment Leakage Due to Seal 

Deterioration."

6. Generic Issue B-24.
Containment Pressure (Atmospheric, Dual, and Ice Condenser)

B 3.6.4A

Westinghouse STS B 3.6.4A-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.4A Containment Pressure (Atmospheric, Dual, and Ice Condenser)

BASES

BACKGROUND The containment pressure is limited during normal operation to preserve 

the initial conditions assumed in the accident analyses for a loss of 

coolant accident (LOCA) or steam line break (SLB). These limits also 

prevent the containment pressure from exceeding the containment design 

negative pressure differential with respect to the outside atmosphere in 

the event of inadvertent actuation of the Containment Spray System.

Containment pressure is a process variable that is monitored and 

controlled. The containment pressure limits are derived from the input 

conditions used in the containment functional analyses and the 

containment structure external pressure analysis. Should operation occur 

outside these limits coincident with a Design Basis Accident (DBA), post 

accident containment pressures could exceed calculated values.

APPLICABLE Containment internal pressure is an initial condition used in the DBA

SAFETY analyses to establish the maximum peak containment internal pressure. 

ANALYSES The limiting DBAs considered, relative to containment pressure, are the 

LOCA and SLB, which are analyzed using computer pressure transients. 

The worst case LOCA generates larger mass and energy release than 

the worst case SLB. Thus, the LOCA event bounds the SLB event from 

the containment peak pressure standpoint (Ref. 1).

The initial pressure condition used in the containment analysis was 

[17.7] psia ([3.0] psig). This resulted in a maximum peak pressure from a 

LOCA of [53.9] psig. The containment analysis (Ref. 1) shows that the 

maximum peak calculated containment pressure, Pa, results from the 

limiting LOCA. The maximum containment pressure resulting from the 

worst case LOCA, [44.1] psig, does not exceed the containment design 

pressure, [55] psig.

The containment was also designed for an external pressure load 

equivalent to [-2.5] psig. The inadvertent actuation of the Containment 

Spray System was analyzed to determine the resulting reduction in 

containment pressure. The initial pressure condition used in this analysis 

was [-0.3] psig. This resulted in a minimum pressure inside containment 

of [-2.0] psig, which is less than the design load.
Containment Pressure (Atmospheric, Dual, and Ice Condenser)

B 3.6.4A

Westinghouse STS B 3.6.4A-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

For certain aspects of transient accident analyses, maximizing the 

calculated containment pressure is not conservative. In particular, the 

cooling effectiveness of the Emergency Core Cooling System during the 

core reflood phase of a LOCA analysis increases with increasing 

containment backpressure. Therefore, for the reflood phase, the 

containment backpressure is calculated in a manner designed to 

conservatively minimize, rather than maximize, the containment pressure 

response in accordance with 10 CFR 50, Appendix K (Ref. 2).

Containment pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO Maintaining containment pressure at less than or equal to the LCO upper 

pressure limit ensures that, in the event of a DBA, the resultant peak 

containment accident pressure will remain below the containment design 

pressure. Maintaining containment pressure at greater than or equal to 

the LCO lower pressure limit ensures that the containment will not exceed 

the design negative differential pressure following the inadvertent 

actuation of the Containment Spray System.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. Since maintaining containment pressure within 

limits is essential to ensure initial conditions assumed in the accident 

analyses are maintained, the LCO is applicable in MODES 1, 2, 3 and 4.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Therefore, maintaining containment pressure within the limits of 

the LCO is not required in MODE 5 or 6.

ACTIONS A.1

When containment pressure is not within the limits of the LCO, it must be 

restored to within these limits within 1 hour. The Required Action is 

necessary to return operation to within the bounds of the containment 

analysis. The 1 hour Completion Time is consistent with the ACTIONS of 

LCO 3.6.1, "Containment," which requires that containment be restored to 

OPERABLE status within 1 hour.
Containment Pressure (Atmospheric, Dual, and Ice Condenser)

B 3.6.4A

Westinghouse STS B 3.6.4A-3 Rev. 4.0

BASES

ACTIONS (continued)

B.1 and B.2

If containment pressure cannot be restored to within limits within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.4A.1

REQUIREMENTS

Verifying that containment pressure is within limits ensures that unit 

operation remains within the limits assumed in the containment analysis. 

[ The 12 hour Frequency of this SR was developed based on operating 

experience related to trending of containment pressure variations during 

the applicable MODES. Furthermore, the 12 hour Frequency is 

considered adequate in view of other indications available in the control 

room, including alarms, to alert the operator to an abnormal containment 

pressure condition.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50, Appendix K.

Containment Pressure (Subatmospheric)

B 3.6.4B

Westinghouse STS B 3.6.4B-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.4B Containment Pressure (Subatmospheric)

BASES

BACKGROUND Containment air partial pressure is a process variable that is monitored 

and controlled. The containment air partial pressure is maintained as a 

function of refueling water storage tank temperature and service water 

temperature according to Figure 3.6.4B-1 of the LCO, to ensure that, 

following a Design Basis Accident (DBA), the containment would

depressurize in < 60 minutes to subatmospheric conditions. Controlling 

containment partial pressure within prescribed limits also prevents the 

containment pressure from exceeding the containment design negative 

pressure differential with respect to the outside atmosphere in the event 

of an inadvertent actuation of the Quench Spray (QS) System.

The containment internal air partial pressure limits of Figure 3.6.4B-1 are 

derived from the input conditions used in the containment DBA analyses. 

Limiting the containment internal air partial pressure and temperature in 

turn limits the pressure that could be expected following a DBA, thus 

ensuring containment OPERABILITY. Ensuring containment 

OPERABILITY limits leakage of fission product radioactivity from 

containment to the environment.

APPLICABLE Containment air partial pressure is an initial condition used in the

SAFETY containment DBA analyses to establish the maximum peak containment

ANALYSES internal pressure. The limiting DBAs considered relative to containment 

pressure are the loss of coolant accident (LOCA) and steam line break 

(SLB). The LOCA and SLB are analyzed using computer codes designed 

to predict the resultant containment pressure transients. DBAs are 

assumed not to occur simultaneously or consecutively. The postulated 

DBAs are analyzed assuming degraded containment Engineered Safety 

Feature (ESF) systems (i.e., assuming the loss of one ESF bus, which is 

the worst case single active failure, resulting in one train of the QS 

System and one train of the Recirculation Spray System becoming 

inoperable). The containment analysis for the DBA (Ref. 1) shows that 

the maximum peak containment pressure, Pa, results from the limiting 

design basis LOCA.

The maximum design internal pressure for the containment is [45.0] psig. 

The initial conditions used in the containment design basis analyses were 

an air partial pressure of [12.2] psia and an air temperature of [120]°F. 

This resulted in a maximum peak containment internal pressure of 

[44.9] psig, which is less than the maximum design internal pressure for 

the containment.
Containment Pressure (Subatmospheric)

B 3.6.4B

Westinghouse STS B 3.6.4B-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The containment was also designed for an external pressure load of 

[9.2] psid (i.e., a design minimum pressure of [5.5] psia). The inadvertent 

actuation of the QS System was analyzed to determine the reduction in 

containment pressure (Ref. 1). The initial conditions used in the analysis 

were [8.6] psia and [120]°F. This resulted in a minimum pressure inside 

containment of [7.7] psia, which is considerably above the design 

minimum of [5.5] psia.

For certain aspects of transient accident analyses, maximizing the 

calculated containment pressure is not conservative. In particular, the 

cooling effectiveness of the Emergency Core Cooling System during the 

core reflood phase of a LOCA analysis increases with increasing 

containment backpressure. For the reflood phase calculations, the 

containment backpressure is calculated in a manner designed to 

conservatively minimize, rather than maximize, the containment pressure 

response in accordance with 10 CFR 50, Appendix K (Ref. 2).

Containment pressure satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO Maintaining containment pressure within the limits shown in 

Figure 3.6.4B-1 of the LCO ensures that in the event of a DBA the 

resultant peak containment accident pressure will be maintained below 

the containment design pressure. These limits also prevent the 

containment pressure from exceeding the containment design negative 

pressure differential with respect to the outside atmosphere in the event 

of inadvertent actuation of the QS System. The LCO limits also ensure 

the return to subatmospheric conditions within 60 minutes following a 

DBA.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. Since maintaining containment pressure within 

design basis limits is essential to ensure initial conditions assumed in the 

accident analyses are maintained, the LCO is applicable in MODES 1, 2, 

3, and 4.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the Reactor Coolant System pressure and temperature 

limitations of these MODES. Therefore, maintaining containment 

pressure within the limits of the LCO is not required in MODE 5 or 6.
Containment Pressure (Subatmospheric)

B 3.6.4B

Westinghouse STS B 3.6.4B-3 Rev. 4.0

BASES 

ACTIONS A.1

When containment air partial pressure is not within the limits of the LCO, 

containment pressure must be restored to within these limits within 

1 hour. The Required Action is necessary to return operation to within the 

bounds of the containment analysis. The 1 hour Completion Time is 

consistent with the ACTIONS of LCO 3.6.1, "Containment," which 

requires that containment be restored to OPERABLE status within 1 hour.

B.1 and B.2

If containment air partial pressure cannot be restored to within limits 

within the required Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.4B.1

REQUIREMENTS

Verifying that containment air partial pressure is within limits ensures that 

operation remains within the limits assumed in the containment analysis. 

[ The 12 hour Frequency of this SR was developed considering operating 

experience related to trending of containment pressure variations and 

pressure instrument drift during the applicable MODES. Furthermore, the 

12 hour Frequency is considered adequate in view of other indications 

available in the control room, including alarms, to alert the operator to an 

abnormal containment pressure condition.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Containment Pressure (Subatmospheric)

B 3.6.4B

Westinghouse STS B 3.6.4B-4 Rev. 4.0

BASES

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50, Appendix K.
Containment Air Temperature (Atmospheric and Dual)

B 3.6.5A

Westinghouse STS B 3.6.5A-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.5A Containment Air Temperature (Atmospheric and Dual)

BASES

BACKGROUND The containment structure serves to contain radioactive material that may 

be released from the reactor core following a Design Basis Accident 

(DBA). The containment average air temperature is limited during normal 

operation to preserve the initial conditions assumed in the accident 

analyses for a loss of coolant accident (LOCA) or steam line break (SLB).

The containment average air temperature limit is derived from the input 

conditions used in the containment functional analyses and the 

containment structure external pressure analyses. This LCO ensures that 

initial conditions assumed in the analysis of containment response to a 

DBA are not violated during unit operations. The total amount of energy 

to be removed from containment by the Containment Spray and Cooling 

systems during post accident conditions is dependent upon the energy 

released to the containment due to the event, as well as the initial 

containment temperature and pressure. The higher the initial 

temperature, the more energy that must be removed, resulting in higher 

peak containment pressure and temperature. Exceeding containment 

design pressure may result in leakage greater than that assumed in the 

accident analysis. Operation with containment temperature in excess of 

the LCO limit violates an initial condition assumed in the accident 

analysis.

APPLICABLE Containment average air temperature is an initial condition used in the

SAFETY DBA analyses that establishes the containment environmental

ANALYSES qualification operating envelope for both pressure and temperature. The 

limit for containment average air temperature ensures that operation is 

maintained within the assumptions used in the DBA analyses for 

containment (Ref. 1).

The limiting DBAs considered relative to containment OPERABILITY are 

the LOCA and SLB. The DBA LOCA and SLB are analyzed using 

computer codes designed to predict the resultant containment pressure 

transients. No two DBAs are assumed to occur simultaneously or 

consecutively. The postulated DBAs are analyzed with regard to 

Engineered Safety Feature (ESF) systems, assuming the loss of one ESF 

bus, which is the worst case single active failure, resulting in one train 

each of the Containment Spray System, Residual Heat Removal System, 

and Containment Cooling System being rendered inoperable.
Containment Air Temperature (Atmospheric and Dual)

B 3.6.5A

Westinghouse STS B 3.6.5A-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The limiting DBA for the maximum peak containment air temperature is 

an SLB. The initial containment average air temperature assumed in the 

design basis analyses (Ref. 1) is [120]°F. This resulted in a maximum 

containment air temperature of [384.9]°F. The design temperature is 

[320]°F.

The temperature limit is used to establish the environmental qualification 

operating envelope for containment. The maximum peak containment air 

temperature was calculated to exceed the containment design

temperature for only a few seconds during the transient. The basis of the 

containment design temperature, however, is to ensure the performance 

of safety related equipment inside containment (Ref. 2). Thermal 

analyses showed that the time interval during which the containment air 

temperature exceeded the containment design temperature was short 

enough that the equipment surface temperatures remained below the 

design temperature. Therefore, it is concluded that the calculated 

transient containment air temperature is acceptable for the DBA SLB.

The temperature limit is also used in the depressurization analyses to 

ensure that the minimum pressure limit is maintained following an 

inadvertent actuation of the Containment Spray System (Ref. 1).

The containment pressure transient is sensitive to the initial air mass in 

containment and, therefore, to the initial containment air temperature. 

The limiting DBA for establishing the maximum peak containment internal 

pressure is a LOCA. The temperature limit is used in this analysis to 

ensure that in the event of an accident the maximum containment internal 

pressure will not be exceeded.

Containment average air temperature satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO During a DBA, with an initial containment average air temperature less 

than or equal to the LCO temperature limit, the resultant accident 

temperature profile assures that the containment structural temperature is 

maintained below its design temperature and that required safety related 

equipment will continue to perform its function.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, maintaining 

containment average air temperature within the limit is not required in 

MODE 5 or 6.
Containment Air Temperature (Atmospheric and Dual)

B 3.6.5A

Westinghouse STS B 3.6.5A-3 Rev. 4.0

BASES 

ACTIONS A.1

When containment average air temperature is not within the limit of the 

LCO, it must be restored to within limit within 8 hours. This Required 

Action is necessary to return operation to within the bounds of the 

containment analysis. The 8 hour Completion Time is acceptable 

considering the sensitivity of the analysis to variations in this parameter 

and provides sufficient time to correct minor problems.

B.1 and B.2

If the containment average air temperature cannot be restored to within 

its limit within the required Completion Time, the plant must be brought to 

a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 6 hours and to MODE 5 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.5A.1

REQUIREMENTS

Verifying that containment average air temperature is within the LCO limit 

ensures that containment operation remains within the limit assumed for 

the containment analyses. In order to determine the containment 

average air temperature, an arithmetic average is calculated using 

measurements taken at locations within the containment selected to 

provide a representative sample of the overall containment atmosphere. 

[ The 24 hour Frequency of this SR is considered acceptable based on 

observed slow rates of temperature increase within containment as a 

result of environmental heat sources (due to the large volume of 

containment). Furthermore, the 24 hour Frequency is considered 

adequate in view of other indications available in the control room, 

including alarms, to alert the operator to an abnormal containment 

temperature condition.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Containment Air Temperature (Atmospheric and Dual)

B 3.6.5A

Westinghouse STS B 3.6.5A-4 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENT (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50.49.
Containment Air Temperature (Ice Condenser)

B 3.6.5B

Westinghouse STS B 3.6.5B-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.5B Containment Air Temperature (Ice Condenser)

BASES

BACKGROUND The containment structure serves to contain radioactive material that may 

be released from the reactor core following a Design Basis Accident 

(DBA). The containment average air temperature is limited, during 

normal operation, to preserve the initial conditions assumed in the 

accident analyses for a loss of coolant accident (LOCA) or steam line 

break (SLB).

The containment average air temperature limit is derived from the input 

conditions used in the containment functional analyses and the 

containment structure external pressure analyses. This LCO ensures that 

initial conditions assumed in the analysis of containment response to a 

DBA are not violated during unit operations. The total amount of energy 

to be removed from containment by the Containment Spray and Cooling 

systems during post accident conditions is dependent upon the energy 

released to the containment due to the event, as well as the initial 

containment temperature and pressure. The higher the initial 

temperature, the more energy that must be removed, resulting in a higher 

peak containment pressure and temperature. Exceeding containment 

design pressure may result in leakage greater than that assumed in the 

accident analysis. Operation with containment temperature in excess of 

the LCO limit violates an initial condition assumed in the accident 

analysis.

APPLICABLE Containment average air temperature is an initial condition used in the

SAFETY DBA analyses that establishes the containment environmental

ANALYSES qualification operating envelope for both pressure and temperature. The 

limit for containment average air temperature ensures that operation is 

maintained within the assumptions used in the DBA analyses for 

containment (Ref. 1).

The limiting DBAs considered relative to containment OPERABILITY are 

the LOCA and SLB. The DBA LOCA and SLB are analyzed using 

computer codes designed to predict the resultant containment pressure 

transients. No two DBAs are assumed to occur simultaneously or 

consecutively. The postulated DBAs are analyzed with regard to 

Engineered Safety Feature (ESF) systems, assuming the loss of one ESF 

bus, which is the worst case single active failure, resulting in one train 

each of Containment Spray System, Residual Heat Removal System, and 

Air Return System being rendered inoperable.

The limiting DBA for the maximum peak containment air temperature is 

an SLB. For the upper compartment, the initial containment average air 

temperature assumed in the design basis analyses (Ref. 1) is [110]°F. 
Containment Air Temperature (Ice Condenser)

B 3.6.5B

Westinghouse STS B 3.6.5B-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

For the lower compartment, the initial average containment air 

temperature assumed in the design basis analyses is [120]°F. This 

resulted in a maximum containment air temperature of [326]°F. The 

design temperature is [250]°F.

The temperature upper limits are used to establish the environmental

qualification operating envelope for both containment compartments. The 

maximum peak containment air temperature for both containment 

compartments was calculated to exceed the containment design 

temperature for only a few seconds during the transient. The basis of the 

containment design temperature, however, is to ensure the performance 

of safety related equipment inside containment (Ref. 2). Thermal 

analyses showed that the time interval during which the containment air 

temperature exceeded the containment design temperature was short 

enough that the equipment surface temperatures remained below the 

design temperature. Therefore, it is concluded that the calculated 

transient containment air temperatures are acceptable for the DBA SLB.

The temperature upper limits are also used in the depressurization 

analyses to ensure that the minimum pressure limit is maintained 

following an inadvertent actuation of the Containment Spray System for 

both containment compartments.

The containment pressure transient is sensitive to the initial air mass in 

containment and, therefore, to the initial containment air temperature. 

The limiting DBA for establishing the maximum peak containment internal 

pressure is a LOCA. The temperature lower limits, [85]°F for the upper 

compartment and [100]°F for the lower compartment, are used in this 

analysis to ensure that, in the event of an accident, the maximum 

containment internal pressure will not be exceeded in either containment 

compartment.

Containment average air temperature satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO During a DBA, with an initial containment average air temperature within 

the LCO temperature limits, the resultant accident temperature profile 

assures that the containment structural temperature is maintained below 

its design temperature and that required safety related equipment will 

continue to perform its function. In MODES 3 and 4, containment air 

temperature may be as low as 60°F because the resultant calculated 

peak containment accident pressure would not exceed the design 

pressure due to a lesser amount of energy released from the pipe break 

in these MODES.
Containment Air Temperature (Ice Condenser)

B 3.6.5B

Westinghouse STS B 3.6.5B-3 Rev. 4.0

BASES 

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, maintaining 

containment average air temperature within the limit is not required in 

MODE 5 or 6.

ACTIONS A.1

When containment average air temperature in the upper or lower 

compartment is not within the limit of the LCO, the average air 

temperature in the affected compartment must be restored to within limits 

within 8 hours. This Required Action is necessary to return operation to 

within the bounds of the containment analysis. The 8 hour Completion 

Time is acceptable considering the sensitivity of the analysis to variations 

in this parameter and provides sufficient time to correct minor problems.

B.1 and B.2

If the containment average air temperature cannot be restored to within 

its limits within the required Completion Time, the plant must be brought 

to a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 6 hours and to MODE 5 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.5B.1 and SR 3.6.5B.2

REQUIREMENTS

Verifying that containment average air temperature is within the LCO 

limits ensures that containment operation remains within the limits 

assumed for the containment analyses. In order to determine the 

containment average air temperature, a weighted average is calculated 

using measurements taken at locations within the containment selected to 

provide a representative sample of the overall containment atmosphere. 

[ The 24 hour Frequency of these SRs is considered acceptable based on 

observed slow rates of temperature increase within containment as a 

result of environmental heat sources (due to the large volume of 

containment). Furthermore, the 24 hour Frequency is considered 

adequate in view of other indications available in the control room, 

including alarms, to alert the operator to an abnormal containment 

temperature condition.

OR
Containment Air Temperature (Ice Condenser)

B 3.6.5B

Westinghouse STS B 3.6.5B-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50.49.
Containment Air Temperature (Subatmospheric)

B 3.6.5C

Westinghouse STS B 3.6.5C-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.5C Containment Air Temperature (Subatmospheric)

BASES

BACKGROUND The containment structure serves to contain radioactive material that may 

be released from the reactor core following a Design Basis Accident 

(DBA). The containment average air temperature is limited during normal 

operation to preserve the initial conditions assumed in the accident 

analyses for a loss of coolant accident (LOCA) or steam line break (SLB).

The containment average air temperature limit is derived from the input 

conditions used in the containment functional analyses and the 

containment structure external pressure analyses. This LCO ensures that 

initial conditions assumed in the analysis of containment response to a 

DBA are not violated during unit operations. The total amount of energy 

to be removed from containment by the Containment Spray and Cooling 

systems during post accident conditions is dependent upon the energy 

released to the containment due to the event, as well as the initial 

containment temperature and pressure. The higher the initial 

temperature, the more energy which must be removed, resulting in a 

higher peak containment pressure and temperature. Exceeding 

containment design pressure may result in leakage greater than that 

assumed in the accident analysis. Operation with containment 

temperature in excess of the LCO limit violates an initial condition 

assumed in the accident analysis.

APPLICABLE Containment average air temperature is an initial condition used in the

SAFETY DBA analyses that establishes the containment environmental

ANALYSES qualification operating envelope for both pressure and temperature. The 

limit for containment average air temperature ensures that operation is 

maintained within the assumptions used in the DBA analyses for 

containment (Ref. 1).

The limiting DBAs considered relative to containment OPERABILITY are 

the LOCA and SLB. The DBA LOCA and SLB are analyzed using 

computer codes designed to predict the resultant containment pressure 

transients. No two DBAs are assumed to occur simultaneously or 

consecutively. The postulated DBAs are analyzed with regard to 

containment Engineered Safety Feature (ESF) systems, assuming the 

loss of one ESF bus, which is the worst case single active failure, 

resulting in one train of the Quench Spray (QS) System and Recirculation 

Spray System being rendered inoperable.
Containment Air Temperature (Subatmospheric)

B 3.6.5C

Westinghouse STS B 3.6.5C-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The limiting DBA for the maximum peak containment air temperature is 

an SLB. The initial containment average air temperature assumed in the 

design basis analyses (Ref. 1) is [120]°F. This resulted in a maximum 

containment air temperature of [357]°F. The design temperature is 

[347]°F.

The temperature upper limit is used to establish the environmental 

qualification operating envelope for containment. The maximum peak 

containment air temperature was calculated to exceed the containment 

design temperature for only a few seconds during the transient. The 

basis of the containment design temperature, however, is to ensure the 

performance of safety related equipment inside containment (Ref. 2). 

Thermal analyses showed that the time interval during which the 

containment air temperature exceeded the containment design 

temperature was short enough that the equipment surface temperatures 

remained below the design temperature. Therefore, it is concluded that 

the calculated transient containment air temperature is acceptable for the 

DBA SLB.

The temperature upper limit is also used in the depressurization analyses 

to ensure that the minimum pressure limit is maintained following an 

inadvertent actuation of the QS System (Ref. 1).

The containment pressure transient is sensitive to the initial air mass in 

containment and, therefore, to the initial containment air temperature. 

The limiting DBA for establishing the maximum peak containment internal 

pressure is a LOCA. The temperature lower limit is used in this analysis 

to ensure that, in the event of an accident, the maximum containment 

internal pressure will not be exceeded.

Containment average air temperature satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO During a DBA, with an initial containment average temperature less than 

or equal to the LCO temperature limits, the resultant accident temperature 

profile assures that the containment structural temperature is maintained 

below its design temperature and that required safety related equipment 

will continue to perform its function.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment. In MODES 5 and 6, the probability and 

consequences of these events are reduced due to the pressure and 

temperature limitations of these MODES. Therefore, maintaining 

containment average air temperature within the limit is not required in 

MODE 5 or 6.
Containment Air Temperature (Subatmospheric)

B 3.6.5C

Westinghouse STS B 3.6.5C-3 Rev. 4.0

BASES 

ACTIONS A.1

When containment average air temperature is not within the limits of the 

LCO, it must be restored to within limits within 8 hours. This Required 

Action is necessary to return operation to within the bounds of the 

containment analysis. The 8 hour Completion Time is acceptable 

considering the sensitivity of the analysis to variations in this parameter 

and provides sufficient time to correct minor problems.

B.1 and B.2

If the containment average air temperature cannot be restored to within 

its limits within the required Completion Time, the plant must be brought 

to a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 6 hours and to MODE 5 

within 36 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.5C.1

REQUIREMENTS

Verifying that containment average air temperature is within the LCO 

limits ensures that containment operation remains within the limits 

assumed for the containment analyses. In order to determine the 

containment average air temperature, a weighted average is calculated 

using measurements taken at locations within containment selected to 

provide a representative sample of the overall containment atmosphere. 

[ The 24 hour Frequency of this SR is considered acceptable based on 

observed slow rates of temperature increase within containment as a 

result of environmental heat sources (due to the large volume of 

containment). Furthermore, the 24 hour Frequency is considered 

adequate in view of other indications available in the control room, 

including alarms, to alert the operator to an abnormal containment 

temperature condition.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Containment Air Temperature (Subatmospheric)

B 3.6.5C

Westinghouse STS B 3.6.5C-4 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50.49.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.6A Containment Spray and Cooling Systems (Atmospheric and Dual) (Credit taken for 

 iodine removal by the Containment Spray System)

BASES

BACKGROUND The Containment Spray and Containment Cooling systems provide 

containment atmosphere cooling to limit post accident pressure and 

temperature in containment to less than the design values. Reduction of 

containment pressure and the iodine removal capability of the spray 

reduces the release of fission product radioactivity from containment to 

the environment, in the event of a Design Basis Accident (DBA), to within 

limits. The Containment Spray and Containment Cooling systems are 

designed to meet the requirements of 10 CFR 50, Appendix A, GDC 38, 

"Containment Heat Removal," GDC 39, "Inspection of Containment Heat 

Removal Systems," GDC 40, "Testing of Containment Heat Removal 

Systems," GDC 41, "Containment Atmosphere Cleanup," GDC 42, 

"Inspection of Containment Atmosphere Cleanup Systems," and GDC 43, 

"Testing of Containment Atmosphere Cleanup Systems" (Ref. 1), or other 

documents that were appropriate at the time of licensing (identified on a 

unit specific basis).

The Containment Cooling System and Containment Spray System are 

Engineered Safety Feature (ESF) systems. They are designed to ensure 

that the heat removal capability required during the post accident period 

can be attained. The Containment Spray System and the Containment 

Cooling System provide redundant methods to limit and maintain post 

accident conditions to less than the containment design values.

Containment Spray System

The Containment Spray System consists of two separate trains of equal 

capacity, each capable of meeting the design bases. Each train includes 

a containment spray pump, spray headers, nozzles, valves, and piping. 

Each train is powered from a separate ESF bus. The refueling water 

storage tank (RWST) supplies borated water to the Containment Spray 

System during the injection phase of operation. In the recirculation mode 

of operation, containment spray pump suction is transferred from the 

RWST to the containment sump(s).

The Containment Spray System provides a spray of cold borated water 

mixed with sodium hydroxide (NaOH) from the spray additive tank into the 

upper regions of containment to reduce the containment pressure and 

temperature and to reduce fission products from the containment 

atmosphere during a DBA. The RWST solution temperature is an 
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-2 Rev. 4.0

BASES

BACKGROUND (continued)

important factor in determining the heat removal capability of the 

Containment Spray System during the injection phase. In the 

recirculation mode of operation, heat is removed from the containment 

sump water by the residual heat removal coolers. Each train of the 

Containment Spray System provides adequate spray coverage to meet 

the system design requirements for containment heat removal.

The Spray Additive System injects an NaOH solution into the spray. The 

resulting alkaline pH of the spray enhances the ability of the spray to 

scavenge fission products from the containment atmosphere. The NaOH 

added in the spray also ensures an alkaline pH for the solution 

recirculated in the containment sump. The alkaline pH of the containment 

sump water minimizes the evolution of iodine and minimizes the 

occurrence of chloride and caustic stress corrosion on mechanical 

systems and components exposed to the fluid.

The Containment Spray System is actuated either automatically by a 

containment High-3 pressure signal or manually. An automatic actuation 

opens the containment spray pump discharge valves, starts the two 

containment spray pumps, and begins the injection phase. A manual 

actuation of the Containment Spray System requires the operator to 

actuate two separate switches on the main control board to begin the 

same sequence. The injection phase continues until an RWST level LowLow alarm is received. The Low-Low level alarm for the RWST actuates 

valves to align the Containment Spray System pump suction with the 

containment sump and/or signals the operator to manually align the 

system to the recirculation mode. The Containment Spray System in the 

recirculation mode maintains an equilibrium temperature between the 

containment atmosphere and the recirculated sump water. Operation of 

the Containment Spray System in the recirculation mode is controlled by 

the operator in accordance with the emergency operating procedures.

Containment Cooling System

Two trains of containment cooling, each of sufficient capacity to supply 

100% of the design cooling requirement, are provided. Each train of two 

fan units is supplied with cooling water from a separate train of essential 

service water (ESW). Air is drawn into the coolers through the fan and 

discharged to the steam generator compartments, pressurizer 

compartment, and instrument tunnel, and outside the secondary shield in 

the lower areas of containment.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-3 Rev. 4.0

BASES

BACKGROUND (continued)

During normal operation, all four fan units are operating. The fans are 

normally operated at high speed with ESW supplied to the cooling coils. 

The Containment Cooling System, operating in conjunction with the 

Containment Ventilation and Air Conditioning systems, is designed to limit 

the ambient containment air temperature during normal unit operation to 

less than the limit specified in LCO 3.6.5A, "Containment Air 

Temperature." This temperature limitation ensures that the containment 

temperature does not exceed the initial temperature conditions assumed 

for the DBAs.

In post accident operation following an actuation signal, the Containment 

Cooling System fans are designed to start automatically in slow speed if 

not already running. If running in high (normal) speed, the fans 

automatically shift to slow speed. The fans are operated at the lower 

speed during accident conditions to prevent motor overload from the 

higher mass atmosphere. The temperature of the ESW is an important 

factor in the heat removal capability of the fan units.

APPLICABLE The Containment Spray System and Containment Cooling System limit

SAFETY the temperature and pressure that could be experienced following a

ANALYSES DBA. The limiting DBAs considered are the loss of coolant accident 

(LOCA) and the steam line break (SLB). The LOCA and SLB are 

analyzed using computer codes designed to predict the resultant 

containment pressure and temperature transients. No DBAs are 

assumed to occur simultaneously or consecutively. The postulated DBAs 

are analyzed with regard to containment ESF systems, assuming the loss 

of one ESF bus, which is the worst case single active failure and results 

in one train of the Containment Spray System and Containment Cooling 

System being rendered inoperable.

The analysis and evaluation show that under the worst case scenario, the 

highest peak containment pressure is [44.1] psig (experienced during a 

LOCA). The analysis shows that the peak containment temperature is 

[384.5]°F (experienced during an SLB). Both results meet the intent of 

the design basis. (See the Bases for LCO 3.6.4A, "Containment 

Pressure," and LCO 3.6.5A for a detailed discussion.) The analyses and 

evaluations assume a unit specific power level of [100]%, one 

containment spray train and one containment cooling train operating, and 

initial (pre-accident) containment conditions of [120]°F and [1.5] psig. The 

analyses also assume a response time delayed initiation to provide 

conservative peak calculated containment pressure and temperature 

responses.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

For certain aspects of transient accident analyses, maximizing the 

calculated containment pressure is not conservative. In particular, the 

effectiveness of the Emergency Core Cooling System during the core 

reflood phase of a LOCA analysis increases with increasing containment 

backpressure. For these calculations, the containment backpressure is 

calculated in a manner designed to conservatively minimize, rather than 

maximize, the calculated transient containment pressures in accordance 

with 10 CFR 50, Appendix K (Ref. 2).

The effect of an inadvertent containment spray actuation has been 

analyzed. An inadvertent spray actuation results in a [2.0] psig 

containment pressure and is associated with the sudden cooling effect in 

the interior of the leak tight containment. Additional discussion is 

provided in the Bases for LCO 3.6.4A.

The modeled Containment Spray System actuation from the containment 

analysis is based on a response time associated with exceeding the 

containment High-3 pressure setpoint to achieving full flow through the 

containment spray nozzles. The Containment Spray System total 

response time of [60] seconds includes diesel generator (DG) startup (for 

loss of offsite power), block loading of equipment, containment spray 

pump startup, and spray line filling (Ref. 3).

Containment cooling train performance for post accident conditions is 

given in Reference 4. The result of the analysis is that each train can 

provide 100% of the required peak cooling capacity during the post 

accident condition. The train post accident cooling capacity under varying 

containment ambient conditions, required to perform the accident 

analyses, is also shown in Reference 5.

The modeled Containment Cooling System actuation from the 

containment analysis is based upon a response time associated with 

exceeding the containment High-3 pressure setpoint to achieving full 

Containment Cooling System air and safety grade cooling water flow. 

The Containment Cooling System total response time of [60] seconds, 

includes signal delay, DG startup (for loss of offsite power), and service 

water pump startup times (Ref. 6).

The Containment Spray System and the Containment Cooling System 

satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-5 Rev. 4.0

BASES 

LCO During a DBA, a minimum of one containment cooling train and one 

containment spray train are required to maintain the containment peak 

pressure and temperature below the design limits (Ref. 7). Additionally, 

one containment spray train is also required to remove iodine from the 

containment atmosphere and maintain concentrations below those 

assumed in the safety analysis. To ensure that these requirements are 

met, two containment spray trains and two containment cooling trains 

must be OPERABLE. Therefore, in the event of an accident, at least one 

train in each system operates, assuming the worst case single active 

failure occurs.

Each Containment Spray System typically includes a spray pump, spray 

headers, nozzles, valves, piping, instruments, and controls to ensure an 

OPERABLE flow path capable of taking suction from the RWST upon an 

ESF actuation signal and automatically transferring suction to the 

containment sump.

Each Containment Cooling System typically includes demisters, cooling 

coils, dampers, fans, instruments, and controls to ensure an OPERABLE 

flow path.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment and an increase in containment pressure and 

temperature requiring the operation of the containment spray trains and 

containment cooling trains.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Thus, the Containment Spray System and the Containment 

Cooling System are not required to be OPERABLE in MODES 5 and 6.

ACTIONS A.1

With one containment spray train inoperable, the inoperable containment 

spray train must be restored to OPERABLE status within 72 hours. In this 

Condition, the remaining OPERABLE spray and cooling trains are 

adequate to perform the iodine removal and containment cooling 

functions. The 72 hour Completion Time takes into account the 

redundant heat removal capability afforded by the Containment Spray 

System, reasonable time for repairs, and low probability of a DBA 

occurring during this period.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-6 Rev. 4.0

BASES

ACTIONS (continued)

B.1 and B.2

If the inoperable containment spray train cannot be restored to 

OPERABLE status within the required Completion Time, the plant must

be brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 6 hours and 

to MODE 5 within 84 hours. The allowed Completion Time of 6 hours is 

reasonable, based on operating experience, to reach MODE 3 from full 

power conditions in an orderly manner and without challenging plant 

systems. The extended interval to reach MODE 5 allows additional time 

for attempting restoration of the containment spray train and is 

reasonable when considering the driving force for a release of radioactive 

material from the Reactor Coolant System is reduced in MODE 3.

C.1

With one of the required containment cooling trains inoperable, the 

inoperable required containment cooling train must be restored to 

OPERABLE status within 7 days. The components in this degraded 

condition provide iodine removal capabilities and are capable of providing 

at least 100% of the heat removal needs. The 7 day Completion Time 

was developed taking into account the redundant heat removal 

capabilities afforded by combinations of the Containment Spray System 

and Containment Cooling System and the low probability of DBA 

occurring during this period.

D.1

With two required containment cooling trains inoperable, one of the 

required containment cooling trains must be restored to OPERABLE 

status within 72 hours. The components in this degraded condition 

provide iodine removal capabilities and are capable of providing at least 

100% of the heat removal needs after an accident. The 72 hour 

Completion Time was developed taking into account the redundant heat 

removal capabilities afforded by combinations of the Containment Spray 

System and Containment Cooling System, the iodine removal function of 

the Containment Spray System, and the low probability of DBA occurring 

during this period.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-7 Rev. 4.0

BASES

ACTIONS (continued)

E.1 and E.2

If the Required Action and associated Completion Time of Condition C 

or D of this LCO are not met, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

F.1

With two containment spray trains or any combination of three or more 

containment spray and cooling trains inoperable, the unit is in a condition 

outside the accident analysis. Therefore, LCO 3.0.3 must be entered 

immediately.

SURVEILLANCE SR 3.6.6A.1

REQUIREMENTS

Verifying the correct alignment for manual, power operated, and 

automatic valves in the containment spray flow path provides assurance 

that the proper flow paths will exist for Containment Spray System 

operation. This SR does not apply to valves that are locked, sealed, or 

otherwise secured in position, since these were verified to be in the 

correct position prior to locking, sealing, or securing. This SR does not 

require any testing or valve manipulation. Rather, it involves verification 

that those valves outside containment (only check valves are inside 

containment) and capable of potentially being mispositioned are in the 

correct position.

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6A.2

Operating each [required] containment cooling train fan unit for 

≥ 15 minutes ensures that all trains are OPERABLE and that all 

associated controls are functioning properly. It also ensures that 

blockage, fan or motor failure, or excessive vibration can be detected for 

corrective action. [ The 31 day Frequency was developed considering the 

known reliability of the fan units and controls, the two train redundancy 

available, and the low probability of significant degradation of the 

containment cooling train occurring between surveillances. It has also 

been shown to be acceptable through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6A.3

Verifying that each [required] containment cooling train ESW cooling flow 

rate to each cooling unit is ≥ [700] gpm provides assurance that the 

design flow rate assumed in the safety analyses will be achieved (Ref. 3). 

[ The Frequency of 3 days was developed considering the known 

reliability of the Cooling Water System, the two train redundancy 

available, and the low probability of a significant degradation of flow 

occurring between surveillances.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6A.4

Verifying each containment spray pump's developed head at the flow test 

point is greater than or equal to the required developed head ensures that 

spray pump performance has not degraded during the cycle. Flow and 

differential pressure are normal tests of centrifugal pump performance 

required by the ASME Code (Ref. 8). Since the containment spray 

pumps cannot be tested with flow through the spray headers, they are 

tested on recirculation flow. This test confirms one point on the pump 

design curve and is indicative of overall performance. Such inservice 

tests confirm component OPERABILITY, trend performance, and detect 

incipient failures by abnormal performance. The Frequency of the SR is 

in accordance with the Inservice Testing Program.

SR 3.6.6A.5 and SR 3.6.6A.6

These SRs require verification that each automatic containment spray 

valve actuates to its correct position and that each containment spray 

pump starts upon receipt of an actual or simulated actuation of a 

containment High-3 pressure signal. This Surveillance is not required for 

valves that are locked, sealed, or otherwise secured in the required 

position under administrative controls. [ The [18] month Frequency is 

based on the need to perform these Surveillances under the conditions 

that apply during a plant outage and the potential for an unplanned 

transient if the Surveillances were performed with the reactor at power. 

Operating experience has shown that these components usually pass the 

Surveillances when performed at the [18] month Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The surveillance of containment sump isolation valves is also required by 

SR 3.5.2.5. A single surveillance may be used to satisfy both 

requirements.

SR 3.6.6A.7

This SR requires verification that each [required] containment cooling 

train actuates upon receipt of an actual or simulated safety injection 

signal. [ The [18] month Frequency is based on engineering judgment 

and has been shown to be acceptable through operating experience. 

See SR 3.6.6A.5 and SR 3.6.6A.6, above, for further discussion of the 

basis for the [18] month Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6A

Westinghouse STS B 3.6.6A-11 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.6A.8

With the containment spray inlet valves closed and the spray header 

drained of any solution, low pressure air or smoke can be blown through 

test connections. This SR ensures that each spray nozzle is 

unobstructed and provides assurance that spray coverage of the 

containment during an accident is not degraded. [ Due to the passive 

design of the nozzle, a test at [the first refueling and at] 10 year intervals 

is considered adequate to detect obstruction of the nozzles.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 38, GDC 39, GDC 40, GDC 41, 

GDC 42, and GDC 43.

2. 10 CFR 50, Appendix K.

3. FSAR, Section [ ].

4. FSAR, Section [ ].

5. FSAR, Section [ ].

6. FSAR, Section [ ].

7. FSAR, Section [ ].

8. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.6B Containment Spray and Cooling Systems (Atmospheric and Dual) (Credit not taken

 for iodine removal by the Containment Spray System)

BASES

BACKGROUND The Containment Spray and Containment Cooling systems provide 

containment atmosphere cooling to limit post accident pressure and 

temperature in containment to less than the design values. Reduction of 

containment pressure reduces the release of fission product radioactivity 

from containment to the environment, in the event of a Design Basis 

Accident (DBA), to within limits. The Containment Spray and 

Containment Cooling systems are designed to meet the requirements of 

10 CFR 50, Appendix A, GDC 38, "Containment Heat Removal," GDC 39, 

"Inspection of Containment Heat Removal Systems," GDC 40, "Testing of 

Containment Heat Removal Systems," GDC 41, "Containment 

Atmosphere Cleanup," GDC 42, "Inspection of Containment Atmosphere 

Cleanup Systems," and GDC 43, "Testing of Containment Atmosphere 

Cleanup Systems" (Ref. 1), or other documents that were appropriate at 

the time of licensing (identified on a unit specific basis).

The Containment Cooling System and Containment Spray System are 

Engineered Safety Feature (ESF) systems. They are designed to ensure 

that the heat removal capability required during the post accident period 

can be attained. The Containment Spray System and the Containment 

Cooling System provide redundant methods to limit and maintain post 

accident conditions to less than the containment design values.

Containment Spray System

The Containment Spray System consists of two separate trains of equal 

capacity, each capable of meeting the design bases. Each train includes 

a containment spray pump, spray headers, nozzles, valves, and piping. 

Each train is powered from a separate ESF bus. The refueling water 

storage tank (RWST) supplies borated water to the Containment Spray 

System during the injection phase of operation. In the recirculation mode 

of operation, containment spray pump suction is transferred from the 

RWST to the containment sump(s).

The Containment Spray System provides a spray of cold borated water 

into the upper regions of containment to reduce the containment pressure 

and temperature during a DBA. The RWST solution temperature is an 

important factor in determining the heat removal capability of the 

Containment Spray System during the injection phase. In the 
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-2 Rev. 4.0

BASES

BACKGROUND (continued)

recirculation mode of operation, heat is removed from the containment 

sump water by the residual heat removal coolers. Each train of the 

Containment Spray System provides adequate spray coverage to meet 

the system design requirements for containment heat removal.

The Containment Spray System is actuated either automatically by a 

containment High-3 pressure signal or manually. An automatic actuation 

opens the containment spray pump discharge valves, starts the two 

containment spray pumps, and begins the injection phase. A manual 

actuation of the Containment Spray System requires the operator to 

actuate two separate switches on the main control board to begin the 

same sequence. The injection phase continues until an RWST level LowLow alarm is received. The Low-Low level alarm for the RWST actuates 

valves to align the containment spray pump suction to the containment 

and/or sump signals the operator to manually align the system to the 

recirculation mode. The Containment Spray System in the recirculation 

mode maintains an equilibrium temperature between the containment 

atmosphere and the recirculated sump water. Operation of the 

Containment Spray System in the recirculation mode is controlled by the 

operator in accordance with the emergency operating procedures.

Containment Cooling System

Two trains of containment cooling, each of sufficient capacity to supply 

100% of the design cooling requirements, are provided. Each train of two 

fan units is supplied with cooling water from a separate train of essential 

service water (ESW). Air is drawn into the coolers through the fan and 

discharged to the steam generator compartments, pressurizer 

compartment, instrument tunnel, and outside the secondary shield in the 

lower areas of containment.

During normal operation, all four fan units are operating. The fans are 

normally operated at high speed, with ESW supplied to the cooling coils. 

The Containment Cooling System, operating in conjunction with the 

Containment Ventilation and Air Conditioning systems, is designed to limit 

the ambient containment air temperature during normal unit operation to 

less than the limit specified in LCO 3.6.5A, "Containment Air 

Temperature." This temperature limitation ensures that the containment 

temperature does not exceed the initial temperature conditions assumed 

for the DBAs.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-3 Rev. 4.0

BASES

BACKGROUND (continued)

In post accident operation following an actuation signal, the Containment 

Cooling System fans are designed to start automatically in slow speed if 

not already running. If running in high (normal) speed, the fans 

automatically shift to slow speed. The fans are operated at the lower 

speed during accident conditions to prevent motor overload from the 

higher density atmosphere. The temperature of the ESW cooling is an 

important factor in the heat removal capability of the fan units.

APPLICABLE The Containment Spray System and Containment Cooling System limit

SAFETY the temperature and pressure that could be experienced following a

ANALYSES DBA. The limiting DBAs considered relative to Containment integrity are 

the loss of coolant accident (LOCA) and the steam line break (SLB). The 

LOCA and SLB are analyzed using computer codes designed to predict 

the resultant containment pressure and temperature transients. No DBAs 

are assumed to occur simultaneously or consecutively. The postulated 

DBAs are analyzed with regard to containment ESF systems, assuming 

the loss of one ESF bus, which is the worst case single active failure and 

results in one train of Containment Spray System and Containment 

Cooling System being inoperable.

The analysis and evaluation show that, under the worst case scenario, 

the highest peak containment pressure is [44.1] psig (experienced during 

a LOCA). The analysis shows that the peak containment temperature is 

[384]°F (experienced during an SLB). Both results meet the intent of the 

design basis. (See the Bases for LCO 3.6.4A, "Containment Pressure," 

and LCO 3.6.5A for a detailed discussion.) The analyses and evaluations 

assume a unit specific power level of [100]%, one containment spray train 

and one containment cooling train operating, and initial (pre-accident) 

containment conditions of [120]°F and [1.5] psig. The analyses also 

assume a response time delayed initiation in order to provide 

conservative peak calculated containment pressure and temperature 

responses.

For certain aspects of transient accident analyses, maximizing the 

calculated containment pressure is not conservative. In particular, the 

effectiveness of the Emergency Core Cooling System during the core 

reflood phase of a LOCA analysis increases with increasing containment 

backpressure. For these calculations, the containment backpressure is 

calculated in a manner designed to conservatively minimize, rather than 

maximize, the calculated transient containment pressures in accordance 

with 10 CFR 50, Appendix K (Ref. 2).
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The effect of an inadvertent containment spray actuation has been 

analyzed. An inadvertent spray actuation results in a [-2.0] psig 

containment pressure and is associated with the sudden cooling effect in 

the interior of the leak tight containment. Additional discussion is 

provided in the Bases for LCO 3.6.4A.

The modeled Containment Spray System actuation from the containment 

analysis is based upon a response time associated with exceeding the 

containment High-3 pressure setpoint to achieving full flow though the 

containment spray nozzles. The Containment Spray System total 

response time of [60] seconds includes diesel generator (DG) startup (for 

loss of offsite power), block loading of equipment, containment spray 

pump startup, and spray line filling (Ref. 3).

Containment cooling train performance for post accident conditions is 

given in Reference 4. The result of the analysis is that each train can 

provide 100% of the required peak cooling capacity during the post 

accident condition. The train post accident cooling capacity under varying 

containment ambient conditions, required to perform the accident 

analyses, is also shown in Reference 5.

The modeled Containment Cooling System actuation from the 

containment analysis is based on a response time associated with 

exceeding the containment High-3 pressure setpoint to achieving full 

Containment Cooling System air and safety grade cooling water flow. 

The Containment Cooling System total response time of [60] seconds 

includes signal delay, DG startup (for loss of offsite power), and Service 

Water pump startup times (Ref. 6).

The Containment Spray System and the Containment Cooling System 

satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO During a DBA, a minimum of one containment cooling train and one 

containment spray train are required to maintain the containment peak 

pressure and temperature below the design limits (Ref. 7). To ensure 

that these requirements are met, two containment spray trains and two 

containment cooling units must be OPERABLE. Therefore, in the event 

of an accident, at least one train in each system operates, assuming the 

worst case single active failure occurs.

Each Containment Spray System typically includes a spray pump, spray 

headers, nozzles, valves, piping, instruments, and controls to ensure an 

OPERABLE flow path capable of taking suction from the RWST upon an 

ESF actuation signal and automatically transferring suction to the 

containment sump.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-5 Rev. 4.0

BASES

LCO (continued)

Each Containment Cooling System typically includes demisters, cooling 

coils, dampers, instruments, and controls to ensure an OPERABLE flow 

path.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment and an increase in containment pressure and 

temperature requiring the operation of the containment spray trains and 

containment cooling trains.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Thus, the Containment Spray System and the Containment 

Cooling System are not required to be OPERABLE in MODES 5 and 6.

ACTIONS A.1

If one containment spray train is inoperable, it must be restored to 

OPERABLE status within 7 days. The components in this degraded 

condition are capable of providing at least 100% of the heat removal 

needs (for the condition of one containment spray train inoperable) after 

an accident. The 7 day Completion Time was chosen in light of the 

redundant heat removal capabilities afforded by combinations of the 

Containment Spray System and Containment Cooling System and the 

low probability of DBA occurring during this period.

B.1

If one of the required containment cooling trains is inoperable, it must be 

restored to OPERABLE status within 7 days. The components in this 

degraded condition are capable of providing at least 100% of the heat

removal needs (for the Condition of one containment cooling train 

inoperable) after an accident. The 7 day Completion Time was chosen 

based on the same reasons as given in Required Action A.1.

C.1

With two of the required containment spray trains inoperable, one must 

be restored to OPERABLE status within 72 hours. The components in 

this degraded condition are capable of providing at least 100% of the heat 

removal needs after an accident. The 72 hour Completion Time was 

chosen in light of the redundant heat removal capabilities afforded by 

combinations of the Containment Spray System and Containment Cooling 

System, reasonable time for repairs, and low probability of DBA occurring 

during this period.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-6 Rev. 4.0

BASES

ACTIONS (continued)

D.1 and D.2

If one required containment spray train is inoperable and one of the 

required containment cooling trains is inoperable, the inoperable 

containment spray train or the inoperable containment cooling train must 

be restored to OPERABLE status within 72 hours. The components in 

this degraded condition are capable of providing at least 100% of the heat 

removal needs after an accident. The 72 hour Completion Time was 

chosen based on the same reasons as those given in Required 

Action C.1.

E.1

If two required containment cooling trains are inoperable, one of the 

required containment cooling trains must be restored to OPERABLE 

status within 72 hours. The components in this degraded condition are 

capable of providing at least 100% of the heat removal needs after an 

accident. The 72 hour Completion Time was chosen based on the same 

reasons as those given in Required Action C.1.

F.1 and F.2

If any of the Required Actions or associated Completion Times for 

Condition A, B, C, D, or E of this LCO are not met, the plant must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the plant must be brought to at least MODE 3 within 6 hours and 

to MODE 5 within 36 hours. The allowed Completion Times are 

reasonable, based on operating experience, to reach the required plant 

conditions from full power conditions in an orderly manner and without 

challenging plant systems.

G.1

With any combination of three or more containment spray and 

containment cooling trains inoperable, the unit is in a condition outside 

the accident analysis. Therefore, LCO 3.0.3 must be entered 

immediately.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-7 Rev. 4.0

BASES

SURVEILLANCE SR 3.6.6B.1

REQUIREMENTS

Verifying the correct alignment for manual, power operated, and 

automatic valves, excluding check valves, in the Containment Spray

System flow path provides assurance that the proper flow path exists for 

Containment Spray System operation. This SR does not apply to valves 

that are locked, sealed, or otherwise secured in position, since these 

were verified to be in the correct positions prior to being secured. This 

SR does not require testing or valve manipulation. Rather, it involves 

verification that those valves outside containment (only check valves are 

inside containment) and capable of potentially being mispositioned are in 

the correct position.

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6B.2

Operating each [required] containment cooling train fan unit for 

≥ 15 minutes ensures that all trains are OPERABLE and all associated 

controls are functioning properly. It also ensures that blockage, fan or 

motor failure, or excessive vibration can be detected for corrective action. 

[ The 31 day Frequency was developed based on the known reliability of 

the fan units and controls, the two train redundancy available, and the low 

probability of significant degradation of the containment cooling train 

occurring between surveillances.

OR
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6B.3

Verifying that each [required] containment cooling train ESW cooling flow 

rate to each cooling unit is ≥ [700] gpm provides assurance that the 

design flow rate assumed in the analyses will be achieved (Ref. 3). [ The 

Frequency of 31 days was developed considering the known reliability of 

the Cooling Water System, the two train redundancy available, and the 

low probability of a significant degradation of flow occurring between 

surveillances.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6B.4

Verifying that each containment spray pump's developed head at the flow 

test point is greater than or equal to the required developed head ensures 

that spray pump performance has not degraded during the cycle. Flow 

and differential pressure are normal tests of centrifugal pump 

performance required by the ASME Code (Ref. 8). Since the containment 

spray pumps cannot be tested with flow through the spray headers, they 

are tested on recirculation flow. This test confirms one point on the pump 

design curve and is indicative of overall performance. Such inservice
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

inspections confirm component OPERABILITY, trend performance, and 

detect incipient failures by indicating abnormal performance. The 

Frequency of this SR is in accordance with the Inservice Testing 

Program.

SR 3.6.6B.5 and SR 3.6.6B.6

These SRs require verification that each automatic containment spray 

valve actuates to its correct position and that each containment spray 

pump starts upon receipt of an actual or simulated containment High-3 

pressure signal. This Surveillance is not required for valves that are 

locked, sealed, or otherwise secured in the required position under 

administrative controls. [ The [18] month Frequency is based on the need 

to perform these Surveillances under the conditions that apply during a 

plant outage and the potential for an unplanned transient if the 

Surveillances were performed with the reactor at power. Operating 

experience has shown that these components usually pass the 

Surveillances when performed at the [18] month Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The surveillance of containment sump isolation valves is also required by 

SR 3.5.2.5. A single surveillance may be used to satisfy both 

requirements.
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.6B.7

This SR ensures that each [required] containment cooling train actuates 

upon receipt of an actual or simulated safety injection signal. [ The 

[18] month Frequency is based on engineering judgment and has been 

proven acceptable through operating experience. See SR 3.6.6B.5 and 

SR 3.6.6B.6, above, for further discussion of the basis for the [18] month 

Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6B.8

With the containment spray inlet valves closed and the spray header 

drained of any solution, low pressure air or smoke can be blown through 

test connections. This SR ensures that each spray nozzle is 

unobstructed and that spray coverage of the containment during an 

accident is not degraded. [ Because of the passive design of the nozzle, 

a test at [the first refueling and at] 10 year intervals is considered 

adequate to detect obstruction of the spray nozzles.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Containment Spray and Cooling Systems (Atmospheric and Dual)

B 3.6.6B

Westinghouse STS B 3.6.6B-11 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50, Appendix A, GDC 38, GDC 39, GDC 40, GDC 41, 

GDC 42, and GDC 43.

2. 10 CFR 50, Appendix A.

3. FSAR, Section [15].

4. FSAR, Section [6.2].

5. FSAR, Section [ ].

6. FSAR, Section [ ].

7. FSAR, Section [ ].

8. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

Containment Spray System (Ice Condenser)

B 3.6.6C

Westinghouse STS B 3.6.6C-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.6C Containment Spray System (Ice Condenser)

BASES

BACKGROUND The Containment Spray System provides containment atmosphere 

cooling to limit post accident pressure and temperature in containment to 

less than the design values. Reduction of containment pressure and the 

iodine removal capability of the spray reduce the release of fission 

product radioactivity from containment to the environment, in the event of 

a Design Basis Accident (DBA). The Containment Spray System is 

designed to meet the requirements of 10 CFR 50, Appendix A, GDC 38, 

"Containment Heat Removal," GDC 39, "Inspection of Containment Heat 

Removal Systems," GDC 40, "Testing of Containment Heat Removal 

Systems," GDC 41, "Containment Atmosphere Cleanup," GDC 42, 

"Inspection of Containment Atmosphere Cleanup Systems," and GDC 43, 

"Testing of Containment Atmosphere Cleanup Systems" (Ref. 1), or other 

documents that were appropriate at the time of licensing (identified on a 

unit specific basis).

The Containment Spray System consists of two separate trains of equal 

capacity, each capable of meeting the system design basis spray 

coverage. Each train includes a containment spray pump, one 

containment spray heat exchanger, spray headers, nozzles, valves, and 

piping. Each train is powered from a separate Engineered Safety Feature 

(ESF) bus. The refueling water storage tank (RWST) supplies borated 

water to the Containment Spray System during the injection phase of 

operation. In the recirculation mode of operation, containment spray 

pump suction is transferred from the RWST to the containment 

recirculation sump(s).

The diversion of a portion of the recirculation flow from each train of the 

Residual Heat Removal (RHR) System to additional redundant spray 

headers completes the Containment Spray System heat removal 

capability. Each RHR train is capable of supplying spray coverage, if 

required, to supplement the Containment Spray System.

The Containment Spray System and RHR System provide a spray of cold 

or subcooled borated water into the upper and lower regions of 

containment and in dead ended volumes to limit the containment 

pressure and temperature during a DBA. The RWST solution 

temperature is an important factor in determining the heat removal 

capability of the Containment Spray System during the injection phase. 

In the recirculation mode of operation, heat is removed from the 
Containment Spray System (Ice Condenser)

B 3.6.6C

Westinghouse STS B 3.6.6C-2 Rev. 4.0

BASES

BACKGROUND (continued)

containment sump water by the Containment Spray System and RHR 

heat exchangers. Each train of the Containment Spray System, 

supplemented by a train of RHR spray, provides adequate spray 

coverage to meet the system design requirements for containment heat 

removal.

The Spray Additive System injects a sodium hydroxide (NaOH) solution 

into the spray. The resulting alkaline pH of the spray enhances the ability 

of the spray to scavenge iodine fission products from the containment 

atmosphere. The NaOH added in the spray also ensures an alkaline pH 

for the solution recirculated in the containment sump. The alkaline pH of 

the containment sump water minimizes the evolution of iodine and the 

occurrence of chloride and caustic stress corrosion on mechanical 

systems and components exposed to the fluid.

The Containment Spray System is actuated either automatically by a 

containment High-3 pressure signal or manually. An automatic actuation 

opens the containment spray pump discharge valves, starts the two 

containment spray pumps, and begins the injection phase. A manual 

actuation of the Containment Spray System requires the operator to 

actuate two separate switches on the main control board to begin the 

same sequence. The injection phase continues until an RWST level LowLow alarm is received. The Low-Low alarm for the RWST actuates 

valves to align the containment spray pump suction to the containment 

sump and/or signals the operator to manually align the system to the 

recirculation mode. The Containment Spray System in the recirculation 

mode maintains an equilibrium temperature between the containment 

atmosphere and the recirculated sump water. Operation of the 

Containment Spray System in the recirculation mode is controlled by the 

operator in accordance with the emergency operation procedures.

The RHR spray operation is initiated manually, when required by the 

emergency operating procedures, after the Emergency Core Cooling 

System (ECCS) is operating in the recirculation mode. The RHR sprays 

are available to supplement the Containment Spray System, if required, in 

limiting containment pressure. This additional spray capacity would 

typically be used after the ice bed has been depleted and in the event that 

containment pressure rises above a predetermined limit. The 

Containment Spray System is an ESF system. It is designed to ensure 

that the heat removal capability required during the post accident period 

can be attained.
Containment Spray System (Ice Condenser)

B 3.6.6C

Westinghouse STS B 3.6.6C-3 Rev. 4.0

BASES

BACKGROUND (continued)

The operation of the Containment Spray System, together with the ice 

condenser, is adequate to assure pressure suppression during the initial 

blowdown of steam and water from a DBA. During the post blowdown 

period, the Air Return System (ARS) is automatically started. The ARS 

returns upper compartment air through the divider barrier to the lower 

compartment. This serves to equalize pressures in containment and to 

continue circulating heated air and steam through the ice condenser, 

where heat is removed by the remaining ice.

The Containment Spray System limits the temperature and pressure that 

could be expected following a DBA. Protection of containment integrity 

limits leakage of fission product radioactivity from containment to the 

environment.

APPLICABLE The limiting DBAs considered relative to containment OPERABILITY are

SAFETY the loss of coolant accident (LOCA) and the steam line break (SLB). The

ANALYSES DBA LOCA and SLB are analyzed using computer codes designed to 

predict the resultant containment pressure and temperature transients. 

No two DBAs are assumed to occur simultaneously or consecutively. 

The postulated DBAs are analyzed, in regard to containment ESF 

systems, assuming the loss of one ESF bus, which is the worst case 

single active failure, resulting in one train of the Containment Spray 

System, the RHR System, and the ARS being rendered inoperable 

(Ref. 2).

The DBA analyses show that the maximum peak containment pressure of 

[44.1] psig results from the LOCA analysis, and is calculated to be less 

than the containment design pressure. The maximum peak containment 

atmosphere temperature of [385]°F results from the SLB analysis and 

was calculated to exceed the containment design temperature [for a few 

seconds] during the DBA SLB. The basis of the containment design 

temperature, however, is to ensure the OPERABILITY of safety related 

equipment inside containment (Ref. 3). Thermal analyses showed that 

the time interval during which the containment atmosphere temperature 

exceed the containment design temperature was short enough that the 

equipment surface temperatures remained below the design temperature. 

Therefore, it is concluded that the calculated transient containment 

atmosphere temperatures are acceptable for the DBA SLB.

The modeled Containment Spray System actuation from the containment 

analysis is based on a response time associated with exceeding the 

containment High-3 pressure signal setpoint to achieving full flow through 

the containment spray nozzles. A delayed response time initiation
Containment Spray System (Ice Condenser)

B 3.6.6C

Westinghouse STS B 3.6.6C-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

provides conservative analyses of peak calculated containment 

temperature and pressure responses. The Containment Spray System 

total response time of [45] seconds is composed of signal delay, diesel 

generator startup, and system startup time.

For certain aspects of transient accident analyses, maximizing the 

calculated containment pressure is not conservative. In particular, the 

ECCS cooling effectiveness during the core reflood phase of a LOCA 

analysis increases with increasing containment backpressure. For these 

calculations, the containment backpressure is calculated in a manner 

designed to conservatively minimize, rather than maximize, the calculated 

transient containment pressures in accordance with 10 CFR 50, 

Appendix K (Ref. 4).

Inadvertent actuation of the Containment Spray System is evaluated in 

the analysis, and the resultant reduction in containment pressure is 

calculated. The maximum calculated reduction in containment pressure 

resulted in a containment external pressure load of [1.2] psid, which 

is below the containment design external pressure load.

The Containment Spray System satisfies Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO During a DBA, one train of Containment Spray System is required to 

provide the heat removal capability assumed in the safety analyses. 

Additionally, a minimum of one train of the Containment Spray System, 

with spray pH adjusted by the Spray Additive System, is required to 

scavenge iodine fission products from the containment atmosphere and 

ensure their retention in the containment sump water. To ensure that 

these requirements are met, two containment spray trains must be 

OPERABLE with power from two safety related, independent power 

supplies. Therefore, in the event of an accident, at least one train in each 

system operates.

Each Containment Spray System typically includes a spray pump, 

headers, valves, heat enhancers, nozzles, piping, instruments, and 

controls to ensure an OPERABLE flow path capable of taking suction 

from the RWST upon an ESF actuation signal and automatically 

transferring suction to the containment sump.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment and an increase in containment pressure and 

temperature requiring the operation of the Containment Spray System.
Containment Spray System (Ice Condenser)

B 3.6.6C

Westinghouse STS B 3.6.6C-5 Rev. 4.0

BASES 

APPLICABILITY (continued)

In MODES 5 and 6, the probability and consequences of these events are 

reduced because of the pressure and temperature limitations of these 

MODES. Thus, the Containment Spray System is not required to be 

OPERABLE in MODE 5 or 6.

ACTIONS A.1

With one containment spray train inoperable, the affected train must be 

restored to OPERABLE status within 72 hours. The components in this 

degraded condition are capable of providing 100% of the heat removal 

and iodine removal needs after an accident. The 72 hour Completion 

Time was developed taking into account the redundant heat removal and 

iodine removal capabilities afforded by the OPERABLE train and the low 

probability of a DBA occurring during this period.

B.1 and B.2

If the affected containment spray train cannot be restored to OPERABLE 

status within the required Completion Time, the plant must be brought to 

a MODE in which the LCO does not apply. To achieve this status, the 

plant must be brought to at least MODE 3 within 6 hours and to MODE 5 

within 84 hours. The allowed Completion Times are reasonable, based 

on operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems. The extended interval to reach MODE 5 allows additional time 

and is reasonable when considering that the driving force for a release of 

radioactive material from the Reactor Coolant System is reduced in 

MODE 3.

SURVEILLANCE SR 3.6.6C.1

REQUIREMENTS

Verifying the correct alignment of manual, power operated, and automatic 

valves, excluding check valves, in the Containment Spray System 

provides assurance that the proper flow path exists for Containment 

Spray System operation. This SR does not apply to valves that are 

locked, sealed, or otherwise secured in position since they were verified 

in the correct position prior to being secured. This SR does not require 

any testing or valve manipulation. Rather, it involves verification that 

those valves outside containment and capable of potentially being 

mispositioned, are in the correct position.

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions.
Containment Spray System (Ice Condenser)

B 3.6.6C

Westinghouse STS B 3.6.6C-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6.2

Verifying that each containment spray pump's developed head at the flow 

test point is greater than or equal to the required developed head ensures 

that spray pump performance has not degraded during the cycle. Flow 

and differential head are normal tests of centrifugal pump performance 

required by the ASME Code (Ref. 5). Since the containment spray 

pumps cannot be tested with flow through the spray headers, they are 

tested on bypass flow. This test confirms one point on the pump design 

curve and is indicative of overall performance. Such inservice inspections 

confirm component OPERABILITY, trend performance, and detect 

incipient failures by indicating abnormal performance. The Frequency of 

this SR is in accordance with the Inservice Testing Program.

SR 3.6.6.3 and SR 3.6.6.4

These SRs require verification that each automatic containment spray 

valve actuates to its correct position and each containment spray pump 

starts upon receipt of an actual or simulated containment spray actuation 

signal. This Surveillance is not required for valves that are locked, 

sealed, or otherwise secured in the required position under administrative 

controls. [ The [18] month Frequency is based on the need to perform 

these Surveillances under the conditions that apply during a plant outage 

and the potential for an unplanned transient if the Surveillances were 

performed with the reactor at power. Operating experience has shown 

these components usually pass the Surveillances when performed at the 

[18] month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint.

OR
Containment Spray System (Ice Condenser)

B 3.6.6C

Westinghouse STS B 3.6.6C-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The surveillance of containment sump isolation valves is also required by 

SR 3.6.6.3. A single surveillance may be used to satisfy both 

requirements.

SR 3.6.6.5

With the containment spray inlet valves closed and the spray header 

drained of any solution, low pressure air or smoke can be blown through 

test connections. This SR ensures that each spray nozzle is 

unobstructed and that spray coverage of the containment during an 

accident is not degraded. [ Because of the passive design of the nozzle, 

a test at [the first refueling and at] 10 year intervals is considered 

adequate to detect obstruction of the spray nozzles.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 38, GDC 39, GDC 40, GDC 41, 

GDC 42, and GDC 43.

2. FSAR, Section [6.2].
Containment Spray System (Ice Condenser)

B 3.6.6C

Westinghouse STS B 3.6.6C-8 Rev. 4.0

BASES 

REFERENCES (continued)

3. 10 CFR 50.49.

4. 10 CFR 50, Appendix K.

5. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.
QS System (Subatmospheric)

B 3.6.6D

Westinghouse STS B 3.6.6D-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.6D Quench Spray (QS) System (Subatmospheric)

BASES

BACKGROUND The QS System is designed to provide containment atmosphere cooling 

to limit post accident pressure and temperature in containment to less 

than the design values. The QS System, operating in conjunction with 

the Recirculation Spray (RS) System, is designed to cool and 

depressurize the containment structure to subatmospheric pressure in 

less than 60 minutes following a Design Basis Accident (DBA). 

Reduction of containment pressure and the iodine removal capability of 

the spray limit the release of fission product radioactivity from 

containment to the environment in the event of a DBA.

The QS System consists of two separate trains of equal capacity, each 

capable of meeting the design bases. Each train includes a spray pump, 

spray headers, nozzles, valves, and piping. Each train is powered from a 

separate Engineered Safety Features (ESF) bus. The refueling water 

storage tank (RWST) supplies borated water to the QS System.

The QS System is actuated either automatically by a containment HighHigh pressure signal or manually. The QS System provides a spray of 

cold borated water into the upper regions of containment to reduce the 

containment pressure and temperature during a DBA. Each train of the 

QS System provides adequate spray coverage to meet the system design 

requirements for containment heat and iodine fission product removal. 

The QS System also provides flow to the containment sump to improve 

the net positive suction head available to the RS System pumps.

The Spray Additive System injects a sodium hydroxide (NaOH) solution 

into the spray. The resulting alkaline pH of the spray enhances the ability 

of the spray to scavenge iodine fission products from the containment 

atmosphere. The NaOH added to the spray also ensures an alkaline pH 

for the solution recirculated in the containment sump. The alkaline pH of 

the containment sump water minimizes the evolution of iodine and 

minimizes the occurrence of chloride and caustic stress corrosion on 

mechanical systems and components exposed to the fluid.

The QS System is a containment ESF system. It is designed to ensure 

that the heat removal capability required during the post accident period 

can be attained. Operation of the QS System and RS System provides 

the required heat removal capability to limit post accident conditions to 

less than the containment design values and depressurize the 

containment structure to subatmospheric pressure in < 60 minutes 

following a DBA.
QS System (Subatmospheric)

B 3.6.6D

Westinghouse STS B 3.6.6D-2 Rev. 4.0

BASES

BACKGROUND (continued)

The QS System limits the temperature and pressure that could be 

expected following a DBA and ensures that containment leakage is 

maintained consistent with the accident analysis.

APPLICABLE The limiting DBAs considered are the loss of coolant accident (LOCA)

SAFETY and the steam line break (SLB). The LOCA and SLB are analyzed using

ANALYSES computer codes designed to predict the resultant containment pressure 

and temperature transients. No DBAs are assumed to occur 

simultaneously or consecutively. The postulated DBAs are analyzed, with 

respect to containment ESF Systems, assuming the loss of one ESF bus, 

which is the worst case single active failure, resulting in one train of the 

QS System and the RS System inoperable.

During normal operation, the containment internal pressure is varied to 

maintain the capability to depressurize the containment to a 

subatmospheric pressure in < 60 minutes after a DBA. This capability 

and the variation of containment pressure are functions of the service 

water temperature, the RWST water temperature, and the containment air 

temperature.

The DBA analyses (Ref. 1) show that the maximum peak containment 

pressure of [44.1] psig results from the LOCA analysis and is calculated 

to be less than the containment design pressure. The maximum peak 

containment atmosphere temperature of [385]°F results from the SLB 

analysis and was calculated to exceed the containment design 

temperature for [a few seconds] during the transient. The basis of the 

containment design temperature, however, is to ensure OPERABILITY of 

safety related equipment inside containment (Ref. 2). Thermal analyses 

show that the time interval during which the containment atmosphere 

temperature exceeded the containment design temperature was short 

enough that the equipment surface temperatures remained below the 

design temperature. Therefore, it is concluded that the calculated 

transient containment atmosphere temperatures are acceptable for the 

SLB.

The modeled QS System actuation from the containment analysis is 

based upon a response time associated with exceeding the containment 

High-High pressure signal setpoint to achieving full flow through the spray 

nozzles. A delayed response time initiation provides conservative 

analyses of peak calculated containment temperature and pressure 

responses. The QS System total response time of [66] seconds 

comprises the signal delay, diesel generator startup time, and system 

startup time.
QS System (Subatmospheric)

B 3.6.6D

Westinghouse STS B 3.6.6D-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

For certain aspects of accident analyses, maximizing the calculated 

containment pressure is not conservative. In particular, the cooling 

effectiveness of the Emergency Core Cooling System during the core 

reflood phase of a LOCA analysis increases with increasing containment 

backpressure. For these calculations, the containment backpressure is 

calculated in a manner designed to conservatively minimize, rather than 

maximize, the calculated transient containment pressures in accordance 

with 10 CFR 50, Appendix K (Ref. 3).

Inadvertent actuation of the QS System is evaluated in the analysis, and 

the resultant reduction in containment pressure is calculated. The 

maximum calculated reduction in containment pressure resulted in a 

containment external pressure load of [unit specific pressure], which is 

below the containment design external pressure load.

The QS System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO During a DBA, one train of the QS System is required to provide the heat 

removal capability assumed in the safety analyses for containment. In 

addition, one QS System train, with spray pH adjusted by the Spray 

Additive System, is required to scavenge iodine fission products from the 

containment atmosphere and ensure their retention in the containment 

sump water. To ensure that these requirements are met, two QS System 

trains must be OPERABLE with power from two safety related, 

independent power supplies. Therefore, in the event of an accident, at 

least one train in each system will operate, assuming that the worst case 

single active failure occurs.

Each QS System includes a spray pump, spray headers, nozzles, valves, 

piping, instruments, and controls to ensure an OPERABLE flow path 

capable of taking suction from the RWST.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment and an increase in containment pressure and 

temperature requiring the operation of the QS System.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Thus, the QS System is not required to be OPERABLE in 

MODE 5 or 6.
QS System (Subatmospheric)

B 3.6.6D

Westinghouse STS B 3.6.6D-4 Rev. 4.0

BASES

ACTIONS A.1

If one QS train is inoperable, it must be restored to OPERABLE status 

within 72 hours. The components in this degraded condition are capable 

of providing 100% of the heat removal and iodine removal needs after an 

accident. The 72 hour Completion Time was developed taking into 

account the redundant heat removal and iodine removal capabilities 

afforded by the OPERABLE train and the low probability of a DBA 

occurring during this period.

B.1 and B.2

If the Required Action and associated Completion Time are not met, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

6 hours and to MODE 5 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required 

plant conditions from full power conditions in an orderly manner and 

without challenging plant systems.

SURVEILLANCE SR 3.6.6D.1

REQUIREMENTS

Verifying the correct alignment of manual, power operated, and automatic 

valves, excluding check valves, in the QS System provides assurance 

that the proper flow path exists for QS System operation. This SR does 

not apply to valves that are locked, sealed, or otherwise secured in 

position, since they were verified to be in the correct position prior to 

being secured. This SR does not require any testing or valve 

manipulation. Rather, it involves verification that those valves outside 

containment and capable of potentially being mispositioned are in the 

correct position.

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
QS System (Subatmospheric)

B 3.6.6D

Westinghouse STS B 3.6.6D-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6D.2

Verifying that each QS pump's developed head at the flow test point is 

greater than or equal to the required developed head ensures that QS 

pump performance has not degraded during the cycle. Flow and 

differential head are normal tests of centrifugal pump performance 

required by the ASME Code (Ref. 4). Since the QS System pumps 

cannot be tested with flow through the spray headers, they are tested on 

bypass flow. This test confirms one point on the pump design curve and 

is indicative of overall performance. Such inservice tests confirm 

component OPERABILITY, trend performance, and detect incipient 

failures by indicating abnormal performance. The Frequency of this SR is 

in accordance with the Inservice Testing Program.

SR 3.6.6D.3 and SR 3.6.6D.4

These SRs ensure that each QS automatic valve actuates to its correct 

position and each QS pump starts upon receipt of an actual or simulated 

containment spray actuation signal. This Surveillance is not required for 

valves that are locked, sealed, or otherwise secured in the required 

position under administrative controls. [ The [18] month Frequency is 

based on the need to perform these Surveillances under the conditions 

that apply during a plant outage and the potential for an unplanned 

transient if the Surveillances were performed with the reactor at power. 

Operating experience has shown that these components usually pass the 

Surveillances when performed at an [18] month Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
QS System (Subatmospheric)

B 3.6.6D

Westinghouse STS B 3.6.6D-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6D.5

With the containment spray inlet valves closed and the spray header 

drained of any solution, low pressure air or smoke can be blown through 

test connections. This SR ensures that each spray nozzle is 

unobstructed and that spray coverage of the containment during an 

accident is not degraded. [ Due to the passive nature of the design of the 

nozzle, a test at [the first refueling and at] 10 year intervals is considered 

adequate to detect obstruction of the nozzles.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50.49.

3. 10 CFR 50, Appendix K.

4. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.6E Recirculation Spray (RS) System (Subatmospheric)

BASES

BACKGROUND The RS System, operating in conjunction with the Quench Spray (QS) 

System, is designed to limit the post accident pressure and temperature 

in the containment to less than the design values and to depressurize the 

containment structure to a subatmospheric pressure in less than 

60 minutes following a Design Basis Accident (DBA). The reduction of 

containment pressure and the removal of iodine from the containment 

atmosphere by the spray limit the release of fission product radioactivity 

from containment to the environment in the event of a DBA.

The RS System consists of two separate trains of equal capacity, each 

capable of meeting the design and accident analysis bases. Each train 

includes one RS subsystem outside containment and one RS subsystem 

inside containment. Each subsystem consists of one 50% capacity spray 

pump, one spray cooler, one 180° coverage spray header, nozzles, 

valves, piping, instrumentation, and controls. Each outside RS 

subsystem also includes a casing cooling pump with its own valves, 

piping, instrumentation, and controls. The two outside RS subsystems' 

spray pumps are located outside containment and the two inside RS 

subsystems' spray pumps are located inside containment. Each RS train 

(one inside and one outside RS subsystem) is powered from a separate 

Engineered Safety Features (ESF) bus. Each train of the RS System 

provides adequate spray coverage to meet the system design 

requirements for containment heat and iodine fission product removal.

The two casing cooling pumps and common casing cooling tank are 

designed to increase the net positive suction head (NPSH) available to 

the outside RS pumps by injecting cold water into the suction of the spray 

pumps. The casing cooling water tank contains 116,500 gal of chilled 

and borated water. Each casing cooling pump supplies one outside spray 

pump with cold borated water from the casing cooling water tank. The 

casing cooling pumps are considered part of the outside RS subsystems. 

Each casing cooling pump is powered from a separate ESF bus.

The RS provides a spray of subcooled water into the upper regions of 

containment to reduce the containment pressure and temperature during 

a DBA. Upon receipt of a High-High containment pressure signal, the two 

casing cooling pumps start and the RS pump suction and discharge 

valves receive an open signal to assure the valves are open. After a 

[195] second time delay, the inside RS pumps start, and after a 
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-2 Rev. 4.0

BASES

BACKGROUND (continued)

[210] second time delay, the outside RS pumps start. The RS pumps 

take suction from the containment sump and discharge through their 

respective spray coolers to the spray headers and into the containment 

atmosphere. Heat is transferred from the containment sump water to 

service water in the spray coolers.

The Spray Additive System injects a sodium hydroxide (NaOH) solution 

into the suction of the QS System pumps. The NaOH added to the QS 

System spray ensures an alkaline pH for the solution recirculated in the 

containment sump. The resulting alkaline pH of the RS spray (pumped 

from the sump) enhances the ability of the spray to scavenge iodine 

fission products from the containment atmosphere. The alkaline pH of 

the containment sump water minimizes the evolution of iodine and 

minimizes the occurrence of chloride and caustic stress corrosion on 

mechanical systems and components exposed to the fluid.

The RS is a containment ESF system. It is designed to ensure that the 

heat removal capability required during the post accident period can be 

attained. Operation of the QS and RS systems provides the required 

heat removal capability to limit post accident conditions to less than the 

containment design values and depressurize the containment structure to 

subatmospheric pressure in < 60 minutes following a DBA.

The RS limits the temperature and pressure that could be expected 

following a DBA and ensures that containment leakage is maintained 

consistent with the accident analysis.

APPLICABLE The limiting DBAs considered are the loss of coolant accident (LOCA)

SAFETY and the steam line break (SLB). The LOCA and SLB are analyzed using

ANALYSES computer codes designed to predict the resultant containment pressure 

and temperature transients; DBAs are assumed not to occur 

simultaneously or consecutively. The postulated DBAs are analyzed 

assuming the loss of one ESF bus, which is the worst case single active 

failure, resulting in one train of the QS and RS systems being rendered 

inoperable (Ref. 1).

The peak containment pressure following a high energy line break is 

affected by the initial total pressure and temperature of the containment 

atmosphere and the QS System operation. Maximizing the initial 

containment total pressure and average atmospheric temperature 

maximizes the calculated peak pressure. The heat removal effectiveness 

of the QS System spray is dependent on the temperature of the water in

the refueling water storage tank (RWST). The time required to 
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

depressurize the containment and the capability to maintain it 

depressurized below atmospheric pressure depend on the functional 

performance of the QS and RS systems and the service water 

temperature. When the Service Water temperature is elevated, it is more 

difficult to depressurize the containment within 60 minutes since the heat 

removal effectiveness of the RS System is limited.

During normal operation, the containment internal pressure is varied to 

maintain the capability to depressurize the containment to a 

subatmospheric pressure in < 60 minutes after a DBA. This capability 

and the variation of containment pressure are functions of service water 

temperature, RWST water temperature, and the containment air 

temperature.

The DBA analyses show that the maximum peak containment pressure of 

[44.1] psig results from the LOCA analysis and is calculated to be less 

than the containment design pressure. The maximum [385]°F peak 

containment atmosphere temperature results from the SLB analysis and 

is calculated to exceed the containment design temperature for [a few 

seconds] during the transient. The basis of the containment design 

temperature, however, is to ensure OPERABILITY of safety related 

equipment inside containment (Ref. 2). Thermal analyses show that the 

time interval during which the containment atmosphere temperature 

exceeds the containment design temperature is short enough that 

equipment surface temperatures remain below the design temperature. 

Therefore, it is concluded that the calculated transient containment 

atmosphere temperatures are acceptable for the SLB.

The RS System actuation model from the containment analysis is based 

upon a response time associated with exceeding the High-High 

containment pressure signal setpoint to achieving full flow through the RS 

System spray nozzles. A delay in response time initiation provides 

conservative analyses of peak calculated containment temperature and 

pressure. The RS System's total response time of 300 seconds 

comprises the signal delay, diesel generator startup time, and system 

startup time.

For certain aspects of accident analyses, maximizing the calculated 

containment pressure is not conservative. In particular, the cooling 

effectiveness of the Emergency Core Cooling System during the core 

reflood phase of a LOCA analysis increases with increasing containment 
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

backpressure. For these calculations, the containment backpressure is 

calculated in a manner designed to conservatively minimize, rather than 

maximize, the calculated transient containment pressures in accordance 

with 10 CFR 50, Appendix K (Ref. 3).

The RS System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO During a DBA, one train (two subsystems) of the RS System is required 

to provide the minimum heat removal capability assumed in the safety 

analysis. To ensure that this requirement is met, four RS subsystems 

[and a casing cooling tank] must be OPERABLE. This will ensure that at 

least one train will operate assuming the worst case single failure occurs, 

which is in the ESF power supply.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment 

pressure and temperature requiring the operation of the RS System.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Thus, the RS System is not required to be OPERABLE in 

MODE 5 or 6.

ACTIONS A.1

With one of the RS subsystems inoperable, the inoperable subsystem 

must be restored to OPERABLE status within 7 days. The components in 

this degraded condition are capable of providing at least 100% of the heat 

removal needs (i.e., 150% when one RS subsystem is inoperable) after 

an accident. The 7 day Completion Time was developed taking into 

account the redundant heat removal capabilities afforded by combinations 

of the RS and QS systems and the low probability of a DBA occurring 

during this period.

B.1

With two of the required RS subsystems inoperable in the same train, at 

least one of the inoperable RS subsystems must be restored to 

OPERABLE status within 72 hours. The components in this degraded 

condition are capable of providing 100% of the heat removal needs after 

an accident. The 72 hour Completion Time was developed taking into 

account the redundant heat removal capability afforded by the 

OPERABLE subsystems, a reasonable amount of time for repairs, and 

the low probability of a DBA occurring during this period.
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-5 Rev. 4.0

BASES

ACTIONS (continued)

[ C.1

With two inside RS subsystems inoperable, at least one of the inoperable 

subsystems must be restored to OPERABLE status within 72 hours. The 

components in this degraded condition are capable of providing 100% of 

the heat removal needs after an accident. The 72 hour Completion Time 

was chosen based on the same reasons as given in Required 

Action B.1. ]

[ D.1

With two outside RS subsystems inoperable, at least one of the 

inoperable subsystems must be restored to OPERABLE status within 

72 hours. The components in this degraded condition are capable of 

providing 100% of the heat removal needs after an accident. The 72 hour 

Completion Time was chosen based on the same reasons as given in 

Required Action B.1. ]

[ E.1

With the casing cooling tank inoperable, the NPSH available to the 

outside RS subsystem pumps may not be sufficient. The inoperable 

casing cooling tank must be restored to OPERABLE status within 

72 hours. The components in this degraded condition are capable of 

providing 100% of the heat removal needs after an accident. The 72 hour 

Completion Time was chosen based on the same reasons as given in 

Required Action B.1. ]

F.1 and F.2

If the inoperable RS subsystem(s) or the casing cooling tank cannot be 

restored to OPERABLE status within the required Completion Time, the 

plant must be brought to a MODE in which the LCO does not apply. To 

achieve this status, the plant must be brought to at least MODE 3 within 

6 hours and to MODE 5 within 84 hours. The allowed Completion Time of 

6 hours is reasonable, based on operating experience, to reach MODE 3 

from full power conditions in an orderly manner and without challenging 

plant systems. The extended interval to reach MODE 5 allows additional 

time and is reasonable considering that the driving force for a release of 

radioactive material from the Reactor Coolant System is reduced in 

MODE 3.
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-6 Rev. 4.0

BASES

ACTIONS (continued)

G.1

With three or more RS subsystems inoperable, the unit is in a condition 

outside the accident analysis. Therefore, LCO 3.0.3 must be entered 

immediately.

SURVEILLANCE SR 3.6.6E.1

REQUIREMENTS

Verifying that the casing cooling tank solution temperature is within the 

specified tolerances provides assurance that the water injected into the 

suction of the outside RS pumps will increase the NPSH available as per 

design. [ The 24 hour Frequency of this SR was developed considering 

operating experience related to the parameter variations and instrument 

drift during the applicable MODES. Furthermore, the 24 hour Frequency 

is considered adequate in view of other indications available in the control 

room, including alarms, to alert the operator to an abnormal condition.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6E.2

Verifying the casing cooling tank contained borated water volume 

provides assurance that sufficient water is available to support the outside 

RS subsystem pumps during the time they are required to operate. [ The 

7 day Frequency of this SR was developed considering operating 

experience related to the parameter variations and instrument drift during 

the applicable MODES. Furthermore, the 7 day Frequency is considered 

adequate in view of other indications available in the control room, 

including alarms, to alert the operator to an abnormal condition.

OR
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6E.3

Verifying the boron concentration of the solution in the casing cooling tank 

provides assurance that borated water added from the casing cooling 

tank to RS subsystems will not dilute the solution being recirculated in the 

containment sump. [ The 7 day Frequency of this SR was developed 

considering the known stability of stored borated water and the low 

probability of any source of diluting pure water.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6E.4

Verifying the correct alignment of manual, power operated, and automatic 

valves, excluding check valves, in the RS System and casing cooling tank 

provides assurance that the proper flow path exists for operation of the 

RS System. This SR does not apply to valves that are locked, sealed, or 

otherwise secured in position, since they are verified as being in the 

correct position prior to being secured. This SR does not require any 

testing or valve manipulation. Rather, it involves verification that those 

valves outside containment and capable of potentially being 

mispositioned are in the correct position.
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6E.5

Verifying that each RS [and casing cooling] pump's developed head at the 

flow test point is greater than or equal to the required developed head 

ensures that these pumps' performance has not degraded during the 

cycle. Flow and differential head are normal tests of centrifugal pump 

performance required by the ASME Code (Ref. 4). Since the QS System 

pumps cannot be tested with flow through the spray headers, they are 

tested on bypass flow. This test confirms one point on the pump design 

curve and is indicative of overall performance. Such inservice tests 

confirm component OPERABILITY, trend performance, and detect 

incipient failures by indicating abnormal performance. The Frequency of 

this SR is in accordance with the Inservice Testing Program.

SR 3.6.6E.6

These SRs ensure that each automatic valve actuates and that the RS 

System and casing cooling pumps start upon receipt of an actual or 

simulated High-High containment pressure signal. Start delay times are 

also verified for the RS System pumps. This Surveillance is not required 

for valves that are locked, sealed, or otherwise secured in the required 

position under administrative controls. [ The [18] month Frequency is 

based on the need to perform this Surveillance under the conditions that 

apply during a plant outage and the potential for an unplanned transient if 

the Surveillance were performed with the reactor at power. Operating 
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. Therefore, 

the Frequency was considered to be acceptable from a reliability 

standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.6E.7

This SR ensures that each spray nozzle is unobstructed and that spray 

coverage of the containment will meet its design bases objective. An air 

or smoke test is performed through each spray header. [ Due to the 

passive design of the spray header and its normally dry state, a test at 

[the first refueling and at] 10 year intervals is considered adequate for 

detecting obstruction of the nozzles.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RS System (Subatmospheric)

B 3.6.6E

Westinghouse STS B 3.6.6E-10 Rev. 4.0

BASES

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50.49.

3. 10 CFR 50, Appendix K.

4. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.
Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.7

Westinghouse STS B 3.6.7-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.7 Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

BASES

BACKGROUND The Spray Additive System is a subsystem of the Containment Spray 

System that assists in reducing the iodine fission product inventory in the 

containment atmosphere resulting from a Design Basis Accident (DBA).

Radioiodine in its various forms is the fission product of primary concern 

in the evaluation of a DBA. It is absorbed by the spray from the 

containment atmosphere. To enhance the iodine absorption capacity of 

the spray, the spray solution is adjusted to an alkaline pH that promotes 

iodine hydrolysis, in which iodine is converted to nonvolatile forms. 

Because of its stability when exposed to radiation and elevated 

temperature, sodium hydroxide (NaOH) is the preferred spray additive. 

The NaOH added to the spray also ensures a pH value of between 8.5 

and 11.0 of the solution recirculated from the containment sump. This pH 

band minimizes the evolution of iodine as well as the occurrence of 

chloride and caustic stress corrosion on mechanical systems and 

components.

Eductor Feed Systems Only

The Spray Additive System consists of one spray additive tank that is 

shared by the two trains of spray additive equipment. Each train of 

equipment provides a flow path from the spray additive tank to a 

containment spray pump and consists of an eductor for each containment 

spray pump, valves, instrumentation, and connecting piping. Each 

eductor draws the NaOH spray solution from the common tank using a 

portion of the borated water discharged by the containment spray pump 

as the motive flow. The eductor mixes the NaOH solution and the 

borated water and discharges the mixture into the spray pump suction 

line. The eductors are designed to ensure that the pH of the spray 

mixture is between 8.5 and 11.0.

Gravity Feed Systems Only

The Spray Additive System consists of one spray additive tank, two 

parallel redundant motor operated valves in the line between the additive 

tank and the refueling water storage tank (RWST), instrumentation, and 

recirculation pumps. The NaOH solution is added to the spray water by a 

balanced gravity feed from the additive tank through the connecting 

piping into a weir within the RWST. There, it mixes with the borated 

water flowing to the spray pump suction. Because of the hydrostatic 

balance between the two tanks, the flow rate of the NaOH is controlled by 

the volume per foot of height ratio of the two tanks. This ensures a spray 

mixture pH that is ≥ 8.5 and ≤ 11.0.
Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.7

Westinghouse STS B 3.6.7-2 Rev. 4.0

BASES

BACKGROUND (continued)

The Containment Spray System actuation signal opens the valves from 

the spray additive tank to the spray pump suctions or the containment 

spray pump start signal opens the valves from the spray additive tank 

after a 5 minute delay. The 28% to 31% NaOH solution is drawn into the 

spray pump suctions. The spray additive tank capacity provides for the 

addition of NaOH solution to all of the water sprayed from the RWST into 

containment. The percent solution and volume of solution sprayed into 

containment ensures a long term containment sump pH of ≥ 9.0 and 

≤ 9.5. This ensures the continued iodine retention effectiveness of the 

sump water during the recirculation phase of spray operation and also 

minimizes the occurrence of chloride induced stress corrosion cracking of 

the stainless steel recirculation piping.

APPLICABLE The Spray Additive System is essential to the removal of airborne iodine

SAFETY within containment following a DBA.

ANALYSES

Following the assumed release of radioactive materials into containment, 

the containment is assumed to leak at its design value volume following 

the accident. The analysis assumes that 100% of containment is covered 

by the spray (Ref. 1).

The DBA response time assumed for the Spray Additive System is the 

same as for the Containment Spray System and is discussed in the 

Bases for LCO 3.6.6, "Containment Spray and Cooling Systems."

The DBA analyses assume that one train of the Containment Spray 

System/Spray Additive System is inoperable and that the entire spray 

additive tank volume is added to the remaining Containment Spray 

System flow path.

The Spray Additive System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The Spray Additive System is necessary to reduce the release of 

radioactive material to the environment in the event of a DBA. To be 

considered OPERABLE, the volume and concentration of the spray 

additive solution must be sufficient to provide NaOH injection into the 

spray flow until the Containment Spray System suction path is switched 

from the RWST to the containment sump, and to raise the average spray 

solution pH to a level conducive to iodine removal, namely, to 

between [7.2 and 11.0]. This pH range maximizes the effectiveness of 

the iodine removal mechanism without introducing conditions that may 

induce caustic stress corrosion cracking of mechanical system 

components. In addition, it is essential that valves in the Spray Additive 

System flow paths are properly positioned and that automatic valves are 

capable of activating to their correct positions.
Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.7

Westinghouse STS B 3.6.7-3 Rev. 4.0

BASES

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause a release of radioactive 

material to containment requiring the operation of the Spray Additive 

System. The Spray Additive System assists in reducing the iodine fission 

product inventory prior to release to the environment.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations in these 

MODES. Thus, the Spray Additive System is not required to be 

OPERABLE in MODE 5 or 6.

ACTIONS A.1

If the Spray Additive System is inoperable, it must be restored to 

OPERABLE within 72 hours. The pH adjustment of the Containment 

Spray System flow for corrosion protection and iodine removal 

enhancement is reduced in this condition. The Containment Spray 

System would still be available and would remove some iodine from the 

containment atmosphere in the event of a DBA. The 72 hour Completion 

Time takes into account the redundant flow path capabilities and the low 

probability of the worst case DBA occurring during this period.

B.1 and B.2

If the Spray Additive System cannot be restored to OPERABLE status 

within the required Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 6 hours and to MODE 5 within 

84 hours. The allowed Completion Time of 6 hours is reasonable, based 

on operating experience, to reach MODE 3 from full power conditions in 

an orderly manner and without challenging plant systems. The extended 

interval to reach MODE 5 allows 48 hours for restoration of the Spray 

Additive System in MODE 3 and 36 hours to reach MODE 5. This is 

reasonable when considering the reduced pressure and temperature 

conditions in MODE 3 for the release of radioactive material from the 

Reactor Coolant System.

SURVEILLANCE SR 3.6.7.1

REQUIREMENTS

Verifying the correct alignment of Spray Additive System manual, power 

operated, and automatic valves in the spray additive flow path provides 

assurance that the system is able to provide additive to the Containment 

Spray System in the event of a DBA. This SR does not apply to valves 

that are locked, sealed, or otherwise secured in position, since these 

valves were verified to be in the correct position prior to locking, sealing, 

or securing. This SR does not require any testing or valve manipulation. 

Rather, it involves verification that those valves outside containment and 

capable of potentially being mispositioned are in the correct position.
Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.7

Westinghouse STS B 3.6.7-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.7.2

To provide effective iodine removal, the containment spray must be an 

alkaline solution. Since the RWST contents are normally acidic, the 

volume of the spray additive tank must provide a sufficient volume of 

spray additive to adjust pH for all water injected. This SR is performed to 

verify the availability of sufficient NaOH solution in the Spray Additive 

System. [ The 184 day Frequency was developed based on the low 

probability of an undetected change in tank volume occurring during the 

SR interval (the tank is isolated during normal unit operations). Tank 

level is also indicated and alarmed in the control room, so that there is 

high confidence that a substantial change in level would be detected.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.7

Westinghouse STS B 3.6.7-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.7.3

This SR provides verification of the NaOH concentration in the spray 

additive tank and is sufficient to ensure that the spray solution being 

injected into containment is at the correct pH level. [ The 184 day 

Frequency is sufficient to ensure that the concentration level of NaOH in 

the spray additive tank remains within the established limits. This is 

based on the low likelihood of an uncontrolled change in concentration 

(the tank is normally isolated) and the probability that any substantial 

variance in tank volume will be detected.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.7.4

This SR provides verification that each automatic valve in the Spray 

Additive System flow path actuates to its correct position. This 

Surveillance is not required for valves that are locked, sealed, or 

otherwise secured in the required position under administrative controls. 

[ The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency was concluded to be 

acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Spray Additive System (Atmospheric, Subatmospheric, Ice Condenser, and Dual)

B 3.6.7

Westinghouse STS B 3.6.7-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.7.5

To ensure that the correct pH level is established in the borated water 

solution provided by the Containment Spray System, the flow rate in the 

Spray Additive System is verified once every 5 years. This SR provides 

assurance that the correct amount of NaOH will be metered into the flow 

path upon Containment Spray System initiation. [ Due to the passive 

nature of the spray additive flow controls, the 5 year Frequency is 

sufficient to identify component degradation that may affect flow rate.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [15].
Shield Building (Dual and Ice Condenser)

B 3.6.8

Westinghouse STS B 3.6.8-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.8 Shield Building (Dual and Ice Condenser)

BASES

BACKGROUND The shield building is a concrete structure that surrounds the steel 

containment vessel. Between the containment vessel and the shield 

building inner wall is an annular space that collects containment leakage 

that may occur following a loss of coolant accident (LOCA). This space 

also allows for periodic inspection of the outer surface of the steel 

containment vessel.

The Shield Building Air Cleanup System (SBACS) establishes a negative 

pressure in the annulus between the shield building and the steel 

containment vessel. Filters in the system then control the release of 

radioactive contaminants to the environment. The shield building is 

required to be OPERABLE to ensure retention of containment leakage 

and proper operation of the SBACS.

APPLICABLE The design basis for shield building OPERABILITY is a LOCA. 

SAFETY Maintaining shield building OPERABILITY ensures that the release of

ANALYSES radioactive material from the containment atmosphere is restricted to 

those leakage paths and associated leakage rates assumed in the 

accident analyses.

The shield building satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Shield building OPERABILITY must be maintained to ensure proper 

operation of the SBACS and to limit radioactive leakage from the 

containment to those paths and leakage rates assumed in the accident 

analyses.

APPLICABILITY Maintaining shield building OPERABILITY prevents leakage of radioactive 

material from the shield building. Radioactive material may enter the 

shield building from the containment following a LOCA. Therefore, shield 

building OPERABILITY is required in MODES 1, 2, 3, and 4 when a 

steam line break, LOCA, or rod ejection accident could release 

radioactive material to the containment atmosphere.

In MODES 5 and 6, the probability and consequences of these events are 

low due to the Reactor Coolant System temperature and pressure 

limitations in these MODES. Therefore, shield building OPERABILITY is 

not required in MODE 5 or 6.
Shield Building (Dual and Ice Condenser)

B 3.6.8

Westinghouse STS B 3.6.8-2 Rev. 4.0

BASES 

ACTIONS A.1

In the event shield building OPERABILITY is not maintained, shield 

building OPERABILITY must be restored within 24 hours. Twenty-four 

hours is a reasonable Completion Time considering the limited leakage 

design of containment and the low probability of a Design Basis Accident 

occurring during this time period.

B.1 and B.2

If the shield building cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE [ SR 3.6.8.1

REQUIREMENTS

Verifying that shield building annulus negative pressure is within limit 

ensures that operation remains within the limit assumed in the 

containment analysis. [ The 12 hour Frequency of this SR was developed 

considering operating experience related to shield building annulus 

pressure variations and pressure instrument drift during the applicable 

MODES.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]
Shield Building (Dual and Ice Condenser)

B 3.6.8

Westinghouse STS B 3.6.8-3 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.8.2

Maintaining shield building OPERABILITY requires verifying one door in 

the access opening closed. [An access opening may contain one inner 

and one outer door, or in some cases, shield building access openings 

are shared such that a shield building barrier may have multiple inner or 

multiple outer doors. The intent is to not breach the shield building 

boundary at any time when the shield building boundary is required. This 

is achieved by maintaining the inner or outer portion of the barrier closed 

at all times.] However, all shield building access doors are normally kept 

closed, except when the access opening is being used for entry and exit 

or when maintenance is being performed on an access opening. [ The 

31 day Frequency of this SR is based on engineering judgment and is 

considered adequate in view of the other indications of door status that 

are available to the operator.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.6.8.3

This SR would give advance indication of gross deterioration of the 

concrete structural integrity of the shield building. The Frequency of this 

SR is the same as that of SR 3.6.1.1. The verification is done during 

shutdown. ]
Shield Building (Dual and Ice Condenser)

B 3.6.8

Westinghouse STS B 3.6.8-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.8.4

The Shield Building Air Cleanup System produces a negative pressure to 

prevent leakage from the building. SR 3.6.8.4 verifies that the shield 

building can be rapidly drawn down to [-0.5] inch water gauge in the 

annulus. This test is used to ensure shield building boundary integrity. 

Establishment of this pressure is confirmed by SR 3.6.8.4, which 

demonstrates that the shield building can be drawn down to ≤ [-0.5] 

inches of vacuum water gauge in the annulus ≤ [22] seconds using one 

Shield Building Air Cleanup System train. The time limit ensures that no 

significant quantity of radioactive material leaks from the shield building 

prior to developing the negative pressure. Since this SR is a shield 

building boundary integrity test, it does not need to be performed with 

each Shield Building Air Cleanup System train. [ The Shield Building Air 

Cleanup System train used for this Surveillance is staggered to ensure 

that in addition to the requirements of LCO 3.6.8.4, either train will 

perform this test. ] The primary purpose of this SR is to ensure shield 

building integrity. The secondary purpose of this SR is to ensure that the 

Shield Building Air Cleanup System being tested functions as designed. 

The inoperability of the Shield Building Air Cleanup System train does not 

necessarily constitute a failure of this Surveillance relative to the shield 

building OPERABILITY. [ The 18 month Frequency is based on the need 

to perform this Surveillance under conditions that apply during a plant 

outage.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES None.
HMS (Atmospheric, Ice Condenser, and Dual)

B 3.6.9

Westinghouse STS B 3.6.9-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.9 Hydrogen Mixing System (HMS) (Atmospheric, Ice Condenser, and Dual)

BASES

BACKGROUND The HMS reduces the potential for breach of containment due to a 

hydrogen oxygen reaction by providing a uniformly mixed post accident 

containment atmosphere, thereby minimizing the potential for local 

hydrogen burns due to a pocket of hydrogen above the flammable 

concentration. Maintaining a uniformly mixed containment atmosphere 

also ensures that the hydrogen monitors will give an accurate measure of 

the bulk hydrogen concentration and give the operator the capability of 

preventing the occurrence of a bulk hydrogen burn inside containment per 

10 CFR 50.44, "Standards for Combustible Gas Control Systems in LightWater-Cooled Reactors" (Ref. 1), and 10 CFR 50, GDC 41, "Containment 

Atmosphere Cleanup" (Ref. 2).

The post accident HMS is an Engineered Safety Feature (ESF) and is 

designed to withstand a loss of coolant accident (LOCA) without loss of 

function. The System has two independent trains, each consisting of two 

fans with their own motors and controls. Each train is sized for 

[4000] cfm. The two trains are initiated automatically on a Phase A 

containment isolation signal. The automatic action is to start the 

nonoperating hydrogen mixing fans on slow speed and shift the operating 

hydrogen mixing fans (if any) to slow speed. Each train is powered from 

a separate emergency power supply. Since each train fan can provide 

100% of the mixing requirements, the System will provide its design 

function with a limiting single active failure.

Air is drawn from the steam generator compartments by the locally 

mounted mixing fans and is discharged toward the upper regions of the 

containment. This complements the air patterns established by the 

containment air coolers, which take suction from the operating floor level 

and discharge to the lower regions of the containment, and the 

containment spray, which cools the air and causes it to drop to lower

elevations. The systems work together such that potentially stagnant 

areas where hydrogen pockets could develop are eliminated.

When performing their post accident hydrogen mixing function, the 

hydrogen mixing fans operate on slow speed to prevent motor overload in 

a post accident high pressure environment. The design flow rate on slow 

speed is based on the minimum air distribution requirements to eliminate 

stagnant hydrogen pockets. Each train is redundant (full capacity) and is 

powered from an independent ESF bus. The hydrogen mixing fans may 
HMS (Atmospheric, Ice Condenser, and Dual)

B 3.6.9

Westinghouse STS B 3.6.9-2 Rev. 4.0

BASES

BACKGROUND (continued)

be operated on fast speed during normal operation when a containment 

air cooler is taken out of service. As such, the design flow rate of the 

hydrogen mixing fans for high speed operation is based on air distribution 

requirements during such normal operation.

APPLICABLE The HMS provides the capability for reducing the local hydrogen

SAFETY concentration to approximately the bulk average concentration. The

ANALYSES limiting DBA relative to hydrogen concentration is a LOCA.

Hydrogen may accumulate in containment following a LOCA as a result 

of:

a. A metal steam reaction between the zirconium fuel rod cladding and 

the reactor coolant,

b. Radiolytic decomposition of water in the Reactor Coolant System 

(RCS) and the containment sump,

c. Hydrogen in the RCS at the time of the LOCA (i.e., hydrogen 

dissolved in the reactor coolant and hydrogen gas in the pressurizer 

vapor space), or

d. Corrosion of metals exposed to containment spray and Emergency 

Core Cooling System solutions.

To evaluate the potential for hydrogen accumulation in containment 

following a LOCA, the hydrogen generation as a function of time following 

the initiation of the accident is calculated. Conservative assumptions 

recommended by Reference 3 are used to maximize the amount of 

hydrogen calculated.

The HMS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two HMS trains must be OPERABLE, with power to each from an 

independent, safety related power supply. Each train typically consists of 

two fans with their own motors and controls and is automatically initiated 

by a Phase A containment isolation signal.

Operation with at least one HMS train provides the mixing necessary to 

ensure uniform hydrogen concentration throughout containment.
HMS (Atmospheric, Ice Condenser, and Dual)

B 3.6.9

Westinghouse STS B 3.6.9-3 Rev. 4.0

BASES 

APPLICABILITY In MODES 1 and 2, the two HMS trains ensure the capability to prevent 

localized hydrogen concentrations above the flammability limit of 

4.1 volume percent in containment assuming a worst case single active 

failure.

In MODE 3 or 4, both the hydrogen production rate and the total 

hydrogen produced after a LOCA would be less than that calculated for 

the DBA LOCA. Also, because of the limited time in these MODES, the 

probability of an accident requiring the HMS is low. Therefore, the HMS 

is not required in MODE 3 or 4.

In MODES 5 and 6, the probability and consequences of a LOCA or 

steam line break (SLB) are reduced due to the pressure and temperature 

limitations in these MODES. Therefore, the HMS is not required in these 

MODES.

ACTIONS A.1

With one HMS train inoperable, the inoperable train must be restored to 

OPERABLE status within 30 days. In this Condition, the remaining 

OPERABLE HMS train is adequate to perform the hydrogen mixing 

function. However, the overall reliability is reduced because a single 

failure in the OPERABLE train could result in reduced hydrogen mixing 

capability. The 30 day Completion Time is based on the availability of the 

other HMS train, the small probability of a LOCA or SLB occurring (that 

would generate an amount of hydrogen that exceeds the flammability 

limit), the amount of time available after a LOCA or SLB (should one 

occur) for operator action to prevent hydrogen accumulation from 

exceeding the flammability limit, and the availability of the Containment 

Spray System and Hydrogen Purge System.

B.1 and B.2

-----------------------------------REVIEWER’S NOTE-----------------------------------

This Condition is only allowed for units with an alternate hydrogen control 

system acceptable to the technical staff.

--------------------------------------------------------------------------------------------------

With two HMS trains inoperable, the ability to perform the hydrogen 

control function via alternate capabilities must be verified by 

administrative means within 1 hour. The alternate hydrogen control 

capabilities are provided by [the containment Hydrogen Purge System/ 

Hydrogen Ignitor System/ HMS/ Containment Air Dilution System/ 

Containment Inerting System]. The 1 hour Completion Time allows a 

reasonable period of time to verify that a loss of hydrogen control function 

does not exist.
HMS (Atmospheric, Ice Condenser, and Dual)

B 3.6.9

Westinghouse STS B 3.6.9-4 Rev. 4.0

BASES

ACTIONS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

The following is to be used if a non-Technical Specification alternate 

hydrogen control function is used to justify this Condition: In addition, the 

alternate hydrogen control system capability must be verified once per 

12 hours thereafter to ensure its continued availability.

--------------------------------------------------------------------------------------------------

[Both] the [initial] verification [and all subsequent verifications] may be 

performed as an administrative check, by examining logs or other 

information to determine the availability of the alternate hydrogen control 

system. It does not mean to perform the Surveillances needed to 

demonstrate OPERABILITY of the alternate hydrogen control system. If 

the ability to perform the hydrogen control function is maintained, 

continued operation is permitted with two HMS trains inoperable for up to 

7 days. Seven days is a reasonable time to allow two HMS trains to be 

inoperable because the hydrogen control function is maintained and 

because of the low probability of the occurrence of a LOCA that would 

generate hydrogen in the amounts capable of exceeding the flammability 

limit.

C.1

If an inoperable HMS train cannot be restored to OPERABLE status 

within the required Completion Time, the plant must be brought to a 

MODE in which the LCO does not apply. To achieve this status, the plant 

must be brought to at least MODE 3 within 6 hours. The allowed 

Completion Time of 6 hours is reasonable, based on operating 

experience, to reach MODE 3 from full power conditions in an orderly 

manner and without challenging plant systems.

SURVEILLANCE SR 3.6.9.1

REQUIREMENTS

Operating each HMS train for ≥ 15 minutes ensures that each train is 

OPERABLE and that all associated controls are functioning properly. It 

also ensures that blockage, fan and/or motor failure, or excessive 

vibration can be detected for corrective action. [ The 92 day Frequency is 

consistent with Inservice Testing Program Surveillance Frequencies, 

operating experience, the known reliability of the fan motors and controls, 

and the two train redundancy available.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
HMS (Atmospheric, Ice Condenser, and Dual)

B 3.6.9

Westinghouse STS B 3.6.9-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.9.2

Verifying that each HMS train flow rate on slow speed is ≥ [4000] cfm 

ensures that each train is capable of maintaining localized hydrogen 

concentrations below the flammability limit. [ The [18] month Frequency 

is based on the need to perform this Surveillance under the conditions 

that apply during a plant outage and the potential for an unplanned 

transient if the Surveillance were performed with the reactor at power. 

Operating experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.9.3

This SR ensures that each HMS train responds properly to a containment 

cooling actuation signal. The Surveillance verifies that each fan starts on 

slow speed from the nonoperating condition and that each fan shifts to 

slow speed from fast operating condition. [ The [18] month Frequency is 

based on the need to perform this Surveillance under the conditions that 

apply during a plant outage and the potential for an unplanned transient if 
HMS (Atmospheric, Ice Condenser, and Dual)

B 3.6.9

Westinghouse STS B 3.6.9-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

the Surveillance were performed with the reactor at power. Operating 

experience has shown these components usually pass the Surveillance 

when performed at the [18] month Frequency. Therefore, the Frequency 

was concluded to be acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50.44.

2. 10 CFR 50, Appendix A, GDC 41.

3. Regulatory Guide 1.7, Revision [1].
HIS (Ice Condenser)

B 3.6.10

Westinghouse STS B 3.6.10-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.10 Hydrogen Ignition System (HIS) (Ice Condenser)

BASES

BACKGROUND The HIS reduces the potential for breach of primary containment due to a 

hydrogen oxygen reaction in post accident environments. The HIS is 

required by 10 CFR 50.44, "Standards for Combustible Gas Control 

Systems in Light-Water-Cooled Reactors" (Ref. 1), and Appendix A, 

GDC 41, "Containment Atmosphere Cleanup" (Ref. 2), to reduce the 

hydrogen concentration in the primary containment following a degraded 

core accident. The HIS must be capable of handling an amount of 

hydrogen equivalent to that generated from a metal water reaction 

involving 75% of the fuel cladding surrounding the active fuel region 

(excluding the plenum volume).

10 CFR 50.44 (Ref. 1) requires units with ice condenser containments to 

install suitable hydrogen control systems that would accommodate an 

amount of hydrogen equivalent to that generated from the reaction of 

75% of the fuel cladding with water. The HIS provides this required 

capability. This requirement was placed on ice condenser units because 

of their small containment volume and low design pressure (compared 

with pressurized water reactor dry containments). Calculations indicate 

that if hydrogen equivalent to that generated from the reaction of 75% of 

the fuel cladding with water were to collect in the primary containment, 

the resulting hydrogen concentration would be far above the lower 

flammability limit such that, if ignited from a random ignition source, the 

resulting hydrogen burn would seriously challenge the containment and 

safety systems in the containment.

The HIS is based on the concept of controlled ignition using thermal 

ignitors, designed to be capable of functioning in a post accident 

environment, seismically supported, and capable of actuation from the 

control room. A total of [64] ignitors are distributed throughout the various 

regions of containment in which hydrogen could be released or to which it 

could flow in significant quantities. The ignitors are arranged in two 

independent trains such that each containment region has at least two 

ignitors, one from each train, controlled and powered redundantly so that 

ignition would occur in each region even if one train failed to energize.

When the HIS is initiated, the ignitor elements are energized and heat up 

to a surface temperature ≥ [1700]°F. At this temperature, they ignite the 

hydrogen gas that is present in the airspace in the vicinity of the ignitor. 

The HIS depends on the dispersed location of the ignitors so that local 

pockets of hydrogen at increased concentrations would burn before 
HIS (Ice Condenser)

B 3.6.10

Westinghouse STS B 3.6.10-2 Rev. 4.0

BASES

BACKGROUND (continued)

reaching a hydrogen concentration significantly higher than the lower 

flammability limit. Hydrogen ignition in the vicinity of the ignitors is 

assumed to occur when the local hydrogen concentration reaches 

[8.0] volume percent (v/o) and results in [85]% of the hydrogen present 

being consumed.

APPLICABLE The HIS causes hydrogen in containment to burn in a controlled manner

SAFETY as it accumulates following a degraded core accident (Ref. 3). Burning

ANALYSES occurs at the lower flammability concentration, where the resulting 

temperatures and pressures are relatively benign. Without the system, 

hydrogen could build up to higher concentrations that could result in a 

violent reaction if ignited by a random ignition source after such a buildup.

The hydrogen ignitors are not included for mitigation of a Design Basis 

Accident (DBA) because an amount of hydrogen equivalent to that 

generated from the reaction of 75% of the fuel cladding with water is far in 

excess of the hydrogen calculated for the limiting DBA loss of coolant 

accident (LOCA). The hydrogen ignitors have been shown by 

probabilistic risk analysis to be a significant contributor to limiting the 

severity of accident sequences that are commonly found to dominate risk 

for units with ice condenser containments. The hydrogen ignitors satisfy 

Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO Two HIS trains must be OPERABLE with power from two independent, 

safety related power supplies.

For this unit, an OPERABLE HIS train consists of 32 of 33 ignitors 

energized on the train.

Operation with at least one HIS train ensures that the hydrogen in 

containment can be burned in a controlled manner. Unavailability of both 

HIS trains could lead to hydrogen buildup to higher concentrations, which 

could result in a violent reaction if ignited. The reaction could take place 

fast enough to lead to high temperatures and overpressurization of 

containment and, as a result, breach containment or cause containment 

leakage rates above those assumed in the safety analyses. Damage to 

safety related equipment located in containment could also occur.

APPLICABILITY Requiring OPERABILITY in MODES 1 and 2 for the HIS ensures its 

immediate availability after safety injection and scram actuated on a 

LOCA initiation. In the post accident environment, the two HIS 

subsystems are required to control the hydrogen concentration within 

containment to near its flammability limit of 4.1 v/o assuming a worst case 

single failure. This prevents overpressurization of containment and 

damage to safety related equipment and instruments located within 

containment.
HIS (Ice Condenser)

B 3.6.10

Westinghouse STS B 3.6.10-3 Rev. 4.0

BASES 

APPLICABILITY (continued)

In MODES 3 and 4, both the hydrogen production rate and the total 

hydrogen production after a LOCA would be significantly less than that 

calculated for the DBA LOCA. Also, because of the limited time in these 

MODES, the probability of an accident requiring the HIS is low. 

Therefore, the HIS is not required in MODES 3 and 4.

In MODES 5 and 6, the probability and consequences of a LOCA are 

reduced due to the pressure and temperature limitations of these 

MODES. Therefore, the HIS is not required to be OPERABLE in 

MODES 5 and 6.

ACTIONS A.1 and A.2

With one HIS train inoperable, the inoperable train must be restored to 

OPERABLE status within 7 days or the OPERABLE train must be verified 

OPERABLE frequently by performance of SR 3.6.10.1. The 7 day 

Completion Time is based on the low probability of the occurrence of a 

degraded core event that would generate hydrogen in amounts equivalent 

to a metal water reaction of 75% of the core cladding, the length of time 

after the event that operator action would be required to prevent hydrogen 

accumulation from exceeding this limit, and the low probability of failure of 

the OPERABLE HIS train. Alternative Required Action A.2, by frequent 

surveillances, provides assurance that the OPERABLE train continues to 

be OPERABLE.

B.1

Condition B is one containment region with no OPERABLE hydrogen 

ignitor. Thus, while in Condition B, or in Conditions A and B 

simultaneously, there would always be ignition capability in the adjacent 

containment regions that would provide redundant capability by flame 

propagation to the region with no OPERABLE ignitors.

Required Action B.1 calls for the restoration of one hydrogen ignitor in 

each region to OPERABLE status within 7 days. The 7 day Completion 

Time is based on the same reasons given under Required Action A.1.

C.1

The unit must be placed in a MODE in which the LCO does not apply if 

the HIS subsystem(s) cannot be restored to OPERABLE status within the 

associated Completion Time. This is done by placing the unit in at least 

MODE 3 within 6 hours. The allowed Completion Time of 6 hours is 
HIS (Ice Condenser)

B 3.6.10

Westinghouse STS B 3.6.10-4 Rev. 4.0

BASES

ACTIONS (continued)

reasonable, based on operating experience, to reach MODE 3 from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.10.1

REQUIREMENTS

This SR confirms that ≥ [32] of 33 hydrogen ignitors can be successfully 

energized in each train. The ignitors are simple resistance elements. 

Therefore, energizing provides assurance of OPERABILITY. The 

allowance of one inoperable hydrogen ignitor is acceptable because, 

although one inoperable hydrogen ignitor in a region would compromise 

redundancy in that region, the containment regions are interconnected so 

that ignition in one region would cause burning to progress to the others 

(i.e., there is overlap in each hydrogen ignitor's effectiveness between 

regions). [ The Frequency of 92 days has been shown to be acceptable 

through operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.10.2

This SR confirms that the two inoperable hydrogen ignitors allowed by 

SR 3.6.10.1 (i.e., one in each train) are not in the same containment 

region. [ The Frequency of 92 days is acceptable based on the 

Frequency of SR 3.6.10.1, which provides the information for performing 

this SR.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
HIS (Ice Condenser)

B 3.6.10

Westinghouse STS B 3.6.10-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.10.3

A more detailed functional test is performed to verify system 

OPERABILITY. Each glow plug is visually examined to ensure that it is 

clean and that the electrical circuitry is energized. All ignitors (glow 

plugs), including normally inaccessible ignitors, are visually checked for a 

glow to verify that they are energized. Additionally, the surface 

temperature of each glow plug is measured to be ≥ [1700]°F to 

demonstrate that a temperature sufficient for ignition is achieved. [ The 

[18] month Frequency is based on the need to perform this Surveillance 

under the conditions that apply during a plant outage and the potential for 

an unplanned transient if the Surveillance were performed with the 

reactor at power. Operating experience has shown that these 

components usually pass the SR when performed at the [18] month 

Frequency, which is based on the refueling cycle. Therefore, the 

Frequency was concluded to be acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50.44.

2. 10 CFR 50, Appendix A, GDC 41.

3. FSAR, Section [6.2].

ICS (Atmospheric and Subatmospheric)

B 3.6.11

Westinghouse STS B 3.6.11-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.11 Iodine Cleanup System (ICS) (Atmospheric and Subatmospheric)

BASES

BACKGROUND The ICS is provided per GDC 41, "Containment Atmosphere Cleanup," 

GDC 42, "Inspection of Containment Atmosphere Cleanup Systems," and 

GDC 43, "Testing of Containment Atmosphere Cleanup Systems" 

(Ref. 1), to reduce the concentration of fission products released to the 

containment atmosphere following a postulated accident. The ICS would 

function together with the Containment Spray and Cooling systems 

following a Design Basis Accident (DBA) to reduce the potential release 

of radioactive material, principally iodine, from the containment to the 

environment.

The ICS consists of two 100% capacity, separate, independent, and 

redundant trains. Each train includes a heater, [cooling coils,] a prefilter, 

a demister, a high efficiency particulate air (HEPA) filter, an activated 

charcoal adsorber section for removal of radioiodines, and a fan. 

Ductwork, valves and/or dampers, and instrumentation also form part of 

the system. The demisters function to reduce the moisture content of the 

airstream. A second bank of HEPA filters follows the adsorber section to 

collect carbon fines and provide backup in case of failure in sections of 

the main HEPA filter bank. The upstream HEPA filter and the charcoal 

adsorber section are credited in the analysis. The system initiates filtered 

recirculation of the containment atmosphere following receipt of a safety 

injection signal. The system design is described in Reference 2.

The demister is included for moisture (free water) removal from the gas 

stream. Heaters are used to heat the gas stream, which lowers the 

relative humidity. Continuous operation of each train for at least 10 hours 

per month with the heaters on reduces moisture buildup on the HEPA 

filters and adsorbers. Both the demister and heater are important to the 

effectiveness of the charcoal adsorbers.

The primary purpose of the heaters is to ensure that the relative humidity 

of the airstream entering the charcoal adsorbers is maintained below 

70%, which is consistent with the assigned iodine and iodide removal 

efficiencies as per Regulatory Guide 1.52 (Ref. 3).

Two ICS trains are provided to meet the requirement for separation, 

independence, and redundancy. Each ICS train is powered from a 

separate Engineered Safety Features bus and is provided with a separate 

power panel and control panel. [Essential service water is required to 

supply cooling water to the cooling coils.]
ICS (Atmospheric and Subatmospheric)

B 3.6.11

Westinghouse STS B 3.6.11-2 Rev. 4.0

BASES

BACKGROUND (continued)

During normal operation, the Containment Cooling System is aligned to 

bypass the ICS HEPA filters and charcoal adsorbers. For ICS operation 

following a DBA, however, the bypass dampers automatically reposition 

to draw the air through the filters and adsorbers.

APPLICABLE The DBAs that result in a release of radioactive iodine within containment

SAFETY are a loss of coolant accident (LOCA) or a rod ejection accident (REA). 

ANALYSES In the analysis for each of these accidents, it is assumed that adequate 

containment leak tightness is intact at event initiation to limit potential 

leakage to the environment. Additionally, it is assumed that the amount 

of radioactive iodine released is limited by reducing the iodine 

concentration present in the containment atmosphere.

The ICS design basis is established by the consequences of the limiting 

DBA, which is a LOCA. The accident analysis (Ref. 4) assume that only 

one train of the ICS is functional due to a single failure that disables the 

other train. The accident analysis accounts for the reduction in airborne 

radioactive iodine provided by the remaining one train of this filtration 

system.

The ICS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two separate, independent, and redundant trains of the ICS are required 

to ensure that at least one is available, assuming a single failure 

coincident with a loss of offsite power.

APPLICABILITY In MODES 1, 2, 3, and 4, iodine is a fission product that can be released 

from the fuel to the reactor coolant as a result of a DBA. The DBAs that 

can cause a failure of the fuel cladding are a LOCA, SLB, and REA. 

Because these accidents are considered credible accidents in MODES 1, 

2, 3, and 4, the ICS must be operable to ensure the reduction in iodine 

concentration assumed in the accident analyses.

In MODES 5 and 6, the probability and consequences of a LOCA are low 

due to the pressure and temperature limitations of these MODES. The 

ICS is not required in these MODES to remove iodine from the 

containment atmosphere.

ACTIONS A.1

With one ICS train inoperable, the inoperable train must be restored to 

OPERABLE status within 7 days. The components in this degraded 

condition are capable of providing 100% of the iodine removal needs after 

a DBA. The 7 day Completion Time is based on consideration of such 

factors as:
ICS (Atmospheric and Subatmospheric)

B 3.6.11

Westinghouse STS B 3.6.11-3 Rev. 4.0

BASES 

ACTIONS (continued)

a. The availability of the OPERABLE redundant ICS train,

b. The fact that, even with no ICS train in operation, almost the same 

amount of iodine would be removed from the containment 

atmosphere through absorption by the Containment Spray System, 

and

c. The fact that the Completion Time is adequate to make most repairs.

B.1 and B.2

If the ICS train cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner without challenging plant systems.

SURVEILLANCE SR 3.6.11.1

REQUIREMENTS

Operating each ICS train for ≥ 15 minutes ensures that all trains are 

OPERABLE and that all associated controls are functioning properly. It 

also ensures that blockage, fan or motor failure, or excessive vibration 

can be detected for corrective action. For systems with heaters, 

operation with the heaters on (automatic heater cycling to maintain 

temperature) for ≥ 10 continuous hours eliminates moisture on the 

adsorbers and HEPA filters. Experience from filter testing at operating 

units indicates that the 10 hour period is adequate for moisture 

elimination on the adsorbers and HEPA filters. [ The 31 day Frequency 

was developed considering the known reliability of fan motors and 

controls, the two train redundancy available, and the iodine removal 

capability of the Containment Spray System independent of the ICS.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
ICS (Atmospheric and Subatmospheric)

B 3.6.11

Westinghouse STS B 3.6.11-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.11.2

This SR verifies that the required ICS filter testing is performed in 

accordance with the Ventilation Filter Testing Program (VFTP). The 

VFTP includes testing HEPA filter performance, charcoal adsorber 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal (general use and following specific operations). 

Specific test frequencies and additional information are discussed in 

detail in the VFTP.

SR 3.6.11.3

The automatic startup test verifies that both trains of equipment start upon 

receipt of an actual or simulated test signal. [ The [18] month Frequency 

is based on the need to perform this Surveillance under the conditions 

that apply during a plant outage and the potential for an unplanned 

transient if the Surveillance were performed with the reactor at power. 

Operating experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint. Furthermore, the Frequency was developed considering that 

the system equipment OPERABILITY is demonstrated at a 31 day 

Frequency by SR 3.6.11.1.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
ICS (Atmospheric and Subatmospheric)

B 3.6.11

Westinghouse STS B 3.6.11-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.6.11.4

The ICS filter bypass dampers are tested to verify OPERABILITY. The 

dampers are in the bypass position during normal operation and must 

reposition for accident operation to draw air through the filters. [ The 

[18] month Frequency is considered to be acceptable based on the 

damper reliability and design, the mild environmental conditions in the 

vicinity of the dampers, and the fact that operating experience has shown 

that the dampers usually pass the Surveillance when performed at the 

[18] month Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 41, GDC 42, and GDC 43.

2. FSAR, Section [6.5].

3. Regulatory Guide 1.52, Revision [2].

4. FSAR, Chapter [15].

Vacuum Relief Valves (Atmospheric and Ice Condenser)

B 3.6.12

Westinghouse STS B 3.6.12-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.12 Vacuum Relief Valves (Atmospheric and Ice Condenser)

BASES

BACKGROUND The purpose of the vacuum relief lines is to protect the containment 

vessel against negative pressure (i.e., a lower pressure inside than 

outside). Excessive negative pressure inside containment can occur if 

there is an inadvertent actuation of containment cooling features, such as 

the Containment Spray System. Multiple equipment failures or human 

errors are necessary to cause inadvertent actuation of these systems.

The containment pressure vessel contains two 100% vacuum relief lines 

that protect the containment from excessive external loading.

[ For this facility, the characteristics of the vacuum relief valves and their 

locations in the containment pressure vessel are as follows: ]

APPLICABLE Design of the vacuum relief lines involves calculating the effect of

SAFETY inadvertent actuation of containment cooling features, which can reduce

ANALYSES the atmospheric temperature (and hence pressure) inside containment 

(Ref. 1). Conservative assumptions are used for all the relevant 

parameters in the calculation; for example, for the Containment Spray 

System, the minimum spray water temperature, maximum initial 

containment temperature, maximum spray flow, all spray trains operating, 

etc. The resulting containment pressure versus time is calculated, 

including the effect of the opening of the vacuum relief lines when their 

negative pressure setpoint is reached. It is also assumed that one valve 

fails to open.

The containment was designed for an external pressure load equivalent 

to [-2.5] psig. The inadvertent actuation of the containment cooling 

features was analyzed to determine the resulting reduction in containment 

pressure. The initial pressure condition used in this analysis was 

[-0.3] psig. This resulted in a minimum pressure inside containment of 

[-2.0] psig, which is less than the design load.

The vacuum relief valves must also perform the containment isolation 

function in a containment high pressure event. For this reason, the 

system is designed to take the full containment positive design pressure 

and the environmental conditions (temperature, pressure, humidity, 

radiation, chemical attack, etc.) associated with the containment DBA.

The vacuum relief valves satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Vacuum Relief Valves (Atmospheric and Ice Condenser)

B 3.6.12

Westinghouse STS B 3.6.12-2 Rev. 4.0

BASES

LCO The LCO establishes the minimum equipment required to accomplish the 

vacuum relief function following the inadvertent actuation of containment 

cooling features. Two 100% vacuum relief lines are required to be 

OPERABLE to ensure that at least one is available, assuming one or both 

valves in the other line fail to open.

APPLICABILITY In MODES 1, 2, 3, and 4, the containment cooling features, such as the 

Containment Spray System, are required to be OPERABLE to mitigate 

the effects of a DBA. Excessive negative pressure inside containment 

could occur whenever these systems are required to be OPERABLE due 

to inadvertent actuation of these systems. Therefore, the vacuum relief 

lines are required to be OPERABLE in MODES 1, 2, 3, and 4 to mitigate 

the effects of inadvertent actuation of the Containment Spray System, 

Quench Spray (QS) System, or Containment Cooling System.

In MODES 5 and 6, the probability and consequences of a DBA are 

reduced due to the pressure and temperature limitations of these 

MODES. The Containment Spray System, QS System, and Containment 

Cooling System are not required to be OPERABLE in MODES 5 and 6. 

Therefore, maintaining OPERABLE vacuum relief valves is not required in 

MODE 5 or 6.

ACTIONS A.1

When one of the required vacuum relief lines is inoperable, the inoperable 

line must be restored to OPERABLE status within 72 hours. The 

specified time period is consistent with other LCOs for the loss of one 

train of a system required to mitigate the consequences of a LOCA or 

other DBA.

B.1 and B.2

If the vacuum relief line cannot be restored to OPERABLE status within 

the required Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.
Vacuum Relief Valves (Atmospheric and Ice Condenser)

B 3.6.12

Westinghouse STS B 3.6.12-3 Rev. 4.0

BASES

SURVEILLANCE SR 3.6.12.1

REQUIREMENTS

This SR cites the Inservice Testing Program, which establishes the 

requirement that inservice testing of the ASME Code Class 1, 2, and 3 

pumps and valves shall be performed in accordance with the ASME Code 

(Ref. 2). Therefore, SR Frequency is governed by the Inservice Testing 

Program.

REFERENCES 1. FSAR, Section [6.2].

2. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

SBACS (Dual and Ice Condenser)

B 3.6.13

Westinghouse STS B 3.6.13-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.13 Shield Building Air Cleanup System (SBACS) (Dual and Ice Condenser)

BASES

BACKGROUND The SBACS is required by 10 CFR 50, Appendix A, GDC 41, 

"Containment Atmosphere Cleanup" (Ref. 1), to ensure that radioactive 

materials that leak from the primary containment into the shield building 

(secondary containment) following a Design Basis Accident (DBA) are 

filtered and adsorbed prior to exhausting to the environment.

The containment has a secondary containment called the shield building, 

which is a concrete structure that surrounds the steel primary 

containment vessel. Between the containment vessel and the shield 

building inner wall is an annular space that collects any containment 

leakage that may occur following a loss of coolant accident (LOCA). This 

space also allows for periodic inspection of the outer surface of the steel 

containment vessel.

The SBACS establishes a negative pressure in the annulus between the 

shield building and the steel containment vessel. Filters in the system 

then control the release of radioactive contaminants to the environment. 

Shield building OPERABILITY is required to ensure retention of primary 

containment leakage and proper operation of the SBACS.

The SBACS consists of two separate and redundant trains. Each train 

includes a heater, [cooling coils,] a prefilter, moisture separators, a high 

efficiency particulate air (HEPA) filter, an activated charcoal adsorber 

section for removal of radioiodines, and a fan. Ductwork, valves and/or 

dampers, and instrumentation also form part of the system. The moisture 

separators function to reduce the moisture content of the airstream. A 

second bank of HEPA filters follows the adsorber section to collect carbon 

fines and provide backup in case of failure of the main HEPA filter bank. 

Only the upstream HEPA filter and the charcoal adsorber section are 

credited in the analysis. The system initiates and maintains a negative air 

pressure in the shield building by means of filtered exhaust ventilation of 

the shield building following receipt of a safety injection (SI) signal. The 

system is described in Reference 2.

The prefilters remove large particles in the air, and the moisture 

separators remove entrained water droplets present, to prevent excessive 

loading of the HEPA filters and charcoal absorbers. Heaters may be 

included to reduce the relative humidity of the airstream on systems that 

operate in high humidity. Continuous operation of each train, for at least 

10 hours per month, with heaters on, reduces moisture buildup on their 

HEPA filters and adsorbers. [The cooling coils cool the air to keep the 

charcoal beds from becoming too hot due to absorption of fission 

product.]
SBACS (Dual and Ice Condenser)

B 3.6.13

Westinghouse STS B 3.6.13-2 Rev. 4.0

BASES

BACKGROUND (continued)

During normal operation, the Shield Building Cooling System is aligned to 

bypass the SBACS's HEPA filters and charcoal adsorbers. For SBACS 

operation following a DBA, however, the bypass dampers automatically 

reposition to draw the air through the filters and adsorbers.

The SBACS reduces the radioactive content in the shield building 

atmosphere following a DBA. Loss of the SBACS could cause site 

boundary doses, in the event of a DBA, to exceed the values given in the 

licensing basis.

APPLICABLE The SBACS design basis is established by the consequences of the

SAFETY limiting DBA, which is a LOCA. The accident analysis (Ref. 3) assumes

ANALYSES that only one train of the SBACS is functional due to a single failure that 

disables the other train. The accident analysis accounts for the reduction 

in airborne radioactive material provided by the remaining one train of this 

filtration system. The amount of fission products available for release 

from containment is determined for a LOCA.

The modeled SBACS actuation in the safety analyses is based upon a 

worst case response time following an SI initiated at the limiting setpoint. 

The total response time, from exceeding the signal setpoint to attaining 

the negative pressure of [0.5] inch water gauge in the shield building, is 

[22 seconds]. This response time is composed of signal delay, diesel 

generator startup and sequencing time, system startup time, and time for 

the system to attain the required pressure after starting.

The SBACS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO In the event of a DBA, one SBACS train is required to provide the 

minimum particulate iodine removal assumed in the safety analysis. Two 

trains of the SBACS must be OPERABLE to ensure that at least one train 

will operate, assuming that the other train is disabled by a single active 

failure.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could lead to fission product release to 

containment that leaks to the shield building. The large break LOCA, on 

which this system's design is based, is a full power event. Less severe 

LOCAs and leakage still require the system to be OPERABLE throughout 

these MODES. The probability and severity of a LOCA decrease as core 

power and Reactor Coolant System pressure decrease. With the reactor 

shut down, the probability of release of radioactivity resulting from such 

an accident is low.
SBACS (Dual and Ice Condenser)

B 3.6.13

Westinghouse STS B 3.6.13-3 Rev. 4.0

BASES 

APPLICABILITY (continued)

In MODES 5 and 6, the probability and consequences of a DBA are low 

due to the pressure and temperature limitations in these MODES. Under 

these conditions, the Filtration System is not required to be OPERABLE 

(although one or more trains may be operating for other reasons, such as 

habitability during maintenance in the shield building annulus).

ACTIONS A.1

With one SBACS train inoperable, the inoperable train must be restored 

to OPERABLE status within 7 days. The components in this degraded 

condition are capable of providing 100% of the iodine removal needs after 

a DBA. The 7 day Completion Time is based on consideration of such 

factors as the availability of the OPERABLE redundant SBACS train and 

the low probability of a DBA occurring during this period. The Completion 

Time is adequate to make most repairs.

B.1 and B.2

If the SBACS train cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.13.1

REQUIREMENTS

Operating each SBACS train for ≥ 15 minutes ensures that all trains are 

OPERABLE and that all associated controls are functioning properly. It 

also ensures that blockage, fan or motor failure, or excessive vibration 

can be detected for corrective action. For systems with heaters, 

operation with the heaters on (automatic heater cycling to maintain 

temperature) for ≥ 10 continuous hours eliminates moisture on the 

adsorbers and HEPA filters. Experience from filter testing at operating 

units indicates that the 10 hour period is adequate for moisture 

elimination on the adsorbers and HEPA filters. [ The 31 day Frequency 

was developed in consideration of the known reliability of fan motors and 

controls, the two train redundancy available, and the iodine removal 

capability of the Containment Spray System.
SBACS (Dual and Ice Condenser)

B 3.6.13

Westinghouse STS B 3.6.13-4 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.13.2

This SR verifies that the required SBACS filter testing is performed in 

accordance with the Ventilation Filter Testing Program (VFTP). The 

VFTP includes testing HEPA filter performance, charcoal adsorber 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal (general use and following specific operations). 

Specific test frequencies and additional information are discussed in 

detail in the VFTP.

SR 3.6.13.3

The automatic startup ensures that each SBACS train responds properly. 

[ The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a plant outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore the Frequency was concluded to be 

acceptable from a reliability standpoint. Furthermore, the SR interval was 

developed considering that the SBACS equipment OPERABILITY is 

demonstrated at a 31 day Frequency by SR 3.6.13.1.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
SBACS (Dual and Ice Condenser)

B 3.6.13

Westinghouse STS B 3.6.13-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.6.13.4

The SBACS filter bypass dampers are tested to verify OPERABILITY. 

The dampers are in the bypass position during normal operation and 

must reposition for accident operation to draw air through the filters. 

[ The [18] month Frequency is considered to be acceptable based on 

damper reliability and design, mild environmental conditions in the vicinity 

of the dampers, and the fact that operating experience has shown that the 

dampers usually pass the Surveillance when performed at the [18] month 

Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

SR 3.6.13.5

The proper functioning of the fans, dampers, filters, adsorbers, etc., as a 

system is verified by the ability of each train to produce the required 

system flow rate. [ The [18] month Frequency on a STAGGERED TEST 

BASIS is consistent with Regulatory Guide 1.52 (Ref. 4) guidance for 

functional testing.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
SBACS (Dual and Ice Condenser)

B 3.6.13

Westinghouse STS B 3.6.13-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 41.

2. FSAR, Section [6.5].

3. FSAR, Chapter [15].

4. Regulatory Guide 1.52, Revision [2].
ARS (Ice Condenser)

B 3.6.14

Westinghouse STS B 3.6.14-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.14 Air Return System (ARS) (Ice Condenser)

BASES

BACKGROUND The ARS is designed to assure the rapid return of air from the upper to 

the lower containment compartment after the initial blowdown following a 

Design Basis Accident (DBA). The return of this air to the lower 

compartment and subsequent recirculation back up through the ice 

condenser assists in cooling the containment atmosphere and limiting 

post accident pressure and temperature in containment to less than 

design values. Limiting pressure and temperature reduces the release of 

fission product radioactivity from containment to the environment in the 

event of a DBA.

The ARS provides post accident hydrogen mixing in selected areas of 

containment. The associated Hydrogen Skimmer System consists of 

hydrogen collection headers routed to potential hydrogen pockets in 

containment, terminating on the suction side of either of the two ARS fans 

at the header isolation valves. The minimum design flow from each 

potential hydrogen pocket is sufficient to limit the local concentration of 

hydrogen.

The ARS consists of two separate trains of equal capacity, each capable 

of meeting the design bases. Each train includes a 100% capacity air 

return fan, associated damper, and hydrogen collection headers with 

isolation valves. Each train is powered from a separate Engineered 

Safety Features (ESF) bus.

The ARS fans are automatically started and the hydrogen collection 

header isolation valves are opened by the containment pressure HighHigh signal 10 minutes after the containment pressure reaches the 

pressure setpoint. The time delay ensures that no energy released 

during the initial phase of a DBA will bypass the ice bed through the ARS 

fans or Hydrogen Skimmer System.

After starting, the fans displace air from the upper compartment to the 

lower compartment, thereby returning the air that was displaced by the 

high energy line break blowdown from the lower compartment and 

equalizing pressures throughout containment. After discharge into the 

lower compartment, air flows with steam produced by residual heat 

through the ice condenser doors into the ice condenser compartment 

where the steam portion of the flow is condensed. The air flow returns to 

the upper compartment through the top deck doors in the upper portion of 

the ice condenser compartment. The ARS fans operate continuously 

after actuation, circulating air through the containment volume and
ARS (Ice Condenser)

B 3.6.14

Westinghouse STS B 3.6.14-2 Rev. 4.0

BASES

BACKGROUND (continued)

purging all potential hydrogen pockets in containment. When the 

containment pressure falls below a predetermined value, the ARS fans 

are automatically de-energized. Thereafter, the fans are automatically 

cycled on and off if necessary to control any additional containment 

pressure transients.

The ARS also functions, after all the ice has melted, to circulate any 

steam still entering the lower compartment to the upper compartment 

where the Containment Spray System can cool it.

The ARS is an ESF system. It is designed to ensure that the heat 

removal capability required during the post accident period can be 

attained. The operation of the ARS, in conjunction with the ice bed, the 

Containment Spray System, and the Residual Heat Removal (RHR) 

System spray, provides the required heat removal capability to limit post 

accident conditions to less than the containment design values.

APPLICABLE The limiting DBAs considered relative to containment temperature and

SAFETY pressure are the loss of coolant accident (LOCA) and the steam line

ANALYSES break (SLB). The LOCA and SLB are analyzed using computer codes 

designed to predict the resultant containment pressure and temperature 

transients. DBAs are assumed not to occur simultaneously or 

consecutively. The postulated DBAs are analyzed, in regard to ESF 

systems, assuming the loss of one ESF bus, which is the worst case 

single active failure and results in one train each of the Containment 

Spray System, RHR System, and ARS being inoperable (Ref. 1). The 

DBA analyses show that the maximum peak containment pressure results 

from the LOCA analysis and is calculated to be less than the containment 

design pressure.

For certain aspects of transient accident analyses, maximizing the 

calculated containment pressure is not conservative. In particular, the 

cooling effectiveness of the Emergency Core Cooling System during the 

core reflood phase of a LOCA analysis increases with increasing 

containment backpressure. For these calculations, the containment 

backpressure is calculated in a manner designed to conservatively 

minimize, rather than maximize, the calculated transient containment 

pressures, in accordance with 10 CFR 50, Appendix K (Ref. 2).

The analysis for minimum internal containment pressure (i.e., maximum 

external differential containment pressure) assumes inadvertent 

simultaneous actuation of both the ARS and the Containment Spray 

System. The containment vacuum relief valves are designed to 

accommodate inadvertent actuation of either or both systems.
ARS (Ice Condenser)

B 3.6.14

Westinghouse STS B 3.6.14-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The modeled ARS actuation from the containment analysis is based upon 

a response time associated with exceeding the containment pressure 

High-High signal setpoint to achieving full ARS air flow. A delayed 

response time initiation provides conservative analyses of peak 

calculated containment temperature and pressure responses. The ARS 

total response time of 600 seconds consists of the built in signal delay.

The ARS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO In the event of a DBA, one train of the ARS with the Hydrogen Skimmer 

System is required to provide the minimum air recirculation for heat 

removal and hydrogen mixing assumed in the safety analyses. To ensure 

this requirement is met, two trains of the ARS with the Hydrogen Skimmer 

System must be OPERABLE. This will ensure that at least one train will 

operate, assuming the worst case single failure occurs, which is in the 

ESF power supply.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment 

pressure and temperature requiring the operation of the ARS. Therefore, 

the LCO is applicable in MODES 1, 2, 3, and 4.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Therefore, the ARS is not required to be OPERABLE in these 

MODES.

ACTIONS A.1

If one of the required trains of the ARS is inoperable, it must be restored 

to OPERABLE status within 72 hours. The components in this degraded 

condition are capable of providing 100% of the flow and hydrogen 

skimming needs after an accident. The 72 hour Completion Time was 

developed taking into account the redundant flow and hydrogen skimming 

capability of the OPERABLE ARS train and the low probability of a DBA 

occurring in this period.

B.1 and B.2

If the ARS train cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 
ARS (Ice Condenser)

B 3.6.14

Westinghouse STS B 3.6.14-4 Rev. 4.0

BASES

ACTIONS (continued)

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.14.1

REQUIREMENTS

Verifying that each ARS fan starts on an actual or simulated actuation

signal, after a delay ≥ [9.0] minutes and ≤ [11.0] minutes, and operates for 

≥ 15 minutes is sufficient to ensure that all fans are OPERABLE and that 

all associated controls and time delays are functioning properly. It also 

ensures that blockage, fan and/or motor failure, or excessive vibration 

can be detected for corrective action. [ The [92] day Frequency was 

developed considering the known reliability of fan motors and controls 

and the two train redundancy available.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.14.2

Verifying ARS fan motor current to be at rated speed with the return air 

dampers closed confirms one operating condition of the fan. This test is 

indicative of overall fan motor performance. Such inservice tests confirm 

component OPERABILITY, trend performance, and detect incipient 

failures by indicating abnormal performance. [ The Frequency of 92 days 

conforms with the testing requirements for similar ESF equipment and 

considers the known reliability of fan motors and controls and the two 

train redundancy available.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
ARS (Ice Condenser)

B 3.6.14

Westinghouse STS B 3.6.14-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.14.3

Verifying the OPERABILITY of the return air damper provides assurance 

that the proper flow path will exist when the fan is started. By applying 

the correct counterweight, the damper operation can be confirmed. [ The 

Frequency of 92 days was developed considering the importance of the 

dampers, their location, physical environment, and probability of failure. 

Operating experience has also shown this Frequency to be acceptable.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.6.14.4

Verifying the OPERABILITY of the motor operated valve in the Hydrogen 

Skimmer System hydrogen collection header to the lower containment 

compartment provides assurance that the proper flow path will exist when 

the valve receives an actuation signal. This Surveillance is not required 

for valves that are locked, sealed, or otherwise secured in the required 

position under administrative controls. This Surveillance also confirms 

that the time delay to open is within specified tolerances. [ The 92 day 

Frequency was developed considering the known reliability of the motor 

operated valves and controls and the two train redundancy available. 

Operating experience has also shown this Frequency to be acceptable.

OR
ARS (Ice Condenser)

B 3.6.14

Westinghouse STS B 3.6.14-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50, Appendix K.
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.15 Ice Bed (Ice Condenser)

BASES

BACKGROUND The ice bed consists of a minimum of [2,200,000] lb of ice stored within 

the ice condenser. The primary purpose of the ice bed is to provide a 

large heat sink in the event of a release of energy from a Design Basis 

Accident (DBA) in containment. The ice would absorb energy and limit 

containment peak pressure and temperature during the accident 

transient. Limiting the pressure and temperature reduces the release of 

fission product radioactivity from containment to the environment in the 

event of a DBA.

The ice condenser is an annular compartment enclosing approximately 

300° of the perimeter of the upper containment compartment, but 

penetrating the operating deck so that a portion extends into the lower 

containment compartment. The lower portion has a series of hinged 

doors exposed to the atmosphere of the lower containment compartment, 

which, for normal unit operation, are designed to remain closed. At the 

top of the ice condenser is another set of doors exposed to the 

atmosphere of the upper compartment, which also remain closed during 

normal unit operation. Intermediate deck doors, located below the top 

deck doors, form the floor of a plenum at the upper part of the ice 

condenser. These doors also remain closed during normal unit operation. 

The upper plenum area is used to facilitate surveillance and maintenance 

of the ice bed.

The ice baskets contain the ice within the ice condenser. The ice bed is 

considered to consist of the total volume from the bottom elevation of the 

ice baskets to the top elevation of the ice baskets. The ice baskets 

position the ice within the ice bed in an arrangement to promote heat 

transfer from steam to ice. This arrangement enhances the ice 

condenser's primary function of condensing steam and absorbing heat 

energy released to the containment during a DBA.

In the event of a DBA, the ice condenser inlet doors (located below the 

operating deck) open due to the pressure rise in the lower compartment. 

This allows air and steam to flow from the lower compartment into the ice 

condenser. The resulting pressure increase within the ice condenser 

causes the intermediate deck doors and the top deck doors to open, 

which allows the air to flow out of the ice condenser into the upper 

compartment. Steam condensation within the ice condenser limits the 

pressure and temperature buildup in containment. A divider barrier (i.e., 

operating deck and extensions thereof) separates the upper and lower 

compartments and ensures that the steam is directed into the ice 

condenser.
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-2 Rev. 4.0

BASES

BACKGROUND (continued)

The ice, together with the containment spray, is adequate to absorb the 

initial blowdown of steam and water from a DBA and the additional heat 

loads that would enter containment during several hours following the 

initial blowdown. The additional heat loads would come from the residual 

heat in the reactor core, the hot piping and components, and the 

secondary system, including the steam generators. During the post 

blowdown period, the Air Return System (ARS) returns upper 

compartment air through the divider barrier to the lower compartment. 

This serves to equalize pressures in containment and to continue 

circulating heated air and steam from the lower compartment through the 

ice condenser where the heat is removed by the remaining ice.

As ice melts, the water passes through the ice condenser floor drains into 

the lower compartment. Thus, a second function of the ice bed is to be a 

large source of borated water (via the containment sump) for long term 

Emergency Core Cooling System (ECCS) and Containment Spray 

System heat removal functions in the recirculation mode.

A third function of the ice bed and melted ice is to remove fission product 

iodine that may be released from the core during a DBA. Iodine removal 

occurs during the ice melt phase of the accident and continues as the 

melted ice is sprayed into the containment atmosphere by the 

Containment Spray System. The ice is adjusted to an alkaline pH that 

facilitates removal of radioactive iodine from the containment atmosphere. 

The alkaline pH also minimizes the occurrence of the chloride and caustic 

stress corrosion on mechanical systems and components exposed to 

ECCS and Containment Spray System fluids in the recirculation mode of 

operation.

It is important for ice to exist in the ice baskets, the ice to be appropriately 

distributed around the 24 ice condenser bays, and for open flow paths to 

exist around ice baskets. This is especially important during the initial 

blowdown so that the steam and water mixture entering the lower 

compartment do not pass through only part of the ice condenser, 

depleting the ice there while bypassing the ice in other bays.

Two phenomena that can degrade the ice bed during the long service 

period are:

a. Loss of ice by melting or sublimation and

b. Obstruction of flow passages through the ice bed due to buildup of 

ice. 
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-3 Rev. 4.0

BASES

BACKGROUND (continued)

Both of these degrading phenomena are reduced by minimizing air 

leakage into and out of the ice condenser.

The ice bed limits the temperature and pressure that could be expected 

following a DBA, thus limiting leakage of fission product radioactivity from 

containment to the environment.

APPLICABLE The limiting DBAs considered relative to containment temperature and

SAFETY pressure are the loss of coolant accident (LOCA) and the steam line

ANALYSES break (SLB). The LOCA and SLB are analyzed using computer codes 

designed to predict the resultant containment pressure and temperature 

transients. DBAs are not assumed to occur simultaneously or 

consecutively.

Although the ice condenser is a passive system that requires no electrical 

power to perform its function, the Containment Spray System and the 

ARS also function to assist the ice bed in limiting pressures and 

temperatures. Therefore, the postulated DBAs are analyzed in regards to 

containment Engineered Safety Feature (ESF) systems, assuming the 

loss of one ESF bus, which is the worst case single active failure and 

results in one train each of the Containment Spray System and ARS 

being inoperable.

The limiting DBA analyses (Ref. 1) show that the maximum peak 

containment pressure results from the LOCA analysis and is calculated to 

be less than the containment design pressure. For certain aspects of the 

transient accident analyses, maximizing the calculated containment 

pressure is not conservative. In particular, the cooling effectiveness of 

the ECCS during the core reflood phase of a LOCA analysis increases 

with increasing containment backpressure. For these calculations, the 

containment backpressure is calculated in a manner designed to 

conservatively minimize, rather than maximize, the calculated transient 

containment pressures, in accordance with 10 CFR 50, Appendix K 

(Ref. 2). 

The maximum peak containment atmosphere temperature results from 

the SLB analysis and is discussed in the Bases for LCO 3.6.5, 

"Containment Air Temperature."

In addition to calculating the overall peak containment pressures, the 

DBA analyses include calculation of the transient differential pressures 

that occur across subcompartment walls during the initial blowdown 

phase of the accident transient. The internal containment walls and 

structures are designed to withstand these local transient pressure 

differentials for the limiting DBAs.
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-4 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The ice bed satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The ice bed LCO requires the existence of the required quantity of stored 

ice, appropriate distribution of the ice and the ice bed, open flow paths 

through the ice bed, and appropriate chemical content and pH of the 

stored ice. The stored ice functions to absorb heat during the blowdown 

phase and long term phase of a DBA, thereby limiting containment air 

temperature and pressure. The chemical content and pH of the stored 

ice provide core SDM (boron content) and remove radioactive iodine from 

the containment atmosphere when the melted ice is recirculated through 

the ECCS and the Containment Spray System, respectively.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment 

pressure and temperature requiring the operation of the ice bed. 

Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.

In MODES 5 and 6, the probability and consequences of these events are 

reduced due to the pressure and temperature limitations of these 

MODES. Therefore, the ice bed is not required to be OPERABLE in 

these MODES.

ACTIONS A.1

If the ice bed is inoperable, it must be restored to OPERABLE status 

within 48 hours. The Completion Time was developed based on 

operating experience, which confirms that due to the very large mass of 

stored ice, the parameters comprising OPERABILITY do not change 

appreciably in this time period. Because of this fact, the Surveillance 

Frequencies are long (months), except for the ice bed temperature, which 

is checked every 12 hours. If a degraded condition is identified, even for 

temperature, with such a large mass of ice it is not possible for the 

degraded condition to significantly degrade further in a 48 hour period. 

Therefore, 48 hours is a reasonable amount of time to correct a degraded 

condition before initiating a shutdown.

B.1 and B.2

If the ice bed cannot be restored to OPERABLE status within the required 

Completion Time, the plant must be brought to a MODE in which the LCO 

does not apply. To achieve this status, the plant must be brought to at 

least MODE 3 within 6 hours and to MODE 5 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required plant conditions from full power 

conditions in an orderly manner and without challenging plant systems.
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-5 Rev. 4.0

BASES

SURVEILLANCE SR 3.6.15.1

REQUIREMENTS

Verifying that the maximum temperature of the ice bed is ≤ [27]°F ensures 

that the ice is kept well below the melting point. [ The 12 hour Frequency 

was based on operating experience, which confirmed that, due to the 

large mass of stored ice, it is not possible for the ice bed temperature to 

degrade significantly within a 12 hour period and was also based on 

assessing the proximity of the LCO limit to the melting temperature.

Furthermore, the 12 hour Frequency is considered adequate in view of 

indications in the control room, including the alarm, to alert the operator to 

an abnormal ice bed temperature condition. This SR may be satisfied by 

use of the Ice Bed Temperature Monitoring System.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.15.2

Ice mass determination methodology is designed to verify the total asfound (pre-maintenance) mass of ice in the ice bed, and the appropriate 

distribution of that mass, using a random sampling of individual baskets. 

The random sample will include at least 30 baskets from each of three 

defined Radial Zones (at least 90 baskets total). Radial Zone A consists 

of baskets located in rows [7, 8, and 9] (innermost rows adjacent to the 

crane wall), Radial Zone B consists of baskets located in rows [4, 5, 

and 6] (middle rows of the ice bed), and Radial Zone C consists of 

baskets located in rows [1, 2, and 3] (outermost rows adjacent to the 

containment vessel).

The Radial Zones chosen include the row groupings nearest the inside 

and outside walls of the ice bed and the middle rows of the ice bed. 

These groupings facilitate the statistical sampling plan by creating subpopulations of ice baskets that have similar mean mass and sublimation 

characteristics. 
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Methodology for determining sample ice basket mass will be either by 

direct lifting or by alternative techniques. Any method chosen will include 

procedural allowances for the accuracy of the method used. [The number 

of sample baskets in any Radial Zone may be increased one by adding 

20 or more randomly selected baskets to verify the total mass of that 

Radial Zone.]

In the event the mass of a selected basket in a sample population (initial 

or expanded) cannot be determined by any available means (e.g., due to 

surface ice accumulation or obstruction), a randomly selected 

representative alternate basket may be used to replace the original 

selection in that sample population. If employed, the representative 

alternate must meet the following criteria:

a. Alternate selection must be from the same bay-Zone (i.e., same bay, 

same Radial Zone) as the original selection, and

b. Alternate selection cannot be a repeated selection (original or 

alternate) in the current Surveillance, and cannot have been used as 

an analyzed alternate selection in the three most recent 

Surveillances.

The complete basis for the methodology used in establishing the 95% 

confidence level in the total ice bed mass is documented in Reference 4 

and approved in Reference 5.

The total ice mass and individual Radial Zone ice mass requirements 

defined in this Surveillance, and the minimum ice mass per basket 

requirement defined by SR 3.6.15.3, are the minimum requirements for 

OPERABILITY. Additional ice mass beyond the SRs is maintained to 

address sublimation. This sublimation allowance is generally applied to 

baskets in each Radial Zone, as appropriate, at the beginning of an 

operating cycle to ensure sufficient ice is available at the end of the 

operating cycle for the ice condenser to perform its intended design 

function. 

[ The Frequency of 18 months was based on ice storage tests, and the

typical sublimation allowance maintained in the ice mass over and above 

the minimum ice mass assumed in the safety analyses. Operating and 

maintenance experience has verified that, with the 18 month Frequency, 

the minimum mass and distribution requirements in the ice bed are 

maintained.

OR
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.15.3

Verifying that each selected sample basket from SR 3.6.15.2 contains at 

least 600 lbs of ice in the as-found (pre-maintenance) condition ensures 

that a significant localized degraded mass condition is avoided. 

This SR establishes a per basket limit to ensure any ice mass 

degradation is consistent with the initial conditions of the DBA by not 

significantly affecting the containment pressure response. Reference 4 

provides insights through sensitivity runs that demonstrate that the 

containment peak pressure during a DBA is not significantly affected by 

the ice mass in a large localized region of baskets being degraded below 

the required safety analysis mean, when the Radial Zone and total ice 

mass requirements of SR 3.6.15.2 are satisfied. Any basket identified as 

containing less than 600 lbs of ice requires appropriately entering the TS 

Required Action for an inoperable ice bed due to the potential that it may 

represent a significant condition adverse to quality.

As documented in Reference 4, maintenance practices actively manage 

individual ice basket mass above the required safety analysis mean for 

each Radial Zone. Specifically, each basket is serviced to keep its ice 

mass above [1132] lbs for Radial Zone A, [1132] lbs for Radial Zone B, 

and [1132] lbs for Radial Zone C. If a basket sublimates below the safety 

analysis mean value, this instance is identified within the plant’s 

corrective action program, including evaluating maintenance practices to 

identify the cause and correct any deficiencies. These maintenance 

practices provide defense in depth beyond compliance with the ice bed 

Surveillance Requirements by limiting the occurrence of individual 

baskets with ice mass less than the required safety analysis mean.
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.15.4

This SR ensures that the flow channels through the ice bed have not 

accumulated ice blockage that exceeds 15 percent of the total flow area 

through the ice bed region. The allowable 15 percent buildup of ice is 

based on the analysis of the sub-compartment response to a design basis 

LOCA with partial blockage of the ice condenser flow channels. The 

analysis did not perform detailed flow area modeling, but lumped the ice 

condenser bays into six sections ranging from 2.75 bays to 6.5 bays. 

Individual bays are acceptable with greater than 15 percent blockage, as 

long as 15 percent blockage is not exceeded for any analysis section.

To provide a 95 percent confidence that flow blockage does not exceed 

the allowed 15 percent, the visual inspection must be made for at least 54 

(33 percent) of the 162 flow channels per ice condenser bay. The visual 

inspection of the ice bed flow channels is to inspect the flow area, by 

looking down from the top of the ice bed, and where view is achievable up 

from the bottom of the ice bed. Flow channels to be inspected are 

determined by random sample. As the most restrictive ice bed flow 

passage is found at a lattice frame elevation, the 15 percent blockage 

criteria only applies to "flow channels" that comprise the area:

a. between ice baskets, and

b. past lattice frames and wall panels.

Due to a significantly larger flow area in the regions of the upper deck 

grating and the lower inlet plenum support structures and turning vanes, a 

gross buildup of ice on these structures would be required to degrade air 

and steam flow. Therefore, these structures are excluded as part of a 

flow channel for application of the 15 percent blockage criteria. Industry 

experience has shown that removal of ice from the excluded structures 

during the refueling outage is sufficient to ensure they remain 

OPERABLE throughout the operating cycle. Removal of any gross ice 

buildup on the excluded structures is performed following outage 

maintenance activities.

Operating experience has demonstrated that the ice bed is the region that 

is the most flow restrictive, due to the normal presence of ice 

accumulation on lattice frames and wall panels. The flow area through 

the ice basket support platform is not a more restrictive flow area because 

it is easily accessible from the lower plenum and is maintained clear of ice 

accumulation. There is no mechanistically credible method for ice to
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

accumulate on the ice basket support platform during plant operation. 

Plant and industry experience has shown that the vertical flow area 

through the ice basket support platform remains clear of ice accumulation 

that could produce blockage. Normally only a glaze may develop or exist 

on the ice basket support platform which is not significant to blockage of 

flow area. Additionally, outage maintenance practices provide measures 

to clear the ice basket support platform following maintenance activities of 

any accumulation of ice that could block flow areas.

Frost buildup or loose ice is not to be considered as flow channel 

blockage, whereas attached ice is considered blockage of a flow channel. 

Frost is the solid form of water that is loosely adherent, and can be 

brushed off with the open hand.

SR 3.6.15.5

Verifying the chemical composition of the stored ice ensures that the 

stored ice has a boron concentration ≥ [1800] ppm and ≤ [2000] ppm as 

sodium tetraborate and a high pH, ≥ [9.0] and ≤ [9.5], in order to meet the 

requirement for borated water when the melted ice is used in the ECCS 

recirculation mode of operation. Additionally, the minimum boron 

concentration value is used to assure reactor subcriticality in a post LOCA 

environment, while the maximum boron concentration is used as the 

bounding value in the hot leg switchover timing calculation (Ref. 3). This 

is accomplished by obtaining at least 24 ice samples. Each sample is 

taken approximately one foot from the top of the ice of each randomly 

selected ice basket in each ice condenser bay. The SR is modified by a 

Note that allows the boron concentration and pH value obtained from 

averaging the individual samples' analysis results to satisfy the 

requirements of the SR. If either the average boron concentration or 

average pH value is outside their prescribed limit, then entry into 

Condition A is required. Sodium tetraborate has been proven effective in 

maintaining the boron content for long storage periods, and it also

enhances the ability of the solution to remove and retain fission product 

iodine. The high pH is required to enhance the effectiveness of the ice 

and the melted ice in removing iodine from the containment atmosphere. 

This pH range also minimizes the occurrence of chloride and caustic 

stress corrosion on mechanical systems and components exposed to 

ECCS and Containment Spray System fluids in the recirculation mode of 

operation. [ The Frequency of [54] months is intended to be consistent 

with the expected length of three fuel cycles, and was developed 

considering these facts:
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

a. Long term ice storage tests have determined that the chemical 

composition of the stored ice is extremely stable,

b. There are no normal operating mechanisms that decrease the boron 

concentration of the stored ice, and pH remains within a 9.0-9.5 

range when boron concentrations are above approximately 

1200 ppm,

c. Operating experience has demonstrated that meeting the boron 

concentration and pH requirements has never been a problem, and

d. Someone would have to enter the containment to take the sample, 

and, if the unit is at power, that person would receive a radiation 

dose.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.15.6

This SR ensures that a representative sampling of ice baskets, which are 

relatively thin walled, perforated cylinders, have not been degraded by 

wear, cracks, corrosion, or other damage. The SR is designed around a 

full-length inspection of a sample of baskets, and is intended to monitor the 

effect of the ice condenser environment on ice baskets. The groupings 

defined in the SR (two baskets in each azimuthal third of the ice bed) 

ensure that the sampling of baskets is reasonably distributed. [ The 

Frequency of 40 months for a visual inspection of the structural 

soundness of the ice baskets is based on engineering judgment and 

considers such factors as the thickness of the basket walls relative to 

corrosion rates expected in their service environment and the results of 

the long term ice storage testing.
Ice Bed (Ice Condenser)

B 3.6.15

Westinghouse STS B 3.6.15-11 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.15.7

This SR ensures that initial ice fill and any subsequent ice additions meet 

the boron concentration and pH requirements of SR 3.6.15.5. The SR is 

modified by a Note that allows the chemical analysis to be performed on 

either the liquid or resulting ice of each sodium tetraborate solution 

prepared. If ice is obtained from offsite sources, then chemical analysis 

data must be obtained for the ice supplied.

REFERENCES 1. FSAR, Section [6.2].

2. 10 CFR 50, Appendix K.

3. [ Westinghouse letter, WAT-D-10686, "Upper Limit Ice Boron 

Concentration In Safety Analysis."]

4. Topical Report ICUG-001, "Application of the Active Ice Mass 

Management (AIMM) Concept to the Ice Condenser Ice Mass 

Technical Specifications," Revision 3, September 2003.

5. NRC Letter dated September 11, 2003, "Safety Evaluation for Ice 

Condenser Utility Group Topical Report No. ICUG-001, Revision 2 

RE: Application of the Active Ice Mass Management Concept to the 

Ice Condenser Ice Mass Technical Specification (TAC No. MB3379)."

Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.16 Ice Condenser Doors (Ice Condenser)

BASES

BACKGROUND The ice condenser doors consist of the inlet doors, the intermediate deck 

doors, and the top deck doors. The functions of the doors are to:

a. Seal the ice condenser from air leakage during the lifetime of the unit 

and

b. Open in the event of a Design Basis Accident (DBA) to direct the hot 

steam air mixture from the DBA into the ice bed, where the ice would 

absorb energy and limit containment peak pressure and temperature 

during the accident transient.

Limiting the pressure and temperature following a DBA reduces the 

release of fission product radioactivity from containment to the 

environment.

The ice condenser is an annular compartment enclosing approximately 

300° of the perimeter of the upper containment compartment, but 

penetrating the operating deck so that a portion extends into the lower 

containment compartment. The inlet doors separate the atmosphere of 

the lower compartment from the ice bed inside the ice condenser. The 

top deck doors are above the ice bed and exposed to the atmosphere of 

the upper compartment. The intermediate deck doors, located below the 

top deck doors, form the floor of a plenum at the upper part of the ice 

condenser. This plenum area is used to facilitate surveillance and 

maintenance of the ice bed.

The ice baskets held in the ice bed within the ice condenser are arranged 

to promote heat transfer from steam to ice. This arrangement enhances 

the ice condenser's primary function of condensing steam and absorbing 

heat energy released to the containment during a DBA.

In the event of a DBA, the ice condenser inlet doors (located below the 

operating deck) open due to the pressure rise in the lower compartment. 

This allows air and steam to flow from the lower compartment into the ice 

condenser. The resulting pressure increase within the ice condenser 

causes the intermediate deck doors and the top deck doors to open, 

which allows the air to flow out of the ice condenser into the upper 

compartment. Steam condensation within the ice condensers limits the 

pressure and temperature buildup in containment. A divider barrier 

separates the upper and lower compartments and ensures that the steam 

is directed into the ice condenser.
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-2 Rev. 4.0

BASES

BACKGROUND (continued)

The ice, together with the containment spray, serves as a containment 

heat removal system and is adequate to absorb the initial blowdown of 

steam and water from a DBA as well as the additional heat loads that 

would enter containment during the several hours following the initial 

blowdown. The additional heat loads would come from the residual heat 

in the reactor core, the hot piping and components, and the secondary 

system, including the steam generators. During the post blowdown 

period, the Air Return System (ARS) returns upper compartment air 

through the divider barrier to the lower compartment. This serves to 

equalize pressures in containment and to continue circulating heated air 

and steam from the lower compartment through the ice condenser, where 

the heat is removed by the remaining ice.

The water from the melted ice drains into the lower compartment where it 

serves as a source of borated water (via the containment sump) for the 

Emergency Core Cooling System (ECCS) and the Containment Spray 

System heat removal functions in the recirculation mode. The ice (via the 

Containment Spray System) and the recirculated ice melt also serve to 

clean up the containment atmosphere.

The ice condenser doors ensure that the ice stored in the ice bed is 

preserved during normal operation (doors closed) and that the ice 

condenser functions as designed if called upon to act as a passive heat 

sink following a DBA.

APPLICABLE The limiting DBAs considered relative to containment pressure and

SAFETY temperature are the loss of coolant accident (LOCA) and the steam line

ANALYSES break (SLB). The LOCA and SLB are analyzed using computer codes 

designed to predict the resultant containment pressure and temperature 

transients. DBAs are assumed not to occur simultaneously or 

consecutively.

Although the ice condenser is a passive system that requires no electrical 

power to perform its function, the Containment Spray System and ARS 

also function to assist the ice bed in limiting pressures and temperatures. 

Therefore, the postulated DBAs are analyzed with respect to Engineered 

Safety Feature (ESF) systems, assuming the loss of one ESF bus, which 

is the worst case single active failure and results in one train each of the 

Containment Spray System and the ARS being rendered inoperable.

The limiting DBA analyses (Ref. 1) show that the maximum peak 

containment pressure results from the LOCA analysis and is calculated to 

be less than the containment design pressure. For certain aspects of 

transient accident analyses, maximizing the calculated containment 

pressure is not conservative. In particular, the cooling effectiveness of
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

the ECCS during the core reflood phase of a LOCA analysis increases 

with increasing containment backpressure. For these calculations, the 

containment backpressure is calculated in a manner designed to 

conservatively minimize, rather than maximize, the calculated transient 

containment pressures, in accordance with 10 CFR 50, Appendix K 

(Ref. 2).

The maximum peak containment atmosphere temperature results from 

the SLB analysis and is discussed in the Bases for LCO 3.6.5B, 

"Containment Air Temperature."

An additional design requirement was imposed on the ice condenser door 

design for a small break accident in which the flow of heated air and 

steam is not sufficient to fully open the doors.

For this situation, the doors are designed so that all of the doors would 

partially open by approximately the same amount. Thus, the partially 

opened doors would modulate the flow so that each ice bay would receive 

an approximately equal fraction of the total flow.

This design feature ensures that the heated air and steam will not flow 

preferentially to some ice bays and deplete the ice there without utilizing 

the ice in the other bays.

In addition to calculating the overall peak containment pressures, the 

DBA analyses include the calculation of the transient differential 

pressures that would occur across subcompartment walls during the initial 

blowdown phase of the accident transient. The internal containment walls 

and structures are designed to withstand the local transient pressure 

differentials for the limiting DBAs.

The ice condenser doors satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO establishes the minimum equipment requirements to assure 

that the ice condenser doors perform their safety function. The ice 

condenser inlet doors, intermediate deck doors, and top deck doors must 

be closed to minimize air leakage into and out of the ice condenser, with 

its attendant leakage of heat into the ice condenser and loss of ice 

through melting and sublimation. The doors must be OPERABLE to 

ensure the proper opening of the ice condenser in the event of a DBA. 

OPERABILITY includes being free of any obstructions that would limit 

their opening, and for the inlet doors, being adjusted such that the 

opening and closing torques are within limits. The ice condenser doors 

function with the ice condenser to limit the pressure and temperature that 

could be expected following a DBA.
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-4 Rev. 4.0

BASES

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment 

pressure and temperature requiring the operation of the ice condenser 

doors. Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.

The probability and consequences of these events in MODES 5 and 6 are 

reduced due to the pressure and temperature limitations of these 

MODES. Therefore, the ice condenser doors are not required to be 

OPERABLE in these MODES.

ACTIONS A Note provides clarification that, for this LCO, separate Condition entry is 

allowed for each ice condenser door.

A.1

If one or more ice condenser inlet doors are inoperable due to being 

physically restrained from opening, the door(s) must be restored to 

OPERABLE status within 1 hour. The Required Action is necessary to 

return operation to within the bounds of the containment analysis. The 

1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, 

"Containment," which requires containment to be restored to OPERABLE 

status within 1 hour.

B.1 and B.2

If one or more ice condenser doors are determined to be partially open or 

otherwise inoperable for reasons other than Condition A or if a door is 

found that is not closed, it is acceptable to continue unit operation for up 

to 14 days, provided the ice bed temperature instrumentation is monitored 

once per 4 hours to ensure that the open or inoperable door is not 

allowing enough air leakage to cause the maximum ice bed temperature 

to approach the melting point. The Frequency of 4 hours is based on the 

fact that temperature changes cannot occur rapidly in the ice bed 

because of the large mass of ice involved. The 14 day Completion Time 

is based on long term ice storage tests that indicate that if the 

temperature is maintained below [27]°F, there would not be a significant 

loss of ice from sublimation. If the maximum ice bed temperature 

is > [27]°F at any time, the situation reverts to Condition C and a 

Completion Time of 48 hours is allowed to restore the inoperable door to 

OPERABLE status or enter into Required Actions D.1 and D.2. Ice bed 

temperature must be verified to be within the specified Frequency as 

augmented by the provisions of SR 3.0.2. If this verification is not made, 

Required Actions D.1 and D.2, not Required Action C.1, must be taken. 

Entry into Condition B is not required due to personnel standing on or 

opening an intermediate deck or upper deck door for short durations to 

perform required surveillances, minor maintenance such as ice removal, 

or routine tasks such as system walkdowns.
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-5 Rev. 4.0

BASES

ACTIONS (continued)

C.1

If Required Actions B.1 or B.2 are not met, the doors must be restored to 

OPERABLE status and closed positions within 48 hours. The 48 hour 

Completion Time is based on the fact that, with the very large mass of ice 

involved, it would not be possible for the temperature to decrease to the 

melting point and a significant amount of ice to melt in a 48 hour period. 

Condition C is entered from Condition B only when the Completion Time 

of Required Action B.2 is not met or when the ice bed temperature has 

not been verified at the required frequency.

D.1 and D.2

If the ice condenser doors cannot be restored to OPERABLE status within 

the required Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.16.1

REQUIREMENTS

Verifying, by means of the Inlet Door Position Monitoring System, that the 

inlet doors are in their closed positions makes the operator aware of an 

inadvertent opening of one or more doors. [ The Frequency of 12 hours 

ensures that operators on each shift are aware of the status of the doors.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-6 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.16.2

Verifying, by visual inspection, that each intermediate deck door is closed 

and not impaired by ice, frost, or debris provides assurance that the 

intermediate deck doors (which form the floor of the upper plenum where 

frequent maintenance on the ice bed is performed) have not been left 

open or obstructed. [ The Frequency of 7 days is based on engineering 

judgment and takes into consideration such factors as the frequency of 

entry into the intermediate ice condenser deck, the time required for 

significant frost buildup, and the probability that a DBA will occur.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.16.3

Verifying, by visual inspection, that the ice condenser inlet doors are not 

impaired by ice, frost, or debris provides assurance that the doors are 

free to open in the event of a DBA. [ For this unit, the Frequency of 

[18] months [3 months during the first year after receipt of license] is 

based on door design, which does not allow water condensation to 

freeze, and operating experience, which indicates that the inlet doors very 

rarely fail to meet their SR acceptance criteria. Because of high radiation 

in the vicinity of the inlet doors during power operation, this Surveillance 

is normally performed during a shutdown.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.16.4

Verifying the opening torque of the inlet doors provides assurance that no 

doors have become stuck in the closed position. The value of [675] in-lb 

is based on the design opening pressure on the doors of 1.0 lb/ft2. [ For 

this unit, the Frequency of [18] months [3 months during the first year 

after receipt of license] is based on the passive nature of the closing 

mechanism (i.e., once adjusted, there are no known factors that would 

change the setting, except possibly a buildup of ice; ice buildup is not 

likely, however, because of the door design, which does not allow water 

condensation to freeze). Operating experience indicates that the inlet 

doors usually meet their SR acceptance criteria. Because of high 

radiation in the vicinity of the inlet doors during power operation, this 

Surveillance is normally performed during a shutdown.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.16.5

The torque test Surveillance ensures that the inlet doors have not 

developed excessive friction and that the return springs are producing a 

door return torque within limits. The torque test consists of the following:

1. Verify that the torque, T(OPEN), required to cause opening motion at 

the [40]° open position is ≤ [195] in-lb,
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

2. Verify that the torque, T(CLOSE), required to hold the door stationary 

(i.e., keep it from closing) at the [40]° open position is ≥ [78] in-lb, and

3. Calculate the frictional torque, T(FRICT) = 0.5 {T(OPEN) -

T(CLOSE)}, and verify that the T(FRICT) is ≤ [40] in-lb.

The purpose of the friction and return torque Specifications is to ensure 

that, in the event of a small break LOCA or SLB, all of the 24 door pairs 

open uniformly. This assures that, during the initial blowdown phase, the 

steam and water mixture entering the lower compartment does not pass 

through part of the ice condenser, depleting the ice there, while bypassing 

the ice in other bays. [ The Frequency of [18] months [3 months during 

the first year after receipt of license] is based on the passive nature of the 

closing mechanism (i.e., once adjusted, there are no known factors that 

would change the setting, except possibly a buildup of ice; ice buildup is 

not likely, however, because of the door design, which does not allow 

water condensation to freeze). Operating experience indicates that the 

inlet doors very rarely fail to meet their SR acceptance criteria. Because 

of high radiation in the vicinity of the inlet doors during power operation, 

this Surveillance is normally performed during a shutdown.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.16.6

Verifying the OPERABILITY of the intermediate deck doors provides 

assurance that the intermediate deck doors are free to open in the event 

of a DBA. The verification consists of visually inspecting the intermediate 

doors for structural deterioration, verifying free movement of the vent 

assemblies, and ascertaining free movement of each door when lifted 

with the applicable force shown below:
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Door Lifting Force

a. Adjacent to crane wall < 37.4 lb

b. Paired with door adjacent to crane wall ≤ 33.8 lb

c. Adjacent to containment wall ≤ 31.8 lb

d. Paired with door adjacent to containment wall ≤ 31.0 lb

[ The 18 month Frequency [3 months during the first year after receipt of 

license] is based on the passive design of the intermediate deck doors, 

the frequency of personnel entry into the intermediate deck, and the fact 

that SR 3.6.16.2 confirms on a 7 day Frequency that the doors are not 

impaired by ice, frost, or debris, which are ways a door would fail the 

opening force test (i.e., by sticking or from increased door weight).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.16.7

Verifying, by visual inspection, that the top deck doors are in place and 

not obstructed provides assurance that the doors are performing their 

function of keeping warm air out of the ice condenser during normal 

operation, and would not be obstructed if called upon to open in response 

to a DBA. [ The Frequency of 92 days is based on engineering judgment, 

which considered such factors as the following:

a. The relative inaccessibility and lack of traffic in the vicinity of the 

doors make it unlikely that a door would be inadvertently left open,

b. Excessive air leakage would be detected by temperature monitoring 

in the ice condenser, and
Ice Condenser Doors (Ice Condenser)

B 3.6.16

Westinghouse STS B 3.6.16-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

c. The light construction of the doors would ensure that, in the event of 

a DBA, air and gases passing through the ice condenser would find a 

flow path, even if a door were obstructed.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [15].

2. 10 CFR 50, Appendix K.
Divider Barrier Integrity (Ice Condenser)

B 3.6.17

Westinghouse STS B 3.6.17-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.17 Divider Barrier Integrity (Ice Condenser)

BASES

BACKGROUND The divider barrier consists of the operating deck and associated seals, 

personnel access doors, and equipment hatches that separate the upper 

and lower containment compartments. Divider barrier integrity is 

necessary to minimize bypassing of the ice condenser by the hot steam 

and air mixture released into the lower compartment during a Design 

Basis Accident (DBA). This ensures that most of the gases pass through 

the ice bed, which condenses the steam and limits pressure and 

temperature during the accident transient. Limiting the pressure and 

temperature reduces the release of fission product radioactivity from 

containment to the environment in the event of a DBA.

In the event of a DBA, the ice condenser inlet doors (located below the 

operating deck) open due to the pressure rise in the lower compartment. 

This allows air and steam to flow from the lower compartment into the ice 

condenser. The resulting pressure increase within the ice condenser 

causes the intermediate deck doors and the door panels at the top of the 

condenser to open, which allows the air to flow out of the ice condenser 

into the upper compartment. The ice condenses the steam as it enters, 

thus limiting the pressure and temperature buildup in containment. The 

divider barrier separates the upper and lower compartments and ensures 

that the steam is directed into the ice condenser. The ice, together with 

the containment spray, is adequate to absorb the initial blowdown of 

steam and water from a DBA as well as the additional heat loads that 

would enter containment over several hours following the initial 

blowdown. The additional heat loads would come from the residual heat 

in the reactor core, the hot piping and components, and the secondary 

system, including the steam generators. During the post blowdown 

period, the Air Return System (ARS) returns upper compartment air 

through the divider barrier to the lower compartment. This serves to 

equalize pressures in containment and to continue circulating heated air 

and steam from the lower compartment through the ice condenser, where 

the heat is removed by the remaining ice.

Divider barrier integrity ensures that the high energy fluids released 

during a DBA would be directed through the ice condenser and that the 

ice condenser would function as designed if called upon to act as a 

passive heat sink following a DBA.
Divider Barrier Integrity (Ice Condenser)

B 3.6.17

Westinghouse STS B 3.6.17-2 Rev. 4.0

BASES 

APPLICABLE Divider barrier integrity ensures the functioning of the ice condenser to

SAFETY the limiting containment pressure and temperature that could be

ANALYSES experienced following a DBA. The limiting DBAs considered relative to 

containment temperature and pressure are the loss of coolant accident 

(LOCA) and the steam line break (SLB). The LOCA and SLB are 

analyzed using computer codes designed to predict the resultant 

containment pressure and temperature transients. DBAs are assumed 

not to occur simultaneously or consecutively.

Although the ice condenser is a passive system that requires no electrical 

power to perform its function, the Containment Spray System and the 

ARS also function to assist the ice bed in limiting pressures and 

temperatures. Therefore, the postulated DBAs are analyzed, with respect 

to containment Engineered Safety Feature (ESF) systems, assuming the 

loss of one ESF bus, which is the worst case single active failure and 

results in the inoperability of one train in both the Containment Spray 

System and the ARS.

The limiting DBA analyses (Ref. 1) show that the maximum peak 

containment pressure results from the LOCA analysis and is calculated to 

be less than the containment design pressure. The maximum peak 

containment temperature results from the SLB analysis and is discussed 

in the Bases for LCO 3.6.5B, "Containment Air Temperature."

In addition to calculating the overall peak containment pressures, the 

DBA analyses include calculation of the transient differential pressures 

that occur across subcompartment walls during the initial blowdown 

phase of the accident transient. The internal containment walls and 

structures are designed to withstand these local transient pressure 

differentials for the limiting DBAs.

The divider barrier satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO establishes the minimum equipment requirements to ensure 

that the divider barrier performs its safety function of ensuring that bypass 

leakage, in the event of a DBA, does not exceed the bypass leakage 

assumed in the accident analysis. Included are the requirements that the 

personnel access doors and equipment hatches in the divider barrier are 

OPERABLE and closed and that the divider barrier seal is properly 

installed and has not degraded with time. An exception to the 

requirement that the doors be closed is made to allow personnel transit 

entry through the divider barrier. The basis of this exception is the 

assumption that, for personnel transit, the time during which a door is 

open will be short (i.e., shorter than the Completion Time of 1 hour for 

Condition A). The divider barrier functions with the ice condenser to limit 

the pressure and temperature that could be expected following a DBA.
Divider Barrier Integrity (Ice Condenser)

B 3.6.17

Westinghouse STS B 3.6.17-3 Rev. 4.0

BASES

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment 

pressure and temperature requiring the integrity of the divider barrier. 

Therefore, the LCO is applicable in MODES 1, 2, 3, and 4.

The probability and consequences of these events in MODES 5 and 6 are 

low due to the pressure and temperature limitations of these MODES. As 

such, divider barrier integrity is not required in these MODES.

ACTIONS A.1

If one or more personnel access doors or equipment hatches are 

inoperable or open, except for personnel transit entry, 1 hour is allowed to 

restore the door(s) and equipment hatches to OPERABLE status and the 

closed position. The 1 hour Completion Time is consistent with 

LCO 3.6.1, "Containment," which requires that containment be restored to 

OPERABLE status within 1 hour.

Condition A has been modified by a Note to provide clarification that, for 

this LCO, separate Condition entry is allowed for each personnel access 

door or equipment hatch.

B.1

If the divider barrier seal is inoperable, 1 hour is allowed to restore the 

seal to OPERABLE status. The 1 hour Completion Time is consistent 

with LCO 3.6.1, which requires that containment be restored to 

OPERABLE status within 1 hour.

C.1 and C.2

If divider barrier integrity cannot be restored to OPERABLE status within 

the required Completion Time, the plant must be brought to a MODE in 

which the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.
Divider Barrier Integrity (Ice Condenser)

B 3.6.17

Westinghouse STS B 3.6.17-4 Rev. 4.0

BASES

SURVEILLANCE SR 3.6.17.1

REQUIREMENTS

Verification, by visual inspection, that all personnel access doors and 

equipment hatches between the upper and lower containment 

compartments are closed provides assurance that divider barrier integrity 

is maintained prior to the reactor being taken from MODE 5 to MODE 4. 

This SR is necessary because many of the doors and hatches may have 

been opened for maintenance during the shutdown.

SR 3.6.17.2

Verification, by visual inspection, that the personnel access door and 

equipment hatch seals, sealing surfaces, and alignments are acceptable 

provides assurance that divider barrier integrity is maintained. This 

inspection cannot be made when the door or hatch is closed. Therefore, 

SR 3.6.17.2 is required for each door or hatch that has been opened, 

prior to the final closure. Some doors and hatches may not be opened for 

long periods of time. [ Those that use resilient materials in the seals must 

be opened and inspected at least once every 10 years to provide 

assurance that the seal material has not aged to the point of degraded 

performance. The Frequency of 10 years is based on the known 

resiliency of the materials used for seals, the fact that the openings have 

not been opened (to cause wear), and operating experience that confirms 

that the seals inspected at this Frequency have been found to be 

acceptable.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.17.3

Verification, by visual inspection, after each opening of a personnel 

access door or equipment hatch that it has been closed makes the 

operator aware of the importance of closing it and thereby provides 

additional assurance that divider barrier integrity is maintained while in 

applicable MODES.
Divider Barrier Integrity (Ice Condenser)

B 3.6.17

Westinghouse STS B 3.6.17-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.6.17.4

Conducting periodic physical property tests on divider barrier seal test 

coupons provides assurance that the seal material has not degraded in 

the containment environment, including the effects of irradiation with the 

reactor at power. The required tests include a tensile strength test [and a 

test for elongation]. [ The Frequency of [18] months was developed 

considering such factors as the known resiliency of the seal material 

used, the inaccessibility of the seals and absence of traffic in their vicinity, 

and the unit conditions needed to perform the SR. Operating experience 

has shown that these components usually pass the Surveillance when 

performed at the [18] month Frequency. Therefore, the Frequency was 

concluded to be acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.17.5

Visual inspection of the seal around the perimeter provides assurance 

that the seal is properly secured in place. [ The Frequency of [18] months 

was developed considering such factors as the inaccessibility of the seals 

and absence of traffic in their vicinity, the strength of the bolts and 

mechanisms used to secure the seal, and the unit conditions needed to 

perform the SR. Operating experience has shown that these components 

usually pass the Surveillance when performed at the [18] month 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint.

OR
Divider Barrier Integrity (Ice Condenser)

B 3.6.17

Westinghouse STS B 3.6.17-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [6.2].
Containment Recirculation Drains (Ice Condenser)

B 3.6.18

Westinghouse STS B 3.6.18-1 Rev. 4.0

B 3.6 CONTAINMENT SYSTEMS

B 3.6.18 Containment Recirculation Drains (Ice Condenser)

BASES

BACKGROUND The containment recirculation drains consist of the ice condenser drains 

and the refueling canal drains. The ice condenser is partitioned into 

24 bays, each having a pair of inlet doors that open from the bottom 

plenum to allow the hot steam-air mixture from a Design Basis Accident 

(DBA) to enter the ice condenser. Twenty of the 24 bays have an ice 

condenser floor drain at the bottom to drain the melted ice into the lower 

compartment (in the 4 bays that do not have drains, the water drains 

through the floor drains in the adjacent bays). Each drain leads to a drain 

pipe that drops down several feet, then makes one or more 90° bends 

and exits into the lower compartment. A check (flapper) valve at the end 

of each pipe keeps warm air from entering during normal operation, but 

when the water exerts pressure, it opens to allow the water to spill into 

the lower compartment. This prevents water from backing up and 

interfering with the ice condenser inlet doors. The water delivered to the 

lower containment serves to cool the atmosphere as it falls through to the 

floor and provides a source of borated water at the containment sump for 

long term use by the Emergency Core Cooling System (ECCS) and the 

Containment Spray System during the recirculation mode of operation.

The two refueling canal drains are at low points in the refueling canal. 

During a refueling, plugs are installed in the drains and the canal is 

flooded to facilitate the refueling process. The water acts to shield and 

cool the spent fuel as it is transferred from the reactor vessel to storage. 

After refueling, the canal is drained and the plugs removed. In the event 

of a DBA, the refueling canal drains are the main return path to the lower 

compartment for Containment Spray System water sprayed into the upper 

compartment.

The ice condenser drains and the refueling canal drains function with the 

ice bed, the Containment Spray System, and the ECCS to limit the 

pressure and temperature that could be expected following a DBA.

APPLICABLE The limiting DBAs considered relative to containment temperature and

SAFETY pressure are the loss of coolant accident (LOCA) and the steam line

ANALYSES break (SLB). The LOCA and SLB are analyzed using computer codes 

designed to predict the resultant containment pressure and temperature 

transients. DBAs are assumed not to occur simultaneously or 

consecutively. Although the ice condenser is a passive system that 

requires no electrical power to perform its function, the Containment 

Spray System and the Air Return System (ARS) also function to assist 

the ice bed in limiting pressures and temperatures. Therefore, the
Containment Recirculation Drains (Ice Condenser)

B 3.6.18

Westinghouse STS B 3.6.18-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

analysis of the postulated DBAs, with respect to Engineered Safety 

Feature (ESF) systems, assumes the loss of one ESF bus, which is the 

worst case single active failure and results in one train of the Containment 

Spray System and one train of the ARS being rendered inoperable.

The limiting DBA analyses (Ref. 1) show that the maximum peak 

containment pressure results from the LOCA analysis and is calculated to 

be less than the containment design pressure. The maximum peak 

containment atmosphere temperature results from the SLB analysis and 

is discussed in the Bases for LCO 3.6.5, "Containment Air Temperature." 

In addition to calculating the overall peak containment pressures, the 

DBA analyses include calculation of the transient differential pressures 

that occur across subcompartment walls during the initial blowdown 

phase of the accident transient. The internal containment walls and 

structures are designed to withstand these local transient pressure 

differentials for the limiting DBAs.

The containment recirculation drains satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO This LCO establishes the minimum requirements to ensure that the 

containment recirculation drains perform their safety functions. The ice 

condenser floor drain valve disks must be closed to minimize air leakage 

into and out of the ice condenser during normal operation and must open 

in the event of a DBA when water begins to drain out. The refueling canal 

drains must have their plugs removed and remain clear to ensure the 

return of Containment Spray System water to the lower containment in 

the event of a DBA. The containment recirculation drains function with 

the ice condenser, ECCS, and Containment Spray System to limit the 

pressure and temperature that could be expected following a DBA.

APPLICABILITY In MODES 1, 2, 3, and 4, a DBA could cause an increase in containment 

pressure and temperature, which would require the operation of the 

containment recirculation drains. Therefore, the LCO is applicable in 

MODES 1, 2, 3, and 4.

The probability and consequences of these events in MODES 5 and 6 are 

low due to the pressure and temperature limitations of these MODES. As 

such, the containment recirculation drains are not required to be 

OPERABLE in these MODES.
Containment Recirculation Drains (Ice Condenser)

B 3.6.18

Westinghouse STS B 3.6.18-3 Rev. 4.0

BASES

ACTIONS A.1

If one ice condenser floor drain is inoperable, 1 hour is allowed to restore 

the drain to OPERABLE status. The Required Action is necessary to 

return operation to within the bounds of the containment analysis. The 

1 hour Completion Time is consistent with the ACTIONS of LCO 3.6.1, 

"Containment," which requires that containment be restored to 

OPERABLE status within 1 hour.

B.1

If one refueling canal drain is inoperable, 1 hour is allowed to restore the 

drain to OPERABLE status. The Required Action is necessary to return 

operation to within the bounds of the containment analysis. The 1 hour 

Completion Time is consistent with the ACTIONS of LCO 3.6.1, which 

requires that containment be restored to OPERABLE status in 1 hour.

C.1 and C.2

If the affected drain(s) cannot be restored to OPERABLE status within the 

required Completion Time, the plant must be brought to a MODE in which 

the LCO does not apply. To achieve this status, the plant must be 

brought to at least MODE 3 within 6 hours and to MODE 5 within 

36 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required plant conditions from full 

power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.6.18.1

REQUIREMENTS

Verifying the OPERABILITY of the refueling canal drains ensures that 

they will be able to perform their functions in the event of a DBA. This 

Surveillance confirms that the refueling canal drain plugs have been 

removed and that the drains are clear of any obstructions that could 

impair their functioning. In addition to debris near the drains, attention 

must be given to any debris that is located where it could be moved to the 

drains in the event that the Containment Spray System is in operation and 

water is flowing to the drains. SR 3.6.18.1 must be performed before 

entering MODE 4 from MODE 5 after every filling of the canal to ensure 

that the plugs have been removed and that no debris that could impair the 

drains was deposited during the time the canal was filled. [ The 92 day 

Frequency was developed considering such factors as the inaccessibility 

of the drains, the absence of traffic in the vicinity of the drains, and the 

redundancy of the drains.
Containment Recirculation Drains (Ice Condenser)

B 3.6.18

Westinghouse STS B 3.6.18-4 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.6.18.2

Verifying the OPERABILITY of the ice condenser floor drains ensures that 

they will be able to perform their functions in the event of a DBA. 

Inspecting the drain valve disk ensures that the valve is performing its 

function of sealing the drain line from warm air leakage into the ice 

condenser during normal operation, yet will open if melted ice fills the line 

following a DBA. Verifying that the drain lines are not obstructed ensures 

their readiness to drain water from the ice condenser. [ The [18] month 

Frequency was developed considering such factors as the inaccessibility 

of the drains during power operation; the design of the ice condenser, 

which precludes melting and refreezing of the ice; and operating 

experience that has confirmed that the drains are found to be acceptable 

when the Surveillance is performed at an [18] month Frequency. 

Because of high radiation in the vicinity of the drains during power 

operation, this Surveillance is normally done during a shutdown.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [6.2].
MSSVs

B 3.7.1

Westinghouse STS B 3.7.1-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.1 Main Steam Safety Valves (MSSVs)

BASES

BACKGROUND The primary purpose of the MSSVs is to provide overpressure protection 

for the secondary system. The MSSVs also provide protection against 

overpressurizing the reactor coolant pressure boundary (RCPB) by 

providing a heat sink for the removal of energy from the Reactor Coolant 

System (RCS) if the preferred heat sink, provided by the Condenser and 

Circulating Water System, is not available.

[Five] MSSVs are located on each main steam header, outside 

containment, upstream of the main steam isolation valves, as described 

in the FSAR, Section [10.3.1] (Ref. 1). The MSSVs must have sufficient 

capacity to limit the secondary system pressure to ≤ 110% of the steam 

generator design pressure in order to meet the requirements of the ASME 

Code, Section III (Ref. 2). The MSSV design includes staggered 

setpoints, according to Table 3.7.1-2 in the accompanying LCO, so that 

only the needed valves will actuate. Staggered setpoints reduce the 

potential for valve chattering that is due to steam pressure insufficient to 

fully open all valves following a turbine reactor trip.

APPLICABLE The design basis for the MSSVs comes from Reference 2 and its purpose

SAFETY is to limit the secondary system pressure to ≤ 110% of design pressure

ANALYSES for any anticipated operational occurrence (AOO) or accident considered 

in the Design Basis Accident (DBA) and transient analysis.

The events that challenge the relieving capacity of the MSSVs, and thus 

RCS pressure, are those characterized as decreased heat removal 

events, which are presented in the FSAR, Section [15.2] (Ref. 3). Of 

these, the full power turbine trip without steam dump is typically the 

limiting AOO. This event also terminates normal feedwater flow to the 

steam generators.

The safety analysis demonstrates that the transient response for turbine 

trip occurring from full power without a direct reactor trip presents no 

hazard to the integrity of the RCS or the Main Steam System. One 

turbine trip analysis is performed assuming primary system pressure 

control via operation of the pressurizer relief valves and spray. This 

analysis demonstrates that the DNB design basis is met. Another 

analysis is performed assuming no primary system pressure control, but 

crediting reactor trip on high pressurizer pressure and operation of the 

pressurizer safety valves. This analysis demonstrates that RCS integrity
MSSVs

B 3.7.1

Westinghouse STS B 3.7.1-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

is maintained by showing that the maximum RCS pressure does not 

exceed 110% of the design pressure. All cases analyzed demonstrate 

that the MSSVs maintain Main Steam System integrity by limiting the 

maximum steam pressure to less than 110% of the steam generator 

design pressure.

In addition to the decreased heat removal events, reactivity insertion 

events may also challenge the relieving capacity of the MSSVs. The 

uncontrolled rod cluster control assembly (RCCA) bank withdrawal at 

power event is characterized by an increase in core power and steam 

generation rate until reactor trip occurs when either the Overtemperature 

∆T or Power Range Neutron Flux-High setpoint is reached. Steam flow to 

the turbine will not increase from its initial value for this event. The 

increased heat transfer to the secondary side causes an increase in 

steam pressure and may result in opening of the MSSVs prior to reactor 

trip, assuming no credit for operation of the atmospheric or condenser 

steam dump valves. The FSAR Section [15.4] safety analysis of the 

RCCA bank withdrawal at power event for a range of initial core power 

levels demonstrates that the MSSVs are capable of preventing secondary 

side overpressurization for this AOO.

The FSAR safety analyses discussed above assume that all of the 

MSSVs for each steam generator are OPERABLE. If there are 

inoperable MSSV(s), it is necessary to limit the primary system power 

during steady-state operation and AOOs to a value that does not result in 

exceeding the combined steam flow capacity of the turbine (if available) 

and the remaining OPERABLE MSSVs. The required limitation on 

primary system power necessary to prevent secondary system 

overpressurization may be determined by system transient analyses or 

conservatively arrived at by a simple heat balance calculation. In some 

circumstances it is necessary to limit the primary side heat generation 

that can be achieved during an AOO by reducing the setpoint of the 

Power Range Neutron Flux-High reactor trip function. For example, if 

more than one MSSV on a single steam generator is inoperable, an 

uncontrolled RCCA bank withdrawal at power event occurring from a 

partial power level may result in an increase in reactor power that 

exceeds the combined steam flow capacity of the turbine and the 

remaining OPERABLE MSSVs. Thus, for multiple inoperable MSSVs on 

the same steam generator it is necessary to prevent this power increase 

by lowering the Power Range Neutron Flux-High setpoint to an 

appropriate value. [When the Moderator Temperature Coefficient (MTC) 

is positive, the reactor power may increase above the initial value during
MSSVs

B 3.7.1

Westinghouse STS B 3.7.1-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

an RCS heatup event (e.g., turbine trip). Thus, for any number of 

inoperable MSSVs, it is necessary to reduce the trip setpoint if a positive 

MTC may exist at partial power conditions, unless it is demonstrated by 

analysis that a specified reactor power reduction alone is sufficient to 

prevent overpressurization of the steam system.]

The MSSVs are assumed to have two active and one passive failure 

modes. The active failure modes are spurious opening, and failure to 

reclose once opened. The passive failure mode is failure to open upon 

demand.

The MSSVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The accident analysis requires that [five] MSSVs per steam generator be 

OPERABLE to provide overpressure protection for design basis 

transients occurring at 102% RTP. The LCO requires that [five] MSSVs 

per steam generator be OPERABLE in compliance with Reference 2, and 

the DBA analysis.

The OPERABILITY of the MSSVs is defined as the ability to open upon 

demand within the setpoint tolerances, to relieve steam generator 

overpressure, and reseat when pressure has been reduced. The 

OPERABILITY of the MSSVs is determined by periodic surveillance 

testing in accordance with the Inservice Testing Program.

This LCO provides assurance that the MSSVs will perform their designed 

safety functions to mitigate the consequences of accidents that could 

result in a challenge to the RCPB, or Main Steam System integrity.

APPLICABILITY In MODES 1, 2, and 3, [five] MSSVs per steam generator are required to 

be OPERABLE to prevent Main Steam System overpressurization.

In MODES 4 and 5, there are no credible transients requiring the MSSVs. 

The steam generators are not normally used for heat removal in 

MODES 5 and 6, and thus cannot be overpressurized; there is no 

requirement for the MSSVs to be OPERABLE in these MODES.
MSSVs

B 3.7.1

Westinghouse STS B 3.7.1-4 Rev. 4.0

BASES 

ACTIONS The ACTIONS Table is modified by a Note indicating that separate 

Condition entry is allowed for each MSSV.

With one or more MSSVs inoperable, action must be taken so that the 

available MSSV relieving capacity meets Reference 2 requirements.

Operation with less than all [five] MSSVs OPERABLE for each steam 

generator is permissible, if THERMAL POWER is limited to the relief 

capacity of the remaining MSSVs. This is accomplished by restricting 

THERMAL POWER so that the energy transfer to the most limiting steam 

generator is not greater than the available relief capacity in that steam 

generator.

A.1

In the case of only a single inoperable MSSV on one or more steam 

generators [when the Moderator Temperature Coefficient is not positive], 

a reactor power reduction alone is sufficient to limit primary side heat 

generation such that overpressurization of the secondary side is 

precluded for any RCS heatup event. Furthermore, for this case there is 

sufficient total steam flow capacity provided by the turbine and remaining 

OPERABLE MSSVs to preclude overpressurization in the event of an 

increased reactor power due to reactivity insertion, such as in the event of 

an uncontrolled RCCA bank withdrawal at power. Therefore, Required 

Action A.1 requires an appropriate reduction in reactor power within 

4 hours.

The maximum THERMAL POWER corresponding to the heat removal 

capacity of the remaining OPERABLE MSSVs is determined via a 

conservative heat balance calculation as described in the attachment to 

Reference 6, with an appropriate allowance for calorimetric power 

uncertainty.

-----------------------------------REVIEWER’S NOTE-----------------------------------

To determine the maximum THERMAL POWER corresponding to the 

heat removal capacity of the remaining OPERABLE MSSVs, the 

governing heat transfer relationship is the equation q = 



m

∆h, where q is 

the heat input from the primary side, 



m

is the mass flow rate of the 

steam, and ∆h is the increase in enthalpy that occurs in converting the 

secondary side water to steam. If it is conservatively assumed that the 

secondary side water is all saturated liquid (i.e., no subcooled feedwater), 

then the ∆h is the heat of vaporization (hfg) at the steam relief pressure. 

The following equation is used to determine the maximum allowable 

power level for continued operation with inoperable MSSV(s):
MSSVs

B 3.7.1

Westinghouse STS B 3.7.1-5 Rev. 4.0

BASES

ACTIONS (continued)

Maximum NSSS Power ≤ (100/Q) (wshfgN) / K

where:

Q = Nominal NSSS power rating of the plant (including reactor 

coolant pump heat), MWt

K = Conversion factor, 947.82 (Btu/sec)/MWt

ws = Minimum total steam flow rate capability of the OPERABLE 

MSSVs on any one steam generator at the highest OPERABLE 

MSSV opening pressure, including tolerance and accumulation, 

as appropriate, lbm/sec.

hfg = Heat of vaporization at the highest MSSV opening pressure, 

including tolerance and accumulation as appropriate, Btu/lbm.

N = Number of steam generators in the plant.

For use in determining the %RTP in the Required Action statement A.1, 

the Maximum NSSS Power calculated above is reduced by [2]% RTP to 

account for calorimetric power uncertainty.

--------------------------------------------------------------------------------------------------

B.1 and B.2

In the case of multiple inoperable MSSVs on one or more steam 

generators, with a reactor power reduction alone there may be insufficient 

total steam flow capacity provided by the turbine and remaining 

OPERABLE MSSVs to preclude overpressurization in the event of an 

increased reactor power due to reactivity insertion, such as in the event of 

an uncontrolled RCCA bank withdrawal at power. [Furthermore, for a 

single inoperable MSSV on one or more steam generators when the 

Moderator Temperature Coefficient is positive the reactor power may 

increase as a result of an RCS heatup event such that flow capacity of 

the remaining OPERABLE MSSVs is insufficient.] The 4 hour Completion 

Time for Required Action B.1 is consistent with A.1. An additional 

32 hours is allowed in Required Action B.2 to reduce the setpoints. The 

Completion Time of 36 hours is based on a reasonable time to correct the 

MSSV inoperability, the time required to perform the power reduction, 

operating experience in resetting all channels of a protective function, and 

on the low probability of the occurrence of a transient that could result in 

steam generator overpressure during this period.
MSSVs

B 3.7.1

Westinghouse STS B 3.7.1-6 Rev. 4.0

BASES

ACTIONS (continued)

The maximum THERMAL POWER corresponding to the heat removal 

capacity of the remaining OPERABLE MSSVs is determined via a 

conservative heat balance calculation as described in the attachment to 

Reference 6, with an appropriate allowance for Nuclear Instrumentation 

System trip channel uncertainties.

-----------------------------------REVIEWER’S NOTE-----------------------------------

To determine the Table 3.7.1-1 Maximum Allowable Power for Required 

Actions B.1 and B.2 (%RTP), the Maximum NSSS Power calculated 

using the equation in the Reviewer's Note above is reduced by [9]% RTP 

to account for Nuclear Instrumentation System trip channel uncertainties.

--------------------------------------------------------------------------------------------------

Required Action B.2 is modified by a Note, indicating that the Power 

Range Neutron Flux-High reactor trip setpoint reduction is only required in 

MODE 1. In MODES 2 and 3 the reactor protection system trips specified 

in LCO 3.3.1, "Reactor Trip System Instrumentation," provide sufficient 

protection.

The allowed Completion Times are reasonable based on operating 

experience to accomplish the Required Actions in an orderly manner 

without challenging unit systems.

C.1 and C.2

If the Required Actions are not completed within the associated 

Completion Time, or if one or more steam generators have ≥ [4] 

inoperable MSSVs, the unit must be placed in a MODE in which the LCO 

does not apply. To achieve this status, the unit must be placed in at least 

MODE 3 within 6 hours, and in MODE 4 within 12 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems.

SURVEILLANCE SR 3.7.1.1

REQUIREMENTS

This SR verifies the OPERABILITY of the MSSVs by the verification of 

each MSSV lift setpoint in accordance with the Inservice Testing 

Program. The ASME Code (Ref. 4), requires that safety and relief valve 

tests be performed in accordance with ANSI/ASME OM-1-1987 (Ref. 5). 

According to Reference 5, the following tests are required:

a. Visual examination,
MSSVs

B 3.7.1

Westinghouse STS B 3.7.1-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

b. Seat tightness determination,

c. Setpoint pressure determination (lift setting),

d. Compliance with owner's seat tightness criteria, and

e. Verification of the balancing device integrity on balanced valves.

The ANSI/ASME Standard requires that all valves be tested every 

5 years, and a minimum of 20% of the valves be tested every 24 months. 

The ASME Code specifies the activities and frequencies necessary to 

satisfy the requirements. Table 3.7.1-2 allows a ± [3]% setpoint tolerance 

for OPERABILITY; however, the valves are reset to ± 1% during the 

Surveillance to allow for drift. The lift settings, according to Table 3.7.1-2, 

correspond to ambient conditions of the valve at nominal operating 

temperature and pressure.

This SR is modified by a Note that allows entry into and operation in 

MODE 3 prior to performing the SR. The MSSVs may be either bench 

tested or tested in situ at hot conditions using an assist device to simulate 

lift pressure. If the MSSVs are not tested at hot conditions, the lift setting 

pressure shall be corrected to ambient conditions of the valve at 

operating temperature and pressure.

REFERENCES 1. FSAR, Section [10.3.1].

2. ASME, Boiler and Pressure Vessel Code, Section III, Article NC7000, Class 2 Components.

3. FSAR, Section [15.2].

4. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

5. ANSI/ASME OM-1-1987.

6. NRC Information Notice 94-60, "Potential Overpressurization of the 

Main Steam System," August 22, 1994.

MSIVs

B 3.7.2

Westinghouse STS B 3.7.2-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.2 Main Steam Isolation Valves (MSIVs)

BASES

BACKGROUND The MSIVs isolate steam flow from the secondary side of the steam 

generators following a high energy line break (HELB). MSIV closure 

terminates flow from the unaffected (intact) steam generators.

One MSIV is located in each main steam line outside, but close to, 

containment. The MSIVs are downstream from the main steam safety 

valves (MSSVs) and auxiliary feedwater (AFW) pump turbine steam 

supply, to prevent MSSV and AFW isolation from the steam generators 

by MSIV closure. Closing the MSIVs isolates each steam generator from 

the others, and isolates the turbine, Steam Bypass System, and other 

auxiliary steam supplies from the steam generators.

The MSIVs close on a main steam isolation signal generated by either 

low steam generator pressure or high containment pressure. The MSIVs 

fail closed on loss of control or actuation power.

Each MSIV has an MSIV bypass valve. Although these bypass valves 

are normally closed, they receive the same emergency closure signal as 

do their associated MSIVs. The MSIVs may also be actuated manually.

A description of the MSIVs is found in the FSAR, Section [10.3] (Ref. 1).

APPLICABLE The design basis of the MSIVs is established by the containment analysis

SAFETY for the large steam line break (SLB) inside containment, discussed in the

ANALYSES FSAR, Section [6.2] (Ref. 2). It is also affected by the accident analysis 

of the SLB events presented in the FSAR, Section [15.1.5] (Ref. 3). The 

design precludes the blowdown of more than one steam generator, 

assuming a single active component failure (e.g., the failure of one MSIV 

to close on demand).

The limiting case for the containment analysis is the SLB inside 

containment, with a loss of offsite power following turbine trip, and failure 

of the MSIV on the affected steam generator to close. At lower powers, 

the steam generator inventory and temperature are at their maximum, 

maximizing the analyzed mass and energy release to the containment. 

Due to reverse flow and failure of the MSIV to close, the additional mass 

and energy in the steam headers downstream from the other MSIV 

contribute to the total release. With the most reactive rod cluster control 

assembly assumed stuck in the fully withdrawn position, there is an 

increased possibility that the core will become critical and return to power. 

The core is ultimately shut down by the boric acid injection delivered by 

the Emergency Core Cooling System.
MSIVs

B 3.7.2

Westinghouse STS B 3.7.2-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The accident analysis compares several different SLB events against 

different acceptance criteria. The large SLB outside containment 

upstream of the MSIV is limiting for offsite dose, although a break in this 

short section of main steam header has a very low probability. The large 

SLB inside containment at hot zero power is the limiting case for a post 

trip return to power. The analysis includes scenarios with offsite power 

available, and with a loss of offsite power following turbine trip. With 

offsite power available, the reactor coolant pumps continue to circulate 

coolant through the steam generators, maximizing the Reactor Coolant 

System cooldown. With a loss of offsite power, the response of mitigating 

systems is delayed. Significant single failures considered include failure 

of an MSIV to close.

The MSIVs serve only a safety function and remain open during power 

operation. These valves operate under the following situations:

a. An HELB inside containment. In order to maximize the mass and 

energy release into containment, the analysis assumes that the MSIV 

in the affected steam generator remains open. For this accident 

scenario, steam is discharged into containment from all steam 

generators until the remaining MSIVs close. After MSIV closure, 

steam is discharged into containment only from the affected steam 

generator and from the residual steam in the main steam header 

downstream of the closed MSIVs in the unaffected loops. Closure of 

the MSIVs isolates the break from the unaffected steam generators.

b. A break outside of containment and upstream from the MSIVs is not 

a containment pressurization concern. The uncontrolled blowdown of 

more than one steam generator must be prevented to limit the 

potential for uncontrolled RCS cooldown and positive reactivity 

addition. Closure of the MSIVs isolates the break and limits the 

blowdown to a single steam generator.

c. A break downstream of the MSIVs will be isolated by the closure of 

the MSIVs.

d. Following a steam generator tube rupture, closure of the MSIVs 

isolates the ruptured steam generator from the intact steam 

generators to minimize radiological releases.

e. The MSIVs are also utilized during other events such as a feedwater 

line break. This event is less limiting so far as MSIV OPERABILITY 

is concerned.

The MSIVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
MSIVs

B 3.7.2

Westinghouse STS B 3.7.2-3 Rev. 4.0

BASES

LCO This LCO requires that [four] MSIVs in the steam lines be OPERABLE. 

The MSIVs are considered OPERABLE when the isolation times are 

within limits, and they close on an isolation actuation signal.

This LCO provides assurance that the MSIVs will perform their design 

safety function to mitigate the consequences of accidents that could result 

in offsite exposures comparable to the 10 CFR 100 (Ref. 4) limits or the 

NRC staff approved licensing basis.

APPLICABILITY The MSIVs must be OPERABLE in MODE 1, and in MODES 2 and 3 

except when closed and de-activated, when there is significant mass and 

energy in the RCS and steam generators. When the MSIVs are closed, 

they are already performing the safety function.

In MODE 4, normally most of the MSIVs are closed, and the steam 

generator energy is low.

In MODE 5 or 6, the steam generators do not contain much energy 

because their temperature is below the boiling point of water; therefore, 

the MSIVs are not required for isolation of potential high energy 

secondary system pipe breaks in these MODES.

ACTIONS A.1

With one MSIV inoperable in MODE 1, action must be taken to restore 

OPERABLE status within [8] hours. Some repairs to the MSIV can be 

made with the unit hot. The [8] hour Completion Time is reasonable, 

considering the low probability of an accident occurring during this time 

period that would require a closure of the MSIVs.

The [8] hour Completion Time is greater than that normally allowed for 

containment isolation valves because the MSIVs are valves that isolate a 

closed system penetrating containment. These valves differ from other 

containment isolation valves in that the closed system provides an 

additional means for containment isolation.

B.1

If the MSIV cannot be restored to OPERABLE status within [8] hours, the 

unit must be placed in a MODE in which the LCO does not apply. To 

achieve this status, the unit must be placed in MODE 2 within 6 hours and 

Condition C would be entered. The Completion Times are reasonable, 

based on operating experience, to reach MODE 2 and to close the MSIVs 

in an orderly manner and without challenging unit systems.
MSIVs

B 3.7.2

Westinghouse STS B 3.7.2-4 Rev. 4.0

BASES

ACTIONS (continued)

C.1 and C.2

Condition C is modified by a Note indicating that separate Condition entry 

is allowed for each MSIV.

Since the MSIVs are required to be OPERABLE in MODES 2 and 3, the 

inoperable MSIVs may either be restored to OPERABLE status or closed. 

When closed, the MSIVs are already in the position required by the 

assumptions in the safety analysis.

The [8] hour Completion Time is consistent with that allowed in 

Condition A.

For inoperable MSIVs that cannot be restored to OPERABLE status 

within the specified Completion Time, but are closed, the inoperable 

MSIVs must be verified on a periodic basis to be closed. This is 

necessary to ensure that the assumptions in the safety analysis remain 

valid. The 7 day Completion Time is reasonable, based on engineering 

judgment, in view of MSIV status indications available in the control room, 

and other administrative controls, to ensure that these valves are in the 

closed position.

D.1 and D.2

If the MSIVs cannot be restored to OPERABLE status or are not closed 

within the associated Completion Time, the unit must be placed in a 

MODE in which the LCO does not apply. To achieve this status, the unit 

must be placed at least in MODE 3 within 6 hours, and in MODE 4 within 

12 hours. The allowed Completion Times are reasonable, based on 

operating experience, to reach the required unit conditions from MODE 2 

conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.2.1

REQUIREMENTS

This SR verifies that the closure time of each MSIV is within the limit 

given in Reference 5 and is within that assumed in the accident and 

containment analyses. This SR also verifies the valve closure time is in 

accordance with the Inservice Testing Program. This SR is normally 

performed upon returning the unit to operation following a refueling 

outage. The MSIVs should not be tested at power, since even a part 

stroke exercise increases the risk of a valve closure when the unit is 

generating power. As the MSIVs are not tested at power, they are 

exempt from the ASME Code (Ref. 6), requirements during operation in 

MODE 1 or 2.
MSIVs

B 3.7.2

Westinghouse STS B 3.7.2-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Frequency is in accordance with the Inservice Testing Program.

This test is conducted in MODE 3 with the unit at operating temperature 

and pressure. This SR is modified by a Note that allows entry into and 

operation in MODE 3 prior to performing the SR. This allows a delay of 

testing until MODE 3, to establish conditions consistent with those under 

which the acceptance criterion was generated.

SR 3.7.2.2

This SR verifies that each MSIV can close on an actual or simulated 

actuation signal. This Surveillance is normally performed upon returning 

the plant to operation following a refueling outage. [ The Frequency of 

MSIV testing is every [18] months. The [18] month Frequency for testing 

is based on the refueling cycle. Operating experience has shown that 

these components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, this Frequency is acceptable from a 

reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [10.3].

2. FSAR, Section [6.2].

3. FSAR, Section [15.1.5].

4. 10 CFR 100.11.

5. [Technical Requirements Manual.]

6. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

MFIVs and MFRVs [and Associated Bypass Valves]

B 3.7.3

Westinghouse STS B 3.7.3-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.3 Main Feedwater Isolation Valves (MFIVs) and Main Feedwater Regulation Valves 

 (MFRVs) [and Associated Bypass Valves]

BASES

BACKGROUND The MFIVs isolate main feedwater (MFW) flow to the secondary side of 

the steam generators following a high energy line break (HELB). The 

safety related function of the MFRVs is to provide the second isolation of 

MFW flow to the secondary side of the steam generators following an 

HELB. Closure of the MFIVs and associated bypass valves or MFRVs 

and associated bypass valves terminates flow to the steam generators, 

terminating the event for feedwater line breaks (FWLBs) occurring 

upstream of the MFIVs or MFRVs. The consequences of events 

occurring in the main steam lines or in the MFW lines downstream from 

the MFIVs will be mitigated by their closure. Closure of the MFIVs and 

associated bypass valves, or MFRVs and associated bypass valves, 

effectively terminates the addition of feedwater to an affected steam 

generator, limiting the mass and energy release for steam line breaks 

(SLBs) or FWLBs inside containment, and reducing the cooldown effects 

for SLBs.

The MFIVs and associated bypass valves, or MFRVs and associated 

bypass valves, isolate the nonsafety related portions from the safety 

related portions of the system. In the event of a secondary side pipe 

rupture inside containment, the valves limit the quantity of high energy 

fluid that enters containment through the break, and provide a pressure 

boundary for the controlled addition of auxiliary feedwater (AFW) to the 

intact loops.

One MFIV and associated bypass valve, and one MFRV and its 

associated bypass valve, are located on each MFW line, outside but 

close to containment. The MFIVs and MFRVs are located upstream of 

the AFW injection point so that AFW may be supplied to the steam 

generators following MFIV or MFRV closure. The piping volume from 

these valves to the steam generators must be accounted for in calculating 

mass and energy releases, and refilled prior to AFW reaching the steam 

generator following either an SLB or FWLB.

The MFIVs and associated bypass valves, and MFRVs and associated 

bypass valves, close on receipt of a Tavg - Low coincident with reactor trip 

(P-4) or steam generator water level - high high signal. They may also be 

actuated manually. In addition to the MFIVs and associated bypass 

valves, and the MFRVs and associated bypass valves, a check valve 

inside containment is available. The check valve isolates the feedwater 

line, penetrating containment, and ensures that the consequences of 

events do not exceed the capacity of the containment heat removal 

systems.
MFIVs and MFRVs [and Associated Bypass Valves]

B 3.7.3

Westinghouse STS B 3.7.3-2 Rev. 4.0

BASES

BACKGROUND (continued)

A description of the MFIVs and MFRVs is found in the FSAR, 

Section [10.4.7] (Ref. 1).

APPLICABLE The design basis of the MFIVs and MFRVs is established by the 

SAFETY analyses for the large SLB. It is also influenced by the accident analysis 

ANALYSES for the large FWLB. Closure of the MFIVs and associated bypass valves, 

or MFRVs and associated bypass valves, may also be relied on to 

terminate an SLB for core response analysis and excess feedwater event 

upon the receipt of a steam generator water level - high high signal or a 

feedwater isolation signal on high steam generator level.

Failure of an MFIV, MFRV, or the associated bypass valves to close 

following an SLB or FWLB can result in additional mass and energy being 

delivered to the steam generators, contributing to cooldown. This failure 

also results in additional mass and energy releases following an SLB or 

FWLB event.

The MFIVs and MFRVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO This LCO ensures that the MFIVs, MFRVs, and their associated bypass 

valves will isolate MFW flow to the steam generators, following an FWLB 

or main steam line break. These valves will also isolate the nonsafety 

related portions from the safety related portions of the system.

This LCO requires that [four] MFIVs and associated bypass valves and 

[four] MFRVs [and associated bypass valves] be OPERABLE. The 

MFIVs and MFRVs and the associated bypass valves are considered 

OPERABLE when isolation times are within limits and they close on an 

isolation actuation signal.

Failure to meet the LCO requirements can result in additional mass and 

energy being released to containment following an SLB or FWLB inside 

containment. If a feedwater isolation signal on high steam generator level 

is relied on to terminate an excess feedwater flow event, failure to meet 

the LCO may result in the introduction of water into the main steam lines.

APPLICABILITY The MFIVs and MFRVs and the associated bypass valves must be 

OPERABLE whenever there is significant mass and energy in the 

Reactor Coolant System and steam generators. This ensures that, in the 

event of an HELB, a single failure cannot result in the blowdown of more 

than one steam generator. In MODES 1, 2, [and 3], the MFIVs and 

MFRVs and the associated bypass valves are required to be OPERABLE 

to limit the amount of available fluid that could be added to containment in 

the case of a secondary system pipe break inside containment. When 

the valves are closed and de-activated or isolated by a closed manual 

valve, they are already performing their safety function.
MFIVs and MFRVs [and Associated Bypass Valves]

B 3.7.3

Westinghouse STS B 3.7.3-3 Rev. 4.0

BASES

APPLICABILITY (continued)

In MODES 4, 5, and 6, steam generator energy is low. Therefore, the 

MFIVs, MFRVs, and the associated bypass valves are normally closed 

since MFW is not required.

ACTIONS The ACTIONS Table is modified by a Note indicating that separate 

Condition entry is allowed for each valve.

A.1 and A.2

With one MFIV in one or more flow paths inoperable, action must be 

taken to restore the affected valves to OPERABLE status, or to close or 

isolate inoperable affected valves within [72] hours. When these valves 

are closed or isolated, they are performing their required safety function.

The [72] hour Completion Time takes into account the redundancy 

afforded by the remaining OPERABLE valves and the low probability of 

an event occurring during this time period that would require isolation of 

the MFW flow paths. The [72] hour Completion Time is reasonable, 

based on operating experience.

Inoperable MFIVs that are closed or isolated must be verified on a 

periodic basis that they are closed or isolated. This is necessary to 

ensure that the assumptions in the safety analysis remain valid. The 

7 day Completion Time is reasonable, based on engineering judgment, in 

view of valve status indications available in the control room, and other 

administrative controls, to ensure that these valves are closed or isolated.

B.1 and B.2

With one MFRV in one or more flow paths inoperable, action must be 

taken to restore the affected valves to OPERABLE status, or to close or 

isolate inoperable affected valves within [72] hours. When these valves 

are closed or isolated, they are performing their required safety function.

The [72] hour Completion Time takes into account the redundancy 

afforded by the remaining OPERABLE valves and the low probability of 

an event occurring during this time period that would require isolation of 

the MFW flow paths. The [72] hour Completion Time is reasonable, 

based on operating experience.
MFIVs and MFRVs [and Associated Bypass Valves]

B 3.7.3

Westinghouse STS B 3.7.3-4 Rev. 4.0

BASES

ACTIONS (continued)

Inoperable MFRVs, that are closed or isolated, must be verified on a 

periodic basis that they are closed or isolated. This is necessary to 

ensure that the assumptions in the safety analysis remain valid. The 

7 day Completion Time is reasonable, based on engineering judgment, in 

view of valve status indications available in the control room, and other 

administrative controls to ensure that the valves are closed or isolated.

C.1 and C.2

With one associated bypass valve in one or more flow paths inoperable, 

action must be taken to restore the affected valves to OPERABLE status, 

or to close or isolate inoperable affected valves within [72] hours. When 

these valves are closed or isolated, they are performing their required 

safety function.

The [72] hour Completion Time takes into account the redundancy 

afforded by the remaining OPERABLE valves and the low probability of 

an event occurring during this time period that would require isolation of 

the MFW flow paths. The [72] hour Completion Time is reasonable, 

based on operating experience.

Inoperable associated bypass valves that are closed or isolated must be 

verified on a periodic basis that they are closed or isolated. This is 

necessary to ensure that the assumptions in the safety analysis remain 

valid. The 7 day Completion Time is reasonable, based on engineering 

judgment, in view of valve status indications available in the control room, 

and other administrative controls, to ensure that these valves are closed 

or isolated.

D.1

With two inoperable valves in the same flow path, there may be no 

redundant system to operate automatically and perform the required 

safety function. Although the containment can be isolated with the failure 

of two valves in parallel in the same flow path, the double failure can be 

an indication of a common mode failure in the valves of this flow path, 

and as such, is treated the same as a loss of the isolation capability of 

this flow path. Under these conditions, affected valves in each flow path 

must be restored to OPERABLE status, or the affected flow path isolated 

within 8 hours. This action returns the system to the condition where at 

least one valve in each flow path is performing the required safety 

function. The 8 hour Completion Time is reasonable, based on operating 

experience, to complete the actions required to close the MFIV or MFRV, 

or otherwise isolate the affected flow path.
MFIVs and MFRVs [and Associated Bypass Valves]

B 3.7.3

Westinghouse STS B 3.7.3-5 Rev. 4.0

BASES

ACTIONS (continued)

E.1 and E.2

If the MFIV(s) and MFRV(s) and the associated bypass valve(s) cannot 

be restored to OPERABLE status, or closed, or isolated within the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed in 

at least MODE 3 within 6 hours [, and in MODE 4 within 12 hours]. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.3.1

REQUIREMENTS

This SR verifies that the closure time of each MFIV, MFRV, and 

[associated bypass valve] is within the limit given in Reference 2 and is 

within that assumed in the accident and containment analyses. This SR 

also verifies the valve closure time is in accordance with the Inservice 

Testing Program. This SR is normally performed upon returning the unit 

to operation following a refueling outage. These valves should not be 

tested at power since even a part stroke exercise increases the risk of a 

valve closure with the unit generating power. This is consistent with the 

ASME Code (Ref. 3), quarterly stroke requirements during operation in 

MODES 1 and 2.

The Frequency for this SR is in accordance with the Inservice Testing 

Program.

SR 3.7.3.2

This SR verifies that each MFIV, MFRV, and [associated bypass valves] 

can close on an actual or simulated actuation signal. This Surveillance is 

normally performed upon returning the plant to operation following a 

refueling outage.

[ The Frequency for this SR is every [18] months. The [18] month 

Frequency for testing is based on the refueling cycle. Operating 

experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. Therefore, 

this Frequency is acceptable from a reliability standpoint.

OR
MFIVs and MFRVs [and Associated Bypass Valves]

B 3.7.3

Westinghouse STS B 3.7.3-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [10.4.7].

2. [Technical Requirements Manual.]

3. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.
ADVs

B 3.7.4

Westinghouse STS B 3.7.4-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.4 Atmospheric Dump Valves (ADVs)

BASES

BACKGROUND The ADVs provide a method for cooling the unit to residual heat removal 

(RHR) entry conditions should the preferred heat sink via the Steam 

Bypass System to the condenser not be available, as discussed in the 

FSAR, Section [10.3] (Ref. 1). This is done in conjunction with the 

Auxiliary Feedwater System providing cooling water from the condensate 

storage tank (CST). The ADVs may also be required to meet the design 

cooldown rate during a normal cooldown when steam pressure drops too 

low for maintenance of a vacuum in the condenser to permit use of the 

Steam Dump System.

One ADV line for each of the [four] steam generators is provided. Each 

ADV line consists of one ADV and an associated block valve.

The ADVs are provided with upstream block valves to permit their being 

tested at power, and to provide an alternate means of isolation. The 

ADVs are equipped with pneumatic controllers to permit control of the 

cooldown rate.

The ADVs are usually provided with a pressurized gas supply of bottled 

nitrogen that, on a loss of pressure in the normal instrument air supply, 

automatically supplies nitrogen to operate the ADVs. The nitrogen supply 

is sized to provide the sufficient pressurized gas to operate the ADVs for 

the time required for Reactor Coolant System cooldown to RHR entry 

conditions.

A description of the ADVs is found in Reference 1. The ADVs are 

OPERABLE with only a DC power source available. In addition, 

handwheels are provided for local manual operation.

APPLICABLE The design basis of the ADVs is established by the capability to cool the

SAFETY unit to RHR entry conditions. The design rate of [75]°F per hour is

ANALYSES applicable for two steam generators, each with one ADV. This rate is 

adequate to cool the unit to RHR entry conditions with only one steam 

generator and one ADV, utilizing the cooling water supply available in the 

CST.

In the accident analysis presented in Reference 1, the ADVs are 

assumed to be used by the operator to cool down the unit to RHR entry 

conditions for accidents accompanied by a loss of offsite power. Prior to 

operator actions to cool down the unit, the ADVs and main steam safety 

valves (MSSVs) are assumed to operate automatically to relieve steam 

and maintain the steam generator pressure below the design value. For 

the recovery from a steam generator tube rupture (SGTR) event, the
ADVs

B 3.7.4

Westinghouse STS B 3.7.4-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

operator is also required to perform a limited cooldown to establish 

adequate subcooling as a necessary step to terminate the primary to 

secondary break flow into the ruptured steam generator. The time 

required to terminate the primary to secondary break flow for an SGTR is 

more critical than the time required to cool down to RHR conditions for 

this event and also for other accidents. Thus, the SGTR is the limiting 

event for the ADVs. The number of ADVs required to be OPERABLE to 

satisfy the SGTR accident analysis requirements depends upon the 

number of unit loops and consideration of any single failure assumptions 

regarding the failure of one ADV to open on demand.

The ADVs are equipped with block valves in the event an ADV spuriously 

fails to open or fails to close during use.

The ADVs satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO [Three] ADV lines are required to be OPERABLE. One ADV line is 

required from each of [three] steam generators to ensure that at least one 

ADV line is available to conduct a unit cooldown following an SGTR, in 

which one steam generator becomes unavailable, accompanied by a 

single, active failure of a second ADV line on an unaffected steam 

generator. The block valves must be OPERABLE to isolate a failed open 

ADV line. A closed block valve does not render it or its ADV line 

inoperable if operator action time to open the block valve is supported in 

the accident analysis.

Failure to meet the LCO can result in the inability to cool the unit to RHR 

entry conditions following an event in which the condenser is unavailable 

for use with the Steam Bypass System.

An ADV is considered OPERABLE when it is capable of providing 

controlled relief of the main steam flow and capable of fully opening and 

closing on demand.

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when a steam generator is being 

relied upon for heat removal, the ADVs are required to be OPERABLE.

In MODE 5 or 6, an SGTR is not a credible event.

ACTIONS A.1

With one required ADV line inoperable, action must be taken to restore 

OPERABLE status within 7 days. The 7 day Completion Time allows for 

the redundant capability afforded by the remaining OPERABLE ADV 

lines, a nonsafety grade backup in the Steam Bypass System, and 

MSSVs. 
ADVs

B 3.7.4

Westinghouse STS B 3.7.4-3 Rev. 4.0

BASES 

ACTIONS (continued)

B.1

With two or more ADV lines inoperable, action must be taken to restore 

all but one ADV line to OPERABLE status. Since the block valve can be 

closed to isolate an ADV, some repairs may be possible with the unit at 

power. The 24 hour Completion Time is reasonable to repair inoperable 

ADV lines, based on the availability of the Steam Bypass System and 

MSSVs, and the low probability of an event occurring during this period 

that would require the ADV lines.

C.1 and C.2

If the ADV lines cannot be restored to OPERABLE status within the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours, and in MODE 4, without reliance upon 

steam generator for heat removal, within [24] hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems.

SURVEILLANCE SR 3.7.4.1

REQUIREMENTS

To perform a controlled cooldown of the RCS, the ADVs must be able to 

be opened either remotely or locally and throttled through their full range. 

This SR ensures that the ADVs are tested through a full control cycle at 

least once per fuel cycle. Performance of inservice testing or use of an 

ADV during a unit cooldown may satisfy this requirement. [ Operating 

experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. The 

Frequency is acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
ADVs

B 3.7.4

Westinghouse STS B 3.7.4-4 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.7.4.2

The function of the block valve is to isolate a failed open ADV. Cycling 

the block valve both closed and open demonstrates its capability to 

perform this function. Performance of inservice testing or use of the block 

valve during unit cooldown may satisfy this requirement. [ Operating

experience has shown that these components usually pass the 

Surveillance when performed at the [18] month Frequency. The 

Frequency is acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

REFERENCES 1. FSAR, Section [10.3].
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.5 Auxiliary Feedwater (AFW) System

BASES

BACKGROUND The AFW System automatically supplies feedwater to the steam 

generators to remove decay heat from the Reactor Coolant System upon 

the loss of normal feedwater supply. The AFW pumps take suction 

through separate and independent suction lines from the condensate 

storage tank (CST) (LCO 3.7.6, "Condensate Storage Tank (CST)") and 

pump to the steam generator secondary side via separate and 

independent connections to the main feedwater (MFW) piping outside 

containment. The steam generators function as a heat sink for core 

decay heat. The heat load is dissipated by releasing steam to the 

atmosphere from the steam generators via the main steam safety valves 

(MSSVs) (LCO 3.7.1, "Main Steam Safety Valves (MSSVs)") or 

atmospheric dump valves (LCO 3.7.4, "Atmospheric Dump Valves 

(ADVs)"). If the main condenser is available, steam may be released via 

the steam bypass valves and recirculated to the CST.

The AFW System consists of [two] motor driven AFW pumps and one 

steam turbine driven pump configured into [three] trains. Each motor 

driven pump provides [100]% of AFW flow capacity, and the turbine 

driven pump provides [200]% of the required capacity to the steam 

generators, as assumed in the accident analysis. The pumps are 

equipped with independent recirculation lines to prevent pump operation 

against a closed system. Each motor driven AFW pump is powered from 

an independent Class 1E power supply and feeds [two] steam 

generators, although each pump has the capability to be realigned from 

the control room to feed other steam generators. The steam turbine 

driven AFW pump receives steam from two main steam lines upstream of 

the main steam isolation valves. Each of the steam feed lines will supply 

100% of the requirements of the turbine driven AFW pump.

The AFW System is capable of supplying feedwater to the steam 

generators during normal unit startup, shutdown, and hot standby 

conditions.

The turbine driven AFW pump supplies a common header capable of 

feeding all steam generators with DC powered control valves actuated to 

the appropriate steam generator by the Engineered Safety Feature 

Actuation System (ESFAS). One pump at full flow is sufficient to remove 

decay heat and cool the unit to residual heat removal (RHR) entry 

conditions. Thus, the requirement for diversity in motive power sources 

for the AFW System is met.
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-2 Rev. 4.0

BASES

BACKGROUND (continued)

The AFW System is designed to supply sufficient water to the steam 

generator(s) to remove decay heat with steam generator pressure at the 

setpoint of the MSSVs. Subsequently, the AFW System supplies 

sufficient water to cool the unit to RHR entry conditions, with steam 

released through the ADVs.

The AFW System actuates automatically on steam generator water level -

low-low by the ESFAS (LCO 3.3.2, "Engineered Safety Feature Actuation 

System (ESFAS) Instrumentation"). The system also actuates on loss of 

offsite power, safety injection, and trip of all MFW pumps.

The AFW System is discussed in the FSAR, Section [10.4.9] (Ref. 1).

APPLICABLE The AFW System mitigates the consequences of any event with loss of

SAFETY normal feedwater.

ANALYSES

The design basis of the AFW System is to supply water to the steam 

generator to remove decay heat and other residual heat by delivering at 

least the minimum required flow rate to the steam generators at 

pressures corresponding to the lowest steam generator safety valve set 

pressure plus 3%.

In addition, the AFW System must supply enough makeup water to 

replace steam generator secondary inventory lost as the unit cools to 

MODE 4 conditions. Sufficient AFW flow must also be available to 

account for flow losses such as pump recirculation and line breaks.

The limiting Design Basis Accidents (DBAs) and transients for the AFW 

System are as follows:

a. Feedwater Line Break (FWLB) and

b. Loss of MFW.

In addition, the minimum available AFW flow and system characteristics 

are serious considerations in the analysis of a small break loss of coolant 

accident (LOCA).

The AFW System design is such that it can perform its function following 

an FWLB between the MFW isolation valves and containment, combined 

with a loss of offsite power following turbine trip, and a single active 

failure of the steam turbine driven AFW pump. In such a case, the 
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

ESFAS logic may not detect the affected steam generator if the backflow 

check valve to the affected MFW header worked properly. One motor 

driven AFW pump would deliver to the broken MFW header at the pump 

runout flow until the problem was detected, and flow terminated by the 

operator. Sufficient flow would be delivered to the intact steam generator 

by the redundant AFW pump.

The ESFAS automatically actuates the AFW turbine driven pump and 

associated power operated valves and controls when required to ensure 

an adequate feedwater supply to the steam generators during loss of 

power. DC power operated valves are provided for each AFW line to 

control the AFW flow to each steam generator.

The AFW System satisfies the requirements of Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO This LCO provides assurance that the AFW System will perform its 

design safety function to mitigate the consequences of accidents that 

could result in overpressurization of the reactor coolant pressure 

boundary. [Three] independent AFW pumps in [three] diverse trains are 

required to be OPERABLE to ensure the availability of RHR capability for 

all events accompanied by a loss of offsite power and a single failure. 

This is accomplished by powering two of the pumps from independent 

emergency buses. The third AFW pump is powered by a different means, 

a steam driven turbine supplied with steam from a source that is not 

isolated by closure of the MSIVs.

The AFW System is configured into [three] trains. The AFW System is 

considered OPERABLE when the components and flow paths required to 

provide redundant AFW flow to the steam generators are OPERABLE. 

This requires that the two motor driven AFW pumps be OPERABLE in 

[two] diverse paths, each supplying AFW to separate steam generators. 

The turbine driven AFW pump is required to be OPERABLE with 

redundant steam supplies from each of [two] main steam lines upstream 

of the MSIVs, and shall be capable of supplying AFW to any of the steam 

generators. The piping, valves, instrumentation, and controls in the 

required flow paths also are required to be OPERABLE.

The LCO is modified by a Note indicating that one AFW train, which 

includes a motor driven pump, is required to be OPERABLE in MODE 4. 

This is because of the reduced heat removal requirements and short 

period of time in MODE 4 during which the AFW is required and the 

insufficient steam available in MODE 4 to power the turbine driven AFW 

pump.
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-4 Rev. 4.0

BASES 

APPLICABILITY In MODES 1, 2, and 3, the AFW System is required to be OPERABLE in 

the event that it is called upon to function when the MFW is lost. In 

addition, the AFW System is required to supply enough makeup water to 

replace the steam generator secondary inventory, lost as the unit cools to 

MODE 4 conditions.

In MODE 4 the AFW System may be used for heat removal via the steam 

generators.

In MODE 5 or 6, the steam generators are not normally used for heat 

removal, and the AFW System is not required.

ACTIONS -----------------------------------REVIEWER’S NOTE-----------------------------------

The LCO 3.0.4.b Note prohibits application of the LCO 3.0.4.b exception 

when entering MODE 1 if the plant does not depend on AFW for startup. 

If the plant does depend on AFW for startup, the Note should state, 

“LCO 3.0.4.b is not applicable.”

--------------------------------------------------------------------------------------------------

A Note prohibits the application of LCO 3.0.4.b to an inoperable AFW 

train [when entering MODE 1]. There is an increased risk associated with 

[entering a MODE or other specified condition in the Applicability] 

[entering MODE 1] with an AFW train inoperable and the provisions of 

LCO 3.0.4.b, which allow entry into a MODE or other specified condition 

in the Applicability with the LCO not met after performance of a risk 

assessment addressing inoperable systems and components, should not 

be applied in this circumstance.

[ A.1

If the turbine driven AFW train is inoperable due to one inoperable steam 

supply, or if a turbine driven pump is inoperable for any reason while in 

MODE 3 immediately following refueling, action must be taken to restore 

the inoperable equipment to an OPERABLE status within 7 days. The 

7 day Completion Time is reasonable, based on the following reasons:

a. For the inoperability of the turbine driven AFW pump due to one 

inoperable steam supply, the 7 day Completion Time is reasonable 

since there is a redundant steam supply line for the turbine driven 

pump and the turbine driven train is still capable of performing its 

specified function for most postulated events.

b. For the inoperability of a turbine driven AFW pump while in MODE 3 

immediately subsequent to a refueling, the 7 day Completion Time is 

reasonable due to the minimal decay heat levels in this situation.
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-5 Rev. 4.0

BASES

ACTIONS (continued)

c. For both the inoperability of the turbine driven pump due to one 

inoperable steam supply and an inoperable turbine driven AFW pump 

while in MODE 3 immediately following a refueling outage, the 7 day 

Completion Time is reasonable due to the availability of redundant 

OPERABLE motor driven AFW pumps, and due to the low probability 

of an event requiring the use of the turbine driven AFW pump.

Condition A is modified by a Note which limits the applicability of the 

Condition for an inoperable turbine driven AFW pump in MODE 3 to when 

the unit has not entered MODE 2 following a refueling. Condition A 

allows one AFW train to be inoperable for 7 days vice the 72 hour 

Completion Time in Condition B. This longer Completion Time is based 

on the reduced decay heat following refueling and prior to the reactor 

being critical. ]

B.1

With one of the required AFW trains (pump or flow path) inoperable in 

MODE 1, 2, or 3 [for reasons other than Condition A], action must be 

taken to restore OPERABLE status within 72 hours. This Condition 

includes the loss of two steam supply lines to the turbine driven AFW 

pump. The 72 hour Completion Time is reasonable, based on the 

redundant capabilities afforded by the AFW System, the time needed for 

repairs, and the low probability of a DBA occurring during this time period.

C.1 and C.2

With one of the required motor driven AFW trains (pump or flow path) 

inoperable and the turbine driven AFW train inoperable due to one 

inoperable steam supply, action must be taken to restore the affected 

equipment to OPERABLE status within [24] [48] hours. Assuming no 

single active failures when in this condition, the accident (a feedline break 

(FLB) or main steam line break (MSLB) could result in the loss of the 

remaining steam supply to the turbine driven AFW pump due to the 

faulted steam generator (SG). In this condition, the AFW System may no 

longer be able to meet the required flow to the SGs assumed in the safety 

analysis, [either due to the analysis requiring flow from two AFW pumps 

or due to the remaining AFW pump having to feed a faulted SG].
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-6 Rev. 4.0

BASES

ACTIONS (continued)

------------------------------------REVIEWER’S NOTE----------------------------------

Licensees should adopt the appropriate Completion Time based on their 

plant design. The 24 hour Completion Time is applicable to plants that 

can no longer meet the safety analysis requirement of 100% AFW flow to 

the SG(s) assuming no single active failure and a FLB or MSLB resulting 

in the loss of the remaining steam supply to the turbine driven AFW 

pump. The 48 hour Completion Time is applicable to plants that can still 

meet the safety analysis requirement of 100% AFW flow to the SG(s) 

assuming no single active failure and a FLB or MSLB resulting in the loss 

of the remaining steam supply to the turbine driven AFW pump.

--------------------------------------------------------------------------------------------------

[ The 24 hour Completion Time is reasonable based on the remaining 

OPERABLE steam supply to the turbine driven AFW pump, the 

availability of the remaining OPERABLE motor driven AFW pump, and 

the low probability of an event occurring that would require the inoperable 

steam supply to be available for the turbine driven AFW pump. ]

[ The 48 hour Completion Time is reasonable based on the fact that the 

remaining motor driven AFW train is capable of providing 100% of the 

AFW flow requirements, and the low probability of an event occurring that 

would challenge the AFW system. ]

D.1 and D.2

When Required Action A.1 [B.1, C.1, or C.2] cannot be completed within 

the required Completion Time, or if two AFW trains are inoperable in 

MODE 1, 2, or 3 for reasons other than Condition C, the unit must be 

placed in a MODE in which the LCO does not apply. To achieve this 

status, the unit must be placed in at least MODE 3 within 6 hours, and in 

MODE 4 within [18] hours.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

In MODE 4 with two AFW trains inoperable, operation is allowed to 

continue because only one motor driven pump AFW train is required in 

accordance with the Note that modifies the LCO. Although not required, 

the unit may continue to cool down and initiate RHR.
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-7 Rev. 4.0

BASES

ACTIONS (continued)

E.1

If all [three] AFW trains are inoperable in MODE 1, 2, or 3, the unit is in a 

seriously degraded condition with no safety related means for conducting 

a cooldown, and only limited means for conducting a cooldown with 

nonsafety related equipment. In such a condition, the unit should not be 

perturbed by any action, including a power change, that might result in a 

trip. The seriousness of this condition requires that action be started 

immediately to restore one AFW train to OPERABLE status.

Required Action E.1 is modified by a Note indicating that all required 

MODE changes are suspended until one AFW train is restored to 

OPERABLE status. In this case, LCO 3.0.3 is not applicable because it 

could force the unit into a less safe condition.

F.1

In MODE 4, either the reactor coolant pumps or the RHR loops can be 

used to provide forced circulation. This is addressed in LCO 3.4.6, "RCS 

Loops - MODE 4." With one required AFW train inoperable, action must 

be taken to immediately restore the inoperable train to OPERABLE 

status. The immediate Completion Time is consistent with LCO 3.4.6.

SURVEILLANCE SR 3.7.5.1

REQUIREMENTS

Verifying the correct alignment for manual, power operated, and 

automatic valves in the AFW System water and steam supply flow paths 

provides assurance that the proper flow paths will exist for AFW 

operation. This SR does not apply to valves that are locked, sealed, or 

otherwise secured in position, since they are verified to be in the correct 

position prior to locking, sealing, or securing. This SR also does not 

apply to valves that cannot be inadvertently misaligned, such as check 

valves. This Surveillance does not require any testing or valve 

manipulation; rather, it involves verification that those valves capable of 

being mispositioned are in the correct position.

[ The SR is modified by a Note that states one or more AFW trains may be 

considered OPERABLE during alignment and operation for steam 

generator level control, if it is capable of being manually (i.e., remotely or 

locally, as appropriate) realigned to the AFW mode of operation, provided 

it is not otherwise inoperable. This exception allows the system to be out 

of its normal standby alignment and temporarily incapable of automatic 

initiation without declaring the train(s) inoperable. Since AFW may be
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

used during startup, shutdown, hot standby operations, and hot shutdown 

operations for steam generator level control, and these manual 

operations are an accepted function of the AFW System, OPERABILITY 

(i.e., the intended safety function) continues to be maintained. ]

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.5.2

Verifying that each AFW pump's developed head at the flow test point is 

greater than or equal to the required developed head ensures that AFW 

pump performance has not degraded during the cycle. Flow and 

differential head are normal tests of centrifugal pump performance 

required by the ASME Code (Ref 2). Because it is undesirable to 

introduce cold AFW into the steam generators while they are operating, 

this testing is performed on recirculation flow. This test confirms one 

point on the pump design curve and is indicative of overall performance. 

Such inservice tests confirm component OPERABILITY, trend 

performance, and detect incipient failures by indicating abnormal 

performance. Performance of inservice testing discussed in the ASME 

Code (Ref. 2) (only required at 3 month intervals) satisfies this 

requirement.

[ This SR is modified by a Note indicating that the SR should be deferred 

until suitable test conditions are established. This deferral is required 

because there is insufficient steam pressure to perform the test. ]
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.5.3

This SR verifies that AFW can be delivered to the appropriate steam 

generator in the event of any accident or transient that generates an 

ESFAS, by demonstrating that each automatic valve in the flow path 

actuates to its correct position on an actual or simulated actuation signal. 

This Surveillance is not required for valves that are locked, sealed, or 

otherwise secured in the required position under administrative controls. 

[ The [18] month Frequency is based on the need to perform this 

Surveillance under the conditions that apply during a unit outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. The [18] month Frequency is acceptable based 

on operating experience and the design reliability of the equipment.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ The SR is modified by a Note that states one or more AFW trains may be 

considered OPERABLE during alignment and operation for steam 

generator level control, if it is capable of being manually (i.e., remotely or 

locally, as appropriate) realigned to the AFW mode of operation, provided 

it is not otherwise inoperable. This exception allows the system to be out 

of its normal standby alignment and temporarily incapable of automatic 

initiation without declaring the train(s) inoperable. Since AFW may be 

used during startup, shutdown, hot standby operations, and hot shutdown 

operations for steam generator level control, and these manual 

operations are an accepted function of the AFW System, OPERABILITY 

(i.e., the intended safety function) continues to be maintained. ]
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.5.4

This SR verifies that the AFW pumps will start in the event of any 

accident or transient that generates an ESFAS by demonstrating that 

each AFW pump starts automatically on an actual or simulated actuation 

signal in MODES 1, 2, and 3. In MODE 4, the required pump is already 

operating and the autostart function is not required. [ The [18] month 

Frequency is based on the need to perform this Surveillance under the 

conditions that apply during a unit outage and the potential for an 

unplanned transient if the Surveillance were performed with the reactor at 

power.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by [a] [two] Note[s]. [Note 1 indicates that the SR be 

deferred until suitable test conditions are established. This deferral is 

required because there is insufficient steam pressure to perform the test.] 

[The Note [2] states that one or more AFW trains may be considered 

OPERABLE during alignment and operation for steam generator level 

control, if it is capable of being manually (i.e., remotely or locally, as 

appropriate) realigned to the AFW mode of operation, provided it is not 

otherwise inoperable. This exception allows the system to be out of its 

normal standby alignment and temporarily incapable of automatic 

initiation without declaring the train(s) inoperable. Since AFW may be 

used during startup, shutdown, hot standby operations, and hot shutdown 

operations for steam generator level control, and these manual 

operations are an accepted function of the AFW System. OPERABILITY 

(i.e., the intended safety function) continues to be maintained. ]
AFW System

B 3.7.5

Westinghouse STS B 3.7.5-11 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.7.5.5

This SR verifies that the AFW is properly aligned by verifying the flow 

paths from the CST to each steam generator prior to entering MODE 2 

after more than 30 days in any combination of MODE 5 or 6 or defueled. 

OPERABILITY of AFW flow paths must be verified before sufficient core 

heat is generated that would require the operation of the AFW System 

during a subsequent shutdown. The Frequency is reasonable, based on 

engineering judgement and other administrative controls that ensure that 

flow paths remain OPERABLE. To further ensure AFW System 

alignment, flow path OPERABILITY is verified following extended outages 

to determine no misalignment of valves has occurred. This SR ensures 

that the flow path from the CST to the steam generators is properly 

aligned. ]

-----------------------------------REVIEWER’S NOTE-----------------------------------

This SR is not required by those units that use AFW for normal startup 

and shutdown.

--------------------------------------------------------------------------------------------------

REFERENCES 1. FSAR, Section [10.4.9].

2. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

CST

B 3.7.6

Westinghouse STS B 3.7.6-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.6 Condensate Storage Tank (CST)

BASES

BACKGROUND The CST provides a safety grade source of water to the steam generators 

for removing decay and sensible heat from the Reactor Coolant System 

(RCS). The CST provides a passive flow of water, by gravity, to the 

Auxiliary Feedwater (AFW) System (LCO 3.7.5). The steam produced is 

released to the atmosphere by the main steam safety valves or the 

atmospheric dump valves. The AFW pumps operate with a continuous 

recirculation to the CST.

When the main steam isolation valves are open, the preferred means of 

heat removal is to discharge steam to the condenser by the nonsafety 

grade path of the steam bypass valves. The condensed steam is returned 

to the CST by the condensate transfer pump. This has the advantage of 

conserving condensate while minimizing releases to the environment.

Because the CST is a principal component in removing residual heat from 

the RCS, it is designed to withstand earthquakes and other natural 

phenomena, including missiles that might be generated by natural 

phenomena. The CST is designed to Seismic Category I to ensure 

availability of the feedwater supply. Feedwater is also available from 

alternate sources.

A description of the CST is found in the FSAR, Section [9.2.6] (Ref. 1).

APPLICABLE The CST provides cooling water to remove decay heat and to cool down

SAFETY the unit following all events in the accident analysis as discussed in the

ANALYSES FSAR, Chapters [6] and [15] (Refs. 2 and 3, respectively). For 

anticipated operational occurrences and accidents that do not affect the 

OPERABILITY of the steam generators, the analysis assumption is 

generally 30 minutes at MODE 3, steaming through the MSSVs, followed 

by a cooldown to residual heat removal (RHR) entry conditions at the 

design cooldown rate.

The limiting event for the condensate volume is the large feedwater line 

break coincident with a loss of offsite power. Single failures that also 

affect this event include the following:

a. Failure of the diesel generator powering the motor driven AFW pump 

to the unaffected steam generator (requiring additional steam to drive 

the remaining AFW pump turbine) and

b. Failure of the steam driven AFW pump (requiring a longer time for 

cooldown using only one motor driven AFW pump).
CST

B 3.7.6

Westinghouse STS B 3.7.6-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

These are not usually the limiting failures in terms of consequences for 

these events.

A nonlimiting event considered in CST inventory determinations is a 

break in either the main feedwater or AFW line near where the two join. 

This break has the potential for dumping condensate until terminated by 

operator action, since the Emergency Feedwater Actuation System would 

not detect a difference in pressure between the steam generators for this 

break location. This loss of condensate inventory is partially 

compensated for by the retention of steam generator inventory.

The CST satisfies Criteria 2 and 3 of 10 CFR 50.36(c)(2)(ii).

LCO To satisfy accident analysis assumptions, the CST must contain sufficient 

cooling water to remove decay heat for [30 minutes] following a reactor 

trip from 102% RTP, and then to cool down the RCS to RHR entry 

conditions, assuming a coincident loss of offsite power and the most 

adverse single failure. In doing this, it must retain sufficient water to 

ensure adequate net positive suction head for the AFW pumps during 

cooldown, as well as account for any losses from the steam driven AFW 

pump turbine, or before isolating AFW to a broken line.

The CST level required is equivalent to a usable volume of 

≥ [110,000 gallons], which is based on holding the unit in MODE 3 for 

[2] hours, followed by a cooldown to RHR entry conditions at [75]°F/hour. 

This basis is established in Reference 4 and exceeds the volume required 

by the accident analysis.

The OPERABILITY of the CST is determined by maintaining the tank 

level at or above the minimum required level.

APPLICABILITY In MODES 1, 2, and 3, and in MODE 4, when steam generator is being 

relied upon for heat removal, the CST is required to be OPERABLE.

In MODE 5 or 6, the CST is not required because the AFW System is not 

required.

ACTIONS A.1 and A.2

If the CST is not OPERABLE, the OPERABILITY of the backup supply 

should be verified by administrative means within 4 hours and once every 

12 hours thereafter. OPERABILITY of the backup feedwater supply must 

include verification that the flow paths from the backup water supply to 

the AFW pumps are OPERABLE, and that the backup supply has the 

required volume of water available. The CST must be restored to 

OPERABLE status within 7 days, because the backup supply may be
CST

B 3.7.6

Westinghouse STS B 3.7.6-3 Rev. 4.0

BASES 

ACTIONS (continued)

performing this function in addition to its normal functions. The 4 hour 

Completion Time is reasonable, based on operating experience, to verify 

the OPERABILITY of the backup water supply. Additionally, verifying the 

backup water supply every 12 hours is adequate to ensure the backup 

water supply continues to be available. The 7 day Completion Time is 

reasonable, based on an OPERABLE backup water supply being 

available, and the low probability of an event occurring during this time 

period requiring the CST.

B.1 and B.2

If the CST cannot be restored to OPERABLE status within the associated 

Completion Time, the unit must be placed in a MODE in which the LCO 

does not apply. To achieve this status, the unit must be placed in at least 

MODE 3 within 6 hours, and in MODE 4, without reliance on the steam 

generator for heat removal, within [24] hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required unit conditions from full power conditions in an orderly manner 

and without challenging unit systems.

SURVEILLANCE SR 3.7.6.1

REQUIREMENTS

This SR verifies that the CST contains the required volume of cooling 

water. (The required CST volume may be single value or a function of 

RCS conditions.) [ The 12 hour Frequency is based on operating 

experience and the need for operator awareness of unit evolutions that 

may affect the CST inventory between checks. Also, the 12 hour 

Frequency is considered adequate in view of other indications in the

control room, including alarms, to alert the operator to abnormal 

deviations in the CST level.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
CST

B 3.7.6

Westinghouse STS B 3.7.6-4 Rev. 4.0

BASES

REFERENCES 1. FSAR, Section [9.2.6].

2. FSAR, Chapter [6].

3. FSAR, Chapter [15].
CCW System

B 3.7.7

Westinghouse STS B 3.7.7-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.7 Component Cooling Water (CCW) System

BASES

BACKGROUND The CCW System provides a heat sink for the removal of process and 

operating heat from safety related components during a Design Basis 

Accident (DBA) or transient. During normal operation, the CCW System 

also provides this function for various nonessential components, as well 

as the spent fuel storage pool. The CCW System serves as a barrier to 

the release of radioactive byproducts between potentially radioactive 

systems and the Service Water System, and thus to the environment.

A typical CCW System is arranged as two independent, full capacity 

cooling loops, and has isolatable nonsafety related components. Each 

safety related train includes a full capacity pump, surge tank, heat 

exchanger, piping, valves, and instrumentation. Each safety related train 

is powered from a separate bus. An open surge tank in the system 

provides pump trip protective functions to ensure that sufficient net 

positive suction head is available. The pump in each train is 

automatically started on receipt of a safety injection signal, and all 

nonessential components are isolated.

Additional information on the design and operation of the system, along

with a list of the components served, is presented in the FSAR, 

Section [9.2.2] (Ref. 1). The principal safety related function of the CCW 

System is the removal of decay heat from the reactor via the Residual 

Heat Removal (RHR) System. This may be during a normal or post 

accident cooldown and shutdown.

APPLICABLE The design basis of the CCW System is for one CCW train to remove the

SAFETY post loss of coolant accident (LOCA) heat load from the containment

ANALYSES sump during the recirculation phase, with a maximum CCW temperature 

of [120]°F (Ref. 2). The Emergency Core Cooling System (ECCS) LOCA 

and containment OPERABILITY LOCA each model the maximum and 

minimum performance of the CCW System, respectively. The normal 

temperature of the CCW is [80]°F, and, during unit cooldown to MODE 5 

(Tcold < [200]°F), a maximum temperature of 95°F is assumed. This 

prevents the containment sump fluid from increasing in temperature 

during the recirculation phase following a LOCA, and provides a gradual 

reduction in the temperature of this fluid as it is supplied to the Reactor 

Coolant System (RCS) by the ECCS pumps.

The CCW System is designed to perform its function with a single failure 

of any active component, assuming a loss of offsite power.
CCW System

B 3.7.7

Westinghouse STS B 3.7.7-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

The CCW System also functions to cool the unit from RHR entry 

conditions (Tcold < [350]°F), to MODE 5 (Tcold < [200]°F), during normal 

and post accident operations. The time required to cool from [350]°F to 

[200]°F is a function of the number of CCW and RHR trains operating. 

One CCW train is sufficient to remove decay heat during subsequent 

operations with Tcold < [200]°F. This assumes a maximum service water 

temperature of [95]°F occurring simultaneously with the maximum heat 

loads on the system.

The CCW System satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The CCW trains are independent of each other to the degree that each 

has separate controls and power supplies and the operation of one does 

not depend on the other. In the event of a DBA, one CCW train is 

required to provide the minimum heat removal capability assumed in the 

safety analysis for the systems to which it supplies cooling water. To 

ensure this requirement is met, two trains of CCW must be OPERABLE. 

At least one CCW train will operate assuming the worst case single active 

failure occurs coincident with a loss of offsite power.

A CCW train is considered OPERABLE when:

a. The pump and associated surge tank are OPERABLE and

b. The associated piping, valves, heat exchanger, and instrumentation 

and controls required to perform the safety related function are 

OPERABLE.

The isolation of CCW from other components or systems not required for 

safety may render those components or systems inoperable but does not 

affect the OPERABILITY of the CCW System.

APPLICABILITY In MODES 1, 2, 3, and 4, the CCW System is a normally operating 

system, which must be prepared to perform its post accident safety 

functions, primarily RCS heat removal, which is achieved by cooling the 

RHR heat exchanger.

In MODE 5 or 6, the OPERABILITY requirements of the CCW System are 

determined by the systems it supports.
CCW System

B 3.7.7

Westinghouse STS B 3.7.7-3 Rev. 4.0

BASES

ACTIONS A.1

Required Action A.1 is modified by a Note indicating that the applicable 

Conditions and Required Actions of LCO 3.4.6, "RCS Loops - MODE 4," 

be entered if an inoperable CCW train results in an inoperable RHR loop. 

This is an exception to LCO 3.0.6 and ensures the proper actions are 

taken for these components.

If one CCW train is inoperable, action must be taken to restore 

OPERABLE status within 72 hours. In this Condition, the remaining 

OPERABLE CCW train is adequate to perform the heat removal function. 

The 72 hour Completion Time is reasonable, based on the redundant 

capabilities afforded by the OPERABLE train, and the low probability of a 

DBA occurring during this period.

B.1 and B.2

If the CCW train cannot be restored to OPERABLE status within the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours and in MODE 5 within 36 hours. The 

allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1

REQUIREMENTS

This SR is modified by a Note indicating that the isolation of the CCW 

flow to individual components may render those components inoperable 

but does not affect the OPERABILITY of the CCW System.

Verifying the correct alignment for manual, power operated, and 

automatic valves in the CCW flow path provides assurance that the 

proper flow paths exist for CCW operation. This SR does not apply to 

valves that are locked, sealed, or otherwise secured in position, since 

these valves are verified to be in the correct position prior to locking, 

sealing, or securing. This SR also does not apply to valves that cannot 

be inadvertently misaligned, such as check valves. This Surveillance 

does not require any testing or valve manipulation; rather, it involves 

verification that those valves capable of being mispositioned are in the 

correct position.

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions.
CCW System

B 3.7.7

Westinghouse STS B 3.7.7-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.7.2

This SR verifies proper automatic operation of the CCW valves on an 

actual or simulated actuation signal. The CCW System is a normally 

operating system that cannot be fully actuated as part of routine testing 

during normal operation. This Surveillance is not required for valves that 

are locked, sealed, or otherwise secured in the required position under 

administrative controls. [ The [18] month Frequency is based on the need 

to perform this Surveillance under the conditions that apply during a unit 

outage and the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. Operating experience has 

shown that these components usually pass the Surveillance when 

performed at the [18] month Frequency. Therefore, the Frequency is 

acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
CCW System

B 3.7.7

Westinghouse STS B 3.7.7-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.7.3

This SR verifies proper automatic operation of the CCW pumps on an 

actual or simulated actuation signal. The CCW System is a normally 

operating system that cannot be fully actuated as part of routine testing 

during normal operation. [ The [18] month Frequency is based on the 

need to perform this Surveillance under the conditions that apply during a 

unit outage and the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. Operating experience has 

shown that these components usually pass the Surveillance when 

performed at the [18] month Frequency. Therefore, the Frequency is

acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [9.2.2].

2. FSAR, Section [6.2].

SWS

B 3.7.8

Westinghouse STS B 3.7.8-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.8 Service Water System (SWS)

BASES

BACKGROUND The SWS provides a heat sink for the removal of process and operating 

heat from safety related components during a Design Basis Accident 

(DBA) or transient. During normal operation, and a normal shutdown, the 

SWS also provides this function for various safety related and nonsafety 

related components. The safety related function is covered by this LCO.

The SWS consists of two separate, 100% capacity, safety related, cooling 

water trains. Each train consists of two 100% capacity pumps, one 

component cooling water (CCW) heat exchanger, piping, valving, 

instrumentation, and two cyclone separators. The pumps and valves are 

remote and manually aligned, except in the unlikely event of a loss of 

coolant accident (LOCA). The pumps aligned to the critical loops are 

automatically started upon receipt of a safety injection signal, and all 

essential valves are aligned to their post accident positions. The SWS 

also provides emergency makeup to the spent fuel pool and CCW 

System [and is the backup water supply to the Auxiliary Feedwater 

System].

Additional information about the design and operation of the SWS, along 

with a list of the components served, is presented in the FSAR, 

Section [9.2.1] (Ref. 1). The principal safety related function of the SWS 

is the removal of decay heat from the reactor via the CCW System.

APPLICABLE The design basis of the SWS is for one SWS train, in conjunction with the

SAFETY CCW System and a 100% capacity containment cooling system, to

ANALYSES remove core decay heat following a design basis LOCA as discussed in 

the FSAR, Section [6.2] (Ref. 2). This prevents the containment sump 

fluid from increasing in temperature during the recirculation phase 

following a LOCA and provides for a gradual reduction in the temperature 

of this fluid as it is supplied to the Reactor Coolant System by the ECCS 

pumps. The SWS is designed to perform its function with a single failure 

of any active component, assuming the loss of offsite power.

The SWS, in conjunction with the CCW System, also cools the unit from 

residual heat removal (RHR), as discussed in the FSAR, Section [5.4.7], 

(Ref. 3) entry conditions to MODE 5 during normal and post accident 

operations. The time required for this evolution is a function of the 

number of CCW and RHR System trains that are operating. One SWS 

train is sufficient to remove decay heat during subsequent operations in 

MODES 5 and 6. This assumes a maximum SWS temperature of [95]°F 

occurring simultaneously with maximum heat loads on the system.

The SWS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).
SWS

B 3.7.8

Westinghouse STS B 3.7.8-2 Rev. 4.0

BASES

LCO Two SWS trains are required to be OPERABLE to provide the required 

redundancy to ensure that the system functions to remove post accident 

heat loads, assuming that the worst case single active failure occurs 

coincident with the loss of offsite power.

An SWS train is considered OPERABLE during MODES 1, 2, 3, and 4 

when:

a. The pump is OPERABLE and

b. The associated piping, valves, heat exchanger, and instrumentation 

and controls required to perform the safety related function are 

OPERABLE.

APPLICABILITY In MODES 1, 2, 3, and 4, the SWS is a normally operating system that is 

required to support the OPERABILITY of the equipment serviced by the 

SWS and required to be OPERABLE in these MODES.

In MODES 5 and 6, the OPERABILITY requirements of the SWS are 

determined by the systems it supports.

ACTIONS A.1

If one SWS train is inoperable, action must be taken to restore 

OPERABLE status within 72 hours. In this Condition, the remaining 

OPERABLE SWS train is adequate to perform the heat removal function. 

However, the overall reliability is reduced because a single failure in the 

OPERABLE SWS train could result in loss of SWS function. Required 

Action A.1 is modified by two Notes. The first Note indicates that the 

applicable Conditions and Required Actions of LCO 3.8.1, "AC Sources -

Operating," should be entered if an inoperable SWS train results in an 

inoperable emergency diesel generator. The second Note indicates that 

the applicable Conditions and Required Actions of LCO 3.4.6, "RCS 

Loops - MODE 4," should be entered if an inoperable SWS train results in 

an inoperable decay heat removal train. This is an exception to 

LCO 3.0.6 and ensures the proper actions are taken for these 

components. The 72 hour Completion Time is based on the redundant 

capabilities afforded by the OPERABLE train, and the low probability of a 

DBA occurring during this time period.

B.1 and B.2

If the SWS train cannot be restored to OPERABLE status within the 

associated Completion Time, the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in at least MODE 3 within 6 hours and in MODE 5 within 36 hours.
SWS

B 3.7.8

Westinghouse STS B 3.7.8-3 Rev. 4.0

BASES

ACTIONS (continued)

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.8.1

REQUIREMENTS

This SR is modified by a Note indicating that the isolation of the SWS 

components or systems may render those components inoperable, but 

does not affect the OPERABILITY of the SWS.

Verifying the correct alignment for manual, power operated, and 

automatic valves in the SWS flow path provides assurance that the 

proper flow paths exist for SWS operation. This SR does not apply to 

valves that are locked, sealed, or otherwise secured in position, since 

they are verified to be in the correct position prior to being locked, sealed, 

or secured. This SR does not require any testing or valve manipulation; 

rather, it involves verification that those valves capable of being 

mispositioned are in the correct position. This SR does not apply to 

valves that cannot be inadvertently misaligned, such as check valves.

[ The 31 day Frequency is based on engineering judgment, is consistent 

with the procedural controls governing valve operation, and ensures 

correct valve positions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.8.2

This SR verifies proper automatic operation of the SWS valves on an 

actual or simulated actuation signal. The SWS is a normally operating 

system that cannot be fully actuated as part of normal testing. This 

Surveillance is not required for valves that are locked, sealed, or 

otherwise secured in the required position under administrative controls. 

[ The [18] month Frequency is based on the need to perform this
SWS

B 3.7.8

Westinghouse STS B 3.7.8-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Surveillance under the conditions that apply during a unit outage and the 

potential for an unplanned transient if the Surveillance were performed 

with the reactor at power. Operating experience has shown that these 

components usually pass the Surveillance when performed at the 

[18] month Frequency. Therefore, the Frequency is acceptable from a 

reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.8.3

This SR verifies proper automatic operation of the SWS pumps on an 

actual or simulated actuation signal. The SWS is a normally operating 

system that cannot be fully actuated as part of normal testing during 

normal operation. [ The [18] month Frequency is based on the need to 

perform this Surveillance under the conditions that apply during a unit 

outage and the potential for an unplanned transient if the Surveillance 

were performed with the reactor at power. Operating experience has 

shown that these components usually pass the Surveillance when 

performed at the [18] month Frequency. Therefore, the Frequency is 

acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
SWS

B 3.7.8

Westinghouse STS B 3.7.8-5 Rev. 4.0

BASES

REFERENCES 1. FSAR, Section [9.2.1].

2. FSAR, Section [6.2].

3. FSAR, Section [5.4.7].

UHS

B 3.7.9

Westinghouse STS B 3.7.9-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.9 Ultimate Heat Sink (UHS)

BASES

BACKGROUND The UHS provides a heat sink for processing and operating heat from 

safety related components during a transient or accident, as well as 

during normal operation. This is done by utilizing the Service Water 

System (SWS) and the Component Cooling Water (CCW) System.

The UHS has been defined as that complex of water sources, including 

necessary retaining structures (e.g., a pond with its dam, or a river with its 

dam), and the canals or conduits connecting the sources with, but not 

including, the cooling water system intake structures as discussed in the 

FSAR, Section [9.2.5] (Ref. 1). If cooling towers or portions thereof are 

required to accomplish the UHS safety functions, they should meet the 

same requirements as the sink. The two principal functions of the UHS 

are the dissipation of residual heat after reactor shutdown, and dissipation 

of residual heat after an accident.

A variety of complexes is used to meet the requirements for a UHS. A 

lake or an ocean may qualify as a single source. If the complex includes 

a water source contained by a structure, it is likely that a second source 

will be required.

The basic performance requirements are that a 30 day supply of water be 

available, and that the design basis temperatures of safety related 

equipment not be exceeded. Basins of cooling towers generally include 

less than a 30 day supply of water, typically 7 days or less. A 30 day 

supply would be dependent on other source(s) and makeup system(s) for 

replenishing the source in the cooling tower basin. For smaller basin 

sources, which may be as small as a 1 day supply, the systems for 

replenishing the basin and the backup source(s) become of sufficient 

importance that the makeup system itself may be required to meet the 

same design criteria as an Engineered Safety Feature (e.g., single failure 

considerations), and multiple makeup water sources may be required.

Additional information on the design and operation of the system, along 

with a list of components served, can be found in Reference 1.

APPLICABLE The UHS is the sink for heat removed from the reactor core following all

SAFETY accidents and anticipated operational occurrences in which the unit is

ANALYSES cooled down and placed on residual heat removal (RHR) operation. For 

units that use UHS as the normal heat sink for condenser cooling via the 

Circulating Water System, unit operation at full power is its maximum heat

load. Its maximum post accident heat load occurs 20 minutes after a 
UHS

B 3.7.9

Westinghouse STS B 3.7.9-2 Rev. 4.0

BASES 

APPLICABLE SAFETY ANALYSES

design basis loss of coolant accident (LOCA). Near this time, the unit 

switches from injection to recirculation and the containment cooling 

systems and RHR are required to remove the core decay heat.

The operating limits are based on conservative heat transfer analyses for 

the worst case LOCA. Reference 1 provides the details of the 

assumptions used in the analysis, which include worst expected 

meteorological conditions, conservative uncertainties when calculating 

decay heat, and worst case single active failure (e.g., single failure of a 

manmade structure). The UHS is designed in accordance with 

Regulatory Guide 1.27 (Ref. 2), which requires a 30 day supply of cooling 

water in the UHS.

The UHS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The UHS is required to be OPERABLE and is considered OPERABLE if it 

contains a sufficient volume of water at or below the maximum 

temperature that would allow the SWS to operate for at least 30 days 

following the design basis LOCA without the loss of net positive suction 

head (NPSH), and without exceeding the maximum design temperature 

of the equipment served by the SWS. To meet this condition, the UHS 

temperature should not exceed [90°F] and the level should not fall below 

[562 ft mean sea level] during normal unit operation.

APPLICABILITY In MODES 1, 2, 3, and 4, the UHS is required to support the 

OPERABILITY of the equipment serviced by the UHS and required to be 

OPERABLE in these MODES.

In MODE 5 or 6, the OPERABILITY requirements of the UHS are 

determined by the systems it supports.

ACTIONS [ A.1

If one or more cooling towers have one fan inoperable (i.e., up to one fan 

per cooling tower inoperable), action must be taken to restore the 

inoperable cooling tower fan(s) to OPERABLE status within 7 days.

The 7 day Completion Time is reasonable based on the low probability of 

an accident occurring during the 7 days that one cooling tower fan is 

inoperable (in one or more cooling towers), the number of available 

systems, and the time required to reasonably complete the Required 

Action. ]
UHS

B 3.7.9

Westinghouse STS B 3.7.9-3 Rev. 4.0

BASES

ACTIONS (continued)

[ B.1

-----------------------------------REVIEWER’S NOTE-----------------------------------

The [ ]°F is the maximum allowed UHS temperature value and is based 

on temperature limitations of the equipment that is relied upon for 

accident mitigation and safe shutdown of the unit.

--------------------------------------------------------------------------------------------------

With water temperature of the UHS > [90]°F, the design basis assumption 

associated with initial UHS temperature are bounded provided the 

temperature of the UHS averaged over the previous 24 hour period is 

≤ [90]°F. With the water temperature of the UHS > [90]°F, long term 

cooling capability of the ECCS loads and DGs may be affected. 

Therefore, to ensure long term cooling capability is provided to the ECCS 

loads when water temperature of the UHS is > [90]°F, Required Action 

B.1 is provided to more frequently monitor the water temperature of the 

UHS and verify the temperature is ≤ [90]°F when averaged over the 

previous 24 hour period. The once per hour Completion Time takes into 

consideration UHS temperature variations and the increased monitoring 

frequency needed to ensure design basis assumptions and equipment 

limitations are not exceeded in this condition. If the water temperature of 

the UHS exceeds [90]°F when averaged over the previous 24 hour period 

or the water temperature of the UHS exceeds [ ]°F, Condition C must be 

entered immediately.]

[ C.1 and C.2

If the Required Actions and Completion Times of Condition [A or B] are 

not met, or the UHS is inoperable for reasons other than Condition A [or 

B], the unit must be placed in a MODE in which the LCO does not apply. 

To achieve this status, the unit must be placed in at least MODE 3 within 

6 hours and in MODE 5 within 36 hours.

The allowed Completion Times are reasonable, based on operating 

experience, to reach the required unit conditions from full power 

conditions in an orderly manner and without challenging unit systems. ]

SURVEILLANCE [ SR 3.7.9.1

REQUIREMENTS

This SR verifies that adequate long term (30 day) cooling can be 

maintained. The specified level also ensures that sufficient NPSH is 

available to operate the SWS pumps. [ The [24] hour Frequency is based 

on operating experience related to trending of the parameter variations 

during the applicable MODES. This SR verifies that the UHS water level 

is ≥ [562] ft [mean sea level].
UHS

B 3.7.9

Westinghouse STS B 3.7.9-4 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

[ SR 3.7.9.2

This SR verifies that the SWS is available to cool the CCW System to at 

least its maximum design temperature with the maximum accident or 

normal design heat loads for 30 days following a Design Basis Accident. 

[ The 24 hour Frequency is based on operating experience related to 

trending of the parameter variations during the applicable MODES. This 

SR verifies that the average water temperature of the UHS is ≤ [90°F].

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

[ SR 3.7.9.3

Operating each cooling tower fan for ≥[15] minutes ensures that all fans 

are OPERABLE and that all associated controls are functioning properly. 

It also ensures that fan or motor failure, or excessive vibration, can be 

detected for corrective action. [ The 31 day Frequency is based on 

operating experience, the known reliability of the fan units, the 

redundancy available, and the low probability of significant degradation of 

the UHS cooling tower fans occurring between surveillances.
UHS

B 3.7.9

Westinghouse STS B 3.7.9-5 Rev. 4.0

BASES 

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

[ SR 3.7.9.4

This SR verifies that each cooling tower fan starts and operates on an 

actual or simulated actuation signal. [ The [18] month Frequency is 

consistent with the typical refueling cycle. Operating experience has 

shown that these components usually pass the Surveillance when 

performed at the [18] month Frequency. Therefore, the Frequency is 

acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

REFERENCES 1. FSAR, Section [9.2.5].

2. Regulatory Guide 1.27.

CREFS

B 3.7.10

Westinghouse STS B 3.7.10-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.10 Control Room Emergency Filtration System (CREFS)

BASES

BACKGROUND The CREFS provides a protected environment from which occupants can 

control the unit following an uncontrolled release of radioactivity, 

hazardous chemicals, or smoke.

The CREFS consists of two independent, redundant trains that recirculate 

and filter the air in the control room envelope (CRE) and a CRE boundary 

that limits the inleakage of unfiltered air. Each CREFS train consists of a 

prefilter or demister, a high efficiency particulate air (HEPA) filter, an 

activated charcoal adsorber section for removal of gaseous activity 

(principally iodines), and a fan. Ductwork, valves or dampers, doors, 

barriers, and instrumentation also form part of the system, as well as 

demisters to remove water droplets from the air stream. A second bank 

of HEPA filters follows the adsorber section to collect carbon fines and 

provides backup in case of failure of the main HEPA filter bank.

The CRE is the area within the confines of the CRE boundary that 

contains the spaces that control room occupants inhabit to control the unit 

during normal and accident conditions. This area encompasses the 

control room, and may encompass other non-critical areas to which 

frequent personnel access or continuous occupancy is not necessary in 

the event of an accident. The CRE is protected during normal operation, 

natural events, and accident conditions. The CRE boundary is the 

combination of walls, floor, roof, ducting, doors, penetrations and 

equipment that physically form the CRE. The OPERABILITY of the CRE 

boundary must be maintained to ensure that the inleakage of unfiltered air 

into the CRE will not exceed the inleakage assumed in the licensing basis 

analysis of design basis accident (DBA) consequences to CRE 

occupants. The CRE and its boundary are defined in the Control Room 

Envelope Habitability Program.

The CREFS is an emergency system, parts of which may also operate 

during normal unit operations in the standby mode of operation. Upon 

receipt of the actuating signal(s), normal air supply to the CRE is isolated, 

and the stream of ventilation air is recirculated through the system filter 

trains. The prefilters or demisters remove any large particles in the air, 

and any entrained water droplets present, to prevent excessive loading of 

the HEPA filters and charcoal adsorbers. Continuous operation of each 

train for at least 10 hours per month, with the heaters on, reduces 

moisture buildup on the HEPA filters and adsorbers. Both the demister 

and heater are important to the effectiveness of the charcoal adsorbers.
CREFS

B 3.7.10

Westinghouse STS B 3.7.10-2 Rev. 4.0

BASES

BACKGROUND (continued)

Actuation of the CREFS places the system in either of two separate 

states (emergency radiation state or toxic gas isolation state) of the 

emergency mode of operation, depending on the initiation 

signal. Actuation of the system to the emergency radiation state of the 

emergency mode of operation, closes the unfiltered outside air intake and 

unfiltered exhaust dampers, and aligns the system for recirculation of the 

air within the CRE through the redundant trains of HEPA and the charcoal 

filters. The emergency radiation state also initiates pressurization and 

filtered ventilation of the air supply to the CRE.

Outside air is filtered, diluted with building air from the electrical 

equipment and cable spreading rooms, and added to the air being 

recirculated from the CRE. Pressurization of the CRE minimizes

infiltration of unfiltered air through the CRE boundary from all the 

surrounding areas adjacent to the CRE boundary. The actions taken in 

the toxic gas isolation state are the same, except that the signal switches 

the CREFS to an isolation alignment to minimize any outside air from 

entering the CRE trhough the CRE boundary.

The air entering the CRE is continuously monitored by radiation and toxic 

gas detectors. One detector output above the setpoint will cause 

actuation of the emergency radiation state or toxic gas isolation state, as 

required. The actions of the toxic gas isolation state are more restrictive, 

and will override the actions of the emergency radiation state.

A single CREFS train operating at a flow rate of < [3000] cfm will 

pressurize the CRE to about [0.125] inches water gauge relative to 

external areas adjacent to the CRE boundary. The CREFS operation in 

maintaining the CRE habitable is discussed in the FSAR, Section [9.4] 

(Ref. 1).

Redundant supply and recirculation trains provide the required filtration 

should an excessive pressure drop develop across the other filter train. 

Normally open isolation dampers are arranged in series pairs so that the 

failure of one damper to shut will not result in a breach of isolation. The 

CREFS is designed in accordance with Seismic Category I requirements.

The CREFS is designed to maintain a habitable environment in the CRE

for 30 days of continuous occupancy after a DBA without exceeding a 

[5 rem whole body dose or its equivalent to any part of the body] [5 rem 

total effective does equivalent (TEDE)].
CREFS

B 3.7.10

Westinghouse STS B 3.7.10-3 Rev. 4.0

BASES

APPLICABLE The CREFS components are arranged in redundant, safety related

SAFETY ventilation trains. The location of components and ducting within the

ANALYSES CRE ensures an adequate supply of filtered air to all areas requiring 

access. The CREFS provides airborne radiological protection for the 

CRE occupants, as demonstrated by the CRE occupant dose analyses 

for the most limiting design basis accident, fission product release 

presented in the FSAR, Chapter [15] (Ref. 2).

The CREFS provides protection from smoke and hazardous chemicals to 

the CRE occupants. The analysis of hazardous chemical releases 

demonstrates that the toxicity limits are not exceeded in the CRE 

following a hazardous chemical release (Ref. 3). The evaluation of a 

smoke challenge demonstrates that it will not result in the inability of the 

CRE occupants to control the reactor either from the control room or from 

the remote shutdown panels (Ref. 4).

The worst case single active failure of a component of the CREFS, 

assuming a loss of offsite power, does not impair the ability of the system 

to perform its design function.

The CREFS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent and redundant CREFS trains are required to be 

OPERABLE to ensure that at least one is available if a single active 

failure disables the other train. Total system failure, such as from a loss 

of both ventilation trains or from an inoperable CRE boundary, could 

result in exceeding a dose of [5 rem whole body or its equivalent to any 

part of the body] [5 rem TEDE] to the CRE occupants in the event of a 

large radioactive release.

Each CREFS train is considered OPERABLE when the individual 

components necessary to limit CRE occupant exposure are OPERABLE. 

A CREFS train is OPERABLE when the associated:

a. Fan is OPERABLE,

b. HEPA filters and charcoal adsorbers are not excessively restricting 

flow, and are capable of performing their filtration functions, and

c. Heater, demister, ductwork, valves, and dampers are OPERABLE, 

and air circulation can be maintained.

In order for the CREFS trains to be considered OPERABLE, the CRE 

boundary must be maintained such that the CRE occupant dose from a 

large radioactive release does not exceed the calculated dose in the 

licensing basis consequence analyses for DBAs, and that CRE occupants 

are protected from hazardous chemicals and smoke.
CREFS

B 3.7.10

Westinghouse STS B 3.7.10-4 Rev. 4.0

BASES

LCO (continued)

The LCO is modified by a Note allowing the CRE boundary to be opened 

intermittently under administrative controls. This Note only applies to 

openings in the CRE boundary that can be rapidly restored to the design 

condition, such as doors, hatches, floor plugs, and access panels. For 

entry and exit through doors, the administrative control of the opening is 

performed by the person(s) entering or exiting the area. For other 

openings, these controls should be proceduralized and consist of 

stationing a dedicated individual at the opening who is in continuous 

communication with the operators in the CRE. This individual will have a 

method to rapidly close the opening and to restore the CRE boundary to a 

condition equivalent to the design condition when a need for CRE

isolation is indicated.

APPLICABILITY In MODES 1, 2, 3, 4, [5, and 6,] and during movement of [recently] 

irradiated fuel assemblies, the CREFS must be OPERABLE to ensure 

that the CRE will remain habitable during and following a DBA.

In [MODES 5 and 6], the CREFS is required to cope with the release from 

the rupture of an outside waste gas tank.

During movement of [recently] irradiated fuel assemblies, the CREFS 

must be OPERABLE to cope with the release from a fuel handling 

accident [involving handling recently irradiated fuel]. [The CREFS is only 

required to be OPERABLE during fuel handling involving handling 

recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor 

core within the previous [X] days), due to radioactive decay.]

ACTIONS A.1

When one CREFS train is inoperable, for reasons other than an 

inoperable CRE boundary, action must be taken to restore OPERABLE 

status within 7 days. In this Condition, the remaining OPERABLE CREFS 

train is adequate to perform the CRE occupant protection function. 

However, the overall reliability is reduced because a failure in the 

OPERABLE CREFS train could result in loss of CREFS function. The 

7 day Completion Time is based on the low probability of a DBA occurring 

during this time period, and ability of the remaining train to provide the 

required capability.

B.1, B.2, and B.3

If the unfiltered inleakage of potentially contaminated air past the CRE 

boundary and into the CRE can result in CRE occupant radiological dose 

greater than the calculated dose of the licensing basis analyses of DBA 

consequences (allowed to be up to [5 rem whole body or its equivalent to
CREFS

B 3.7.10

Westinghouse STS B 3.7.10-5 Rev. 4.0

BASES

ACTIONS (continued)

any part of the body] [5 rem TEDE]), or inadequate protection of CRE 

occupants from hazardous chemicals or smoke, the CRE boundary is 

inoperable. Actions must be taken to restore an OPERABLE CRE 

boundary within 90 days.

During the period that the CRE boundary is considered inoperable, action 

must be initiated to implement mitigating actions to lessen the effect on 

CRE occupants from the potential hazards of a radiological or chemical 

event or a challenge from smoke. Actions must be taken within 24 hours 

to verify that in the event of a DBA, the mitigating actions will ensure that 

CRE occupant radiological exposures will not exceed the calculated dose 

of the licensing basis analyses of DBA consequences, and that CRE 

occupants are protected from hazardous chemicals and smoke. These 

mitigating actions (i.e., actions that are taken to offset the consequences 

of the inoperable CRE boundary) should be preplanned for 

implementation upon entry into the condition, regardless of whether entry 

is intentional or unintentional. The 24 hour Completion Time is 

reasonable based on the low probability of a DBA occurring during this 

time period, and the use of mitigating actions. The 90 day Completion 

Time is reasonable based on the determination that the mitigating actions 

will ensure protection of CRE occupants within analyzed limits while 

limiting the probability that CRE occupants will have to implement 

protective measures that may adversely affect their ability to control the 

reactor and maintain it in a safe shutdown condition in the event of a 

DBA. In addition, the 90 day Completion Time is a reasonable time to 

diagnose, plan and possibly repair, and test most problems with the CRE 

boundary.

C.1 and C.2

In MODE 1, 2, 3, or 4, if the inoperable CREFS train or the CRE boundary 

cannot be restored to OPERABLE status within the required Completion 

Time, the unit must be placed in a MODE that minimizes accident 

risk. To achieve this status, the unit must be placed in at least MODE 3 

within 6 hours, and in MODE 5 within 36 hours. The allowed Completion 

Times are reasonable, based on operating experience, to reach the 

required unit conditions from full power conditions in an orderly manner 

and without challenging unit systems.
CREFS

B 3.7.10

Westinghouse STS B 3.7.10-6 Rev. 4.0

BASES

ACTIONS (continued)

D.1 and D.2

[ In MODE 5 or 6, or] during movement of [recently] irradiated fuel 

assemblies, if the inoperable CREFS train cannot be restored to 

OPERABLE status within the required Completion Time, action must be 

taken to immediately place the OPERABLE CREFS train in the 

emergency mode. This action ensures that the remaining train is 

OPERABLE, that no failures preventing automatic actuation will occur, 

and that any active failure would be readily detected.

An alternative to Required Action D.1 is to immediately suspend activities 

that could result in a release of radioactivity that might require isolation of 

the CRE. This places the unit in a condition that minimizes the accident 

risk. This does not preclude the movement of fuel to a safe position.

[ Required Action D.1 is modified by a Note indicating to place the system 

in the toxic gas protection mode if automatic transfer to the toxic gas 

protection mode is inoperable. ]

E.1

[In MODE 5 or 6, or] during movement of [recently] irradiated fuel 

assemblies, with two CREFS trains inoperable or with one or more 

CREVS trains inoperable due to an inoperable CRE boundary, action 

must be taken immediately to suspend activities that could result in a 

release of radioactivity that might require isolation of the CRE. This 

places the unit in a condition that minimizes the accident risk. This does 

not preclude the movement of fuel to a safe position.

F.1

If both CREFS trains are inoperable in MODE 1, 2, 3, or 4 for reasons 

other than an inoperable CRE boundary (i.e., Condition B), the CREFS 

may not be capable of performing the intended function and the unit is in 

a condition outside the accident analyses. Therefore, LCO 3.0.3 must be 

entered immediately.
CREFS

B 3.7.10

Westinghouse STS B 3.7.10-7 Rev. 4.0

BASES

SURVEILLANCE SR 3.7.10.1

REQUIREMENTS

Standby systems should be checked periodically to ensure that they 

function properly. As the environment and normal operating conditions 

on this system are not too severe, testing each train once every month 

provides an adequate check of this system. Monthly heater operations 

dry out any moisture accumulated in the charcoal from humidity in the 

ambient air. [Systems with heaters must be operated for ≥10 continuous 

hours with the heaters energized. Systems without heaters need only be 

operated for ≥15 minutes to demonstrate the function of the system.] 

[ The 31 day Frequency is based on the reliability of the equipment and 

the two train redundancy.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.10.2

This SR verifies that the required CREFS testing is performed in 

accordance with the [Ventilation Filter Testing Program (VFTP)]. The 

[VFTP] includes testing the performance of the HEPA filter, charcoal 

adsorber efficiency, minimum flow rate, and the physical properties of the 

activated charcoal. Specific test Frequencies and additional information 

are discussed in detail in the [VFTP].

SR 3.7.10.3

This SR verifies that each CREFS train starts and operates on an actual 

or simulated actuation signal. [ The Frequency of [18] months is based 

on industry operating experience and is consistent with the typical 

refueling cycle.

OR
CREFS

B 3.7.10

Westinghouse STS B 3.7.10-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.10.4

This SR verifies the OPERABILITY of the CRE boundary by testing for 

unfiltered air inleakage past the CRE boundary and into the CRE. The 

details of the testing are specified in the Control Room Envelope

Habitability Program.

The CRE is considered habitable when the radiological dose to CRE 

occupants calculated in the licensing basis analyses of DBA 

consequences is no more than [5 rem whole body or its equivalent to any 

part of the body] [5 rem TEDE] and the CRE occupants are protected 

from hazardous chemicals and smoke. This SR verifies that the unfiltered 

air inleakage into the CRE is no greater than the flow rate assumed in the 

licensing basis analyses of DBA consequences. When unfiltered air 

inleakage is greater than the assumed flow rate, Condition B must be 

entered. Required Action B.3 allows time to restore the CRE boundary to 

OPERABLE status provided mitigating actions can ensure that the CRE 

remains within the licensing basis habitability limits for the occupants 

following an accident. Compensatory measures are discussed in 

Regulatory Guide 1.196, Section C.2.7.3, (Ref. 5) which endorses, with 

exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 6). These 

compensatory measures may also be used as mitigating actions as 

required by Required Action B.2. Temporary analytical methods may also 

be used as compensatory measures to restore OPERABILITY (Ref. 7). 

Options for restoring the CRE boundary to OPERABLE status include 

changing the licensing basis DBA consequence analysis, repairing the 

CRE boundary, or a combination of these actions. Depending upon the 

nature of the problem and the corrective action, a full scope inleakage 

test may not be necessary to establish that the CRE boundary has been 

restored to OPERABLE status.
CREFS

B 3.7.10

Westinghouse STS B 3.7.10-9 Rev. 4.0

BASES

REFERENCES 1. FSAR, Section [9.4].

2. FSAR, Chapter [15].

3. FSAR, Section [6.4].

4. FSAR, Section [9.5]

5. Regulatory Guide 1.196.

6. NEI 99-03, "Control Room Habitability Assessment," June 2001.

7. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) dated 

January 30, 2004, "NEI Draft White Paper, Use of Generic Letter 

91-18 Process and Alternative Source Terms in the Context of 

Control Room Habitability," (ADAMS Accession No. ML040300694).

CREATCS

B 3.7.11

Westinghouse STS B 3.7.11-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.11 Control Room Emergency Air Temperature Control System (CREATCS)

BASES

BACKGROUND The CREATCS provides temperature control for the control room 

following isolation of the control room.

The CREATCS consists of two independent and redundant trains that 

provide cooling and heating of recirculated control room air. Each train 

consists of heating coils, cooling coils, instrumentation, and controls to 

provide for control room temperature control. The CREATCS is a 

subsystem providing air temperature control for the control room.

The CREATCS is an emergency system, parts of which may also operate 

during normal unit operations. A single train will provide the required 

temperature control to maintain the control room between [70]° and [85]°. 

The CREATCS operation in maintaining the control room temperature is 

discussed in the FSAR, Section [6.4] (Ref. 1).

APPLICABLE The design basis of the CREATCS is to maintain the control room

SAFETY temperature for 30 days of continuous occupancy.

ANALYSES

The CREATCS components are arranged in redundant, safety related 

trains. During emergency operation, the CREATCS maintains the 

temperature between [70]° and [85]°. A single active failure of a 

component of the CREATCS, with a loss of offsite power, does not impair 

the ability of the system to perform its design function. Redundant 

detectors and controls are provided for control room temperature control. 

The CREATCS is designed in accordance with Seismic Category I 

requirements. The CREATCS is capable of removing sensible and latent 

heat loads from the control room, which include consideration of 

equipment heat loads and personnel occupancy requirements, to ensure 

equipment OPERABILITY.

The CREATCS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent and redundant trains of the CREATCS are required to 

be OPERABLE to ensure that at least one is available, assuming a single 

failure disabling the other train. Total system failure could result in the 

equipment operating temperature exceeding limits in the event of an 

accident.
CREATCS

B 3.7.11

Westinghouse STS B 3.7.11-2 Rev. 4.0

BASES

LCO (continued)

The CREATCS is considered to be OPERABLE when the individual 

components necessary to maintain the control room temperature are 

OPERABLE in both trains. These components include the heating and 

cooling coils and associated temperature control instrumentation. In 

addition, the CREATCS must be operable to the extent that air circulation 

can be maintained.

APPLICABILITY In MODES 1, 2, 3, 4, [5, and 6,] and during movement of [recently] 

irradiated fuel assemblies, the CREATCS must be OPERABLE to ensure 

that the control room temperature will not exceed equipment operational 

requirements following isolation of the control room. [The CREATCS is 

only required to be OPERABLE during fuel handling involving handling 

recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor 

core within the previous [X] days), due to radioactive decay.]

[In MODE 5 or 6,] CREATCS may not be required for those facilities that 

do not require automatic control room isolation.

ACTIONS A.1

With one CREATCS train inoperable, action must be taken to restore 

OPERABLE status within 30 days. In this Condition, the remaining 

OPERABLE CREATCS train is adequate to maintain the control room 

temperature within limits. However, the overall reliability is reduced 

because a single failure in the OPERABLE CREATCS train could result in 

loss of CREATCS function. The 30 day Completion Time is based on the 

low probability of an event requiring control room isolation, the 

consideration that the remaining train can provide the required protection, 

and that alternate safety or nonsafety related cooling means are 

available.

B.1 and B.2

In MODE 1, 2, 3, or 4, if the inoperable CREATCS train cannot be 

restored to OPERABLE status within the required Completion Time, the 

unit must be placed in a MODE that minimizes the risk. To achieve this 

status, the unit must be placed in at least MODE 3 within 6 hours, and in 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging unit 

systems.
CREATCS

B 3.7.11

Westinghouse STS B 3.7.11-3 Rev. 4.0

BASES

ACTIONS (continued)

C.1 and C.2

[ In MODE 5 or 6, or] during movement of [recently] irradiated fuel, if the 

inoperable CREATCS train cannot be restored to OPERABLE status 

within the required Completion Time, the OPERABLE CREATCS train 

must be placed in operation immediately. This action ensures that the 

remaining train is OPERABLE, that no failures preventing automatic 

actuation will occur, and that active failures will be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities 

that present a potential for releasing radioactivity that might require 

isolation of the control room. This places the unit in a condition that 

minimizes accident risk. This does not preclude the movement of fuel to 

a safe position.

D.1

[In MODE 5 or 6, or] during movement of [recently] irradiated fuel 

assemblies, with two CREATCS trains inoperable, action must be taken 

immediately to suspend activities that could result in a release of 

radioactivity that might require isolation of the control room. This places 

the unit in a condition that minimizes risk. This does not preclude the 

movement of fuel to a safe position.

E.1

If both CREATCS trains are inoperable in MODE 1, 2, 3, or 4, the control 

room CREATCS may not be capable of performing its intended function. 

Therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.7.11.1

REQUIREMENTS

This SR verifies that the heat removal capability of the system is sufficient 

to remove the heat load assumed in the [safety analyses] in the control 

room. This SR consists of a combination of testing and calculations. 

[ The [18] month Frequency is appropriate since significant degradation of 

the CREATCS is slow and is not expected over this time period.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
CREATCS

B 3.7.11

Westinghouse STS B 3.7.11-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [6.4].
ECCS PREACS

B 3.7.12

Westinghouse STS B 3.7.12-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.12 Emergency Core Cooling System (ECCS) Pump Room Exhaust Air Cleanup 

 System (PREACS)

BASES

BACKGROUND The ECCS PREACS filters air from the area of the active ECCS 

components during the recirculation phase of a loss of coolant accident 

(LOCA). The ECCS PREACS, in conjunction with other normally 

operating systems, also provides environmental control of temperature 

and humidity in the ECCS pump room area and the lower reaches of the 

Auxiliary Building.

The ECCS PREACS consists of two independent and redundant trains. 

Each train consists of a heater, a prefilter or demister, a high efficiency 

particulate air (HEPA) filter, an activated charcoal adsorber section for 

removal of gaseous activity (principally iodines), and a fan. Ductwork, 

valves or dampers, and instrumentation also form part of the system, as 

well as demisters functioning to reduce the relative humidity of the air 

stream. A second bank of HEPA filters follows the adsorber section to 

collect carbon fines and provide backup in case the main HEPA filter 

bank fails. The downstream HEPA filter is not credited in the accident 

analysis, but serves to collect charcoal fines, and to back up the upstream 

HEPA filter should it develop a leak. The system initiates filtered 

ventilation of the pump room following receipt of a safety injection (SI) 

signal.

The ECCS PREACS is a standby system, aligned to bypass the system 

HEPA filters and charcoal adsorbers. During emergency operations, the 

ECCS PREACS dampers are realigned, and fans are started to begin 

filtration. Upon receipt of the actuating Engineered Safety Feature 

Actuation System signal(s), normal air discharges from the ECCS pump 

room isolate, and the stream of ventilation air discharges through the 

system filter trains. The prefilters remove any large particles in the air, 

and any entrained water droplets present, to prevent excessive loading of 

the HEPA filters and charcoal adsorbers.

The ECCS PREACS is discussed in the FSAR, Sections [6.5.1], [9.4.5], 

and [15.6.5] (Refs. 1, 2, and 3, respectively) since it may be used for 

normal, as well as post accident, atmospheric cleanup functions. The 

primary purpose of the heaters is to maintain the relative humidity at an 

acceptable level, consistent with iodine removal efficiencies per 

Regulatory Guide 1.52 (Ref. 4).
ECCS PREACS

B 3.7.12

Westinghouse STS B 3.7.12-2 Rev. 4.0

BASES 

APPLICABLE The design basis of the ECCS PREACS is established by the large break

SAFETY LOCA. The system evaluation assumes a passive failure of the ECCS

ANALYSES outside containment, such as an SI pump seal failure, during the 

recirculation mode. In such a case, the system limits radioactive release 

to within the 10 CFR 100 (Ref. 5) limits, or the NRC staff approved 

licensing basis (e.g., a specified fraction of Reference 5 limits). The 

analysis of the effects and consequences of a large break LOCA is 

presented in Reference 3. The ECCS PREACS also actuates following a 

small break LOCA, in those cases where the ECCS goes into the 

recirculation mode of long term cooling, to clean up releases of smaller 

leaks, such as from valve stem packing.

Two types of system failures are considered in the accident analysis: 

complete loss of function, and excessive LEAKAGE. Either type of failure 

may result in a lower efficiency of removal for any gaseous and 

particulate activity released to the ECCS pump rooms following a LOCA.

The ECCS PREACS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent and redundant trains of the ECCS PREACS are 

required to be OPERABLE to ensure that at least one is available, 

assuming that a single failure disables the other train coincident with loss 

of offsite power. Total system failure could result in the atmospheric 

release from the ECCS pump room exceeding 10 CFR 100 limits in the 

event of a Design Basis Accident (DBA).

ECCS PREACS is considered OPERABLE when the individual 

components necessary to maintain the ECCS pump room filtration are 

OPERABLE in both trains.

An ECCS PREACS train is considered OPERABLE when its associated:

a. Fan is OPERABLE,

b. HEPA filter and charcoal adsorbers are not excessively restricting 

flow, and are capable of performing their filtration functions, and

c. Heater, demister, ductwork, valves, and dampers are OPERABLE 

and air circulation can be maintained.

The LCO is modified by a Note allowing the ECCS pump room boundary 

to be opened intermittently under administrative controls. For entry and 

exit through doors, the administrative control of the opening is performed 

by the person(s) entering or exiting the area. For other openings, these 

controls consist of stationing a dedicated individual at the opening who is 

in continuous communication with the control room. This individual will 

have a method to rapidly close the opening when a need for ECCS pump 

room isolation is indicated.
ECCS PREACS

B 3.7.12

Westinghouse STS B 3.7.12-3 Rev. 4.0

BASES

APPLICABILITY In MODES 1, 2, 3, and 4, the ECCS PREACS is required to be 

OPERABLE consistent with the OPERABILITY requirements of the 

ECCS.

In MODE 5 or 6, the ECCS PREACS is not required to be OPERABLE 

since the ECCS is not required to be OPERABLE.

ACTIONS A.1

With one ECCS PREACS train inoperable, action must be taken to 

restore OPERABLE status within 7 days. During this time, the remaining 

OPERABLE train is adequate to perform the ECCS PREACS function.

The 7 day Completion Time is appropriate because the risk contribution is 

less than that for the ECCS (72 hour Completion Time), and this system 

is not a direct support system for the ECCS. The 7 day Completion Time 

is based on the low probability of a DBA occurring during this time period, 

and ability of the remaining train to provide the required capability.

Concurrent failure of two ECCS PREACS trains would result in the loss of 

functional capability; therefore, LCO 3.0.3 must be entered immediately.

B.1

-----------------------------------REVIEWER’S NOTE-----------------------------------

Adoption of Condition B is dependent on a commitment from the licensee 

to have written procedures available describing compensatory measures 

to be taken in the event of an intentional or unintentional entry into 

Condition B.

--------------------------------------------------------------------------------------------------

If the ECCS pump room boundary is inoperable, the ECCS PREACS 

trains cannot perform their intended functions. Actions must be taken to 

restore an OPERABLE ECCS pump room boundary within 24 hours. 

During the period that the ECCS pump room boundary is inoperable, 

appropriate compensatory measures [consistent with the intent, as 

applicable, of GDC 19, 60, 64 and 10 CFR Part 100] should be utilized to 

protect plant personnel from potential hazards such as radioactive 

contamination, toxic chemicals, smoke, temperature and relative 

humidity, and physical security. Preplanned measures should be 

available to address these concerns for intentional and unintentional entry 

into the condition. The 24 hour Completion Time is reasonable based on 

the low probability of a DBA occurring during this time period, and the use 

of compensatory measures. The 24 hour Completion Time is a typically 

reasonable time to diagnose, plan and possibly repair, and test most 

problems with the ECCS pump room boundary.
ECCS PREACS

B 3.7.12

Westinghouse STS B 3.7.12-4 Rev. 4.0

BASES

ACTIONS (continued)

C.1 and C.2

If the ECCS PREACS train or ECCS pump room boundary cannot be 

restored to OPERABLE status within the associated Completion Time, 

the unit must be placed in a MODE in which the LCO does not apply. To 

achieve this status, the unit must be placed in at least MODE 3 within 

6 hours, and in MODE 5 within 36 hours. The allowed Completion Times 

are reasonable, based on operating experience, to reach the required unit 

conditions from full power conditions in an orderly manner and without 

challenging unit systems.

SURVEILLANCE SR 3.7.12.1

REQUIREMENTS

Standby systems should be checked periodically to ensure that they 

function properly. As the environment and normal operating conditions 

on this system are not severe, testing each train once a month provides 

an adequate check on this system. Monthly heater operations dry out 

any moisture that may have accumulated in the charcoal from humidity in 

the ambient air. [Systems with heaters must be operated ≥10 continuous 

hours with the heaters energized. Systems without heaters need only be 

operated for ≥15 minutes to demonstrate the function of the system.] 

[ The 31 day Frequency is based on the known reliability of equipment 

and the two train redundancy available.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
ECCS PREACS

B 3.7.12

Westinghouse STS B 3.7.12-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.7.12.2

This SR verifies that the required ECCS PREACS testing is performed in 

accordance with the [Ventilation Filter Testing Program (VFTP)]. The 

[VFTP] includes testing HEPA filter performance, charcoal adsorbers 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal (general use and following specific operations). 

Specific test Frequencies and additional information are discussed in 

detail in the [VFTP].

SR 3.7.12.3

This SR verifies that each ECCS PREACS train starts and operates on an 

actual or simulated actuation signal. [ The [18] month Frequency is 

consistent with that specified in Reference 4.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.12.4

This SR verifies the integrity of the ECCS pump room enclosure. The 

ability of the ECCS pump room to maintain a negative pressure, with 

respect to potentially uncontaminated adjacent areas, is periodically 

tested to verify proper functioning of the ECCS PREACS. During the 

[post accident] mode of operation, the ECCS PREACS is designed to 

maintain a slight negative pressure in the ECCS pump room, with respect 

to adjacent areas, to prevent unfiltered LEAKAGE. The ECCS PREACS 

is designed to maintain a ≤[-0.125] inches water gauge relative to 

atmospheric pressure at a flow rate of [3000] cfm from the ECCS pump 

room. [ The Frequency of [18] months is consistent with the guidance 

provided in NUREG-0800, Section 6.5.1 (Ref. 6).
ECCS PREACS

B 3.7.12

Westinghouse STS B 3.7.12-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This test is conducted with the tests for filter penetration; thus, an 

[18] month Frequency on a STAGGERED TEST BASIS is consistent with 

that specified in Reference 4.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.7.12.5

Operating the ECCS PREACS bypass damper is necessary to ensure 

that the system functions properly. The OPERABILITY of the ECCS 

PREACS bypass damper is verified if it can be specified in Reference 4. 

[ An [18] month Frequency is consistent with that specified in 

Reference 4.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]
ECCS PREACS

B 3.7.12

Westinghouse STS B 3.7.12-7 Rev. 4.0

BASES 

REFERENCES 1. FSAR, Section [6.5.1].

2. FSAR, Section [9.4.5].

3. FSAR, Section [15.6.5].

4. Regulatory Guide 1.52 (Rev. 2).

5. 10 CFR 100.11.

6. NUREG-0800, Section 6.5.1, Rev. 2, July 1981.

FBACS

B 3.7.13

Westinghouse STS B 3.7.13-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.13 Fuel Building Air Cleanup System (FBACS)

BASES

BACKGROUND The FBACS filters airborne radioactive particulates from the area of the 

fuel pool following a fuel handling accident or loss of coolant accident 

(LOCA). The FBACS, in conjunction with other normally operating 

systems, also provides environmental control of temperature and humidity 

in the fuel pool area.

The FBACS consists of two independent and redundant trains. Each 

train consists of a heater, a prefilter or demister, a high efficiency 

particulate air (HEPA) filter, an activated charcoal adsorber section for 

removal of gaseous activity (principally iodines), and a fan. Ductwork, 

valves or dampers, and instrumentation also form part of the system, as 

well as demisters, functioning to reduce the relative humidity of the 

airstream. A second bank of HEPA filters follows the adsorber section to 

collect carbon fines and provide backup in case the main HEPA filter 

bank fails. The downstream HEPA filter is not credited in the analysis, 

but serves to collect charcoal fines, and to back up the upstream HEPA 

filter should it develop a leak. The system initiates filtered ventilation of 

the fuel handling building following receipt of a high radiation signal.

The FBACS is a standby system, parts of which may also be operated 

during normal plant operations. Upon receipt of the actuating signal, 

normal air discharges from the building, the fuel handling building is 

isolated, and the stream of ventilation air discharges through the system 

filter trains. The prefilters or demisters remove any large particles in the 

air, and any entrained water droplets present, to prevent excessive 

loading of the HEPA filters and charcoal adsorbers.

The FBACS is discussed in the FSAR, Sections [6.5.1], [9.4.5], 

and [15.7.4] (Refs. 1, 2, and 3, respectively) because it may be used for 

normal, as well as post accident, atmospheric cleanup functions.

APPLICABLE The FBACS design basis is established by the consequences of the

SAFETY limiting Design Basis Accident (DBA), which is a fuel handling accident

ANALYSES [involving handling recently irradiated fuel]. The analysis of the fuel 

handling accident, given in Reference 3, assumes that all fuel rods in an 

assembly are damaged. The analysis of the LOCA assumes that 

radioactive materials leaked from the Emergency Core Cooling System 

(ECCS) are filtered and adsorbed by the FBACS. The DBA analysis of 

the fuel handling accident assumes that only one train of the FBACS is 

functional due to a single failure that disables the other train. The 

accident analysis accounts for the reduction in airborne radioactive 
FBACS

B 3.7.13

Westinghouse STS B 3.7.13-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

material provided by the one remaining train of this filtration system. The 

amount of fission products available for release from the fuel handling 

building is determined for a fuel handling accident and for a LOCA. [Due 

to radioactive decay, FBACS is only required to isolate during fuel 

handling accidents involving handling recently irradiated fuel (i.e., fuel that 

has occupied part of a critical reactor core within the previous [X] days).] 

These assumptions and the analysis follow the guidance provided in 

Regulatory Guide 1.25 (Ref. 4).

The FBACS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent and redundant trains of the FBACS are required to be 

OPERABLE to ensure that at least one train is available, assuming a 

single failure that disables the other train, coincident with a loss of offsite 

power. Total system failure could result in the atmospheric release from 

the fuel handling building exceeding the 10 CFR 100 (Ref. 5) limits in the 

event of a fuel handling accident [involving handling recently irradiated 

fuel]. 

The FBACS is considered OPERABLE when the individual components 

necessary to control exposure in the fuel handling building are 

OPERABLE in both trains. An FBACS train is considered OPERABLE 

when its associated:

a. Fan is OPERABLE,

b. HEPA filter and charcoal adsorber are not excessively restricting 

flow, and are capable of performing their filtration function, and

c. Heater, demister, ductwork, valves, and dampers are OPERABLE, 

and air circulation can be maintained.

The LCO is modified by a Note allowing the fuel building boundary to be 

opened intermittently under administrative controls. For entry and exit 

through doors the administrative control of the opening is performed by 

the person(s) entering or exiting the area. For other openings, these 

controls consist of stationing a dedicated individual at the opening who is 

in continuous communication with the control room. This individual will 

have a method to rapidly close the opening when a need for fuel building 

isolation is indicated.
FBACS

B 3.7.13

Westinghouse STS B 3.7.13-3 Rev. 4.0

BASES 

APPLICABILITY In MODE 1, 2, 3, or 4, the FBACS is required to be OPERABLE to 

provide fission product removal associated with ECCS leaks due to a 

LOCA and leakage from containment and annulus.

In MODE 5 or 6, the FBACS is not required to be OPERABLE since the 

ECCS is not required to be OPERABLE.

During movement of [recently] irradiated fuel in the fuel handling area, the 

FBACS is required to be OPERABLE to alleviate the consequences of a 

fuel handling accident.

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily.

A.1

With one FBACS train inoperable, action must be taken to restore 

OPERABLE status within 7 days. During this period, the remaining 

OPERABLE train is adequate to perform the FBACS function. The 7 day 

Completion Time is based on the risk from an event occurring requiring 

the inoperable FBACS train, and the remaining FBACS train providing the 

required protection.

B.1

-----------------------------------REVIEWER’S NOTE-------------------------

Adoption of Condition B is dependent on a commitment from the licensee 

to have guidance available describing compensatory measures to be 

taken in the event of an intentional and unintentional entry into 

Condition B.

--------------------------------------------------------------------------------------------------

If the fuel building boundary is inoperable in MODE 1, 2, 3, or 4, the 

FBACS trains cannot perform their intended functions. Actions must be 

taken to restore an OPERABLE fuel building boundary within 24 hours. 

During the period that the fuel building boundary is inoperable, 

appropriate compensatory measures [consistent with the intent, as 
FBACS

B 3.7.13

Westinghouse STS B 3.7.13-4 Rev. 4.0

BASES

ACTIONS (continued)

applicable, of GDC 19, 60, 61, 63, 64 and 10 CFR Part 100] should be 

utilized to protect plant personnel from potential hazards such as 

radioactive contamination, toxic chemicals, smoke, temperature and 

relative humidity, and physical security. Preplanned measures should be 

available to address these concerns for intentional and unintentional entry 

into the condition. The 24 hour Completion Time is reasonable based on 

the low probability of a DBA occurring during this time period, and the use 

of compensatory measures. The 24 hour Completion Time is a typically 

reasonable time to diagnose, plan and possibly repair, and test most 

problems with the fuel building boundary.

[ C.1 and C.2

In MODE 1, 2, 3, or 4, when Required Action A.1 or B.1 cannot be 

completed within the associated Completion Time, or when both FBACS 

trains are inoperable for reasons other than an inoperable fuel building 

boundary (i.e., Condition B), the unit must be placed in a MODE in which 

the LCO does not apply. To achieve this status, the unit must be placed 

in MODE 3 within 6 hours, and in MODE 5 within 36 hours. The 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems. ]

D.1 and D.2

When Required Action A.1 cannot be completed within the required 

Completion Time, during movement of [recently] irradiated fuel 

assemblies in the fuel building, the OPERABLE FBACS train must be 

started immediately or [recently] irradiated fuel movement suspended. 

This action ensures that the remaining train is OPERABLE, that no 

undetected failures preventing system operation will occur, and that any 

active failure will be readily detected.

If the system is not placed in operation, this action requires suspension of 

[recently] irradiated fuel movement, which precludes a fuel handling 

accident [involving handling recently irradiated fuel]. This does not 

preclude the movement of fuel assemblies to a safe position.
FBACS

B 3.7.13

Westinghouse STS B 3.7.13-5 Rev. 4.0

BASES

ACTIONS (continued)

E.1

When two trains of the FBACS are inoperable during movement of 

[recently] irradiated fuel assemblies in the fuel building, action must be 

taken to place the unit in a condition in which the LCO does not apply. 

Action must be taken immediately to suspend movement of [recently] 

irradiated fuel assemblies in the fuel building. This does not preclude the 

movement of fuel to a safe position.

SURVEILLANCE SR 3.7.13.1

REQUIREMENTS

Standby systems should be checked periodically to ensure that they 

function properly. As the environmental and normal operating conditions 

on this system are not severe, testing each train once every month 

provides an adequate check on this system.

Monthly heater operation dries out any moisture accumulated in the 

charcoal from humidity in the ambient air. [Systems with heaters must be 

operated for ≥10 continuous hours with the heaters energized. Systems 

without heaters need only be operated for ≥15 minutes to demonstrate 

the function of the system.] [ The 31 day Frequency is based on the 

known reliability of the equipment and the two train redundancy available.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.7.13.2

This SR verifies that the required FBACS testing is performed in 

accordance with the [Ventilation Filter Testing Program (VFTP)]. The 

[VFTP] includes testing HEPA filter performance, charcoal adsorber 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal (general use and following specific operations). 

Specific test frequencies and additional information are discussed in 

detail in the [VFTP]. ]
FBACS

B 3.7.13

Westinghouse STS B 3.7.13-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.7.13.3

This SR verifies that each FBACS train starts and operates on an actual 

or simulated actuation signal. [ The [18] month Frequency is consistent 

with Reference 6. ]

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.13.4

This SR verifies the integrity of the fuel building enclosure. The ability of 

the fuel building to maintain negative pressure with respect to potentially 

uncontaminated adjacent areas is periodically tested to verify proper 

function of the FBACS. During the [post accident] mode of operation, the 

FBACS is designed to maintain a slight negative pressure in the fuel 

building, to prevent unfiltered LEAKAGE. The FBACS is designed to 

maintain a ≤[-0.125] inches water gauge with respect to atmospheric 

pressure at a flow rate of [20,000] cfm to the fuel building. [ The 

Frequency of [18] months is consistent with the guidance provided in 

NUREG-0800, Section 6.5.1 (Ref. 7).

An [18] month Frequency (on a STAGGERED TEST BASIS) is consistent 

with Reference 6.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
FBACS

B 3.7.13

Westinghouse STS B 3.7.13-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

[ SR 3.7.13.5

Operating the FBACS filter bypass damper is necessary to ensure that 

the system functions properly. The OPERABILITY of the FBACS filter 

bypass damper is verified if it can be closed. [ An [18] month Frequency 

is consistent with Reference 6.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

REFERENCES 1. FSAR, Section [6.5.1].

2. FSAR, Section [9.4.5].

3. FSAR, Section [15.7.4].

4. Regulatory Guide 1.25.

5. 10 CFR 100.

6. Regulatory Guide 1.52, Rev. [2].

7. NUREG-0800, Section 6.5.1, Rev. 2, July 1981.

PREACS

B 3.7.14

Westinghouse STS B 3.7.14-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.14 Penetration Room Exhaust Air Cleanup System (PREACS)

BASES

BACKGROUND The PREACS filters air from the penetration area between containment 

and the Auxiliary Building.

The PREACS consists of two independent and redundant trains. Each 

train consists of a heater, a prefilter or demister, a high efficiency 

particulate air (HEPA) filter, an activated charcoal adsorber section for 

removal of gaseous activity (principally iodines), and a fan. Ductwork, 

valves or dampers, and instrumentation, as well as demisters, functioning 

to reduce the relative humidity of the air stream, also form part of the 

system. A second bank of HEPA filters, which follows the adsorber 

section, collects carbon fines and provides backup in case of failure of the 

main HEPA filter bank. The downstream HEPA filter, although not 

credited in the accident analysis, collects charcoal fines and serves as a 

backup should the upstream HEPA filter develop a leak. The system 

initiates filtered ventilation following receipt of a safety injection signal.

The PREACS is a standby system, parts of which may also operate 

during normal unit operations. During emergency operations, the 

PREACS dampers are realigned and fans are started to initiate filtration. 

Upon receipt of the actuating signal(s), normal air discharges from the 

penetration room, the penetration room is isolated, and the stream of 

ventilation air discharges through the system filter trains. The prefilters 

remove any large particles in the air, as well as any entrained water 

droplets, to prevent excessive loading of the HEPA filters and charcoal 

adsorbers.

The PREACS is discussed in the FSAR, Sections [6.5.1], [9.4.5], 

and [15.6.5] (Refs. 1, 2, and 3, respectively) since it may be used for 

normal, as well as post accident, atmospheric cleanup functions. Heaters 

may be included for moisture removal on systems operating in high 

humidity conditions. The primary purpose of the heaters is to maintain 

the relative humidity at an acceptable level consistent with iodine removal 

efficiencies per Regulatory Guide 1.52 (Ref. 4).

APPLICABLE The PREACS design basis is established by the large break loss of

SAFETY coolant accident (LOCA). The system evaluation assumes a passive

ANALYSES failure outside containment, such as valve packing leakage during a 

Design Basis Accident (DBA). In such a case, the system restricts the 

failure outside containment, such as valve packing leakage during a
PREACS

B 3.7.14

Westinghouse STS B 3.7.14-2 Rev. 4.0

BASES 

APPLICABLE SAFETY ANALYSES (continued)

Design Basis Accident (DBA). In such a case, the system restricts the 

radioactive release to within the 10 CFR 100 (Ref. 4) limits, or the NRC 

staff approved licensing basis (e.g., a specified fraction of 10 CFR 100 

limits). The analysis of the effects and consequences of a large break 

LOCA are presented in Reference 3.

Two types of system failures are considered in the accident analysis: a 

complete loss of function, and excessive LEAKAGE. Either type of failure 

may result in less efficient removal of any gaseous or particulate material 

released to the penetration room following a LOCA.

The PREACS satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO Two independent and redundant trains of the PREACS are required to be 

OPERABLE to ensure that at least one train is available, assuming there 

is a single failure disabling the other train coincident with a loss of offsite 

power.

The PREACS is considered OPERABLE when the individual components 

necessary to control radioactive releases are OPERABLE in both trains. 

A PREACS train is considered OPERABLE when its associated:

a. Fan is OPERABLE,

b. HEPA filter and charcoal adsorber are not excessively restricting 

flow, and are capable of performing their filtration functions, and

c. Heater, demister, ductwork, valves, and dampers are OPERABLE 

and air circulation can be maintained.

The LCO is modified by a Note allowing the penetration room boundary to 

be opened intermittently under administrative controls. For entry and exit 

through doors, the administrative control of the opening is performed by 

the person(s) entering or exiting the area. For other openings, these 

controls consist of stationing a dedicated individual at the opening who is 

in continuous communication with the control room. This individual will 

have a method to rapidly close the opening when a need for penetration 

room isolation is indicated.

APPLICABILITY In MODES 1, 2, 3, and 4, the PREACS is required to be OPERABLE, 

consistent with the OPERABILITY requirements of the Emergency Core 

Cooling System (ECCS).

In MODE 5 or 6, the PREACS is not required to be OPERABLE since the 

ECCS is not required to be OPERABLE.
PREACS

B 3.7.14

Westinghouse STS B 3.7.14-3 Rev. 4.0

BASES 

ACTIONS A.1

With one PREACS train inoperable, the action must be taken to restore 

OPERABLE status within 7 days. During this period, the remaining 

OPERABLE train is adequate to perform the PREACS function. The 

7 day Completion Time is appropriate because the risk contribution of the 

PREACS is less than that of the ECCS (72 hour Completion Time), and 

this system is not a direct support system for the ECCS. The 7 day 

Completion Time is based on the low probability of a DBA occurring 

during this period, and the remaining train providing the required 

capability.

B.1

-----------------------------------REVIEWER’S NOTE-----------------------------------

Adoption of Condition B is dependent on a commitment from the licensee 

to have guidance available describing compensatory measures to be 

taken in the event of an intentional and unintentional entry into 

Condition B.

--------------------------------------------------------------------------------------------------

If the penetration room boundary is inoperable, the PREACS trains 

cannot perform their intended functions. Actions must be taken to restore 

an OPERABLE penetration room boundary within 24 hours. During the 

period that the penetration room boundary is inoperable, appropriate 

compensatory measures [consistent with the intent, as applicable, of 

GDC 19, 60, 64 and 10 CFR Part 100] should be utilized to protect plant 

personnel from potential hazards such as radioactive contamination, toxic 

chemicals, smoke, temperature and relative humidity, and physical 

security. Preplanned measures should be available to address these 

concerns for intentional and unintentional entry into the condition. The 

24 hour Completion Time is reasonable based on the low probability of a 

DBA occurring during this time period, and the use of compensatory 

measures. The 24 hour Completion Time is a typically reasonable time to 

diagnose, plan and possibly repair, and test most problems with the 

penetration room boundary.

C.1 and C.2

If the inoperable train or penetration room boundary cannot be restored to 

OPERABLE status within the associated Completion Time, the unit must 

be placed in a MODE in which the LCO does not apply. To achieve this 

status, the unit must be placed in at least MODE 3 within 6 hours, and in 

MODE 5 within 36 hours. The Completion Times are reasonable, based 
PREACS

B 3.7.14

Westinghouse STS B 3.7.14-4 Rev. 4.0

BASES

ACTIONS (continued)

on operating experience, to reach the required unit conditions from full 

power conditions in an orderly manner and without challenging unit 

systems.

SURVEILLANCE SR 3.7.14.1

REQUIREMENTS

Standby systems should be checked periodically to ensure that they 

function properly. As the environmental and normal operating conditions 

on this system are not severe, testing each train once every month 

provides an adequate check on this system. Monthly heater operation 

dries out any moisture that may have accumulated in the charcoal as a 

result of humidity in the ambient air. [Systems with heaters must be 

operated for ≥10 continuous hours with the heaters energized. Systems 

without heaters need only be operated for ≥15 minutes to demonstrate 

the function of the system.] [ The 31 day Frequency is based on the 

known reliability of equipment and the two train redundancy available.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.7.14.2

This SR verifies that the required PREACS testing is performed in 

accordance with the [Ventilation Filter Testing Program (VFTP)]. The 

[VFTP] includes testing HEPA filter performance, charcoal adsorber 

efficiency, minimum system flow rate, and the physical properties of the 

activated charcoal (general use and following specific operations). 

Specific test frequencies and additional information are discussed in 

detail in the [VFTP].
PREACS

B 3.7.14

Westinghouse STS B 3.7.14-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.7.14.3

This SR verifies that each PREACS starts and operates on an actual or 

simulated actuation signal. [ The [18] month Frequency is consistent with 

that specified in Reference 5.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

[ SR 3.7.14.4

This SR verifies the integrity of the penetration room enclosure. The 

ability of the penetration room to maintain a negative pressure, with 

respect to potentially uncontaminated adjacent areas, is periodically 

tested to verify proper function of PREACS. During the [post accident] 

mode of operation, the PREACS is designed to maintain a 

≤[-0.125] inches water gauge relative to atmospheric pressure at a flow 

rate of [3000] cfm in the penetration room, with respect to adjacent areas, 

to prevent unfiltered LEAKAGE. 

The minimum system flow rate maintains a slight negative pressure in the 

penetration room area, and provides sufficient air velocity to transport 

particulate contaminants, assuming only one filter train is operating. The 

number of filter elements is selected to limit the flow rate through any 

individual element to about [3000] cfm. This may vary based on filter 

housing geometry. The maximum limit ensures that the flow through, and 

pressure drop across, each filter element are not excessive.

The number and depth of the adsorber elements ensure that, at the 

maximum flow rate, the residence time of the air stream in the charcoal 

bed achieves the desired adsorption rate. At least a [0.125] second 

residence time is necessary for an assumed [99]% efficiency.
PREACS

B 3.7.14

Westinghouse STS B 3.7.14-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The filters have a certain pressure drop at the design flow rate when 

clean. The magnitude of the pressure drop indicates acceptable 

performance, and is based on manufacturers' recommendations for the 

filter and adsorber elements at the design flow rate. An increase in 

pressure drop or a decrease in flow indicates that the filter is being loaded 

or that there are other problems with the system.

[ This test is conducted along with the tests for filter penetration; thus, the 

[18] month Frequency is consistent with that specified in Reference 5.

The Frequency of [18] months is also consistent with the guidance 

provided in NUREG-0800 (Ref. 6).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]

[ SR 3.7.14.5

It is necessary to operate the PREACS filter bypass damper to ensure 

that the system functions properly. The OPERABILITY of the PREACS 

filter bypass damper is verified if it can be closed. [ An [18] month 

Frequency is consistent with that specified in Reference 5.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

---------------------------------------------------------------------------------------------- ] ]
PREACS

B 3.7.14

Westinghouse STS B 3.7.14-7 Rev. 4.0

BASES 

REFERENCES 1. FSAR, Section [6.5.1].

2. FSAR, Section [9.4.5].

3. FSAR, Section [15.6.5].

4. 10 CFR 100.

5. Regulatory Guide 1.52, Rev. [2].

6. NUREG-0800, Section 6.5.1, Rev. 2, July 1981.

Fuel Storage Pool Water Level

B 3.7.15

Westinghouse STS B 3.7.15-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.15 Fuel Storage Pool Water Level

BASES

BACKGROUND The minimum water level in the fuel storage pool meets the assumptions 

of iodine decontamination factors following a fuel handling accident. The 

specified water level shields and minimizes the general area dose when 

the storage racks are filled to their maximum capacity. The water also 

provides shielding during the movement of spent fuel.

A general description of the fuel storage pool design is given in the FSAR, 

Section [9.1.2] (Ref. 1). A description of the Spent Fuel Pool Cooling and 

Cleanup System is given in the FSAR, Section [9.1.3] (Ref. 2). The 

assumptions of the fuel handling accident are given in the FSAR, 

Section [15.7.4] (Ref. 3).

APPLICABLE The minimum water level in the fuel storage pool meets the 

SAFETY assumptions of the fuel handling accident described in Regulatory 

ANALYSES Guide 1.25 (Ref. 4). The resultant 2 hour thyroid dose per person at the 

exclusion area boundary is a small fraction of the 10 CFR 100 (Ref. 5) 

limits.

According to Reference 4, there is 23 ft of water between the top of the 

damaged fuel bundle and the fuel pool surface during a fuel handling 

accident. With 23 ft of water, the assumptions of Reference 4 can be 

used directly. In practice, this LCO preserves this assumption for the bulk 

of the fuel in the storage racks. In the case of a single bundle dropped 

and lying horizontally on top of the spent fuel racks, however, there may 

be < 23 ft of water above the top of the fuel bundle and the surface, 

indicated by the width of the bundle. To offset this small 

nonconservatism, the analysis assumes that all fuel rods fail, although 

analysis shows that only the first few rows fail from a hypothetical 

maximum drop.

The fuel storage pool water level satisfies Criteria 2 and 3 of 

10 CFR 50.36(c)(2)(ii).

LCO The fuel storage pool water level is required to be ≥ 23 ft over the top of 

irradiated fuel assemblies seated in the storage racks. The specified 

water level preserves the assumptions of the fuel handling accident 

analysis (Ref. 3). As such, it is the minimum required for fuel storage and 

movement within the fuel storage pool.
Fuel Storage Pool Water Level

B 3.7.15

Westinghouse STS B 3.7.15-2 Rev. 4.0

BASES 

APPLICABILITY This LCO applies during movement of irradiated fuel assemblies in the 

fuel storage pool, since the potential for a release of fission products 

exists.

ACTIONS A.1

Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does 

not apply.

When the initial conditions for prevention of an accident cannot be met, 

steps should be taken to preclude the accident from occurring. When the 

fuel storage pool water level is lower than the required level, the 

movement of irradiated fuel assemblies in the fuel storage pool is 

immediately suspended to a safe position. This action effectively 

precludes the occurrence of a fuel handling accident. This does not 

preclude movement of a fuel assembly to a safe position.

If moving irradiated fuel assemblies while in MODE 5 or 6, LCO 3.0.3 

would not specify any action. If moving irradiated fuel assemblies while in 

MODES 1, 2, 3, and 4, the fuel movement is independent of reactor 

operations. Therefore, inability to suspend movement of irradiated fuel 

assemblies is not sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.7.15.1

REQUIREMENTS

This SR verifies sufficient fuel storage pool water is available in the event 

of a fuel handling accident. The water level in the fuel storage pool must 

be checked periodically. [ The 7 day Frequency is appropriate because 

the volume in the pool is normally stable. Water level changes are 

controlled by plant procedures and are acceptable based on operating 

experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

During refueling operations, the level in the fuel storage pool is in 

equilibrium with the refueling canal, and the level in the refueling canal is 

checked daily in accordance with SR 3.9.6.1.
Fuel Storage Pool Water Level

B 3.7.15

Westinghouse STS B 3.7.15-3 Rev. 4.0

BASES

REFERENCES 1. FSAR, Section [9.1.2].

2. FSAR, Section [9.1.3].

3. FSAR, Section [15.7.4].

4. Regulatory Guide 1.25, [Rev. 0].

5. 10 CFR 100.11.

[Fuel Storage Pool Boron Concentration]

B 3.7.16

Westinghouse STS B 3.7.16-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.16 [ Fuel Storage Pool Boron Concentration ]

BASES

BACKGROUND In the Maximum Density Rack (MDR) [(Refs. 1 and 2)] design, the spent 

fuel storage pool is divided into two separate and distinct regions which, 

for the purpose of criticality considerations, are considered as separate 

pools. [Region 1], with [336] storage positions, is designed to 

accommodate new fuel with a maximum enrichment of [4.65] wt% U-235, 

or spent fuel regardless of the discharge fuel burnup. [Region 2], with 

[2670] storage positions, is designed to accommodate fuel of various 

initial enrichments which have accumulated minimum burnups within the 

acceptable domain according to Figure [3.7.17-1], in the accompanying 

LCO. Fuel assemblies not meeting the criteria of Figure [3.7.17-1] shall 

be stored in accordance with paragraph 4.3.1.1 in Section 4.3, Fuel 

Storage.

The water in the spent fuel storage pool normally contains soluble boron, 

which results in large subcriticality margins under actual operating 

conditions. However, the NRC guidelines, based upon the accident 

condition in which all soluble poison is assumed to have been lost, 

specify that the limiting keff of 0.95 be evaluated in the absence of soluble 

boron. Hence, the design of both regions is based on the use of 

unborated water, which maintains each region in a subcritical condition 

during normal operation with the regions fully loaded. The double 

contingency principle discussed in ANSI N-16.1-1975 and the April 1978 

NRC letter (Ref. 3) allows credit for soluble boron under other abnormal 

or accident conditions, since only a single accident need be considered at 

one time. For example, the most severe accident scenario is associated 

with the movement of fuel from [Region 1 to Region 2], and accidental 

misloading of a fuel assembly in [Region 2]. This could potentially 

increase the criticality of [Region 2]. To mitigate these postulated 

criticality related accidents, boron is dissolved in the pool water. Safe 

operation of the MDR with no movement of assemblies may therefore be 

achieved by controlling the location of each assembly in accordance with 

LCO 3.7.17, "Spent Fuel Assembly Storage." Prior to movement of an 

assembly, it is necessary to perform SR 3.7.16.1.

APPLICABLE Most accident conditions do not result in an increase in the activity of

SAFETY either of the two regions. Examples of these accident conditions are the

ANALYSES loss of cooling (reactivity increase with decreasing water density) and the 

dropping of a fuel assembly on the top of the rack. However, accidents 

can be postulated that could increase the reactivity. This increase in 

reactivity is unacceptable with unborated water in the storage pool. Thus, 

for these accident occurrences, the presence of soluble boron in the
[Fuel Storage Pool Boron Concentration]

B 3.7.16

Westinghouse STS B 3.7.16-2 Rev. 4.0

BASES 

APPLICABLE SAFETY ANALYSES (continued)

storage pool prevents criticality in both regions. The postulated accidents 

are basically of two types. A fuel assembly could be incorrectly 

transferred from [Region 1 to Region 2] (e.g., an unirradiated fuel 

assembly or an insufficiently depleted fuel assembly). The second type of 

postulated accidents is associated with a fuel assembly which is dropped 

adjacent to the fully loaded [Region 2] storage rack. This could have a 

small positive reactivity effect on [Region 2]. However, the negative 

reactivity effect of the soluble boron compensates for the increased 

reactivity caused by either one of the two postulated accident scenarios. 

The accident analyses is provided in the FSAR, Section [15.7.4] (Ref. 4).

The concentration of dissolved boron in the fuel storage pool satisfies 

Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The fuel storage pool boron concentration is required to be ≥ [2300] ppm. 

The specified concentration of dissolved boron in the fuel storage pool 

preserves the assumptions used in the analyses of the potential critical 

accident scenarios as described in Reference 4. This concentration of 

dissolved boron is the minimum required concentration for fuel assembly 

storage and movement within the fuel storage pool.

APPLICABILITY This LCO applies whenever fuel assemblies are stored in the spent fuel 

storage pool, until a complete spent fuel storage pool verification has 

been performed following the last movement of fuel assemblies in the 

spent fuel storage pool. This LCO does not apply following the 

verification, since the verification would confirm that there are no 

misloaded fuel assemblies. With no further fuel assembly movements in 

progress, there is no potential for a misloaded fuel assembly or a dropped 

fuel assembly.

ACTIONS A.1, A.2.1, and A.2.2

The Required Actions are modified by a Note indicating that LCO 3.0.3 

does not apply.

When the concentration of boron in the fuel storage pool is less than 

required, immediate action must be taken to preclude the occurrence of 

an accident or to mitigate the consequences of an accident in progress. 

This is most efficiently achieved by immediately suspending the 

movement of fuel assemblies. The concentration of boron is restored 

simultaneously with suspending movement of fuel assemblies. 

Alternatively, beginning a verification of the fuel storage pool fuel 

locations, to ensure proper locations of the fuel, can be performed. 

However, prior to resuming movement of fuel assemblies, the 

concentration of boron must be restored. This does not preclude 

movement of a fuel assembly to a safe position.
[Fuel Storage Pool Boron Concentration]

B 3.7.16

Westinghouse STS B 3.7.16-3 Rev. 4.0

BASES

ACTIONS (continued)

If the LCO is not met while moving irradiated fuel assemblies in MODE 5 

or 6, LCO 3.0.3 would not be applicable. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operation. Therefore, inability to suspend 

movement of fuel assemblies is not sufficient reason to require a reactor 

shutdown.

SURVEILLANCE SR 3.7.16.1

REQUIREMENTS

This SR verifies that the concentration of boron in the fuel storage pool is 

within the required limit. As long as this SR is met, the analyzed 

accidents are fully addressed. [ The 7 day Frequency is appropriate 

because no major replenishment of pool water is expected to take place 

over such a short period of time.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES [ 1. Callaway FSAR, Appendix 9.1A, "The Maximum Density Rack (MDR) 

Design Concept."

2. Description and Evaluation for Proposed Changes to Facility 

Operating Licenses DPR-39 and DPR-48 (Zion Power Station). ]

3. Double contingency principle of ANSI N16.1-1975, as specified in the 

April 14, 1978 NRC letter (Section 1.2) and implied in the proposed 

revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).

4. FSAR, Section [15.7.4].

[Spent Fuel Pool Storage]

B 3.7.17

Westinghouse STS B 3.7.17-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.17 [ Spent Fuel Pool Storage ]

BASES

BACKGROUND In the Maximum Density Rack (MDR) [(Refs. 1 and 2)] design, the spent 

fuel storage pool is divided into two separate and distinct regions which, 

for the purpose of criticality considerations, are considered as separate 

pools. [Region 1], with [336] storage positions, is designed to 

accommodate new fuel with a maximum enrichment of [4.65] wt% U-235, 

or spent fuel regardless of the discharge fuel burnup. [Region 2], with 

[2670] storage positions, is designed to accommodate fuel of various 

initial enrichments which have accumulated minimum burnups within the 

acceptable domain according to Figure 3.7.17-1, in the accompanying 

LCO. Fuel assemblies not meeting the criteria of Figure [3.7.17-1] shall 

be stored in accordance with paragraph 4.3.1.1 in Section 4.3, Fuel 

Storage.

The water in the spent fuel storage pool normally contains soluble boron, 

which results in large subcriticality margins under actual operating 

conditions. However, the NRC guidelines, based upon the accident 

condition in which all soluble poison is assumed to have been lost, 

specify that the limiting keff of 0.95 be evaluated in the absence of soluble 

boron. Hence, the design of both regions is based on the use of 

unborated water, which maintains each region in a subcritical condition 

during normal operation with the regions fully loaded. The double 

contingency principle discussed in ANSI N-16.1-1975 and the April 1978 

NRC letter (Ref. 3) allows credit for soluble boron under other abnormal 

or accident conditions, since only a single accident need be considered at 

one time. For example, the most severe accident scenario is associated 

with the movement of fuel from [Region 1 to Region 2], and accidental 

misloading of a fuel assembly in [Region 2]. This could potentially 

increase the criticality of [Region 2]. To mitigate these postulated 

criticality related accidents, boron is dissolved in the pool water. Safe 

operation of the MDR with no movement of assemblies may therefore be 

achieved by controlling the location of each assembly in accordance with 

the accompanying LCO. Prior to movement of an assembly, it is 

necessary to perform SR 3.7.16.1.
[Spent Fuel Pool Storage]

B 3.7.17

Westinghouse STS B 3.7.17-2 Rev. 4.0

BASES 

APPLICABLE The hypothetical accidents can only take place during or as a result of

SAFETY the movement of an assembly (Ref. 4). For these accident occurrences, 

ANALYSES the presence of soluble boron in the spent fuel storage pool (controlled by 

LCO 3.7.16, "Fuel Storage Pool Boron Concentration") prevents criticality 

in both regions. By closely controlling the movement of each assembly 

and by checking the location of each assembly after movement, the time 

period for potential accidents may be limited to a small fraction of the total 

operating time. During the remaining time period with no potential for 

accidents, the operation may be under the auspices of the accompanying 

LCO.

The configuration of fuel assemblies in the fuel storage pool satisfies 

Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO The restrictions on the placement of fuel assemblies within the spent fuel 

pool, in accordance with Figure 3.7.17-1, in the accompanying LCO, 

ensures the keff of the spent fuel storage pool will always remain < 0.95, 

assuming the pool to be flooded with unborated water. Fuel assemblies 

not meeting the criteria of Figure [3.7.17-1] shall be stored in accordance 

with Specification 4.3.1.1 in Section 4.3.

APPLICABILITY This LCO applies whenever any fuel assembly is stored in [Region 2] of 

the fuel storage pool.

ACTIONS A.1

Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does 

not apply.

When the configuration of fuel assemblies stored in [Region 2] the spent 

fuel storage pool is not in accordance with Figure 3.7.17-1, or 

paragraph 4.3.1.1, the immediate action is to initiate action to make the 

necessary fuel assembly movement(s) to bring the configuration into 

compliance with Figure 3.7.17-1 or Specification 4.3.1.1.

If unable to move irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not be applicable. If unable to move irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the action is independent of 

reactor operation. Therefore, inability to move fuel assemblies is not 

sufficient reason to require a reactor shutdown.
[Spent Fuel Pool Storage]

B 3.7.17

Westinghouse STS B 3.7.17-3 Rev. 4.0

BASES 

SURVEILLANCE SR 3.7.17.1

REQUIREMENTS

This SR verifies by administrative means that the initial enrichment and 

burnup of the fuel assembly is in accordance with Figure [3.7.17-1] in the 

accompanying LCO. For fuel assemblies in the unacceptable range of 

Figure 3.7.17-1, performance of this SR will ensure compliance with 

Specification 4.3.1.1.

REFERENCES [ 1. Callaway FSAR, Appendix 9.1A, "The Maximum Density Rack (MDR) 

Design Concept."

2. Description and Evaluation for Proposed Changes to Facility 

Operating Licenses DPR-39 and DPR-48 (Zion Power Station). ]

3. Double contingency principle of ANSI N16.1-1975, as specified in the 

April 14, 1978 NRC letter (Section 1.2) and implied in the proposed 

revision to Regulatory Guide 1.13 (Section 1.4, Appendix A).

4. FSAR, Section [15.7.4].

Secondary Specific Activity

B 3.7.18

Westinghouse STS B 3.7.18-1 Rev. 4.0

B 3.7 PLANT SYSTEMS

B 3.7.18 Secondary Specific Activity

BASES

BACKGROUND Activity in the secondary coolant results from steam generator tube 

outleakage from the Reactor Coolant System (RCS). Under steady state 

conditions, the activity is primarily iodines with relatively short half lives 

and, thus, indicates current conditions. During transients, I-131 spikes 

have been observed as well as increased releases of some noble gases. 

Other fission product isotopes, as well as activated corrosion products in 

lesser amounts, may also be found in the secondary coolant.

A limit on secondary coolant specific activity during power operation 

minimizes releases to the environment because of normal operation, 

anticipated operational occurrences, and accidents.

This limit is lower than the activity value that might be expected from a 

1 gpm tube leak (LCO 3.4.13, "RCS Operational LEAKAGE") of primary 

coolant at the limit of [1.0] μCi/gm (LCO 3.4.16, "RCS Specific Activity"). 

The steam line failure is assumed to result in the release of the noble gas 

and iodine activity contained in the steam generator inventory, the 

feedwater, and the reactor coolant LEAKAGE. Most of the iodine isotopes 

have short half lives (i.e., < 20 hours).

With the specified activity limit, the resultant 2 hour thyroid dose to a 

person at the exclusion area boundary (EAB) would be about 0.58 rem if 

the main steam safety valves (MSSVs) open for 2 hours following a trip 

from full power.

Operating a unit at the allowable limits could result in a 2 hour EAB 

exposure of a small fraction of the 10 CFR 100 (Ref. 1) limits, or the limits 

established as the NRC staff approved licensing basis.

APPLICABLE The accident analysis of the main steam line break (MSLB), as

SAFETY discussed in the FSAR, Chapter [15] (Ref. 2) assumes the initial

ANALYSES secondary coolant specific activity to have a radioactive isotope 

concentration of [0.10] μCi/gm DOSE EQUIVALENT I-131. This 

assumption is used in the analysis for determining the radiological 

consequences of the postulated accident. The accident analysis, based 

on this and other assumptions, shows that the radiological consequences 

of an MSLB do not exceed a small fraction of the unit EAB limits (Ref. 1) 

for whole body and thyroid dose rates.

With the loss of offsite power, the remaining steam generators are 

available for core decay heat dissipation by venting steam to the 

atmosphere through the MSSVs and steam generator atmospheric dump 

valves (ADVs). The Auxiliary Feedwater System supplies the necessary
Secondary Specific Activity

B 3.7.18

Westinghouse STS B 3.7.18-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

makeup to the steam generators. Venting continues until the reactor 

coolant temperature and pressure have decreased sufficiently for the 

Residual Heat Removal System to complete the cooldown.

In the evaluation of the radiological consequences of this accident, the 

activity released from the steam generator connected to the failed steam 

line is assumed to be released directly to the environment. The 

unaffected steam generator is assumed to discharge steam and any 

entrained activity through the MSSVs and ADVs during the event. Since 

no credit is taken in the analysis for activity plateout or retention, the 

resultant radiological consequences represent a conservative estimate of 

the potential integrated dose due to the postulated steam line failure.

Secondary specific activity limits satisfy Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO As indicated in the Applicable Safety Analyses, the specific activity of the 

secondary coolant is required to be ≤ [0.10] μCi/gm DOSE 

EQUIVALENT I-131 to limit the radiological consequences of a Design 

Basis Accident (DBA) to a small fraction of the required limit (Ref. 1).

Monitoring the specific activity of the secondary coolant ensures that 

when secondary specific activity limits are exceeded, appropriate actions 

are taken in a timely manner to place the unit in an operational MODE 

that would minimize the radiological consequences of a DBA.

APPLICABILITY In MODES 1, 2, 3, and 4, the limits on secondary specific activity apply 

due to the potential for secondary steam releases to the atmosphere.

In MODES 5 and 6, the steam generators are not being used for heat 

removal. Both the RCS and steam generators are depressurized, and 

primary to secondary LEAKAGE is minimal. Therefore, monitoring of 

secondary specific activity is not required.

ACTIONS A.1 and A.2

DOSE EQUIVALENT I-131 exceeding the allowable value in the 

secondary coolant, is an indication of a problem in the RCS and 

contributes to increased post accident doses. If the secondary specific 

activity cannot be restored to within limits within the associated 

Completion Time, the unit must be placed in a MODE in which the LCO 

does not apply. To achieve this status, the unit must be placed in at least 

MODE 3 within 6 hours, and in MODE 5 within 36 hours. The allowed 

Completion Times are reasonable, based on operating experience, to 

reach the required unit conditions from full power conditions in an orderly 

manner and without challenging unit systems.
Secondary Specific Activity

B 3.7.18

Westinghouse STS B 3.7.18-3 Rev. 4.0

BASES 

SURVEILLANCE SR 3.7.18.1

REQUIREMENTS

This SR verifies that the secondary specific activity is within the limits of 

the accident analysis. A gamma isotopic analysis of the secondary 

coolant, which determines DOSE EQUIVALENT I-131, confirms the 

validity of the safety analysis assumptions as to the source terms in post 

accident releases. It also serves to identify and trend any unusual 

isotopic concentrations that might indicate changes in reactor coolant 

activity or LEAKAGE. [ The 31 day Frequency is based on the detection 

of increasing trends of the level of DOSE EQUIVALENT I-131, and allows 

for appropriate action to be taken to maintain levels below the LCO limit.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 100.11.

2. FSAR, Chapter [15].

AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.1 AC Sources - Operating

BASES

BACKGROUND The unit Class 1E AC Electrical Power Distribution System AC sources 

consist of the offsite power sources (preferred power sources, normal and 

alternate(s)), and the onsite standby power sources (Train A and Train B 

diesel generators (DGs)). As required by 10 CFR 50, Appendix A, 

GDC 17 (Ref. 1), the design of the AC electrical power system provides 

independence and redundancy to ensure an available source of power to 

the Engineered Safety Feature (ESF) systems.

The onsite Class 1E AC Distribution System is divided into redundant 

load groups (trains) so that the loss of any one group does not prevent 

the minimum safety functions from being performed. Each train has 

connections to two preferred offsite power sources and a single DG.

Offsite power is supplied to the unit switchyard(s) from the transmission 

network by [two] transmission lines. From the switchyard(s), two 

electrically and physically separated circuits provide AC power, through 

[step down station auxiliary transformers], to the 4.16 kV ESF buses. A 

detailed description of the offsite power network and the circuits to the 

Class 1E ESF buses is found in the FSAR, Chapter [8] (Ref. 2).

An offsite circuit consists of all breakers, transformers, switches, 

interrupting devices, cabling, and controls required to transmit power from 

the offsite transmission network to the onsite Class 1E ESF bus(es).

Certain required unit loads are returned to service in a predetermined 

sequence in order to prevent overloading the transformer supplying offsite 

power to the onsite Class 1E Distribution System. Within [1] minute after 

the initiating signal is received, all automatic and permanently connected 

loads needed to recover the unit or maintain it in a safe condition are 

returned to service via the load sequencer.

The onsite standby power source for each 4.16 kV ESF bus is a 

dedicated DG. DGs [11] and [12] are dedicated to ESF buses [11] 

and [12], respectively. A DG starts automatically on a safety injection (SI) 

signal (i.e., low pressurizer pressure or high containment pressure 

signals) or on an [ESF bus degraded voltage or undervoltage signal] 

(refer to LCO 3.3.5, "Loss of Power (LOP) Diesel Generator (DG) Start 

Instrumentation"). After the DG has started, it will automatically tie to its 

respective bus after offsite power is tripped as a consequence of ESF bus 

undervoltage or degraded voltage, independent of or coincident with an 

SI signal. The DGs will also start and operate in the standby mode 

without tying to the ESF bus on an SI signal alone. Following the trip of 

offsite power, [a sequencer/an undervoltage signal] strips nonpermanent
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-2 Rev. 4.0

BASES

BACKGROUND (continued)

loads from the ESF bus. When the DG is tied to the ESF bus, loads are 

then sequentially connected to its respective ESF bus by the automatic 

load sequencer. The sequencing logic controls the permissive and 

starting signals to motor breakers to prevent overloading the DG by 

automatic load application.

In the event of a loss of preferred power, the ESF electrical loads are 

automatically connected to the DGs in sufficient time to provide for safe 

reactor shutdown and to mitigate the consequences of a Design Basis 

Accident (DBA) such as a loss of coolant accident (LOCA).

Certain required unit loads are returned to service in a predetermined 

sequence in order to prevent overloading the DG in the process. Within 

[1] minute after the initiating signal is received, all loads needed to 

recover the unit or maintain it in a safe condition are returned to service.

Ratings for Train A and Train B DGs satisfy the requirements of 

Regulatory Guide 1.9 (Ref. 3). The continuous service rating of each DG 

is [7000] kW with [10]% overload permissible for up to 2 hours in any 

24 hour period. The ESF loads that are powered from the 4.16 kV ESF 

buses are listed in Reference 2.

APPLICABLE The initial conditions of DBA and transient analyses in the FSAR,

SAFETY Chapter [6] (Ref. 4) and Chapter [15] (Ref. 5), assume ESF systems are

ANALYSES OPERABLE. The AC electrical power sources are designed to provide 

sufficient capacity, capability, redundancy, and reliability to ensure the 

availability of necessary power to ESF systems so that the fuel, Reactor 

Coolant System (RCS), and containment design limits are not exceeded. 

These limits are discussed in more detail in the Bases for Section 3.2, 

Power Distribution Limits; Section 3.4, Reactor Coolant System (RCS);

and Section 3.6, Containment Systems.

The OPERABILITY of the AC electrical power sources is consistent with 

the initial assumptions of the Accident analyses and is based upon 

meeting the design basis of the unit. This results in maintaining at least 

one train of the onsite or offsite AC sources OPERABLE during Accident 

conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC power and

b. A worst case single failure.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-3 Rev. 4.0

BASES

LCO Two qualified circuits between the offsite transmission network and the 

onsite Class 1E Electrical Power System and separate and independent 

DGs for each train ensure availability of the required power to shut down 

the reactor and maintain it in a safe shutdown condition after an 

anticipated operational occurrence (AOO) or a postulated DBA.

Qualified offsite circuits are those that are described in the FSAR and are 

part of the licensing basis for the unit.

[ In addition, one required automatic load sequencer per train must be 

OPERABLE. ]

Each offsite circuit must be capable of maintaining rated frequency and 

voltage, and accepting required loads during an accident, while 

connected to the ESF buses.

[ Offsite circuit #1 consists of Safeguards Transformer B, which is supplied 

from Switchyard Bus B, and is fed through breaker 52-3 powering the 

ESF transformer XNB01, which, in turn, powers the #1 ESF bus through 

its normal feeder breaker. Offsite circuit #2 consists of the Startup 

Transformer, which is normally fed from the Switchyard Bus A, and is fed 

through breaker PA 0201, powering the ESF transformer, which, in turn, 

powers the #2 ESF bus through its normal feeder breaker. ]

Each DG must be capable of starting, accelerating to rated speed and 

voltage, and connecting to its respective ESF bus on detection of bus 

undervoltage. This will be accomplished within [10] seconds. Each DG 

must also be capable of accepting required loads within the assumed 

loading sequence intervals, and continue to operate until offsite power 

can be restored to the ESF buses. These capabilities are required to be 

met from a variety of initial conditions such as DG in standby with the 

engine hot and DG in standby with the engine at ambient conditions. 

Additional DG capabilities must be demonstrated to meet required 

Surveillance, e.g., capability of the DG to revert to standby status on an 

ECCS signal while operating in parallel test mode.

Proper sequencing of loads, [including tripping of nonessential loads,] is a 

required function for DG OPERABILITY.

The AC sources in one train must be separate and independent (to the 

extent possible) of the AC sources in the other train. For the DGs, 

separation and independence are complete.

For the offsite AC sources, separation and independence are to the 

extent practical. A circuit may be connected to more than one ESF bus, 

with fast transfer capability to the other circuit OPERABLE, and not 

violate separation criteria. A circuit that is not connected to an ESF bus is 

required to have OPERABLE fast transfer interlock mechanisms to at 

least two ESF buses to support OPERABILITY of that circuit.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-4 Rev. 4.0

BASES

APPLICABILITY The AC sources [and sequencers] are required to be OPERABLE in 

MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and

b. Adequate core cooling is provided and containment OPERABILITY 

and other vital functions are maintained in the event of a postulated 

DBA.

The AC power requirements for MODES 5 and 6 are covered in 

LCO 3.8.2, "AC Sources - Shutdown."

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable DG. 

There is an increased risk associated with entering a MODE or other 

specified condition in the Applicability with an inoperable DG and the 

provisions of LCO 3.0.4.b, which allow entry into a MODE or other 

specified condition in the Applicability with the LCO not met after 

performance of a risk assessment addressing inoperable systems and 

components, should not be applied in this circumstance.

A.1

To ensure a highly reliable power source remains with one offsite circuit

inoperable, it is necessary to verify the OPERABILITY of the remaining 

required offsite circuit on a more frequent basis. Since the Required 

Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria 

does not result in a Required Action not met. However, if a second 

required circuit fails SR 3.8.1.1, the second offsite circuit is inoperable, 

and Condition C, for two offsite circuits inoperable, is entered.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The turbine driven auxiliary feedwater pump is only required to be 

considered a redundant required feature, and, therefore, required to be 

determined OPERABLE by this Required Action, if the design is such that 

the remaining OPERABLE motor or turbine driven auxiliary feedwater 

pump(s) is not by itself capable (without any reliance on the motor driven 

auxiliary feedwater pump powered by the emergency bus associated with 

the inoperable diesel generator) of providing 100% of the auxiliary 

feedwater flow assumed in the safety analysis.

--------------------------------------------------------------------------------------------------
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-5 Rev. 4.0

BASES

ACTIONS (continued)

A.2

Required Action A.2, which only applies if the train cannot be powered 

from an offsite source, is intended to provide assurance that an event 

coincident with a single failure of the associated DG will not result in a 

complete loss of safety function of critical redundant required features. 

These features are powered from the redundant AC electrical power train. 

This includes motor driven auxiliary feedwater pumps. Single train 

systems, such as turbine driven auxiliary feedwater pumps, may not be 

included.

The Completion Time for Required Action A.2 is intended to allow the 

operator time to evaluate and repair any discovered inoperabilities. This 

Completion Time also allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." In this Required Action, 

the Completion Time only begins on discovery that both:

a. The train has no offsite power supplying it loads and

b. A required feature on the other train is inoperable.

If at any time during the existence of Condition A (one offsite circuit 

inoperable) a redundant required feature subsequently becomes 

inoperable, this Completion Time begins to be tracked.

Discovering no offsite power to one train of the onsite Class 1E Electrical 

Power Distribution System coincident with one or more inoperable 

required support or supported features, or both, that are associated with 

the other train that has offsite power, results in starting the Completion 

Times for the Required Action. Twenty-four hours is acceptable because 

it minimizes risk while allowing time for restoration before subjecting the 

unit to transients associated with shutdown.

The remaining OPERABLE offsite circuit and DGs are adequate to supply 

electrical power to Train A and Train B of the onsite Class 1E Distribution 

System. The 24 hour Completion Time takes into account the component 

OPERABILITY of the redundant counterpart to the inoperable required 

feature. Additionally, the 24 hour Completion Time takes into account the 

capacity and capability of the remaining AC sources, a reasonable time 

for repairs, and the low probability of a DBA occurring during this period.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-6 Rev. 4.0

BASES

ACTIONS (continued)

A.3

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition A for a period that should not exceed 72 hours. With one 

offsite circuit inoperable, the reliability of the offsite system is degraded, 

and the potential for a loss of offsite power is increased, with attendant 

potential for a challenge to the unit safety systems. In this Condition, 

however, the remaining OPERABLE offsite circuit and DGs are adequate 

to supply electrical power to the onsite Class 1E Distribution System.

The 72 hour Completion Time takes into account the capacity and 

capability of the remaining AC sources, a reasonable time for repairs, and 

the low probability of a DBA occurring during this period.

B.1

To ensure a highly reliable power source remains with an inoperable DG, 

it is necessary to verify the availability of the offsite circuits on a more 

frequent basis. Since the Required Action only specifies "perform," a 

failure of SR 3.8.1.1 acceptance criteria does not result in a Required 

Action being not met. However, if a circuit fails to pass SR 3.8.1.1, it is 

inoperable. Upon offsite circuit inoperability, additional Conditions and 

Required Actions must then be entered.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The turbine driven auxiliary feedwater pump is only required to be 

considered a redundant required feature, and, therefore, required to be 

determined OPERABLE by this Required Action, if the design is such that 

the remaining OPERABLE motor or turbine driven auxiliary feedwater 

pump(s) is not by itself capable (without any reliance on the motor driven 

auxiliary feedwater pump powered by the emergency bus associated with 

the inoperable diesel generator) of providing 100% of the auxiliary 

feedwater flow assumed in the safety analysis.

--------------------------------------------------------------------------------------------------

B.2

Required Action B.2 is intended to provide assurance that a loss of offsite 

power, during the period that a DG is inoperable, does not result in a 

complete loss of safety function of critical systems. These features are 

designed with redundant safety related trains. This includes motor driven 

auxiliary feedwater pumps. Single train systems, such as turbine driven 

auxiliary feedwater pumps, are not included. Redundant required feature 

failures consist of inoperable features associated with a train, redundant 

to the train that has an inoperable DG.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-7 Rev. 4.0

BASES

ACTIONS (continued)

The Completion Time for Required Action B.2 is intended to allow the 

operator time to evaluate and repair any discovered inoperabilities. This 

Completion Time also allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." In this Required Action, 

the Completion Time only begins on discovery that both:

a. An inoperable DG exists and

b. A required feature on the other train (Train A or Train B) is 

inoperable.

If at any time during the existence of this Condition (one DG inoperable) a 

required feature subsequently becomes inoperable, this Completion Time 

would begin to be tracked.

Discovering one required DG inoperable coincident with one or more 

inoperable required support or supported features, or both, that are 

associated with the OPERABLE DG, results in starting the Completion 

Time for the Required Action. Four hours from the discovery of these 

events existing concurrently is Acceptable because it minimizes risk while 

allowing time for restoration before subjecting the unit to transients 

associated with shutdown.

In this Condition, the remaining OPERABLE DG and offsite circuits are 

adequate to supply electrical power to the onsite Class 1E Distribution 

System. Thus, on a component basis, single failure protection for the 

required feature's function may have been lost; however, function has not 

been lost. The 4 hour Completion Time takes into account the 

OPERABILITY of the redundant counterpart to the inoperable required 

feature. Additionally, the 4 hour Completion Time takes into account the 

capacity and capability of the remaining AC sources, a reasonable time 

for repairs, and the low probability of a DBA occurring during this period.

B.3.1 and B.3.2

Required Action B.3.1 provides an allowance to avoid unnecessary 

testing of OPERABLE DG(s). If it can be determined that the cause of 

the inoperable DG does not exist on the OPERABLE DG, SR 3.8.1.2 

does not have to be performed. If the cause of inoperability exists on 

other DG(s), the other DG(s) would be declared inoperable upon 

discovery and Condition E of LCO 3.8.1 would be entered. Once the 

failure is repaired, the common cause failure no longer exists, and 

Required Action B.3.1 is satisfied. If the cause of the initial inoperable 

DG cannot be confirmed not to exist on the remaining DG(s), 

performance of SR 3.8.1.2 suffices to provide assurance of continued 

OPERABILITY of that DG.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-8 Rev. 4.0

BASES

ACTIONS (continued)

In the event the inoperable DG is restored to OPERABLE status prior to 

completing either B.3.1 or B.3.2, the [plant corrective action program] will 

continue to evaluate the common cause possibility. This continued 

evaluation, however, is no longer under the 24 hour constraint imposed 

while in Condition B.

According to Generic Letter 84-15 (Ref. 7), [24] hours is reasonable to 

confirm that the OPERABLE DG(s) is not affected by the same problem 

as the inoperable DG.

B.4

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition B for a period that should not exceed 72 hours.

In Condition B, the remaining OPERABLE DG and offsite circuits are 

adequate to supply electrical power to the onsite Class 1E Distribution 

System. The 72 hour Completion Time takes into account the capacity 

and capability of the remaining AC sources, a reasonable time for repairs, 

and the low probability of a DBA occurring during this period.

C.1 and C.2

Required Action C.1, which applies when two offsite circuits are 

inoperable, is intended to provide assurance that an event with a 

coincident single failure will not result in a complete loss of redundant 

required safety functions. The Completion Time for this failure of 

redundant required features is reduced to 12 hours from that allowed for 

one train without offsite power (Required Action A.2). The rationale for 

the reduction to 12 hours is that Regulatory Guide 1.93 (Ref. 6) allows a 

Completion Time of 24 hours for two required offsite circuits inoperable, 

based upon the assumption that two complete safety trains are 

OPERABLE. When a concurrent redundant required feature failure 

exists, this assumption is not the case, and a shorter Completion Time of 

12 hours is appropriate. These features are powered from redundant AC 

safety trains. This includes motor driven auxiliary feedwater pumps. 

Single train features, such as turbine driven auxiliary pumps, are not 

included in the list. 
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-9 Rev. 4.0

BASES

ACTIONS (continued)

The Completion Time for Required Action C.1 is intended to allow the 

operator time to evaluate and repair any discovered inoperabilities. This 

Completion Time also allows for an exception to the normal "time zero" 

for beginning the allowed outage time "clock." In this Required Action the 

Completion Time only begins on discovery that both:

a. All required offsite circuits are inoperable and

b. A required feature is inoperable.

If at any time during the existence of Condition C (two offsite circuits 

inoperable) a required feature becomes inoperable, this Completion Time 

begins to be tracked.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition C for a period that should not exceed 24 hours. This level of 

degradation means that the offsite electrical power system does not have 

the capability to effect a safe shutdown and to mitigate the effects of an 

accident; however, the onsite AC sources have not been degraded. This 

level of degradation generally corresponds to a total loss of the 

immediately accessible offsite power sources.

Because of the normally high availability of the offsite sources, this level 

of degradation may appear to be more severe than other combinations of 

two AC sources inoperable that involve one or more DGs inoperable. 

However, two factors tend to decrease the severity of this level of 

degradation:

a. The configuration of the redundant AC electrical power system that 

remains available is not susceptible to a single bus or switching 

failure and

b. The time required to detect and restore an unavailable offsite power 

source is generally much less than that required to detect and restore 

an unavailable onsite AC source.

With both of the required offsite circuits inoperable, sufficient onsite AC 

sources are available to maintain the unit in a safe shutdown condition in 

the event of a DBA or transient. In fact, a simultaneous loss of offsite AC 

sources, a LOCA, and a worst case single failure were postulated as a 

part of the design basis in the safety analysis. Thus, the 24 hour 

Completion Time provides a period of time to effect restoration of one of 

the offsite circuits commensurate with the importance of maintaining an 

AC electrical power system capable of meeting its design criteria.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-10 Rev. 4.0

BASES

ACTIONS (continued)

According to Reference 6, with the available offsite AC sources, two less 

than required by the LCO, operation may continue for 24 hours. If two 

offsite sources are restored within 24 hours, unrestricted operation may 

continue. If only one offsite source is restored within 24 hours, power 

operation continues in accordance with Condition A.

D.1 and D.2

Pursuant to LCO 3.0.6, the Distribution System ACTIONS would not be 

entered even if all AC sources to it were inoperable, resulting in deenergization. Therefore, the Required Actions of Condition D are 

modified by a Note to indicate that when Condition D is entered with no 

AC source to any train, the Conditions and Required Actions for 

LCO 3.8.9, "Distribution Systems - Operating," must be immediately 

entered. This allows Condition D to provide requirements for the loss of 

one offsite circuit and one DG, without regard to whether a train is deenergized. LCO 3.8.9 provides the appropriate restrictions for a deenergized train.

According to Regulatory Guide 1.93 (Ref. 6), operation may continue in 

Condition D for a period that should not exceed 12 hours.

In Condition D, individual redundancy is lost in both the offsite electrical 

power system and the onsite AC electrical power system. Since power 

system redundancy is provided by two diverse sources of power, 

however, the reliability of the power systems in this Condition may appear 

higher than that in Condition C (loss of both required offsite circuits). This 

difference in reliability is offset by the susceptibility of this power system 

configuration to a single bus or switching failure. The 12 hour Completion 

Time takes into account the capacity and capability of the remaining AC 

sources, a reasonable time for repairs, and the low probability of a DBA 

occurring during this period.

E.1

With Train A and Train B DGs inoperable, there are no remaining standby 

AC sources. Thus, with an assumed loss of offsite electrical power, 

insufficient standby AC sources are available to power the minimum 

required ESF functions. Since the offsite electrical power system is the 

only source of AC power for this level of degradation, the risk associated 

with continued operation for a very short time could be less than that 

associated with an immediate controlled shutdown (the immediate 

shutdown could cause grid instability, which could result in a total loss of 

AC power). Since any inadvertent generator trip could also result in a 
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-11 Rev. 4.0

BASES

ACTIONS (continued)

total loss of offsite AC power, however, the time allowed for continued 

operation is severely restricted. The intent here is to avoid the risk 

associated with an immediate controlled shutdown and to minimize the 

risk associated with this level of degradation.

According to Reference 6, with both DGs inoperable, operation may 

continue for a period that should not exceed 2 hours.

[ F.1

The sequencer(s) is an essential support system to [both the offsite circuit 

and the DG associated with a given ESF bus]. [Furthermore, the 

sequencer is on the primary success path for most major AC electrically 

powered safety systems powered from the associated ESF bus.] 

Therefore, loss of an [ESF bus sequencer] affects every major ESF 

system in the [division]. The [12] hour Completion Time provides a period 

of time to correct the problem commensurate with the importance of 

maintaining sequencer OPERABILITY. This time period also ensures 

that the probability of an accident (requiring sequencer OPERABILITY) 

occurring during periods when the sequencer is inoperable is minimal.

This Condition is preceded by a Note that allows the Condition to be 

deleted if the unit design is such that any sequencer failure mode will only 

affect the ability of the associated DG to power its respective safety loads 

under any conditions. Implicit in this Note is the concept that the 

Condition must be retained if any sequencer failure mode results in the 

inability to start all or part of the safety loads when required, regardless of 

power availability, or results in overloading the offsite power circuit to a 

safety bus during an event and thereby causes its failure. Also implicit in 

the Note, is that the Condition is not applicable to any train that does not 

have a sequencer. ]

G.1 and G.2

If the inoperable AC electric power sources cannot be restored to 

OPERABLE status within the required Completion Time, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and to 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging plant 

systems.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-12 Rev. 4.0

BASES

ACTIONS (continued)

H.1

Condition H corresponds to a level of degradation in which all redundancy 

in the AC electrical power supplies has been lost. At this severely 

degraded level, any further losses in the AC electrical power system will 

cause a loss of function. Therefore, no additional time is justified for 

continued operation. The unit is required by LCO 3.0.3 to commence a 

controlled shutdown.

SURVEILLANCE The AC sources are designed to permit inspection and testing of all

REQUIREMENTS important areas and features, especially those that have a standby 

function, in accordance with 10 CFR 50, Appendix A, GDC 18 (Ref. 8). 

Periodic component tests are supplemented by extensive functional tests 

during refueling outages (under simulated accident conditions). The SRs 

for demonstrating the OPERABILITY of the DGs are in accordance with 

the recommendations of Regulatory Guide 1.9 (Ref. 3), Regulatory 

Guide 1.108 (Ref. 9), and Regulatory Guide 1.137 (Ref. 10), as 

addressed in the FSAR.

Where the SRs discussed herein specify voltage and frequency 

tolerances, the following is applicable. The minimum steady state output 

voltage of [3740] V is 90% of the nominal 4160 V output voltage. This 

value, which is specified in ANSI C84.1 (Ref. 11), allows for voltage drop 

to the terminals of 4000 V motors whose minimum operating voltage is 

specified as 90% or 3600 V. It also allows for voltage drops to motors 

and other equipment down through the 120 V level where minimum 

operating voltage is also usually specified as 90% of name plate rating. 

The specified maximum steady state output voltage of [4756] V is equal 

to the maximum operating voltage specified for 4000 V motors. It 

ensures that for a lightly loaded distribution system, the voltage at the 

terminals of 4000 V motors is no more than the maximum rated operating 

voltages. The specified minimum and maximum frequencies of the DG 

are 58.8 Hz and 61.2 Hz, respectively. These values are equal to ± 2% of 

the 60 Hz nominal frequency and are derived from the recommendations 

given in Regulatory Guide 1.9 (Ref. 3).

SR 3.8.1.1

This SR ensures proper circuit continuity for the offsite AC electrical 

power supply to the onsite distribution network and availability of offsite 

AC electrical power. The breaker alignment verifies that each breaker is 

in its correct position to ensure that distribution buses and loads are 

connected to their preferred power source, and that appropriate 

independence of offsite circuits is maintained. [ The 7 day Frequency is
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-13 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

adequate since breaker position is not likely to change without the 

operator being aware of it and because its status is displayed in the 

control room.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.1.2 and SR 3.8.1.7

These SRs help to ensure the availability of the standby electrical power 

supply to mitigate DBAs and transients and to maintain the unit in a safe 

shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the 

engine is not running, these SRs are modified by a Note (Note 1 for 

SR 3.8.1.2 and Note for SR 3.8.1.7) to indicate that all DG starts for these 

Surveillances may be preceded by an engine prelube period and followed 

by a warmup period prior to loading.

For the purposes of SR 3.8.1.2 and SR 3.8.1.7 testing, the DGs are 

started from standby conditions. Standby conditions for a DG mean that 

the diesel engine coolant and oil are being continuously circulated and 

temperature is being maintained consistent with manufacturer 

recommendations.

[ In order to reduce stress and wear on diesel engines, some 

manufacturers recommend a modified start in which the starting speed of 

DGs is limited, warmup is limited to this lower speed, and the DGs are 

gradually accelerated to synchronous speed prior to loading. These start 

procedures are the intent of Note 2, which is only applicable when such 

modified start procedures are recommended by the manufacturer. ]
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-14 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.7 requires that the DG starts from standby conditions and 

achieves required voltage and frequency within 10 seconds. The 

10 second start requirement supports the assumptions of the design 

basis LOCA analysis in the FSAR, Chapter [15] (Ref. 5).

The 10 second start requirement is not applicable to SR 3.8.1.2 (see 

Note 2) when a modified start procedure as described above is used. If a 

modified start is not used, the 10 second start requirement of SR 3.8.1.7 

applies.

Since SR 3.8.1.7 requires a 10 second start, it is more restrictive than 

SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2.

In addition to the SR requirements, the time for the DG to reach steady 

state operation, unless the modified DG start method is employed, is 

periodically monitored and the trend evaluated to identify degradation of 

governor and voltage regulator performance.

[ The 31 day Frequency for SR 3.8.1.2 is consistent with Regulatory 

Guide 1.9 (Ref. 3). The 184 day Frequency for SR 3.8.1.7 is a reduction 

in cold testing consistent with Generic Letter 84-15 (Ref. 7). These 

Frequencies provide adequate assurance of DG OPERABILITY, while 

minimizing degradation resulting from testing.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.1.3

This Surveillance verifies that the DGs are capable of synchronizing with 

the offsite electrical system and accepting loads greater than or equal to 

the equivalent of the maximum expected accident loads. A minimum run 

time of 60 minutes is required to stabilize engine temperatures, while 

minimizing the time that the DG is connected to the offsite source.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-15 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Although no power factor requirements are established by this SR, the 

DG is normally operated at a power factor between [0.8 lagging] and 

[1.0]. The [0.8] value is the design rating of the machine, while the [1.0] is 

an operational limitation [to ensure circulating currents are minimized]. 

The load band is provided to avoid routine overloading of the DG. 

Routine overloading may result in more frequent teardown inspections in 

accordance with vendor recommendations in order to maintain DG 

OPERABILITY.

[ The 31 day Frequency for this Surveillance is consistent with Regulatory 

Guide 1.9 (Ref. 3).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by four Notes. Note 1 indicates that diesel engine 

runs for this Surveillance may include gradual loading, as recommended 

by the manufacturer, so that mechanical stress and wear on the diesel 

engine are minimized. Note 2 states that momentary transients, because 

of changing bus loads, do not invalidate this test. Similarly, momentary 

power factor transients above the limit do not invalidate the test. Note 3 

indicates that this Surveillance should be conducted on only one DG at a 

time in order to avoid common cause failures that might result from offsite 

circuit or grid perturbations. Note 4 stipulates a prerequisite requirement 

for performance of this SR. A successful DG start must precede this test 

to credit satisfactory performance.

SR 3.8.1.4

This SR provides verification that the level of fuel oil in the day tank [and 

engine mounted tank] is at or above the level at which fuel oil is 

automatically added. The level is expressed as an equivalent volume in 

gallons, and is selected to ensure adequate fuel oil for a minimum of 

1 hour of DG operation at full load plus 10%.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-16 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The 31 day Frequency is adequate to assure that a sufficient supply of 

fuel oil is available, since low level alarms are provided and facility 

operators would be aware of any large uses of fuel oil during this period.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.1.5

Microbiological fouling is a major cause of fuel oil degradation. There are 

numerous bacteria that can grow in fuel oil and cause fouling, but all must 

have a water environment in order to survive. Removal of water from the 

fuel oil day [and engine mounted] tanks eliminates the necessary 

environment for bacterial survival. This is the most effective means of 

controlling microbiological fouling. In addition, it eliminates the potential 

for water entrainment in the fuel oil during DG operation. Water may 

come from any of several sources, including condensation, ground water, 

rain water, contaminated fuel oil, and breakdown of the fuel oil by 

bacteria. Frequent checking for and removal of accumulated water 

minimizes fouling and provides data regarding the watertight integrity of 

the fuel oil system. [ The Surveillance Frequency of 31 days is 

established by Regulatory Guide 1.137 (Ref. 10). This SR is for 

preventative maintenance. 

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-17 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The presence of water does not necessarily represent failure of this SR, 

provided the accumulated water is removed during the performance of 

this Surveillance.

SR 3.8.1.6

This Surveillance demonstrates that each required fuel oil transfer pump 

operates and transfers fuel oil from its associated storage tank to its 

associated day tank. This is required to support continuous operation of 

standby power sources. This Surveillance provides assurance that the 

fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, 

the fuel delivery piping is not obstructed, and the controls and control 

systems for automatic fuel transfer systems are OPERABLE.

[ The Frequency for this SR is variable, depending on individual system 

design, with up to a [92] day interval. The [92] day Frequency 

corresponds to the testing requirements for pumps as contained in the 

ASME Code (Ref. 11); however, the design of fuel transfer systems is 

such that pumps operate automatically or must be started manually in 

order to maintain an adequate volume of fuel oil in the day [and engine 

mounted] tanks during or following DG testing. In such a case, a 31 day 

Frequency is appropriate. Since proper operation of fuel transfer systems 

is an inherent part of DG OPERABILITY, the Frequency of this SR should 

be modified to reflect individual designs.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.1.7

See SR 3.8.1.2.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-18 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.8.1.8

Transfer of each [4.16 kV ESF bus] power supply from the normal offsite 

circuit to the alternate offsite circuit demonstrates the OPERABILITY of 

the alternate circuit distribution network to power the shutdown loads. 

[ The [18 month] Frequency of the Surveillance is based on engineering 

judgment, taking into consideration the unit conditions required to perform 

the Surveillance, and is intended to be consistent with expected fuel cycle 

lengths. Operating experience has shown that these components usually 

pass the SR when performed at the [18 month] Frequency. Therefore, 

the Frequency was concluded to be acceptable from a reliability 

standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note. The reason for the Note is that, during 

operation with the reactor critical, performance of this SR could cause 

perturbations to the electrical distribution systems that could challenge 

continued steady state operation and, as a result, unit safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment.] 

Credit may be taken for unplanned events that satisfy this SR.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-19 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.9

Each DG is provided with an engine overspeed trip to prevent damage to 

the engine. Recovery from the transient caused by the loss of a large 

load could cause diesel engine overspeed, which, if excessive, might 

result in a trip of the engine. This Surveillance demonstrates the DG load 

response characteristics and capability to reject the largest single load 

without exceeding predetermined voltage and frequency and while 

maintaining a specified margin to the overspeed trip. [For this unit, the 

single load for each DG and its horsepower rating is as follows:] This 

Surveillance may be accomplished by:

a. Tripping the DG output breaker with the DG carrying greater than or 

equal to its associated single largest post-accident load while 

paralleled to offsite power, or while solely supplying the bus, or

b. Tripping its associated single largest post-accident load with the DG 

solely supplying the bus.

As required by IEEE-308 (Ref. 12), the load rejection test is acceptable if 

the increase in diesel speed does not exceed 75% of the difference 

between synchronous speed and the overspeed trip setpoint, or 15% 

above synchronous speed, whichever is lower.

The time, voltage, and frequency tolerances specified in this SR are 

derived from Regulatory Guide 1.9 (Ref. 3) recommendations for 

response during load sequence intervals. The 3 seconds specified is 

equal to 60% of a typical 5 second load sequence interval associated with 

sequencing of the largest load. The voltage and frequency specified are 

consistent with the design range of the equipment powered by the DG. 

SR 3.8.1.9.a corresponds to the maximum frequency excursion, while 

SR 3.8.1.9.b and SR 3.8.1.9.c are steady state voltage and frequency 

values to which the system must recover following load rejection. [ The 

[18 month] Frequency is consistent with the recommendation of 

Regulatory Guide 1.108 (Ref. 9).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-20 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by two Notes. The reason for Note 1 is that during 

operation with the reactor critical, performance of this SR could cause 

perturbations to the electrical distribution systems that could challenge

continued steady state operation and, as a result, unit safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR.

Note 2 ensures that the DG is tested under load conditions that are as 

close to design basis conditions as possible. When synchronized with 

offsite power, testing should be performed at a power factor of ≤ [0.9]. 

This power factor is representative of the actual inductive loading a DG 

would see under design basis accident conditions. Under certain 

conditions, however, Note 2 allows the Surveillance to be conducted at a 

power factor other than ≤ [0.9]. These conditions occur when grid voltage 

is high, and the additional field excitation needed to get the power factor 

to ≤ [0.9] results in voltages on the emergency busses that are too high. 

Under these conditions, the power factor should be maintained as close 

as practicable to [0.9] while still maintaining acceptable voltage limits on 

the emergency busses. In other circumstances, the grid voltage may be 

such that the DG excitation levels needed to obtain a power factor of [0.9] 

may not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DG. In such 

cases, the power factor shall be maintained as close as practicable to 

[0.9] without exceeding the DG excitation limits.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-21 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable:

a. Performance of the SR will not render any safety system or 

component inoperable,

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems.

--------------------------------------------------------------------------------------------------

SR 3.8.1.10

This Surveillance demonstrates the DG capability to reject a full load 

without overspeed tripping or exceeding the predetermined voltage limits. 

The DG full load rejection may occur because of a system fault or 

inadvertent breaker tripping. This Surveillance ensures proper engine 

generator load response under the simulated test conditions. This test 

simulates the loss of the total connected load that the DG experiences 

following a full load rejection and verifies that the DG does not trip upon 

loss of the load. These acceptance criteria provide for DG damage 

protection. While the DG is not expected to experience this transient 

during an event and continues to be available, this response ensures that 

the DG is not degraded for future application, including reconnection to 

the bus if the trip initiator can be corrected or isolated.

[ The [18 month] Frequency is consistent with the recommendation of 

Regulatory Guide 1.108 (Ref. 9) and is intended to be consistent with 

expected fuel cycle lengths.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-22 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR has been modified by two Notes. The reason for Note 1 is that 

during operation with the reactor critical, performance of this SR could 

cause perturbation to the electrical distribution systems that could 

challenge continued steady state operation and, as a result, unit safety 

systems. This restriction from normally performing the Surveillance in 

MODE 1 or 2 is further amplified to allow the Surveillance to be performed 

for the purpose of reestablishing OPERABILITY (e.g., post work testing 

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed Surveillance, a

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. Note 2

ensures that the DG is tested under load conditions that are as close to 

design basis conditions as possible. When synchronized with offsite 

power, testing should be performed at a power factor of ≤ [0.9]. This

power factor is representative of the actual inductive loading a DG would 

see under design basis accident conditions. Under certain conditions, 

however, Note 2 allows the Surveillance to be conducted at a power 

factor other than ≤ [0.9]. These conditions occur when grid voltage is 

high, and the additional field excitation needed to get the power factor to 

≤ [0.9] results in voltages on the emergency busses that are too high. 

Under these conditions, the power factor should be maintained as close 

as practicable to [0.9] while still maintaining acceptable voltage limits on 

the emergency busses. In other circumstances, the grid voltage may be 

such that the DG excitation levels needed to obtain a power factor of [0.9] 

may not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DG. In such 

cases, the power factor shall be maintained as close as practicable to 

[0.9] without exceeding the DG excitation limits. 
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-23 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE----------------------------

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable:

a. Performance of the SR will not render any safety system or 

component inoperable,

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems.

--------------------------------------------------------------------------------------------------

SR 3.8.1.11

As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), this 

Surveillance demonstrates the as designed operation of the standby 

power sources during loss of the offsite source. This test verifies all 

actions encountered from the loss of offsite power, including shedding of 

the nonessential loads and energization of the emergency buses and 

respective loads from the DG. It further demonstrates the capability of 

the DG to automatically achieve the required voltage and frequency within 

the specified time.

The DG autostart time of [10] seconds is derived from requirements of the 

accident analysis to respond to a design basis large break LOCA. The 

Surveillance should be continued for a minimum of 5 minutes in order to 

demonstrate that all starting transients have decayed and stability is 

achieved.

The requirement to verify the connection and power supply of permanent 

and autoconnected loads is intended to satisfactorily show the 

relationship of these loads to the DG loading logic. In certain 

circumstances, many of these loads cannot actually be connected or 

loaded without undue hardship or potential for undesired operation. For 

instance, Emergency Core Cooling Systems (ECCS) injection valves are 

not desired to be stroked open, or high pressure injection systems are not 

capable of being operated at full flow, or residual heat removal (RHR) 

systems performing a decay heat removal function are not desired to be 

realigned to the ECCS mode of operation. In lieu of actual demonstration 
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-24 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

of connection and loading of loads, testing that adequately shows the 

capability of the DG systems to perform these functions is acceptable. 

This testing may include any series of sequential, overlapping, or total 

steps so that the entire connection and loading sequence is verified.

[ The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(1), takes into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by two Notes. The reason for Note 1 is to minimize 

wear and tear on the DGs during testing. For the purpose of this testing, 

the DGs must be started from standby conditions, that is, with the engine 

coolant and oil continuously circulated and temperature maintained 

consistent with manufacturer recommendations. The reason for Note 2 is 

that performing the Surveillance would remove a required offsite circuit 

from service, perturb the electrical distribution system, and challenge

safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-25 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.8.1.12

This Surveillance demonstrates that the DG automatically starts and 

achieves the required voltage and frequency within the specified time 

([10] seconds) from the design basis actuation signal (LOCA signal) and 

operates for ≥ 5 minutes. The 5 minute period provides sufficient time to 

demonstrate stability. SR 3.8.1.12.d and SR 3.8.1.12.e ensure that 

permanently connected loads and emergency loads are energized from 

the offsite electrical power system on an ESF signal without loss of offsite 

power.

The requirement to verify the connection of permanent and 

autoconnected loads is intended to satisfactorily show the relationship of 

these loads to the DG loading logic. In certain circumstances, many of 

these loads cannot actually be connected or loaded without undue 

hardship or potential for undesired operation. For instance, ECCS 

injection valves are not desired to be stroked open, or high pressure 

injection systems are not capable of being operated at full flow, or RHR 

systems performing a decay heat removal function are not desired to be 

realigned to the ECCS mode of operation. In lieu of actual demonstration 

of connection and loading of loads, testing that adequately shows the 

capability of the DG system to perform these functions is acceptable. 

This testing may include any series of sequential, overlapping, or total 

steps so that the entire connection and loading sequence is verified.

[ The Frequency of [18 months] takes into consideration unit conditions 

required to perform the Surveillance and is intended to be consistent with 

the expected fuel cycle lengths. Operating experience has shown that 

these components usually pass the SR when performed at the [18 month] 

Frequency. Therefore, the Frequency was concluded to be acceptable 

from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-26 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This SR is modified by two Notes. The reason for Note 1 is to minimize 

wear and tear on the DGs during testing. For the purpose of this testing, 

the DGs must be started from standby conditions, that is, with the engine 

coolant and oil continuously circulated and temperature maintained 

consistent with manufacturer recommendations. The reason for Note 2 is 

that during operation with the reactor critical, performance of this 

Surveillance could cause perturbations to the electrical distribution 

systems that could challenge continued steady state operation and, as a 

result, unit safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. ] 

Credit may be taken for unplanned events that satisfy this SR. 

SR 3.8.1.13

This Surveillance demonstrates that DG noncritical protective functions 

(e.g., high jacket water temperature) are bypassed on a loss of voltage 

signal concurrent with an ESF actuation test signal. Noncritical automatic 

trips are all automatic trips except:

a. Engine overspeed;

b. Generator differential current;

[ c. Low lube oil pressure;

d. High crankcase pressure; and

e. Start failure relay.]
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-27 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

The noncritical trips are bypassed during DBAs and provide an alarm on 

an abnormal engine condition. This alarm provides the operator with 

sufficient time to react appropriately. The DG availability to mitigate the 

DBA is more critical than protecting the engine against minor problems 

that are not immediately detrimental to emergency operation of the DG.

[ The [18 month] Frequency is based on engineering judgment, taking into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths. Operating 

experience has shown that these components usually pass the SR when 

performed at the [18 month] Frequency. Therefore, the Frequency was 

concluded to be acceptable from a reliability standpoint.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required DG from service. This 

restriction from normally performing the Surveillance in MODE 1 or 2 is 

further amplified to allow the Surveillance to be performed for the purpose 

of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. 
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-28 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable:

a. Performance of the SR will not render any safety system or 

component inoperable,

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems.

--------------------------------------------------------------------------------------------------

SR 3.8.1.14

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3), requires 

demonstration that the DGs can start and run continuously at full load 

capability for an interval of not less than 24 hours, ≥ [2] hours of which is 

at a load equivalent to 110% of the continuous duty rating and the 

remainder of the time at a load equivalent to the continuous duty rating of 

the DG. The DG starts for this Surveillance can be performed either from 

standby or hot conditions. The provisions for prelubricating and warmup, 

discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, 

are applicable to this SR.

The load band is provided to avoid routine overloading of the DG. 

Routine overloading may result in more frequent teardown inspections in 

accordance with vendor recommendations in order to maintain DG 

OPERABILITY.

[ The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(3), takes into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-29 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This Surveillance is modified by three Notes. Note 1 states that 

momentary transients due to changing bus loads do not invalidate this 

test. Similarly, momentary power factor transients above the power factor 

limit will not invalidate the test. The reason for Note 2 is that during 

operation with the reactor critical, performance of this Surveillance could 

cause perturbations to the electrical distribution systems that could 

challenge continued steady state operation and, as a result, unit safety 

systems. This restriction from normally performing the Surveillance in 

MODE 1 or 2 is further amplified to allow the Surveillance to be performed 

for the purpose of reestablishing OPERABILITY (e.g., post work testing 

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. Note 3 

ensures that the DG is tested under load conditions that are as close to 

design basis conditions as possible. When synchronized with offsite 

power, testing should be performed at a power factor of ≤ [0.9]. This 

power factor is representative of the actual inductive loading a DG would 

see under design basis accident conditions. Under certain conditions, 

however, Note 3 allows the Surveillance to be conducted as a power 

factor other than ≤ [0.9]. These conditions occur when grid voltage is 

high, and the additional field excitation needed to get the power factor to 

≤ [0.9] results in voltages on the emergency busses that are too high. 

Under these conditions, the power factor should be maintained as close 

as practicable to [0.9] while still maintaining acceptable voltage limits on 

the emergency busses. In other circumstances, the grid voltage may be 

such that the DG excitation levels needed to obtain a power factor of [0.9] 

may not cause unacceptable voltages on the emergency busses, but the 

excitation levels are in excess of those recommended for the DG. In such 

cases, the power factor shall be maintained close as practicable to [0.9] 

without exceeding the DG excitation limits.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-30 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.1.15

This Surveillance demonstrates that the diesel engine can restart from a 

hot condition, such as subsequent to shutdown from normal 

Surveillances, and achieve the required voltage and frequency within 

[10] seconds. The [10] second time is derived from the requirements of 

the accident analysis to respond to a design basis large break LOCA.

[ The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(5).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by two Notes. Note 1 ensures that the test is 

performed with the diesel sufficiently hot. The load band is provided to 

avoid routine overloading of the DG. Routine overloads may result in 

more frequent teardown inspections in accordance with vendor 

recommendations in order to maintain DG OPERABILITY. The 

requirement that the diesel has operated for at least [2] hours at full load 

conditions prior to performance of this Surveillance is based on 

manufacturer recommendations for achieving hot conditions. Momentary 

transients due to changing bus loads do not invalidate this test. Note 2 

allows all DG starts to be preceded by an engine prelube period to 

minimize wear and tear on the diesel during testing.

SR 3.8.1.16

As required by Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), this 

Surveillance ensures that the manual synchronization and automatic load 

transfer from the DG to the offsite source can be made and the DG can 

be returned to ready to load status when offsite power is restored. It also 

ensures that the autostart logic is reset to allow the DG to reload if a 
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-31 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

subsequent loss of offsite power occurs. The DG is considered to be in 

ready to load status when the DG is at rated speed and voltage, the 

output breaker is open and can receive an autoclose signal on bus 

undervoltage, and the load sequence timers are reset.

[ The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(6), and takes into 

consideration unit conditions required to perform the Surveillance.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required offsite circuit from service, 

perturb the electrical distribution system, and challenge safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR. 
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-32 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ SR 3.8.1.17

Demonstration of the test mode override ensures that the DG availability 

under accident conditions will not be compromised as the result of testing 

and the DG will automatically reset to ready to load operation if a LOCA 

actuation signal is received during operation in the test mode. Ready to 

load operation is defined as the DG running at rated speed and voltage 

with the DG output breaker open. These provisions for automatic 

switchover are required by IEEE-308 (Ref. 13), paragraph 6.2.6(2).

The requirement to automatically energize the emergency loads with 

offsite power is essentially identical to that of SR 3.8.1.12. The intent in 

the requirement associated with SR 3.8.1.17.b is to show that the 

emergency loading was not affected by the DG operation in test mode. In 

lieu of actual demonstration of connection and loading of loads, testing 

that adequately shows the capability of the emergency loads to perform 

these functions is acceptable.

This testing may include any series of sequential, overlapping, or total 

steps so that the entire connection and loading sequence is verified.

[ The [18 month] Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(8), takes into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required offsite circuit from service, 

perturb the electrical distribution system, and challenge safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow portions of the Surveillance to be performed 

for the purpose of reestablishing OPERABILITY (e.g., post work testing
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-33 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed partial 

Surveillance, a successful partial Surveillance, and a perturbation of the 

offsite or onsite system when they are tied together or operated 

independently for the partial Surveillance; as well as the operator 

procedures available to cope with these outcomes. These shall be 

measured against the avoided risk of a plant shutdown and startup to 

determine that plant safety is maintained or enhanced when portions of 

the Surveillance are performed in MODE 1 or 2. Risk insights or 

deterministic methods may be used for the assessment. ] Credit may be 

taken for unplanned events that satisfy this SR. 

SR 3.8.1.18

Under accident [and loss of offsite power] conditions loads are 

sequentially connected to the bus by the [automatic load sequencer]. The 

sequencing logic controls the permissive and starting signals to motor 

breakers to prevent overloading of the DGs due to high motor starting 

currents. The [10]% load sequence time interval tolerance ensures that 

sufficient time exists for the DG to restore frequency and voltage prior to 

applying the next load and that safety analysis assumptions regarding 

ESF equipment time delays are not violated. Reference 2 provides a 

summary of the automatic loading of ESF buses.

[ The Frequency of [18 months] is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9), paragraph 2.a.(2), takes into 

consideration unit conditions required to perform the Surveillance, and is 

intended to be consistent with expected fuel cycle lengths.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-34 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would remove a required offsite circuit from service, 

perturb the electrical distribution system, and challenge safety systems. 

This restriction from normally performing the Surveillance in MODE 1 or 2 

is further amplified to allow the Surveillance to be performed for the 

purpose of reestablishing OPERABILITY (e.g., post work testing following 

corrective maintenance, corrective modification, deficient or incomplete 

surveillance testing, and other unanticipated OPERABILITY concerns) 

provided an assessment determines plant safety is maintained or 

enhanced. This assessment shall, as a minimum, consider the potential 

outcomes and transients associated with a failed Surveillance, a 

successful Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the 

Surveillance; as well as the operator procedures available to cope with 

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when the Surveillance is performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for this assessment. 

Credit may be taken for unplanned events that satisfy this SR.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The above MODE restrictions may be deleted if it can be demonstrated to 

the staff, on a plant specific basis, that performing the SR with the reactor 

in any of the restricted MODES can satisfy the following criteria, as 

applicable:

a. Performance of the SR will not render any safety system or 

component inoperable,

b. Performance of the SR will not cause perturbations to any of the 

electrical distribution systems that could result in a challenge to 

steady state operation or to plant safety systems, and

c. Performance of the SR, or failure of the SR, will not cause, or result 

in, an AOO with attendant challenge to plant safety systems.

--------------------------------------------------------------------------------------------------

SR 3.8.1.19

In the event of a DBA coincident with a loss of offsite power, the DGs are 

required to supply the necessary power to ESF systems so that the fuel, 

RCS, and containment design limits are not exceeded.
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-35 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

This Surveillance demonstrates the DG operation, as discussed in the 

Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal 

in conjunction with an ESF actuation signal. In lieu of actual 

demonstration of connection and loading of loads, testing that adequately 

shows the capability of the DG system to perform these functions is 

acceptable. This testing may include any series of sequential, 

overlapping, or total steps so that the entire connection and loading 

sequence is verified.

[ The Frequency of [18 months] takes into consideration unit conditions 

required to perform the Surveillance and is intended to be consistent with 

an expected fuel cycle length of [18 months].

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by two Notes. The reason for Note 1 is to minimize 

wear and tear on the DGs during testing. For the purpose of this testing, 

the DGs must be started from standby conditions, that is, with the engine 

coolant and oil continuously circulated and temperature maintained 

consistent with manufacturer recommendations for DGs. The reason for 

Note 2 is that the performance of the Surveillance would remove a 

required offsite circuit from service, perturb the electrical distribution 

system, and challenge safety systems. This restriction from normally 

performing the Surveillance in MODE 1 or 2 is further amplified to allow 

portions of the Surveillance to be performed for the purpose of 

reestablishing OPERABILITY (e.g., post work testing following corrective 

maintenance, corrective modification, deficient or incomplete surveillance 

testing, and other unanticipated OPERABILITY concerns) provided an 

assessment determines plant safety is maintained or enhanced. This 

assessment shall, as a minimum, consider the potential outcomes and 

transients associated with a failed partial Surveillance, a successful 

partial Surveillance, and a perturbation of the offsite or onsite system 

when they are tied together or operated independently for the partial 

Surveillance; as well as the operator procedures available to cope with 
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-36 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

these outcomes. These shall be measured against the avoided risk of a 

plant shutdown and startup to determine that plant safety is maintained or 

enhanced when portions of the Surveillance are performed in MODE 1 

or 2. Risk insights or deterministic methods may be used for the 

assessment. Credit may be taken for unplanned events that satisfy this 

SR. 

SR 3.8.1.20

This Surveillance demonstrates that the DG starting independence has 

not been compromised. Also, this Surveillance demonstrates that each 

engine can achieve proper speed within the specified time when the DGs 

are started simultaneously.

[ The 10 year Frequency is consistent with the recommendations of 

Regulatory Guide 1.108 (Ref. 9).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note. The reason for the Note is to minimize 

wear on the DG during testing. For the purpose of this testing, the DGs 

must be started from standby conditions, that is, with the engine coolant 

and oil continuously circulated and temperature maintained consistent 

with manufacturer recommendations.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. FSAR, Chapter [8].

3. Regulatory Guide 1.9, Rev. 3.

4. FSAR, Chapter [6].

5. FSAR, Chapter [15].
AC Sources - Operating

B 3.8.1

Westinghouse STS B 3.8.1-37 Rev. 4.0

BASES

REFERENCES (continued)

6. Regulatory Guide 1.93, Rev. 0, December 1974.

7. Generic Letter 84-15, "Proposed Staff Actions to Improve and 

Maintain Diesel Generator Reliability," July 2, 1984.

8. 10 CFR 50, Appendix A, GDC 18.

9. Regulatory Guide 1.108, Rev. 1, August 1977.

10. Regulatory Guide 1.137, Rev. [ ], [date].

11. ASME Code for Operation and Maintenance of Nuclear Power 

Plants.

12. IEEE Standard 308-1978.

AC Sources - Shutdown

B 3.8.2

Westinghouse STS B 3.8.2-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.2 AC Sources - Shutdown

BASES

BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, 

"AC Sources - Operating."

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 5 and 6

SAFETY and during movement of [recently] irradiated fuel assemblies ensures

ANALYSES that:

a. The unit can be maintained in the shutdown or refueling condition for 

extended periods,

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and

c. Adequate AC electrical power is provided to mitigate events 

postulated during shutdown, such as a fuel handling accident 

[involving handling recently irradiated fuel. Due to radioactive decay, 

AC electrical power is only required to mitigate fuel handling 

accidents involving handling recently irradiated fuel (i.e., fuel that has 

occupied part of a critical reactor core within the previous [X] days)].

In general, when the unit is shut down, the Technical Specifications 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or all onsite power is not required. 

The rationale for this is based on the fact that many Design Basis 

Accidents (DBAs) that are analyzed in MODES 1, 2, 3, and 4 have no 

specific analyses in MODES 5 and 6. Worst case bounding events are 

deemed not credible in MODES 5 and 6 because the energy contained 

within the reactor pressure boundary, reactor coolant temperature and 

pressure, and the corresponding stresses result in the probabilities of 

occurrence being significantly reduced or eliminated, and in minimal 

consequences. These deviations from DBA analysis assumptions and 

design requirements during shutdown conditions are allowed by the LCO 

for required systems.

During MODES 1, 2, 3, and 4, various deviations from the analysis 

assumptions and design requirements are allowed within the Required 

Actions. This allowance is in recognition that certain testing and 

maintenance activities must be conducted provided an acceptable level of 

risk is not exceeded. During MODES 5 and 6, performance of a 
AC Sources - Shutdown

B 3.8.2

Westinghouse STS B 3.8.2-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

significant number of required testing and maintenance activities is also 

required. In MODES 5 and 6, the activities are generally planned and 

administratively controlled. Relaxations from MODE 1, 2, 3, and 4 LCO 

requirements are acceptable during shutdown modes based on:

a. The fact that time in an outage is limited. This is a risk prudent goal 

as well as a utility economic consideration.

b. Requiring appropriate compensatory measures for certain conditions. 

These may include administrative controls, reliance on systems that 

do not necessarily meet typical design requirements applied to 

systems credited in operating MODE analyses, or both.

c. Prudent utility consideration of the risk associated with multiple 

activities that could affect multiple systems.

d. Maintaining, to the extent practical, the ability to perform required 

functions (even if not meeting MODE 1, 2, 3, and 4 OPERABILITY 

requirements) with systems assumed to function during an event.

In the event of an accident during shutdown, this LCO ensures the 

capability to support systems necessary to avoid immediate difficulty, 

assuming either a loss of all offsite power or a loss of all onsite diesel 

generator (DG) power.

The AC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO One offsite circuit capable of supplying the onsite Class 1E power 

distribution subsystem(s) of LCO 3.8.10, "Distribution Systems -

Shutdown," ensures that all required loads are powered from offsite 

power. An OPERABLE DG, associated with a distribution system train 

required to be OPERABLE by LCO 3.8.10, ensures a diverse power 

source is available to provide electrical power support, assuming a loss of 

the offsite circuit. Together, OPERABILITY of the required offsite circuit 

and DG ensures the availability of sufficient AC sources to operate the 

unit in a safe manner and to mitigate the consequences of postulated 

events during shutdown (e.g., fuel handling accidents [involving handling 

recently irradiated fuel]).

The qualified offsite circuit must be capable of maintaining rated 

frequency and voltage, and accepting required loads during an accident, 

while connected to the Engineered Safety Feature (ESF) bus(es). 

Qualified offsite circuits are those that are described in the FSAR and are 

part of the licensing basis for the unit.
AC Sources - Shutdown

B 3.8.2

Westinghouse STS B 3.8.2-3 Rev. 4.0

BASES

LCO (continued)

[ Offsite circuit #1 consists of Safeguards Transformer B, which is supplied 

from Switchyard Bus B, and is fed through breaker 52-3 powering the 

ESF transformer XNB01, which, in turn, powers the #1 ESF bus through 

its normal feeder breaker. The second offsite circuit consists of the 

Startup Transformer, which is normally fed from the Switchyard Bus A, 

and is fed through breaker PA 0201 powering the ESF transformer, 

which, in turn, powers the #2 ESF bus through its normal feeder 

breaker. ]

The DG must be capable of starting, accelerating to rated speed and 

voltage, and connecting to its respective ESF bus on detection of bus 

undervoltage. This sequence must be accomplished within [10] seconds. 

The DG must be capable of accepting required loads within the assumed 

loading sequence intervals, and continue to operate until offsite power 

can be restored to the ESF buses. These capabilities are required to be 

met from a variety of initial conditions such as DG in standby with the 

engine hot and DG in standby at ambient conditions.

Proper sequencing of loads, including tripping of nonessential loads, is a 

required function for DG OPERABILITY.

[ In addition, proper sequencer operation is an integral part of offsite circuit 

OPERABILITY since its inoperability impacts on the ability to start and 

maintain energized loads required OPERABLE by LCO 3.8.10. ]

It is acceptable for trains to be cross tied during shutdown conditions, 

allowing a single offsite power circuit to supply all required trains.

APPLICABILITY The AC sources required to be OPERABLE in MODES 5 and 6 and 

during movement of [recently] irradiated fuel assemblies provide 

assurance that:

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel assemblies in the core,

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available,

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and
AC Sources - Shutdown

B 3.8.2

Westinghouse STS B 3.8.2-4 Rev. 4.0

BASES

APPLICABILITY (continued)

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition.

The AC power requirements for MODES 1, 2, 3, and 4 are covered in 

LCO 3.8.1.

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily.

A.1

An offsite circuit would be considered inoperable if it were not available to 

one required ESF train. Although two trains are required by LCO 3.8.10, 

the one train with offsite power available may be capable of supporting 

sufficient required features to allow continuation of [recently] irradiated 

fuel movement. By the allowance of the option to declare required 

features inoperable, with no offsite power available, appropriate 

restrictions will be implemented in accordance with the affected required 

features LCO's ACTIONS.

A.2.1, A.2.2, A.2.3, B.1, B.2, and B.3

With the offsite circuit not available to all required trains, the option would 

still exist to declare all required features inoperable. Since this option 

may involve undesired administrative efforts, the allowance for sufficiently 

conservative actions is made. With the required DG inoperable, the 

minimum required diversity of AC power sources is not available. It is, 

therefore, required to suspend movement of [recently] irradiated fuel 

assemblies, and operations involving positive reactivity additions that 

could result in loss of required SDM (MODE 5) or boron concentration 

(MODE 6). Suspending positive reactivity additions that could result in 

failure to meet the minimum SDM or boron concentration limit is required

to assure continued safe operation. Introduction of coolant inventory 

must be from sources that have a boron concentration greater than that 

what would be required in the RCS for minimum SDM or refueling boron 

concentration. This may result in an overall reduction in RCS boron
AC Sources - Shutdown

B 3.8.2

Westinghouse STS B 3.8.2-5 Rev. 4.0

BASES

ACTIONS (continued)

concentration, but provides acceptable margin to maintaining subcritical 

operation. Introduction of temperature changes including temperature 

increases when operating with a positive MTC must also be evaluated to 

ensure they do not result in a loss of required SDM.

Suspension of these activities does not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability or the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required AC sources and to 

continue this action until restoration is accomplished in order to provide 

the necessary AC power to the unit safety systems.

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required AC 

electrical power sources should be completed as quickly as possible in 

order to minimize the time during which the unit safety systems may be 

without sufficient power.

Pursuant to LCO 3.0.6, the Distribution System's ACTIONS would not be 

entered even if all AC sources to it are inoperable, resulting in deenergization. Therefore, the Required Actions of Condition A are 

modified by a Note to indicate that when Condition A is entered with no 

AC power to any required ESF bus, the ACTIONS for LCO 3.8.10 must 

be immediately entered. This Note allows Condition A to provide 

requirements for the loss of the offsite circuit, whether or not a train is deenergized. LCO 3.8.10 would provide the appropriate restrictions for the 

situation involving a de-energized train.

SURVEILLANCE SR 3.8.2.1

REQUIREMENTS

SR 3.8.2.1 requires the SRs from LCO 3.8.1 that are necessary for 

ensuring the OPERABILITY of the AC sources in other than MODES 1, 2, 

3, and 4. SR 3.8.1.8 is not required to be met since only one offsite 

circuit is required to be OPERABLE. SR 3.8.1.12 and SR 3.8.1.19 are 

not required to be met because the ESF actuation signal is not required to 

be OPERABLE. SR 3.8.1.17 is not required to be met because the 

required OPERABLE DG(s) is not required to undergo periods of being 

synchronized to the offsite circuit. SR 3.8.1.20 is excepted because 

starting independence is not required with the DG(s) that is not required 

to be operable.

This SR is modified by a Note. The reason for the Note is to preclude 

requiring the OPERABLE DG(s) from being paralleled with the offsite 

power network or otherwise rendered inoperable during performance of 

SRs, and to preclude deenergizing a required 4160 V ESF bus or
AC Sources - Shutdown

B 3.8.2

Westinghouse STS B 3.8.2-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

disconnecting a required offsite circuit during performance of SRs. With 

limited AC sources available, a single event could compromise both the 

required circuit and the DG. It is the intent that these SRs must still be 

capable of being met, but actual performance is not required during 

periods when the DG and offsite circuit is required to be OPERABLE. 

Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each 

SR. 

REFERENCES None.
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.3 Diesel Fuel Oil, Lube Oil, and Starting Air

BASES

BACKGROUND Each diesel generator (DG) is provided with a storage tank having a fuel 

oil capacity sufficient to operate that diesel for a period of [7] days while 

the DG is supplying maximum post loss of coolant accident load demand 

discussed in the FSAR, Section [9.5.4.2] (Ref. 1) [and Regulatory 

Guide 1.137 (Ref. 2)]. The maximum load demand is calculated using the 

assumption that a minimum of any two DGs is available. This onsite fuel 

oil capacity is sufficient to operate the DGs for longer than the time to 

replenish the onsite supply from outside sources.

Fuel oil is transferred from storage tank to day tank by either of two 

transfer pumps associated with each storage tank. Redundancy of 

pumps and piping precludes the failure of one pump, or the rupture of any 

pipe, valve or tank to result in the loss of more than one DG. All outside 

tanks, pumps, and piping are located underground.

For proper operation of the standby DGs, it is necessary to ensure the 

proper quality of the fuel oil. Regulatory Guide 1.137 (Ref. 2) addresses 

the recommended fuel oil practices as supplemented by ANSI N195 

(Ref. 3). The fuel oil properties governed by these SRs are the water and 

sediment content, the kinematic viscosity, specific gravity (or API gravity), 

and impurity level.

The DG lubrication system is designed to provide sufficient lubrication to 

permit proper operation of its associated DG under all loading conditions. 

The system is required to circulate the lube oil to the diesel engine 

working surfaces and to remove excess heat generated by friction during 

operation. Each engine oil sump contains an inventory capable of 

supporting a minimum of [7] days of operation. [The onsite storage in 

addition to the engine oil sump is sufficient to ensure [7] days of 

continuous operation.] This supply is sufficient to allow the operator to 

replenish lube oil from outside sources.

Each DG has an air start system with adequate capacity for five 

successive start attempts on the DG without recharging the air start 

receiver(s).
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-2 Rev. 4.0

BASES

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient

SAFETY analyses in the FSAR, Chapter [6] (Ref. 4), and in the FSAR,

ANALYSES Chapter [15] (Ref. 5), assume Engineered Safety Feature (ESF) systems 

are OPERABLE. The DGs are designed to provide sufficient capacity, 

capability, redundancy, and reliability to ensure the availability of 

necessary power to ESF systems so that fuel, Reactor Coolant System 

and containment design limits are not exceeded. These limits are 

discussed in more detail in the Bases for Section 3.2, Power Distribution 

Limits; Section 3.4, Reactor Coolant System (RCS); and Section 3.6, 

Containment Systems.

Since diesel fuel oil, lube oil, and the air start subsystem support the 

operation of the standby AC power sources, they satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO Stored diesel fuel oil is required to have sufficient supply for [7] days of 

full load operation. It is also required to meet specific standards for 

quality. Additionally, sufficient lubricating oil supply must be available to 

ensure the capability to operate at full load for [7] days. This requirement, 

in conjunction with an ability to obtain replacement supplies within 

[7] days, supports the availability of DGs required to shut down the 

reactor and to maintain it in a safe condition for an anticipated operational 

occurrence (AOO) or a postulated DBA with loss of offsite power. DG 

day tank fuel requirements, as well as transfer capability from the storage 

tank to the day tank, are addressed in LCO 3.8.1, "AC Sources -

Operating," and LCO 3.8.2, "AC Sources - Shutdown."

The starting air system is required to have a minimum capacity for five 

successive DG start attempts without recharging the air start receivers.

APPLICABILITY The AC sources (LCO 3.8.1 and LCO 3.8.2) are required to ensure the 

availability of the required power to shut down the reactor and maintain it 

in a safe shutdown condition after an AOO or a postulated DBA. Since 

stored diesel fuel oil, lube oil, and the starting air subsystem support 

LCO 3.8.1 and LCO 3.8.2, stored diesel fuel oil, lube oil, and starting air 

are required to be within limits when the associated DG is required to be 

OPERABLE.

ACTIONS The ACTIONS Table is modified by a Note indicating that separate 

Condition entry is allowed for each DG. This is acceptable, since the 

Required Actions for each Condition provide appropriate compensatory 

actions for each inoperable DG subsystem. Complying with the Required 

Actions for one inoperable DG subsystem may allow for continued 

operation, and subsequent inoperable DG subsystem(s) are governed by 

separate Condition entry and application of associated Required Actions.
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-3 Rev. 4.0

BASES

ACTIONS (continued)

A.1

In this Condition, the [7] day fuel oil supply for a DG is not available. 

However, the Condition is restricted to fuel oil level reductions that 

maintain at least a [6] day supply. The fuel oil level equivalent to a [6] day 

supply is [28,285] gallons. These circumstances may be caused by 

events, such as full load operation required after an inadvertent start 

while at minimum required level, or feed and bleed operations, which may 

be necessitated by increasing particulate levels or any number of other oil 

quality degradations. This restriction allows sufficient time for obtaining 

the requisite replacement volume and performing the analyses required 

prior to addition of fuel oil to the tank. A period of 48 hours is considered 

sufficient to complete restoration of the required level prior to declaring 

the DG inoperable. This period is acceptable based on the remaining 

capacity (> [6] days), the fact that procedures will be initiated to obtain 

replenishment, and the low probability of an event during this brief period.

B.1

In this Condition, the [7] day lube oil inventory i.e., sufficient lubricating oil 

to support [7] days of continuous DG operation at full load conditions is

not available. However, the Condition is restricted to lube oil volume 

reductions that maintain at least a [6] day supply. The lube oil inventory 

equivalent to a [6] day supply is [425] gallons. This restriction allows 

sufficient time to obtain the requisite replacement volume. A period of 

48 hours is considered sufficient to complete restoration of the required 

volume prior to declaring the DG inoperable. This period is acceptable 

based on the remaining capacity (> [6] days), the low rate of usage, the 

fact that procedures will be initiated to obtain replenishment, and the low 

probability of an event during this brief period.

C.1

This Condition is entered as a result of a failure to meet the acceptance 

criterion of SR 3.8.3.5. Normally, trending of particulate levels allows 

sufficient time to correct high particulate levels prior to reaching the limit 

of acceptability. Poor sample procedures (bottom sampling), 

contaminated sampling equipment, and errors in laboratory analysis can 

produce failures that do not follow a trend. Since the presence of 

particulates does not mean failure of the fuel oil to burn properly in the 

diesel engine, and particulate concentration is unlikely to change 

significantly between Surveillance Frequency intervals, and proper engine
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-4 Rev. 4.0

BASES

ACTIONS (continued)

performance has been recently demonstrated (within 31 days), it is 

prudent to allow a brief period prior to declaring the associated DG 

inoperable. The 7 day Completion Time allows for further evaluation, 

resampling and re-analysis of the DG fuel oil.

D.1

With the new fuel oil properties defined in the Bases for SR 3.8.3.4 not 

within the required limits, a period of 30 days is allowed for restoring the 

stored fuel oil properties. This period provides sufficient time to test the 

stored fuel oil to determine that the new fuel oil, when mixed with 

previously stored fuel oil, remains acceptable, or to restore the stored fuel 

oil properties. This restoration may involve feed and bleed procedures, 

filtering, or combinations of these procedures. Even if a DG start and 

load was required during this time interval and the fuel oil properties were 

outside limits, there is a high likelihood that the DG would still be capable 

of performing its intended function.

E.1

With starting air receiver pressure < [225] psig, sufficient capacity for five 

successive DG start attempts does not exist. However, as long as the 

receiver pressure is > [125] psig, there is adequate capacity for at least 

one start attempt, and the DG can be considered OPERABLE while the 

air receiver pressure is restored to the required limit. A period of 48 hours 

is considered sufficient to complete restoration to the required pressure 

prior to declaring the DG inoperable. This period is acceptable based on 

the remaining air start capacity, the fact that most DG starts are 

accomplished on the first attempt, and the low probability of an event 

during this brief period.

F.1

With a Required Action and associated Completion Time not met, or one 

or more DG's fuel oil, lube oil, or starting air subsystem not within limits 

for reasons other than addressed by Conditions A through D, the 

associated DG may be incapable of performing its intended function and 

must be immediately declared inoperable.
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-5 Rev. 4.0

BASES

SURVEILLANCE SR 3.8.3.1

REQUIREMENTS

This SR provides verification that there is an adequate inventory of fuel oil 

in the storage tanks to support each DG's operation for [7] days at full 

load. The fuel oil level equivalent to a [7] day supply is [33,000] gallons 

when calculated in accordance with References 2 and 3. The required 

fuel storage volume is determined using the most limiting energy content 

of the stored fuel. Using the known correlation of diesel fuel oil absolute 

specific gravity or API gravity to energy content, the required diesel 

generator output, the corresponding fuel consumption rate, the onsite fuel 

storage volume required for [7] days of operation can be determined. 

SR 3.8.3.3 requires a new fuel to be tested to verify that the absolute 

specific gravity or API gravity is within the range assumed in the diesel 

fuel oil consumption calculations. The [7] day period is sufficient time to 

place the unit in a safe shutdown condition and to bring in replenishment 

fuel from an offsite location.

[ The 31 day Frequency is adequate to ensure that a sufficient supply of 

fuel oil is available, since low level alarms are provided and unit operators 

would be aware of any large uses of fuel oil during this period.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.3.2

This Surveillance ensures that sufficient lube oil inventory is available to 

support at least [7] days of full load operation for each DG. The lube oil 

inventory equivalent to a [7] day supply is [500] gallons and is based on 

the DG manufacturer consumption values for the run time of the DG. 

Implicit in this SR is the requirement to verify the capability to transfer the 

lube oil from its storage location to the DG, when the DG lube oil sump 

does not hold adequate inventory for [7] days of full load operation 

without the level reaching the manufacturer recommended minimum 

level.
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ A 31 day Frequency is adequate to ensure that a sufficient lube oil supply 

is onsite, since DG starts and run time are closely monitored by the unit 

staff.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.3.3

The tests listed below are a means of determining whether new fuel oil is 

of the appropriate grade and has not been contaminated with substances 

that would have an immediate, detrimental impact on diesel engine 

combustion. If results from these tests are within acceptable limits, the 

fuel oil may be added to the storage tanks without concern for 

contaminating the entire volume of fuel oil in the storage tanks. These 

tests are to be conducted prior to adding the new fuel to the storage 

tank(s), but in no case is the time between receipt of new fuel and 

conducting the tests to exceed 31 days. The tests, limits, and applicable 

ASTM Standards are as follows:

a. Sample the new fuel oil in accordance with ASTM D4057-[ ] 

(Ref. 6),

b. Verify in accordance with the tests specified in ASTM D975-[ ] 

(Ref. 6) that the sample has an absolute specific gravity at 60/60°F of 

≥ 0.83 and ≤ 0.89 or an API gravity at 60°F of ≥ 27° and ≤ 39° when 

tested in accordance with ASTM D1298-[ ] (Ref. 6), a kinematic 

viscosity at 40°C of ≥ 1.9 centistokes and ≤ 4.1 centistokes, and a 

flash point of ≥ 125°F, and

c. Verify that the new fuel oil has a clear and bright appearance with 

proper color when tested in accordance with ASTM D4176-[ ] or a 

water and sediment content within limits when tested in accordance 

with [ASTM D2709-[ ]] (Ref. 6).
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

Failure to meet any of the above limits is cause for rejecting the new fuel 

oil, but does not represent a failure to meet the LCO concern since the 

fuel oil is not added to the storage tanks.

Within 31 days following the initial new fuel oil sample, the fuel oil is 

analyzed to establish that the other properties specified in Table 1 of 

ASTM D975-[ ] (Ref. 7) are met for new fuel oil when tested in 

accordance with ASTM D975-[ ] (Ref. 6), except that the analysis for 

sulfur may be performed in accordance with ASTM D1552-[ ], 

ASTM D2622-[ ], or ASTM D4294-[ ] (Ref. 6). The 31 day period is 

acceptable because the fuel oil properties of interest, even if they were 

not within stated limits, would not have an immediate effect on DG 

operation. This Surveillance ensures the availability of high quality fuel oil 

for the DGs.

Fuel oil degradation during long term storage shows up as an increase in 

particulate, due mostly to oxidation. The presence of particulate does not 

mean the fuel oil will not burn properly in a diesel engine. The particulate 

can cause fouling of filters and fuel oil injection equipment, however, 

which can cause engine failure.

Particulate concentrations should be determined in accordance with 

ASTM D5452-[ ] (Ref. 6). This method involves a gravimetric 

determination of total particulate concentration in the fuel oil and has a 

limit of 10 mg/l. It is acceptable to obtain a field sample for subsequent 

laboratory testing in lieu of field testing. [For those designs in which the 

total stored fuel oil volume is contained in two or more interconnected 

tanks, each tank must be considered and tested separately.]

The Frequency of this test takes into consideration fuel oil degradation 

trends that indicate that particulate concentration is unlikely to change 

significantly between Frequency intervals.

SR 3.8.3.4

This Surveillance ensures that, without the aid of the refill compressor, 

sufficient air start capacity for each DG is available. The system design 

requirements provide for a minimum of [five] engine start cycles without 

recharging. [A start cycle is defined by the DG vendor, but usually is 

measured in terms of time (seconds of cranking) or engine cranking 

speed.] The pressure specified in this SR is intended to reflect the lowest 

value at which the [five] starts can be accomplished.
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The 31 day Frequency takes into account the capacity, capability, 

redundancy, and diversity of the AC sources and other indications 

available in the control room, including alarms, to alert the operator to 

below normal air start pressure.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.3.5

Microbiological fouling is a major cause of fuel oil degradation. There are 

numerous bacteria that can grow in fuel oil and cause fouling, but all must 

have a water environment in order to survive. Removal of water from the 

fuel storage tanks eliminates the necessary environment for bacterial 

survival. This is the most effective means of controlling microbiological 

fouling. In addition, it eliminates the potential for water entrainment in the 

fuel oil during DG operation. Water may come from any of several 

sources, including condensation, ground water, rain water, and 

contaminated fuel oil, and from breakdown of the fuel oil by bacteria. 

Frequent checking for and removal of accumulated water minimizes 

fouling and provides data regarding the watertight integrity of the fuel oil 

system. [ The Surveillance Frequency of 31 days is established by 

Regulatory Guide 1.137 (Ref. 2). This SR is for preventive maintenance. 

The presence of water does not necessarily represent failure of this SR, 

provided the accumulated water is removed during performance of the 

Surveillance.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Diesel Fuel Oil, Lube Oil, and Starting Air

B 3.8.3

Westinghouse STS B 3.8.3-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [9.5.4.2].

2. Regulatory Guide 1.137.

3. ANSI N195, 1976.

4. FSAR, Chapter [6].

5. FSAR, Chapter [15].

6. ASTM Standards: D4057-[ ]; D975-[ ]; D1298-[ ]; D4176-[ ]; 

[D2709-[ ];] D1552-[ ]; D2622-[ ]; D4294-[ ]; D5452-[ ].

7. ASTM Standards, D975-[ ], Table 1.

DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.4 DC Sources - Operating

BASES

BACKGROUND The station DC electrical power system provides the AC emergency 

power system with control power. It also provides both motive and 

control power to selected safety related equipment and preferred AC vital 

bus power (via inverters). As required by 10 CFR 50, Appendix A, 

GDC 17 (Ref. 1), the DC electrical power system is designed to have 

sufficient independence, redundancy, and testability to perform its safety 

functions, assuming a single failure. The DC electrical power system also 

conforms to the recommendations of Regulatory Guide 1.6 (Ref. 2) and 

IEEE-308 (Ref. 3).

The [125/250] VDC electrical power system consists of two independent 

and redundant safety related Class 1E DC electrical power subsystems 

([Train A and Train B]). Each subsystem consists of [two] 125 VDC 

batteries [(each battery [50]% capacity)], the associated battery 

charger(s) for each battery, and all the associated control equipment and 

interconnecting cabling.

[ The 250 VDC source is obtained by use of the two 125 VDC batteries 

connected in series. Additionally there is [one] spare battery charger per 

subsystem, which provides backup service in the event that the preferred 

battery charger is out of service. If the spare battery charger is 

substituted for one of the preferred battery chargers, then the 

requirements of independence and redundancy between subsystems are 

maintained. ]

During normal operation, the [125/250] VDC load is powered from the 

battery chargers with the batteries floating on the system. In case of loss 

of normal power to the battery charger, the DC load is automatically 

powered from the station batteries.

The [Train A and Train B] DC electrical power subsystems provide the 

control power for its associated Class 1E AC power load group, [4.16] kV 

switchgear, and [480] V load centers. The DC electrical power 

subsystems also provide DC electrical power to the inverters, which in 

turn power the AC vital buses.

The DC power distribution system is described in more detail in Bases for 

LCO 3.8.9, "Distribution System - Operating," and LCO 3.8.10, 

"Distribution Systems - Shutdown."
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-2 Rev. 4.0

BASES

BACKGROUND (continued)

Each 125/250 VDC battery is separately housed in a ventilated room 

apart from its charger and distribution centers. Each subsystem is 

located in an area separated physically and electrically from the other 

subsystem to ensure that a single failure in one subsystem does not 

cause a failure in a redundant subsystem. [There is no sharing between 

redundant Class 1E subsystems, such as batteries, battery chargers, or 

distribution panels.]

Each battery has adequate storage capacity to meet the duty cycle(s) 

discussed in the FSAR, Chapter [8] (Ref 4). The battery is designed with 

additional capacity above that required by the design duty cycle to allow 

for temperature variations and other factors.

The batteries for Train A and Train B DC electrical power subsystems are 

sized to produce required capacity at 80% of nameplate rating, 

corresponding to warranted capacity at end of life cycles and the 100% 

design demand. The minimum design voltage limit is [105/210 V].

The battery cells are of flooded lead acid construction with a nominal 

specific gravity of [1.215]. This specific gravity corresponds to an open 

circuit battery voltage of approximately 120 V for a [58] cell battery (i.e., 

cell voltage of [2.065] volts per cell (Vpc)). The open circuit voltage is the 

voltage maintained when there is no charging or discharging. Once fully 

charged with its open circuit voltage ≥ [2.065] Vpc, the battery cell will 

maintain its capacity for [30] days without further charging per 

manufacturer's instructions. Optimal long term performance however, is 

obtained by maintaining a float voltage [2.20 to 2.25] Vpc. This provides 

adequate over-potential, which limits the formation of lead sulfate and self 

discharge. The nominal float voltage of [2.22] Vpc corresponds to a total 

float voltage output of [128.8] V for a [58] cell battery as discussed in the 

FSAR, Chapter [8] (Ref. 4).

Each Train A and Train B DC electrical power subsystem battery charger 

has ample power output capacity for the steady state operation of 

connected loads required during normal operation, while at the same time 

maintaining its battery bank fully charged. Each battery charger also has 

sufficient excess capacity to restore the battery from the design minimum 

charge to its fully charged state within [24] hours while supplying normal 

steady state loads discussed in the FSAR, Chapter [8] (Ref. 4).

The battery charger is normally in the float-charge mode. Float-charge is 

the condition in which the charger is supplying the connected loads and 

the battery cells are receiving adequate current to optimally charge the 

battery. This assures the internal losses of a battery are overcome and 

the battery is maintained in a fully charged state.
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-3 Rev. 4.0

BASES

BACKGROUND (continued)

When desired, the charger can be placed in the equalize mode. The 

equalize mode is at a higher voltage than the float mode and charging 

current is correspondingly higher. The battery charger is operated in the 

equalize mode after a battery discharge or for routine maintenance. 

Following a battery discharge, the battery recharge characteristic accepts 

current at the current limit of the battery charger (if the discharge was 

significant, e.g., following a battery service test) until the battery terminal 

voltage approaches the charger voltage setpoint. Charging current then 

reduces exponentially during the remainder of the recharge cycle. Leadcalcium batteries have recharge efficiencies of greater than 95%, so once 

at least 105% of the ampere-hours discharged have been returned, the 

battery capacity would be restored to the same condition as it was prior to 

the discharge. This can be monitored by direct observation of the 

exponentially decaying charging current or by evaluating the amp-hours 

discharged from the battery and amp-hours returned to the battery.

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient

SAFETY analyses in the FSAR, Chapter [6] (Ref. 5) and Chapter [15] (Ref. 6),

ANALYSES assume that Engineered Safety Feature (ESF) systems are OPERABLE. 

The DC electrical power system provides normal and emergency DC 

electrical power for the DGs, emergency auxiliaries, and control and 

switching during all MODES of operation.

The OPERABILITY of the DC sources is consistent with the initial 

assumptions of the accident analyses and is based upon meeting the 

design basis of the unit. This includes maintaining the DC sources 

OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC power or all onsite AC power and

b. A worst-case single failure.

The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The DC electrical power subsystems, each subsystem consisting of [two] 

batteries, battery charger [for each battery] and the corresponding control 

equipment and interconnecting cabling supplying power to the associated 

bus within the subsystem are required to be OPERABLE to ensure the 

availability of the required power to shut down the reactor and maintain it 

in a safe condition after an anticipated operational occurrence (AOO) or a 

postulated DBA. Loss of any DC electrical power subsystem does not 

prevent the minimum safety function from being performed (Ref. 4).
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-4 Rev. 4.0

BASES

LCO (continued)

An OPERABLE DC electrical power subsystem requires all required 

batteries and respective chargers to be operating and connected to the 

associated DC bus(es).

APPLICABILITY The DC electrical power sources are required to be OPERABLE in 

MODES 1, 2, 3, and 4 to ensure safe unit operation and to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and

b. Adequate core cooling is provided, and containment integrity and 

other vital functions are maintained in the event of a postulated DBA.

The DC electrical power requirements for MODES 5 and 6 are addressed 

in the Bases for LCO 3.8.5, "DC Sources - Shutdown."

ACTIONS A.1, A.2, and A.3

Condition A represents one subsystem with one [or two] battery chargers 

inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The 

ACTIONS provide a tiered response that focuses on returning the battery 

to the fully charged state and restoring a fully qualified charger to 

OPERABLE status in a reasonable time period. Required Action A.1 

requires that the battery terminal voltage be restored to greater than or 

equal to the minimum established float voltage within 2 hours. This time 

provides for returning the inoperable charger to OPERABLE status or 

providing an alternate means of restoring battery terminal voltage to 

greater than or equal to the minimum established float voltage. Restoring 

the battery terminal voltage to greater than or equal to the minimum 

established float voltage provides good assurance that, within [12] hours, 

the battery will be restored to its fully charged condition (Required Action 

A.2) from any discharge that might have occurred due to the charger 

inoperability. 

-----------------------------------REVIEWER’S NOTE-----------------------------------

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3).

--------------------------------------------------------------------------------------------------
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-5 Rev. 4.0

BASES

ACTIONS (continued)

A discharged battery having terminal voltage of at least the minimum 

established float voltage indicates that the battery is on the exponential 

charging current portion (the second part) of its recharge cycle. The time 

to return a battery to its fully charged state under this condition is simply a 

function of the amount of the previous discharge and the recharge 

characteristic of the battery. Thus there is good assurance of fully 

recharging the battery within [12] hours, avoiding a premature shutdown 

with its own attendant risk.

If established battery terminal float voltage cannot be restored to greater 

than or equal to the minimum established float voltage within 2 hours, and 

the charger is not operating in the current-limiting mode, a faulty charger 

is indicated. A faulty charger that is incapable of maintaining established 

battery terminal float voltage does not provide assurance that it can revert 

to and operate properly in the current limit mode that is necessary during 

the recovery period following a battery discharge event that the DC 

system is designed for.

If the charger is operating in the current limit mode after 2 hours that is an 

indication that the battery is partially discharged and its capacity margins 

will be reduced. The time to return the battery to its fully charged 

condition in this case is a function of the battery charger capacity, the 

amount of loads on the associated DC system, the amount of the 

previous discharge, and the recharge characteristic of the battery. The 

charge time can be extensive, and there is not adequate assurance that it 

can be recharged within [12] hours (Required Action A.2).

Required Action A.2 requires that the battery float current be verified as 

less than or equal to [2] amps. This indicates that, if the battery had been 

discharged as the result of the inoperable battery charger, it is now fully 

capable of supplying the maximum expected load requirement. The 

[2] amp value is based on returning the battery to [95]% charge and 

assumes a [5]% design margin for the battery. If at the expiration of the 

initial [12] hour period the battery float current is not less than or equal to 

[2] amps this indicates there may be additional battery problems and the 

battery must be declared inoperable.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Any licensee wishing to adopt Completion Time greater than 72 hours for 

Required Action A.3 will need to demonstrate that the longer Completion 

Time is appropriate for the plant in accordance with the guidance in 

Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific, RiskInformed Decisionmaking: Technical Specifications," and RG 1.174, "An 

Approach for Using Probabilistic Risk Assessment in Risk-Informed 

Decisions on Plant-Specific Changes to the Licensing Basis." 
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-6 Rev. 4.0

BASES

ACTIONS (continued)

Alternatively, a 7 day Completion Time can be justified by an acceptable 

method, such as a regulatory commitment that an alternate means to 

charge the batteries will be available that is capable of being supplied 

power from a power source that is independent of the offsite power 

supply. Otherwise, the 72 hour Completion Time must be adopted.

--------------------------------------------------------------------------------------------------

Required Action A.3 limits the restoration time for the inoperable battery 

charger to [72] hours. This action is applicable if an alternate means of 

restoring battery terminal voltage to greater than or equal to the minimum 

established float voltage has been used (e.g., balance of plant non-Class 

1E battery charger). The [72] hour Completion Time reflects a 

reasonable time to effect restoration of the qualified battery charger to 

OPERABLE status.

B.1

-----------------------------------REVIEWER’S NOTES---------------------------------

1. The 2 hour Completion Times of Required Actions B.1 and C.1 are in 

brackets. Any licensee wishing to request a longer Completion Time 

will need to demonstrate that the longer Completion Time is 

appropriate for the plant in accordance with the guidance in 

RG 1.177 and RG 1.174.

2. Condition B is included if Required Action B.1 (one [or two] 

batter[y][ies on one subsystem] inoperable) and Required Action C.1 

(one DC electrical power subsystem inoperable for reasons other 

than Condition A [or B]) would have different Completion Times. If 

the plant design supports different Completion Times when a battery 

is inoperable but the charger is OPERABLE, then Condition B is 

used. If not, Condition B is deleted and only Condition C is used.

--------------------------------------------------------------------------------------------------

Condition B represents one subsystem with one [or two] batter[y][ies] 

inoperable. With one [or two] batter[y][ies] inoperable, the DC bus is 

being supplied by the OPERABLE battery charger[s]. Any event that 

results in a loss of the AC bus supporting the battery charger[s] will also 

result in loss of DC to that subsystem. Recovery of the AC bus, 

especially if it is due to a loss of offsite power, will be hampered by the 

fact that many of the components necessary for the recovery (e.g., diesel 

generator control and field flash, AC load shed and diesel generator 

output circuit breakers, etc.) likely rely upon the batter[y][ies]. In addition 

the energization transients of any DC loads that are beyond the capability 

of the battery charger[s] and normally require the assistance of the
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-7 Rev. 4.0

BASES

ACTIONS (continued)

batter[y][ies] will not be able to be brought online. The [2] hour limit 

allows sufficient time to effect restoration of an inoperable battery given 

that the majority of the conditions that lead to battery inoperability (e.g., 

loss of battery charger, battery cell voltage less than [2.07] V, etc.) are 

identified in Specifications 3.8.4, 3.8.5, and 3.8.6 together with additional 

specific Completion Times.

C.1

Condition C represents one subsystem with a loss of ability to completely 

respond to an event, and a potential loss of ability to remain energized 

during normal operation. It is therefore, imperative that the operator's 

attention focus on stabilizing the unit, minimizing the potential for 

complete loss of DC power to the affected subsystem. The 2 hour limit is 

consistent with the allowed time for an inoperable DC distribution 

subsystem.

If one of the required DC electrical power subsystems is inoperable for 

reasons other than Condition A or B (e.g., inoperable battery charger and 

associated inoperable battery), the remaining DC electrical power 

subsystem has the capacity to support a safe shutdown and to mitigate

an accident condition. Since a subsequent worst- case single failure 

could, however, result in the loss of the minimum necessary DC electrical 

subsystems to mitigate a worst case accident, continued power operation 

should not exceed 2 hours. The 2 hour Completion Time is based on 

Regulatory Guide 1.93 (Ref. 7) and reflects a reasonable time to assess 

unit status as a function of the inoperable DC electrical power subsystem 

and, if the DC electrical power subsystem is not restored to OPERABLE 

status, to prepare to effect an orderly and safe unit shutdown.

D.1 and D.2

If the inoperable DC electrical power subsystem cannot be restored to 

OPERABLE status within the required Completion Time, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and to 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging plant 

systems. The Completion Time to bring the unit to MODE 5 is consistent 

with the time required in Regulatory Guide 1.93 (Ref. 7).
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-8 Rev. 4.0

BASES

SURVEILLANCE SR 3.8.4.1

REQUIREMENTS

Verifying battery terminal voltage while on float charge for the batteries 

helps to ensure the effectiveness of the battery chargers, which support 

the ability of the batteries to perform their intended function. Float charge 

is the condition in which the charger is supplying the continuous charge 

required to overcome the internal losses of a battery and maintain the 

battery in a fully charged state while supplying the continuous steady 

state loads of the associated DC subsystem. On float charge, battery 

cells will receive adequate current to optimally charge the battery. The 

voltage requirements are based on the nominal design voltage of the 

battery and are consistent with the minimum float voltage established by 

the battery manufacturer ([2.20] Vpc times the number of connected cells 

or [127.6] V for a 58 cell battery at the battery terminals). This voltage 

maintains the battery plates in a condition that supports maintaining the 

grid life. [ The 7 day Frequency is consistent with manufacturer 

recommendations.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.4.2

This SR verifies the design capacity of the battery chargers. According to 

Regulatory Guide 1.32 (Ref. 8), the battery charger supply is 

recommended to be based on the largest combined demands of the 

various steady state loads and the charging capacity to restore the 

battery from the design minimum charge state to the fully charged state, 

irrespective of the status of the unit during these demand occurrences. 

The minimum required amperes and duration ensures that these 

requirements can be satisfied.

This SR provides two options. One option requires that each battery 

charger be capable of supplying [400] amps at the minimum established 

float voltage for [8] hours. The ampere requirements are based on the
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

output rating of the chargers. The voltage requirements are based on the 

charger voltage level after a response to a loss of AC power. The time 

period is sufficient for the charger temperature to have stabilized and to 

have been maintained for at least [2] hours.

The other option requires that each battery charger be capable of 

recharging the battery after a service test coincident with supplying the 

largest coincident demands of the various continuous steady state loads 

(irrespective of the status of the plant during which these demands 

occur). This level of loading may not normally be available following the 

battery service test and will need to be supplemented with additional 

loads. The duration for this test may be longer than the charger sizing 

criteria since the battery recharge is affected by float voltage, 

temperature, and the exponential decay in charging current. The battery 

is recharged when the measured charging current is ≤ [2] amps.

[ The Surveillance Frequency is acceptable, given the unit conditions 

required to perform the test and the other administrative controls existing 

to ensure adequate charger performance during these [18 month] 

intervals. In addition, this Frequency is intended to be consistent with 

expected fuel cycle lengths.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.4.3

A battery service test is a special test of the battery capability, as found, 

to satisfy the design requirements (battery duty cycle) of the DC electrical 

power system. The discharge rate and test length should correspond to 

the design duty cycle requirements as specified in Reference 4.
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-10 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Surveillance Frequency of [18 months] is consistent with the 

recommendations of Regulatory Guide 1.32 (Ref. 8) and Regulatory

Guide 1.129 (Ref. 9), which state that the battery service test should be 

performed during refueling operations, or at some other outage, with 

intervals between tests not to exceed [18 months].

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by two Notes. Note 1 allows the performance of a 

modified performance discharge test in lieu of a service test.

The reason for Note 2 is that performing the Surveillance would perturb 

the electrical distribution system and challenge safety systems. This 

restriction from normally performing the Surveillance in MODE 1 or 2 is 

further amplified to allow portions of the Surveillance to be performed for 

the purpose of reestablishing OPERABILITY (e.g., post work testing 

following corrective maintenance, corrective modification, deficient or 

incomplete surveillance testing, and other unanticipated OPERABILITY 

concerns) provided an assessment determines plant safety is maintained 

or enhanced. This assessment shall, as a minimum, consider the 

potential outcomes and transients associated with a failed partial 

Surveillance, a successful partial Surveillance, and a perturbation of the 

offsite or onsite system when they are tied together or operated 

independently for the partial Surveillance; as well as the operator 

procedures available to cope with these outcomes. These shall be 

measured against the avoided risk of a plant shutdown and startup to 

determine that plant safety is maintained or enhanced when portions of 

the Surveillance are performed in MODE 1 or 2. Risk insights or 

deterministic methods may be used for the assessment. Credit may be 

taken for unplanned events that satisfy this SR.
DC Sources - Operating

B 3.8.4

Westinghouse STS B 3.8.4-11 Rev. 4.0

BASES

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. Regulatory Guide 1.6, March 10, 1971.

3. IEEE-308-[1978].

4. FSAR, Chapter [8].

5. FSAR, Chapter [6].

6. FSAR, Chapter [15].

7. Regulatory Guide 1.93, December 1974.

8. Regulatory Guide 1.32, February 1977.

9. Regulatory Guide 1.129, December 1974.

DC Sources - Shutdown

B 3.8.5

Westinghouse STS B 3.8.5-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.5 DC Sources - Shutdown

BASES

BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, 

"DC Sources - Operating."

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient 

SAFETY analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [15] (Ref. 2), 

ANALYSES assume that Engineered Safety Feature systems are OPERABLE. The 

DC electrical power system provides normal and emergency DC electrical 

power for the diesel generators, emergency auxiliaries, and control and 

switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial 

assumptions of the accident analyses and the requirements for the 

supported systems' OPERABILITY.

The OPERABILITY of the minimum DC electrical power sources during 

MODES 5 and 6 and during movement of [recently] irradiated fuel 

assemblies ensures that:

a. The unit can be maintained in the shutdown or refueling condition for 

extended periods,

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and

c. Adequate DC electrical power is provided to mitigate events 

postulated during shutdown, such as a fuel handling accident 

[involving handling recently irradiated fuel. Due to radioactive decay, 

DC electrical power is only required to mitigate fuel handling 

accidents involving handling recently irradiated fuel (i.e., fuel that has 

occupied part of a critical reactor core within the previous [X] days)].

In general, when the unit is shut down, the Technical Specifications 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or all onsite power is not required. 

The rationale for this is based on the fact that many DBAs that are 

analyzed in MODES [1, 2, 3, and 4] have no specific analyses in MODES 

[5 and 6] because the energy contained within the reactor pressure
DC Sources - Shutdown

B 3.8.5

Westinghouse STS B 3.8.5-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

boundary, reactor coolant temperature and pressure, and the 

corresponding stresses result in the probabilities of occurrence being 

significantly reduced or eliminated, and in minimal consequences. These 

deviations from DBA analysis assumptions and design requirements 

during shutdown conditions are allowed by the LCO for required systems.

The shutdown Technical Specification requirements are designed to 

ensure that the unit has the capability to mitigate the consequences of 

certain postulated accidents. Worst case DBAs which are analyzed for 

operating MODES are generally viewed not to be a significant concern 

during shutdown MODES due to the lower energies involved. The 

Technical Specifications therefore require a lesser complement of 

electrical equipment to be available during shutdown than is required 

during operating MODES. More recent work completed on the potential 

risks associated with shutdown, however, have found significant risk 

associated with certain shutdown evolutions. As a result, in addition to 

the requirements established in the Technical Specifications, the industry 

has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess 

Shutdown Management," as an Industry initiative to manage shutdown 

tasks and associated electrical support to maintain risk at an acceptable 

low level. This may require the availability of additional equipment 

beyond that required by the shutdown Technical Specifications.

The DC sources satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The DC electrical power subsystems, [each required ] [the required] 

[subsystem consisting of two batteries, one battery charger per battery, 

and the corresponding control equipment and interconnecting cabling 

within the subsystem, [are] [is] required to be OPERABLE to support 

[required] [one] subsystem[s] of the distribution systems [required 

OPERABLE by LCO 3.8.10, "Distribution Systems - Shutdown."] This 

ensures the availability of sufficient DC electrical power sources to 

operate the unit in a safe manner and to mitigate the consequences of 

postulated events during shutdown (e.g., fuel handling accidents 

[involving handling recently irradiated fuel]).

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 5 

and 6, and during movement of [recently] irradiated fuel assemblies, 

provide assurance that:

a. Required features to provide adequate coolant inventory makeup are 

available for the irradiated fuel assemblies in the core,
DC Sources - Shutdown

B 3.8.5

Westinghouse STS B 3.8.5-3 Rev. 4.0

BASES

APPLICABILITY (continued)

b. Required features needed to mitigate a fuel handling accident 

[involving handling recently irradiated fuel (i.e., fuel that has occupied 

part of a critical reactor core within the previous [X] days)] are 

available,

c. Required features necessary to mitigate the effects of events that can 

lead to core damage during shutdown are available, and

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition.

The DC electrical power requirements for MODES 1, 2, 3, and 4 are 

covered in LCO 3.8.4.

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily.

A.1, A.2, and A.3

-----------------------------------REVIEWER’S NOTE-----------------------------------

ACTION A is included only when plant-specific implementation of 

LCO 3.8.5 includes the potential to require both subsystems of the DC 

System to be OPERABLE. If plant-specific implementation results in 

LCO 3.8.5 requiring only one subsystem of the DC System to be 

OPERABLE, then ACTION A is omitted and ACTION B is renumbered as 

ACTION A.

--------------------------------------------------------------------------------------------------

Condition A represents one subsystem with one [or two] battery chargers 

inoperable (e.g., the voltage limit of SR 3.8.4.1 is not maintained). The 

ACTIONS provide a tiered response that focuses on returning the battery 

to the fully charged state and restoring a fully qualified charger to 

OPERABLE status in a reasonable time period. Required Action A.1 

requires that the battery terminal voltage be restored to greater than or 

equal to the minimum established float voltage within 2 hours. This time 

provides for returning the inoperable charger to OPERABLE status or 

providing an alternate means of restoring battery terminal voltage to 

greater than or equal to the minimum established float voltage. Restoring
DC Sources - Shutdown

B 3.8.5

Westinghouse STS B 3.8.5-4 Rev. 4.0

BASES

ACTIONS (continued)

the battery terminal voltage to greater than or equal to the minimum 

established float voltage provides good assurance that, within [12] hours, 

the battery will be restored to its fully charged condition (Required Action 

A.2) from any discharge that might have occurred due to the charger 

inoperability.

-----------------------------------REVIEWER’S NOTE-----------------------------------

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3).

--------------------------------------------------------------------------------------------------

A discharged battery having terminal voltage of at least the minimum 

established float voltage indicates that the battery is on the exponential 

charging current portion (the second part) of its recharge cycle. The time 

to return a battery to its fully charged state under this condition is simply a 

function of the amount of the previous discharge and the recharge 

characteristic of the battery. Thus there is good assurance of fully 

recharging the battery within [12] hours, avoiding a premature shutdown 

with its own attendant risk.

If established battery terminal float voltage cannot be restored to greater 

than or equal to the minimum established float voltage within 2 hours, and 

the charger is not operating in the current-limiting mode, a faulty charger 

is indicated. A faulty charger that is incapable of maintaining established 

battery terminal float voltage does not provide assurance that it can revert 

to and operate properly in the current limit mode that is necessary during 

the recovery period following a battery discharge event that the DC 

system is designed for.

If the charger is operating in the current limit mode after 2 hours that is an 

indication that the battery is partially discharged and its capacity margins 

will be reduced. The time to return the battery to its fully charged 

condition in this case is a function of the battery charger capacity, the 

amount of loads on the associated DC system, the amount of the 

previous discharge, and the recharge characteristic of the battery. The 

charge time can be extensive, and there is not adequate assurance that it 

can be recharged within [12] hours (Required Action A.2).

Required Action A.2 requires that the battery float current be verified as 

less than or equal to [2] amps. This indicates that, if the battery had been 

discharged as the result of the inoperable battery charger, it has now
DC Sources - Shutdown

B 3.8.5

Westinghouse STS B 3.8.5-5 Rev. 4.0

BASES

ACTIONS (continued)

been fully recharged. If at the expiration of the initial [12] hour period the 

battery float current is not less than or equal to [2] amps this indicates 

there may be additional battery problems and the battery must be 

declared inoperable.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Any licensee wishing to adopt a Completion Time greater than 72 hours 

for Required Action A.3 will need to demonstrate that the Completion 

Time is appropriate for the plant in accordance with the guidance in 

Regulatory Guide (RG) 1.177, "An Approach for Plant-Specific, RiskInformed Decisionmaking: Technical Specifications." Otherwise, the 

72 hour Completion Time must be adopted.

--------------------------------------------------------------------------------------------------

Required Action A.3 limits the restoration time for the inoperable battery 

charger to [72] hours. This action is applicable if an alternate means of 

restoring battery terminal voltage to greater than or equal to the minimum 

established float voltage has been used (e.g., balance of plant non-Class 

1E battery charger). The [72] hour Completion Time reflects a 

reasonable time to effect restoration of the qualified battery charger to 

OPERABLE status.

B.1, B.2.1, B.2.2, and B.2.3

[If two subsystems are required by LCO 3.8.10, the remaining subsystem

with DC power available may be capable of supporting sufficient systems 

to allow continuation of [recently] irradiated fuel movement]. By allowing 

the option to declare required features inoperable with the associated DC 

power source(s) inoperable, appropriate restrictions will be implemented 

in accordance with the affected required features LCO ACTIONS. In 

many instances this option may involve undesired administrative efforts. 

Therefore, the allowance for sufficiently conservative actions is made 

(i.e., to suspend movement of [recently] irradiated fuel assemblies, and 

operations involving positive reactivity additions) that could result in loss 

of required SDM (MODE 5) or boron concentration (MODE 6). 

Suspending positive reactivity additions that could result in failure to meet 

the minimum SDM or boron concentration limit is required to assure 

continued safe operation. Introduction of coolant inventory must be from 

sources that have a boron concentration greater than that what would be 

required in the RCS for minimum SDM or refueling boron concentration. 

This may result in an overall reduction in RCS boron concentration, but 

provides acceptable margin to maintaining subcritical operation. 

Introduction of temperature changes including temperature increases 

when operating with a positive MTC must also be evaluated to ensure 

they do not result in a loss of required SDM.
DC Sources - Shutdown

B 3.8.5

Westinghouse STS B 3.8.5-6 Rev. 4.0

BASES

ACTIONS (continued)

Suspension of these activities shall not preclude completion of actions to 

establish a safe conservative condition. These actions minimize 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required DC electrical power 

subsystem[s] and to continue this action until restoration is accomplished 

in order to provide the necessary DC electrical power to the unit safety 

systems.

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required DC 

electrical power subsystems should be completed as quickly as possible 

in order to minimize the time during which the unit safety systems may be 

without sufficient power.

SURVEILLANCE SR 3.8.5.1

REQUIREMENTS

SR 3.8.5.1 requires performance of all Surveillances required by 

SR 3.8.4.1 through SR 3.8.4.3. Therefore, see the corresponding Bases 

for LCO 3.8.4 for a discussion of each SR.

This SR is modified by a Note. The reason for the Note is to preclude 

requiring the OPERABLE DC sources from being discharged below their 

capability to provide the required power supply or otherwise rendered 

inoperable during the performance of SRs. It is the intent that these SRs 

must still be capable of being met, but actual performance is not required.

REFERENCES 1. FSAR, Chapter [6].

2. FSAR, Chapter [15].
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.6 Battery Parameters

BASES

BACKGROUND This LCO delineates the limits on battery float current as well as 

electrolyte temperature, level, and float voltage for the DC power 

subsystem batteries. A discussion of these batteries and their 

OPERABILITY requirements is provided in the Bases for LCO 3.8.4, "DC 

Sources - Operating," and LCO 3.8.5, "DC Sources - Shutdown." In 

addition to the limitations of this Specification, the [licensee controlled 

program] also implements a program specified in Specification 5.5.17 for 

monitoring various battery parameters.

The battery cells are of flooded lead acid construction with a nominal 

specific gravity of [1.215]. This specific gravity corresponds to an open 

circuit battery voltage of approximately 120 V for [58] cell battery (i.e., cell 

voltage of [2.065] volts per cell (Vpc)). The open circuit voltage is the 

voltage maintained when there is no charging or discharging. Once fully 

charged with its open circuit voltage ≥ [2.065] Vpc, the battery cell will 

maintain its capacity for [30] days without further charging per 

manufacturer's instructions. Optimal long term performance however, is 

obtained by maintaining a float voltage [2.20 to 2.25] Vpc. This provides 

adequate over-potential which limits the formation of lead sulfate and self 

discharge. The nominal float voltage of [2.22] Vpc corresponds to a total 

float voltage output of [128.8] V for a [58] cell battery as discussed in the 

FSAR, Chapter [8] (Ref. 2).

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient

SAFETY analyses in the FSAR, Chapter [6] (Ref. 3) and Chapter [15] (Ref. 4),

ANALYSES assume Engineered Safety Feature systems are OPERABLE. The DC 

electrical power system provides normal and emergency DC electrical 

power for the DGs, emergency auxiliaries, and control and switching 

during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial 

assumptions of the accident analyses and is based upon meeting the 

design basis of the unit. This includes maintaining at least one 

subsystem of DC sources OPERABLE during accident conditions, in the 

event of:

a. An assumed loss of all offsite AC power or all onsite AC power and

b. A worst-case single failure.

Battery parameters satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-2 Rev. 4.0

BASES

LCO Battery parameters must remain within acceptable limits to ensure 

availability of the required DC power to shut down the reactor and 

maintain it in a safe condition after an anticipated operational occurrence 

or a postulated DBA. Battery parameter limits are conservatively 

established, allowing continued DC electrical system function even with 

limits not met. Additional preventative maintenance, testing, and 

monitoring performed in accordance with the [licensee controlled 

program] is conducted as specified in Specification 5.5.17.

APPLICABILITY The battery parameters are required solely for the support of the 

associated DC electrical power subsystems. Therefore, battery 

parameter limits are only required when the DC power source is required 

to be OPERABLE. Refer to the Applicability discussion in Bases for 

LCO 3.8.4 and LCO 3.8.5.

ACTIONS A.1, A.2, and A.3

With one or more cells in one or more batteries in one subsystem

< [2.07] V, the battery cell is degraded. Within 2 hours verification of the 

required battery charger OPERABILITY is made by monitoring the battery 

terminal voltage (SR 3.8.4.1) and of the overall battery state of charge by 

monitoring the battery float charge current (SR 3.8.6.1). This assures that 

there is still sufficient battery capacity to perform the intended function. 

Therefore, the affected battery is not required to be considered inoperable 

solely as a result of one or more cells in one or more batteries < [2.07] V, 

and continued operation is permitted for a limited period up to 24 hours.

Since the Required Actions only specify "perform," a failure of SR 3.8.4.1 

or SR 3.8.6.1 acceptance criteria does not result in this Required Action 

not met. However, if one of the SRs is failed the appropriate Condition(s), 

depending on the cause of the failures, is entered. If SR 3.8.6.1 is failed 

then there is not assurance that there is still sufficient battery capacity to 

perform the intended function and the battery must be declared 

inoperable immediately.

B.1 and B.2

One or more batteries in one subsystem with float current > [2] amps 

indicates that a partial discharge of the battery capacity has occurred. 

This may be due to a temporary loss of a battery charger or possibly due 

to one or more battery cells in a low voltage condition reflecting some loss 

of capacity. Within 2 hours verification of the required battery charger 

OPERABILITY is made by monitoring the battery terminal voltage. If the 

terminal voltage is found to be less than the minimum established float 

voltage there are two possibilities, the battery charger is inoperable or is
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-3 Rev. 4.0

BASES

ACTIONS (continued)

operating in the current limit mode. Condition A addresses charger 

inoperability. If the charger is operating in the current limit mode after 

2 hours that is an indication that the battery has been substantially 

discharged and likely cannot perform its required design functions. The 

time to return the battery to its fully charged condition in this case is a 

function of the battery charger capacity, the amount of loads on the 

associated DC system, the amount of the previous discharge, and the 

recharge characteristic of the battery. The charge time can be extensive, 

and there is not adequate assurance that it can be recharged within 

[12] hours (Required Action B.2). The battery must therefore be declared

inoperable.

If the float voltage is found to be satisfactory but there are one or more 

battery cells with float voltage less than [2.07] V, the associated "OR" 

statement in Condition F is applicable and the battery must be declared 

inoperable immediately. If float voltage is satisfactory and there are no 

cells less than [2.07] V there is good assurance that, within [12] hours, the 

battery will be restored to its fully charged condition (Required Action B.2) 

from any discharge that might have occurred due to a temporary loss of 

the battery charger. 

-----------------------------------REVIEWER’S NOTE-----------------------------------

A plant that cannot meet the 12 hour Completion Time due to an inherent 

battery charging characteristic can propose an alternate time equal to 

2 hours plus the time experienced to accomplish the exponential charging 

current portion of the battery charge profile following the service test 

(SR 3.8.4.3).

--------------------------------------------------------------------------------------------------

A discharged battery with float voltage (the charger setpoint) across its 

terminals indicates that the battery is on the exponential charging current 

portion (the second part) of its recharge cycle. The time to return a 

battery to its fully charged state under this condition is simply a function of 

the amount of the previous discharge and the recharge characteristic of 

the battery. Thus there is good assurance of fully recharging the battery 

within [12] hours, avoiding a premature shutdown with its own attendant 

risk.

If the condition is due to one or more cells in a low voltage condition but 

still greater than [2.07] V and float voltage is found to be satisfactory, this 

is not indication of a substantially discharged battery and [12] hours is a 

reasonable time prior to declaring the battery inoperable.
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-4 Rev. 4.0

BASES

ACTIONS (continued)

Since Required Action B.1 only specifies "perform," a failure of SR 3.8.4.1 

acceptance criteria does not result in the Required Action not met. 

However, if SR 3.8.4.1 is failed, the appropriate Condition(s), depending 

on the cause of the failure, is entered.

C.1, C.2, and C.3

With one or more batteries in one subsystem with one or more cells 

electrolyte level above the top of the plates, but below the minimum 

established design limits, the battery still retains sufficient capacity to 

perform the intended function. Therefore, the affected battery is not 

required to be considered inoperable solely as a result of electrolyte level 

not met. Within 31 days the minimum established design limits for 

electrolyte level must be re-established.

With electrolyte level below the top of the plates there is a potential for 

dryout and plate degradation. Required Actions C.1 and C.2 address this 

potential (as well as provisions in Specification 5.5.17, Battery Monitoring 

and Maintenance Program). They are modified by a Note that indicates 

they are only applicable if electrolyte level is below the top of the plates. 

Within 8 hours level is required to be restored to above the top of the 

plates. The Required Action C.2 requirement to verify that there is no 

leakage by visual inspection and the Specification 5.5.17.b item to initiate 

action to equalize and test in accordance with manufacturer's 

recommendation are taken from IEEE Standard 450. They are performed 

following the restoration of the electrolyte level to above the top of the 

plates. Based on the results of the manufacturer's recommended testing 

the batter[y][ies] may have to be declared inoperable and the affected 

cell[s] replaced.

D.1

With one or more batteries in one subsystem with pilot cell temperature 

less than the minimum established design limits, 12 hours is allowed to 

restore the temperature to within limits. A low electrolyte temperature 

limits the current and power available. Since the battery is sized with 

margin, while battery capacity is degraded, sufficient capacity exists to 

perform the intended function and the affected battery is not required to 

be considered inoperable solely as a result of the pilot cell temperature 

not met.
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-5 Rev. 4.0

BASES

ACTIONS (continued)

E.1

With one or more batteries in redundant subsystems with battery 

parameters not within limits there is not sufficient assurance that battery 

capacity has not been affected to the degree that the batteries can still 

perform their required function, given that redundant batteries are 

involved. With redundant batteries involved this potential could result in a 

total loss of function on multiple systems that rely upon the batteries. The 

longer Completion Times specified for battery parameters on nonredundant batteries not within limits are therefore not appropriate, and the 

parameters must be restored to within limits on at least one subsystem

within 2 hours.

F.1

With one or more batteries with any battery parameter outside the 

allowances of the Required Actions for Condition A, B, C, D, or E, 

sufficient capacity to supply the maximum expected load requirement is 

not assured and the corresponding battery must be declared inoperable. 

Additionally, discovering one or more batteries in one subsystem with one 

or more battery cells float voltage less than [2.07] V and float current 

greater than [2] amps indicates that the battery capacity may not be 

sufficient to perform the intended functions. The battery must therefore 

be declared inoperable immediately.

SURVEILLANCE SR 3.8.6.1

REQUIREMENTS

Verifying battery float current while on float charge is used to determine 

the state of charge of the battery. Float charge is the condition in which 

the charger is supplying the continuous charge required to overcome the 

internal losses of a battery and maintain the battery in a charged state. 

The float current requirements are based on the float current indicative of 

a charged battery. Use of float current to determine the state of charge of 

the battery is consistent with IEEE-450 (Ref. 1). [ The 7 day Frequency is 

consistent with IEEE-450 (Ref. 1).

OR

The Surveillance Frequency is controlled under the Surveillance

Frequency Control Program.
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

This SR is modified by a Note that states the float current requirement is 

not required to be met when battery terminal voltage is less than the 

minimum established float voltage of SR 3.8.4.1. When this float voltage 

is not maintained the Required Actions of LCO 3.8.4 ACTION A are being 

taken, which provide the necessary and appropriate verifications of the 

battery condition. Furthermore, the float current limit of [2] amps is 

established based on the nominal float voltage value and is not directly

applicable when this voltage is not maintained.

SR 3.8.6.2 and SR 3.8.6.5

Optimal long term battery performance is obtained by maintaining a float 

voltage greater than or equal to the minimum established design limits 

provided by the battery manufacturer, which corresponds to [130.5] V at 

the battery terminals, or [2.25] Vpc. This provides adequate overpotential, which limits the formation of lead sulfate and self discharge, 

which could eventually render the battery inoperable. Float voltages in 

this range or less, but greater than [2.07] Vpc, are addressed in 

Specification 5.5.17. SRs 3.8.6.2 and 3.8.6.5 require verification that the 

cell float voltages are equal to or greater than the short term absolute 

minimum voltage of [2.07] V. [ The Frequency for cell voltage verification 

every 31 days for pilot cell and 92 days for each connected cell is 

consistent with IEEE-450 (Ref. 1).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.6.3

The limit specified for electrolyte level ensures that the plates suffer no 

physical damage and maintains adequate electron transfer capability. 

[ The Frequency of 31 days is consistent with IEEE-450 (Ref. 1).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.8.6.4

This Surveillance verifies that the pilot cell temperature is greater than or 

equal to the minimum established design limit (i.e., [40]°F). Pilot cell 

electrolyte temperature is maintained above this temperature to assure 

the battery can provide the required current and voltage to meet the 

design requirements. Temperatures lower than assumed in battery sizing 

calculations act to inhibit or reduce battery capacity. [ The Frequency of 

31 days is consistent with IEEE-450 (Ref. 1).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-8 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

SR 3.8.6.6

A battery performance discharge test is a test of constant current capacity 

of a battery, normally done in the as found condition, after having been in 

service, to detect any change in the capacity determined by the 

acceptance test. The test is intended to determine overall battery 

degradation due to age and usage.

Either the battery performance discharge test or the modified 

performance discharge test is acceptable for satisfying SR 3.8.6.6; 

however, only the modified performance discharge test may be used to 

satisfy the battery service test requirements of SR 3.8.4.3.

A modified discharge test is a test of the battery capacity and its ability to 

provide a high rate, short duration load (usually the highest rate of the 

duty cycle). This will often confirm the battery's ability to meet the critical 

period of the load duty cycle, in addition to determining its percentage of 

rated capacity. Initial conditions for the modified performance discharge 

test should be identical to those specified for a service test.

It may consist of just two rates; for instance the one minute rate for the 

battery or the largest current load of the duty cycle, followed by the test 

rate employed for the performance test, both of which envelope the duty 

cycle of the service test. Since the ampere-hours removed by a one 

minute discharge represents a very small portion of the battery capacity, 

the test rate can be changed to that for the performance test without 

compromising the results of the performance discharge test. The battery 

terminal voltage for the modified performance discharge test must remain 

above the minimum battery terminal voltage specified in the battery 

service test for the duration of time equal to that of the service test. 

The acceptance criteria for this Surveillance are consistent with IEEE-450 

(Ref. 1) and IEEE-485 (Ref. 5). These references recommend that the 

battery be replaced if its capacity is below 80% of the manufacturer's 

rating. A capacity of 80% shows that the battery rate of deterioration is 

increasing, even if there is ample capacity to meet the load requirements. 

Furthermore, the battery is sized to meet the assumed duty cycle loads 

when the battery design capacity reaches this [80]% limit.

[ The Surveillance Frequency for this test is normally 60 months. 
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-9 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

If the battery shows degradation, or if the battery has reached 85% of its 

expected life and capacity is < 100% of the manufacturer's rating, the 

Surveillance Frequency is reduced to 12 months. However, if the battery 

shows no degradation but has reached 85% of its expected life, the 

Surveillance Frequency is only reduced to 24 months for batteries that 

retain capacity ≥ 100% of the manufacturer's ratings. Degradation is 

indicated, according to IEEE-450 (Ref. 1), when the battery capacity 

drops by more than 10% relative to its capacity on the previous 

performance test or when it is ≥ [10%] below the manufacturer's rating. 

These Frequencies are consistent with the recommendations in IEEE-450 

(Ref. 1).

This SR is modified by a Note. The reason for the Note is that performing 

the Surveillance would perturb the electrical distribution system and 

challenge safety systems. This restriction from normally performing the 

Surveillance in MODE 1 or 2 is further amplified to allow portions of the 

Surveillance to be performed for the purpose of reestablishing 

OPERABILITY (e.g., post work testing following corrective maintenance, 

corrective modification, deficient or incomplete surveillance testing, and 

other unanticipated OPERABILITY concerns) provided an assessment 

determines plant safety is maintained or enhanced. This assessment 

shall, as a minimum, consider the potential outcomes and transients 

associated with a failed partial Surveillance, a successful partial 

Surveillance, and a perturbation of the offsite or onsite system when they 

are tied together or operated independently for the partial Surveillance; as 

well as the operator procedures available to cope with these outcomes. 

These shall be measured against the avoided risk of a plant shutdown 

and startup to determine that plant safety is maintained or enhanced 

when portions of the Surveillance are performed in MODE 1 or 2. Risk 

insights or deterministic methods may be used for the assessment. 

Credit may be taken for unplanned events that satisfy this SR.
Battery Parameters

B 3.8.6

Westinghouse STS B 3.8.6-10 Rev. 4.0

BASES

REFERENCES 1. IEEE-450.

2. FSAR, Chapter 8.

3. FSAR, Chapter [6].

4. FSAR, Chapter [15].

5. IEEE-485-[1983], June 1983.
Inverters - Operating

B 3.8.7

Westinghouse STS B 3.8.7-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.7 Inverters - Operating

BASES

BACKGROUND The inverters are the preferred source of power for the AC vital buses 

because of the stability and reliability they achieve. The function of the 

inverter is to provide AC electrical power to the vital buses. The inverters 

can be powered from an internal AC source/rectifier or from the station 

battery. The station battery provides an uninterruptible power source for 

the instrumentation and controls for the Reactor Protective System (RPS) 

and the Engineered Safety Feature Actuation System (ESFAS). Specific 

details on inverters and their operating characteristics are found in the 

FSAR, Chapter [8] (Ref. 1).

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient

SAFETY analyses in the FSAR, Chapter [6] (Ref. 2) and Chapter [15] (Ref. 3),

ANALYSES assume Engineered Safety Feature systems are OPERABLE. The 

inverters are designed to provide the required capacity, capability, 

redundancy, and reliability to ensure the availability of necessary power to 

the RPS and ESFAS instrumentation and controls so that the fuel, 

Reactor Coolant System, and containment design limits are not 

exceeded. These limits are discussed in more detail in the Bases for 

Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant 

System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the inverters is consistent with the initial 

assumptions of the accident analyses and is based on meeting the design 

basis of the unit. This includes maintaining required AC vital buses 

OPERABLE during accident conditions in the event of:

a. An assumed loss of all offsite AC electrical power or all onsite AC 

electrical power and

b. A worst case single failure.

Inverters are a part of the distribution system and, as such, satisfy 

Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The inverters ensure the availability of AC electrical power for the 

systems instrumentation required to shut down the reactor and maintain it 

in a safe condition after an anticipated operational occurrence (AOO) or a 

postulated DBA.
Inverters - Operating

B 3.8.7

Westinghouse STS B 3.8.7-2 Rev. 4.0

BASES

LCO (continued)

Maintaining the required inverters OPERABLE ensures that the 

redundancy incorporated into the design of the RPS and ESFAS 

instrumentation and controls is maintained. The four inverters [(two per 

train)] ensure an uninterruptible supply of AC electrical power to the AC 

vital buses even if the 4.16 kV safety buses are de-energized.

OPERABLE inverters require the associated vital bus to be powered by 

the inverter with output voltage and frequency within tolerances, and 

power input to the inverter from a [125 VDC] station battery. 

Alternatively, power supply may be from an internal AC source via 

rectifier as long as the station battery is available as the uninterruptible 

power supply.

This LCO is modified by a Note that allows [one/two] inverters to be 

disconnected from a [common] battery for ≤ 24 hours, if the vital bus(es) 

is powered from a [Class 1E constant voltage transformer or inverter 

using internal AC source] during the period and all other inverters are 

operable. This allows an equalizing charge to be placed on one battery. 

If the inverters were not disconnected, the resulting voltage condition 

might damage the inverter[s]. These provisions minimize the loss of 

equipment that would occur in the event of a loss of offsite power. The 

24 hour time period for the allowance minimizes the time during which a 

loss of offsite power could result in the loss of equipment energized from 

the affected AC vital bus while taking into consideration the time required 

to perform an equalizing charge on the battery bank.

The intent of this Note is to limit the number of inverters that may be 

disconnected. Only those inverters associated with the single battery 

undergoing an equalizing charge may be disconnected. All other 

inverters must be aligned to their associated batteries, regardless of the 

number of inverters or unit design.

APPLICABILITY The inverters are required to be OPERABLE in MODES 1, 2, 3, and 4 to 

ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and

b. Adequate core cooling is provided, and containment OPERABILITY 

and other vital functions are maintained in the event of a postulated 

DBA.

Inverter requirements for MODES 5 and 6 are covered in the Bases for 

LCO 3.8.8, "Inverters - Shutdown."
Inverters - Operating

B 3.8.7

Westinghouse STS B 3.8.7-3 Rev. 4.0

BASES

ACTIONS A.1

With a required inverter inoperable, its associated AC vital bus becomes 

inoperable until it is [manually] re-energized from its [Class 1E constant 

voltage source transformer or inverter using internal AC source].

For this reason a Note has been included in Condition A requiring the 

entry into the Conditions and Required Actions of LCO 3.8.9, "Distribution 

Systems - Operating." This ensures that the vital bus is re-energized 

within 2 hours.

Required Action A.1 allows 24 hours to fix the inoperable inverter and 

return it to service. The 24 hour limit is based upon engineering 

judgment, taking into consideration the time required to repair an inverter 

and the additional risk to which the unit is exposed because of the 

inverter inoperability. This has to be balanced against the risk of an 

immediate shutdown, along with the potential challenges to safety 

systems such a shutdown might entail. When the AC vital bus is powered 

from its constant voltage source, it is relying upon interruptible AC 

electrical power sources (offsite and onsite). The uninterruptible inverter 

source to the AC vital buses is the preferred source for powering 

instrumentation trip setpoint devices.

B.1 and B.2

If the inoperable devices or components cannot be restored to 

OPERABLE status within the required Completion Time, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and to 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging plant 

systems.

SURVEILLANCE SR 3.8.7.1

REQUIREMENTS

This Surveillance verifies that the inverters are functioning properly with 

all required circuit breakers closed and AC vital buses energized from the 

inverter. The verification of proper voltage and frequency output ensures 

that the required power is readily available for the instrumentation of the 

RPS and ESFAS connected to the AC vital buses. [ The 7 day 

Frequency takes into account the redundant capability of the inverters 

and other indications available in the control room that alert the operator 

to inverter malfunctions.
Inverters - Operating

B 3.8.7

Westinghouse STS B 3.8.7-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [8].

2. FSAR, Chapter [6].

3. FSAR, Chapter [15].
Inverters - Shutdown

B 3.8.8

Westinghouse STS B 3.8.8-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.8 Inverters - Shutdown

BASES

BACKGROUND A description of the inverters is provided in the Bases for LCO 3.8.7, 

"Inverters - Operating."

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient

SAFETY analyses in the FSAR, Chapter [6] (Ref. 1) and Chapter [15] (Ref. 2),

ANALYSES assume Engineered Safety Feature systems are OPERABLE. The DC to 

AC inverters are designed to provide the required capacity, capability, 

redundancy, and reliability to ensure the availability of necessary power to 

the Reactor Protective System and Engineered Safety Features Actuation 

System instrumentation and controls so that the fuel, Reactor Coolant 

System, and containment design limits are not exceeded.

The OPERABILITY of the inverters is consistent with the initial 

assumptions of the accident analyses and the requirements for the 

supported systems' OPERABILITY.

The OPERABILITY of the minimum inverters to each AC vital bus during 

MODES 5 and 6 ensures that:

a. The unit can be maintained in the shutdown or refueling condition for 

extended periods,

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and

c. Adequate power is available to mitigate events postulated during 

shutdown, such as a fuel handling accident [involving handling 

recently irradiated fuel. Due to radioactive decay, the AC and DC 

inverters are only required to mitigate fuel handling accidents 

involving handling recently irradiated fuel (i.e., fuel that has occupied 

part of a critical reactor core within the previous [X] days).].

In general, when the unit is shut down, the Technical Specifications 

requirements ensure that the unit has the capability to mitigate the 

consequences of postulated accidents. However, assuming a single 

failure and concurrent loss of all offsite or all onsite power is not required. 

The rationale for this is based on the fact that many DBAs that are 

analyzed in MODES [1, 2, 3, and 4] have no specific analyses in 

MODES [5 and 6] because the energy contained within the reactor 

pressure boundary, reactor coolant temperature and pressure, and the 

corresponding stresses result in the probabilities of occurrence being
Inverters - Shutdown

B 3.8.8

Westinghouse STS B 3.8.8-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

significantly reduced or eliminated, and in minimal consequences. These 

deviations from DBA analysis assumptions and design requirements 

during shutdown conditions are allowed by the LCO for required systems.

The shutdown Technical Specification requirements are designed to 

ensure that the unit has the capability to mitigate the consequences of 

certain postulated accidents. Worst case DBAs which are analyzed for 

operating MODES are generally viewed not to be a significant concern 

during shutdown MODES due to the lower energies involved. The 

Technical Specifications therefore require a lesser complement of 

electrical equipment to be available during shutdown than is required 

during operating MODES. More recent work completed on the potential 

risks associated with shutdown, however, have found significant risk 

associated with certain shutdown evolutions. As a result, in addition to 

the requirements established in the Technical Specifications, the industry 

has adopted NUMARC 91-06, "Guidelines for Industry Actions to Assess 

Shutdown Management," as an Industry initiative to manage shutdown 

tasks and associated electrical support to maintain risk at an acceptable 

low level. This may require the availability of additional equipment 

beyond that required by the shutdown Technical Specifications.

The inverters were previously identified as part of the distribution system 

and, as such, satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The inverter[s] ensure the availability of electrical power for the 

instrumentation for systems required to shut down the reactor and 

maintain it in a safe condition after an anticipated operational occurrence 

or a postulated DBA. The battery powered inverter[s] provide[s] 

uninterruptible supply of AC electrical power to the AC vital bus[es] even 

if the 4.16 kV safety buses are de-energized. OPERABILITY of the 

inverter[s] requires that the AC vital bus be powered by the inverter. This 

ensures the availability of sufficient inverter power sources to operate the 

unit in a safe manner and to mitigate the consequences of postulated 

events during shutdown (e.g., fuel handling accidents [involving handling 

recently irradiated fuel]).

APPLICABILITY The inverter[s] required to be OPERABLE in MODES 5 and 6 and during 

movement of [recently] irradiated fuel assemblies provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel in the core,

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available,
Inverters - Shutdown

B 3.8.8

Westinghouse STS B 3.8.8-3 Rev. 4.0

BASES

APPLICABILITY (continued)

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition or refueling 

condition.

Inverter requirements for MODES 1, 2, 3, and 4 are covered in 

LCO 3.8.7.

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily.

A.1, A.2.1, A.2.2, and A.2.3

[If two trains are required by LCO 3.8.10, "Distribution Systems -

Shutdown," the remaining OPERABLE Inverters may be capable of 

supporting sufficient required features to allow continuation of [recently] 

irradiated fuel movement, and operations with a potential for positive 

reactivity additions.] By the allowance of the option to declare required 

features inoperable with the associated inverter(s) inoperable, appropriate 

restrictions will be implemented in accordance with the affected required 

features LCOs' Required Actions. In many instances, this option may 

involve undesired administrative efforts. Therefore, the allowance for 

sufficiently conservative actions is made (i.e., to suspend movement of 

[recently] irradiated fuel assemblies, and operations involving positive 

reactivity additions) that could result in loss of required SDM (MODE 5) or 

boron concentration (MODE 6). Suspending positive reactivity additions 

that could result in failure to meet the minimum SDM or boron 

concentration limit is required to assure continued safe operation. 

Introduction of coolant inventory must be from sources that have a boron 

concentration greater than that what would be required in the RCS for 

minimum SDM or refueling boron concentration. This may result in an 

overall reduction in RCS boron concentration, but provides acceptable 

margin to maintaining subcritical operation. Introduction of temperature 

changes including temperature increases when operating with a positive 

MTC must also be evaluated to ensure they do not result in a loss of 

required SDM.
Inverters - Shutdown

B 3.8.8

Westinghouse STS B 3.8.8-4 Rev. 4.0

BASES

ACTIONS (continued)

Suspension of these activities shall not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required inverter[s] and to 

continue this action until restoration is accomplished in order to provide 

the necessary inverter power to the unit safety systems.

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required 

inverters should be completed as quickly as possible in order to minimize 

the time the unit safety systems may be without power or powered from a 

constant voltage source transformer.

SURVEILLANCE SR 3.8.8.1

REQUIREMENTS

This Surveillance verifies that the inverters are functioning properly with 

all required circuit breakers closed and AC vital buses energized from the 

inverter. The verification of proper voltage and frequency output ensures 

that the required power is readily available for the instrumentation 

connected to the AC vital buses. [ The 7 day Frequency takes into 

account the redundant capability of the inverters and other indications 

available in the control room that alert the operator to inverter 

malfunctions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [6].

2. FSAR, Chapter [15].
Distribution Systems - Operating

B 3.8.9

Westinghouse STS B 3.8.9-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.9 Distribution Systems - Operating

BASES

BACKGROUND The onsite Class 1E AC, DC, and AC vital bus electrical power 

distribution systems are divided by train into [two] redundant and 

independent AC, DC, and AC vital bus electrical power distribution 

subsystems.

The AC electrical power subsystem for each train consists of a primary 

Engineered Safety Feature (ESF) 4.16 kV bus and secondary [480 and 

120] V buses, distribution panels, motor control centers and load centers. 

Each [4.16 kV ESF bus] has at least [one separate and independent 

offsite source of power] as well as a dedicated onsite diesel generator 

(DG) source. Each [4.16 kV ESF bus] is normally connected to a 

preferred offsite source. After a loss of the preferred offsite power source 

to a 4.16 kV ESF bus, a transfer to the alternate offsite source is 

accomplished by utilizing a time delayed bus undervoltage relay. If all 

offsite sources are unavailable, the onsite emergency DG supplies power 

to the 4.16 kV ESF bus. Control power for the 4.16 kV breakers is 

supplied from the Class 1E batteries. Additional description of this 

system may be found in the Bases for LCO 3.8.1, "AC Sources -

Operating," and the Bases for LCO 3.8.4, "DC Sources - Operating."

The secondary AC electrical power distribution subsystem for each train 

includes the safety related buses, load centers, motor control centers, 

and distribution panels shown in Table B 3.8.9-1.

The 120 VAC vital buses are arranged in two load groups per train and 

are normally powered from the inverters. The alternate power supply for 

the vital buses are Class 1E constant voltage source transformers 

powered from the same train as the associated inverter, and its use is 

governed by LCO 3.8.7, "Inverters - Operating." Each constant voltage 

source transformer is powered from a Class 1E AC bus.

The DC electrical power distribution subsystem consists of [125] V 

bus(es) and distribution panel(s).

The list of all required DC and vital AC distribution buses [and panels] is 

presented in Table B 3.8.9-1.
Distribution Systems - Operating

B 3.8.9

Westinghouse STS B 3.8.9-2 Rev. 4.0

BASES

APPLICABLE The initial conditions of Design Basis Accident (DBA) and transient

SAFETY analyses in the FSAR, Chapter [6] (Ref. 1), and in the FSAR,

ANALYSES Chapter [15] (Ref. 2), assume ESF systems are OPERABLE. The AC, 

DC, and AC vital bus electrical power distribution systems are designed 

to provide sufficient capacity, capability, redundancy, and reliability to 

ensure the availability of necessary power to ESF systems so that the 

fuel, Reactor Coolant System, and containment design limits are not 

exceeded. These limits are discussed in more detail in the Bases for 

Section 3.2, Power Distribution Limits; Section 3.4, Reactor Coolant 

System (RCS); and Section 3.6, Containment Systems.

The OPERABILITY of the AC, DC, and AC vital bus electrical power 

distribution systems is consistent with the initial assumptions of the 

accident analyses and is based upon meeting the design basis of the unit. 

This includes maintaining power distribution systems OPERABLE during 

accident conditions in the event of:

a. An assumed loss of all offsite power or all onsite AC electrical power 

and

b. A worst case single failure.

The distribution systems satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The required power distribution subsystems listed in Table B 3.8.9-1 

ensure the availability of AC, DC, and AC vital bus electrical power for the 

systems required to shut down the reactor and maintain it in a safe 

condition after an anticipated operational occurrence (AOO) or a 

postulated DBA. The AC, DC, and AC vital bus electrical power 

distribution subsystems are required to be OPERABLE.

Maintaining the Train A and Train B AC, DC, and AC vital bus electrical 

power distribution subsystems OPERABLE ensures that the redundancy 

incorporated into the design of ESF is not defeated. Therefore, a single 

failure within any system or within the electrical power distribution 

subsystems will not prevent safe shutdown of the reactor.

OPERABLE AC electrical power distribution subsystems require the 

associated buses, load centers, motor control centers, and distribution 

panels to be energized to their proper voltages. OPERABLE DC 

electrical power distribution subsystems require the associated buses and 

distribution panels to be energized to their proper voltage from either the 

associated battery or charger. OPERABLE vital bus electrical power 

distribution subsystems require the associated buses to be energized to 

their proper voltage from the associated [inverter via inverted DC voltage, 

inverter using internal AC source, or Class 1E constant voltage 

transformer].
Distribution Systems - Operating

B 3.8.9

Westinghouse STS B 3.8.9-3 Rev. 4.0

BASES

LCO (continued)

In addition, tie breakers between redundant safety related AC, DC, and 

AC vital bus power distribution subsystems, if they exist, must be open. 

This prevents any electrical malfunction in any power distribution 

subsystem from propagating to the redundant subsystem, that could 

cause the failure of a redundant subsystem and a loss of essential safety 

function(s). If any tie breakers are closed, the affected redundant 

electrical power distribution subsystems are considered inoperable. This 

applies to the onsite, safety related redundant electrical power distribution 

subsystems. It does not, however, preclude redundant Class 1E 4.16 kV 

buses from being powered from the same offsite circuit.

APPLICABILITY The electrical power distribution subsystems are required to be 

OPERABLE in MODES 1, 2, 3, and 4 to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary 

limits are not exceeded as a result of AOOs or abnormal transients 

and

b. Adequate core cooling is provided, and containment OPERABILITY 

and other vital functions are maintained in the event of a postulated 

DBA.

Electrical power distribution subsystem requirements for MODES 5 and 6 

are covered in the Bases for LCO 3.8.10, "Distribution Systems -

Shutdown."

ACTIONS A.1

With one or more Train A and B required AC buses, load centers, motor 

control centers, or distribution panels (except AC vital buses), in one train 

inoperable and a loss of function has not occurred, the remaining AC 

electrical power distribution subsystems are capable of supporting the 

minimum safety functions necessary to shut down the reactor and 

maintain it in a safe shutdown condition, assuming no single failure. The 

overall reliability is reduced, however, because a single failure in the 

remaining power distribution subsystems could result in the minimum 

required ESF functions not being supported. Therefore, the required AC 

buses, load centers, motor control centers, and distribution panels must 

be restored to OPERABLE status within 8 hours.

Condition A worst scenario is one train without AC power (i.e., no offsite 

power to the train and the associated DG inoperable). In this Condition, 

the unit is more vulnerable to a complete loss of AC power. It is, 

therefore, imperative that the unit operator's attention be focused on 

minimizing the potential for loss of power to the remaining train by
Distribution Systems - Operating

B 3.8.9

Westinghouse STS B 3.8.9-4 Rev. 4.0

BASES

ACTIONS (continued)

stabilizing the unit, and on restoring power to the affected train. The 

8 hour time limit before requiring a unit shutdown in this Condition is 

acceptable because of:

a. The potential for decreased safety if the unit operator's attention is 

diverted from the evaluations and actions necessary to restore power 

to the affected train, to the actions associated with taking the unit to 

shutdown within this time limit and

b. The potential for an event in conjunction with a single failure of a 

redundant component in the train with AC power.

Required Action A.1 is modified by a Note that requires the applicable 

Conditions and Required Actions of LCO 3.8.4, "DC Sources - Operating," 

to be entered for DC trains made inoperable by inoperable power 

distribution subsystems. This is an exception to LCO 3.0.6 and ensures 

the proper actions are taken for these components. Inoperability of a 

distribution system can result in loss of charging power to batteries and 

eventual loss of DC power. This Note ensures that the appropriate 

attention is given to restoring charging power to batteries, if necessary, 

after loss of distribution systems.

B.1

With one or more AC vital buses inoperable, and a loss of function has 

not yet occurred, the remaining OPERABLE AC vital buses are capable 

of supporting the minimum safety functions necessary to shut down the 

unit and maintain it in the safe shutdown condition. Overall reliability is 

reduced, however, since an additional single failure could result in the 

minimum [required] ESF functions not being supported. Therefore, the 

required AC vital bus must be restored to OPERABLE status within 

2 hours by powering the bus from the associated [inverter via inverted 

DC, inverter using internal AC source, or Class 1E constant voltage 

transformer].

Condition B represents one or more AC vital buses without power; 

potentially both the DC source and the associated AC source are 

nonfunctioning. In this situation, the unit is significantly more vulnerable 

to a complete loss of all noninterruptible power. It is, therefore, 

imperative that the operator's attention focus on stabilizing the unit, 

minimizing the potential for loss of power to the remaining vital buses and 

restoring power to the affected vital bus.
Distribution Systems - Operating

B 3.8.9

Westinghouse STS B 3.8.9-5 Rev. 4.0

BASES

ACTIONS (continued)

This 2 hour limit is more conservative than Completion Times allowed for 

the vast majority of components that are without adequate vital AC power. 

Taking exception to LCO 3.0.2 for components without adequate vital AC 

power, that would have the Required Action Completion Times shorter 

than 2 hours if declared inoperable, is acceptable because of:

a. The potential for decreased safety by requiring a change in unit 

conditions (i.e., requiring a shutdown) and not allowing stable 

operations to continue,

b. The potential for decreased safety by requiring entry into numerous 

Applicable Conditions and Required Actions for components without 

adequate vital AC power and not providing sufficient time for the 

operators to perform the necessary evaluations and actions for 

restoring power to the affected train, and

c. The potential for an event in conjunction with a single failure of a 

redundant component.

The 2 hour Completion Time takes into account the importance to safety 

of restoring the AC vital bus to OPERABLE status, the redundant 

capability afforded by the other OPERABLE vital buses, and the low 

probability of a DBA occurring during this period.

C.1

With one or more DC buses or distribution panels inoperable, and a loss 

of function has not yet occurred, the remaining DC electrical power 

distribution subsystems are capable of supporting the minimum safety 

functions necessary to shut down the reactor and maintain it in a safe 

shutdown condition, assuming no single failure. The overall reliability is 

reduced, however, because a single failure in the remaining DC electrical 

power distribution subsystem could result in the minimum required ESF 

functions not being supported. Therefore, the [required] DC buses and 

distribution panels must be restored to OPERABLE status within 2 hours 

by powering the bus from the associated battery or charger.

Condition C represents one or more DC buses or distribution panels 

without adequate DC power; potentially both with the battery significantly 

degraded and the associated charger nonfunctioning. In this situation, 

the unit is significantly more vulnerable to a complete loss of all DC 

power. It is, therefore, imperative that the operator's attention focus on 

stabilizing the unit, minimizing the potential for loss of power to the 

remaining trains and restoring power to the affected train.
Distribution Systems - Operating

B 3.8.9

Westinghouse STS B 3.8.9-6 Rev. 4.0

BASES

ACTIONS (continued)

This 2 hour limit is more conservative than Completion Times allowed for 

the vast majority of components that would be without power. Taking 

exception to LCO 3.0.2 for components without adequate DC power, 

which would have Required Action Completion Times shorter than 

2 hours, is acceptable because of:

a. The potential for decreased safety by requiring a change in unit 

conditions (i.e., requiring a shutdown) while allowing stable 

operations to continue,

b. The potential for decreased safety by requiring entry into numerous 

applicable Conditions and Required Actions for components without 

DC power and not providing sufficient time for the operators to 

perform the necessary evaluations and actions for restoring power to 

the affected train, and

c. The potential for an event in conjunction with a single failure of a 

redundant component.

The 2 hour Completion Time for DC buses is consistent with Regulatory 

Guide 1.93 (Ref. 3). 

D.1 and D.2

If the inoperable distribution subsystem cannot be restored to 

OPERABLE status within the required Completion Time, the unit must be 

brought to a MODE in which the LCO does not apply. To achieve this 

status, the unit must be brought to at least MODE 3 within 6 hours and to 

MODE 5 within 36 hours. The allowed Completion Times are reasonable, 

based on operating experience, to reach the required unit conditions from 

full power conditions in an orderly manner and without challenging plant 

systems.

E.1

Condition E corresponds to a level of degradation in the electrical power 

distribution system that causes a required safety function to be lost. 

When more than one inoperable electrical power distribution subsystem 

results in the loss of a required function, the plant is in a condition outside 

the accident analysis. Therefore, no additional time is justified for 

continued operation. LCO 3.0.3 must be entered immediately to 

commence a controlled shutdown.
Distribution Systems - Operating

B 3.8.9

Westinghouse STS B 3.8.9-7 Rev. 4.0

BASES

SURVEILLANCE SR 3.8.9.1

REQUIREMENTS

This Surveillance verifies that the [required] AC, DC, and AC vital bus 

electrical power distribution systems are functioning properly, with the 

correct circuit breaker alignment. The correct breaker alignment ensures 

the appropriate separation and independence of the electrical divisions is 

maintained, and the appropriate voltage is available to each required bus. 

The verification of proper voltage availability on the buses ensures that 

the required voltage is readily available for motive as well as control 

functions for critical system loads connected to these buses. [ The 7 day 

Frequency takes into account the redundant capability of the AC, DC, and 

AC vital bus electrical power distribution subsystems, and other 

indications available in the control room that alert the operator to 

subsystem malfunctions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [6].

2. FSAR, Chapter [15].

3. Regulatory Guide 1.93, December 1974.
Distribution Systems - Operating

B 3.8.9

Westinghouse STS B 3.8.9-8 Rev. 4.0

Table B 3.8.9-1 (page 1 of 1)

AC and DC Electrical Power Distribution Systems

TYPE VOLTAGE TRAIN A* TRAIN B*

AC safety buses [4160 V] [ESF Bus] [NB01] [ESF Bus] [NB02]

[480 V] Load Centers

[NG01, NG03]

Load Centers

[NG02, NG04]

[480 V] Motor Control 

Centers

[NG01A, NG01I, 

NG01B, NG03C, 

NG03I, NG03D]

Motor Control 

Centers

[NG02A, NG02I, 

NG02B, NG04C, 

NG04I, NG04D]

[120 V] Distribution Panels

[NP01, NP03]

Distribution Panels

[NP02, NP04]

DC buses [125 V] Bus [NK01] Bus [NK02]

Bus [NK03] Bus [NK04]

Distribution Panels

[NK41, NK43, NK51]

Distribution Panels

[NK42, NK44, NK52]

AC vital buses [120 V] Bus [NN01] Bus [NN02]

Bus [NN03] Bus [NN04]

* Each train of the AC and DC electrical power distribution systems is a subsystem.
Distribution Systems - Shutdown

B 3.8.10

Westinghouse STS B 3.8.10-1 Rev. 4.0

B 3.8 ELECTRICAL POWER SYSTEMS

B 3.8.10 Distribution Systems - Shutdown

BASES

BACKGROUND A description of the AC, DC, and AC vital bus electrical power distribution 

systems is provided in the Bases for LCO 3.8.9, "Distribution Systems -

Operating."

APPLICABLE The initial conditions of Design Basis Accident and transient analyses in

SAFETY the FSAR, Chapter [6] (Ref. 1) and Chapter [15] (Ref. 2), assume

ANALYSES Engineered Safety Feature (ESF) systems are OPERABLE. The AC, DC, 

and AC vital bus electrical power distribution systems are designed to 

provide sufficient capacity, capability, redundancy, and reliability to 

ensure the availability of necessary power to ESF systems so that the 

fuel, Reactor Coolant System, and containment design limits are not 

exceeded.

The OPERABILITY of the AC, DC, and AC vital bus electrical power 

distribution system is consistent with the initial assumptions of the 

accident analyses and the requirements for the supported systems' 

OPERABILITY.

The OPERABILITY of the minimum AC, DC, and AC vital bus electrical 

power distribution subsystems during MODES 5 and 6, and during 

movement of [recently] irradiated fuel assemblies ensures that:

a. The unit can be maintained in the shutdown or refueling condition for 

extended periods,

b. Sufficient instrumentation and control capability is available for 

monitoring and maintaining the unit status, and

c. Adequate power is provided to mitigate events postulated during 

shutdown, such as a fuel handling accident [involving handling 

recently irradiated fuel. Due to radioactive decay, AC and DC 

electrical power is only required to mitigate fuel handling accidents 

involving handling recently irradiated fuel (i.e., fuel that has occupied 

part of a critical reactor core within the previous [X] days)].

The AC and DC electrical power distribution systems satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii).
Distribution Systems - Shutdown

B 3.8.10

Westinghouse STS B 3.8.10-2 Rev. 4.0

BASES

LCO Various combinations of subsystems, equipment, and components are 

required OPERABLE by other LCOs, depending on the specific plant 

condition. Implicit in those requirements is the required OPERABILITY of 

necessary support required features. This LCO explicitly requires 

energization of the portions of the electrical distribution system necessary 

to support OPERABILITY of required systems, equipment, and 

components - all specifically addressed in each LCO and implicitly 

required via the definition of OPERABILITY.

Maintaining these portions of the distribution system energized ensures 

the availability of sufficient power to operate the unit in a safe manner to 

mitigate the consequences of postulated events during shutdown (e.g., 

fuel handling accidents [involving handling recently irradiated fuel]).

APPLICABILITY The AC and DC electrical power distribution subsystems required to be 

OPERABLE in MODES 5 and 6, and during movement of [recently] 

irradiated fuel assemblies, provide assurance that:

a. Systems to provide adequate coolant inventory makeup are available 

for the irradiated fuel in the core,

b. Systems needed to mitigate a fuel handling accident [involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [X] days)] are available,

c. Systems necessary to mitigate the effects of events that can lead to 

core damage during shutdown are available, and

d. Instrumentation and control capability is available for monitoring and 

maintaining the unit in a cold shutdown condition and refueling 

condition.

The AC, DC, and AC vital bus electrical power distribution subsystems 

requirements for MODES 1, 2, 3, and 4 are covered in LCO 3.8.9.

ACTIONS LCO 3.0.3 is not applicable while in MODE 5 or 6. However, since 

irradiated fuel assembly movement can occur in MODE 1, 2, 3, or 4, the 

ACTIONS have been modified by a Note stating that LCO 3.0.3 is not 

applicable. If moving irradiated fuel assemblies while in MODE 5 or 6, 

LCO 3.0.3 would not specify any action. If moving irradiated fuel 

assemblies while in MODE 1, 2, 3, or 4, the fuel movement is 

independent of reactor operations. Entering LCO 3.0.3, while in MODE 1, 

2, 3, or 4 would require the unit to be shutdown unnecessarily.
Distribution Systems - Shutdown

B 3.8.10

Westinghouse STS B 3.8.10-3 Rev. 4.0

BASES

ACTIONS (continued)

A.1, A.2.1, A.2.2, A.2.3, and A.2.4

Although redundant required features may require redundant trains of 

electrical power distribution subsystems to be OPERABLE, one 

OPERABLE distribution subsystem train may be capable of supporting 

sufficient required features to allow continuation of [recently] irradiated 

fuel movement. By allowing the option to declare required features 

associated with an inoperable distribution subsystem inoperable, 

appropriate restrictions are implemented in accordance with the affected 

distribution subsystem LCO's Required Actions. In many instances, this 

option may involve undesired administrative efforts. Therefore, the 

allowance for sufficiently conservative actions is made (i.e., to suspend 

movement of [recently] irradiated fuel assemblies, and operations 

involving positive reactivity additions that could result in loss of required 

SDM (MODE 5) or boron concentration (MODE 6). Suspending positive 

reactivity additions that could result in failure to meet the minimum SDM 

or boron concentration limit is required to assure continued safe 

operation. Introduction of coolant inventory must be from sources that 

have a boron concentration greater than that what would be required in 

the RCS for minimum SDM or refueling boron concentration. This may 

result in an overall reduction in RCS boron concentration, but provides 

acceptable margin to maintaining subcritical operation. Introduction of 

temperature changes including temperature increases when operating 

with a positive MTC must also be evaluated to ensure they do not result 

in a loss of required SDM.

Suspension of these activities does not preclude completion of actions to 

establish a safe conservative condition. These actions minimize the 

probability of the occurrence of postulated events. It is further required to 

immediately initiate action to restore the required AC and DC electrical 

power distribution subsystems and to continue this action until restoration 

is accomplished in order to provide the necessary power to the unit safety 

systems.

Notwithstanding performance of the above conservative Required 

Actions, a required residual heat removal (RHR) subsystem may be 

inoperable. In this case, Required Actions A.2.1 through A.2.4 do not 

adequately address the concerns relating to coolant circulation and heat 

removal. Pursuant to LCO 3.0.6, the RHR ACTIONS would not be 

entered. Therefore, Required Action A.2.5 is provided to direct declaring 

RHR inoperable, which results in taking the appropriate RHR actions.
Distribution Systems - Shutdown

B 3.8.10

Westinghouse STS B 3.8.10-4 Rev. 4.0

BASES

ACTIONS (continued)

The Completion Time of immediately is consistent with the required times 

for actions requiring prompt attention. The restoration of the required 

distribution subsystems should be completed as quickly as possible in 

order to minimize the time the unit safety systems may be without power.

SURVEILLANCE SR 3.8.10.1

REQUIREMENTS

This Surveillance verifies that the AC, DC, and AC vital bus electrical 

power distribution subsystems are functioning properly, with all the buses 

energized. The verification of proper voltage availability on the buses 

ensures that the required power is readily available for motive as well as 

control functions for critical system loads connected to these buses. 

[ The 7 day Frequency takes into account the capability of the electrical 

power distribution subsystems, and other indications available in the 

control room that alert the operator to subsystem malfunctions.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Chapter [6].

2. FSAR, Chapter [15].
Boron Concentration

B 3.9.1

Westinghouse STS B 3.9.1-1 Rev. 4.0

B 3.9 REFUELING OPERATIONS

B 3.9.1 Boron Concentration

BASES

BACKGROUND The limit on the boron concentrations of the Reactor Coolant System 

(RCS), the refueling canal, and the refueling cavity during refueling 

ensures that the reactor remains subcritical during MODE 6. Refueling 

boron concentration is the soluble boron concentration in the coolant in 

each of these volumes having direct access to the reactor core during 

refueling.

The soluble boron concentration offsets the core reactivity and is 

measured by chemical analysis of a representative sample of the coolant 

in each of the volumes. The refueling boron concentration limit is 

specified in the COLR. Plant procedures ensure the specified boron 

concentration in order to maintain an overall core reactivity of keff ≤ 0.95 

during fuel handling, with control rods and fuel assemblies assumed to be 

in the most adverse configuration (least negative reactivity) allowed by 

plant procedures.

GDC 26 of 10 CFR 50, Appendix A, requires that two independent 

reactivity control systems of different design principles be provided 

(Ref. 1). One of these systems must be capable of holding the reactor 

core subcritical under cold conditions. The Chemical and Volume Control 

System (CVCS) is the system capable of maintaining the reactor

subcritical in cold conditions by maintaining the boron concentration.

The reactor is brought to shutdown conditions before beginning 

operations to open the reactor vessel for refueling. After the RCS is 

cooled and depressurized and the vessel head is unbolted, the head is 

slowly removed to form the refueling cavity. The refueling canal and the 

refueling cavity are then flooded with borated water from the refueling 

water storage tank through the open reactor vessel by gravity feeding or 

by the use of the Residual Heat Removal (RHR) System pumps.

The pumping action of the RHR System in the RCS and the natural 

circulation due to thermal driving heads in the reactor vessel and refueling 

cavity mix the added concentrated boric acid with the water in the 

refueling canal. The RHR System is in operation during refueling (see 

LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High 

Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and 

Coolant Circulation - Low Water Level") to provide forced circulation in the 

RCS and assist in maintaining the boron concentrations in the RCS, the 

refueling canal, and the refueling cavity above the COLR limit.
Boron Concentration

B 3.9.1

Westinghouse STS B 3.9.1-2 Rev. 4.0

BASES

APPLICABLE During refueling operations, the reactivity condition of the core is

SAFETY consistent with the initial conditions assumed for the boron dilution

ANALYSES accident in the accident analysis and is conservative for MODE 6. The 

boron concentration limit specified in the COLR is based on the core 

reactivity at the beginning of each fuel cycle (the end of refueling) and 

includes an uncertainty allowance.

The required boron concentration and the plant refueling procedures that 

verify the correct fuel loading plan (including full core mapping) ensure 

that the keff of the core will remain ≤ 0.95 during the refueling operation. 

Hence, at least a 5% ∆k/k margin of safety is established during refueling.

During refueling, the water volume in the spent fuel pool, the transfer 

canal, the refueling canal, the refueling cavity, and the reactor vessel form 

a single mass. As a result, the soluble boron concentration is relatively 

the same in each of these volumes.

The limiting boron dilution accident analyzed occurs in MODE 5 (Ref. 2). 

A detailed discussion of this event is provided in Bases B 3.1.1, 

"SHUTDOWN MARGIN (SDM)."

The RCS boron concentration satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO The LCO requires that a minimum boron concentration be maintained in 

the RCS, the refueling canal, and the refueling cavity while in MODE 6. 

The boron concentration limit specified in the COLR ensures that a core 

keff of ≤ 0.95 is maintained during fuel handling operations. Violation of 

the LCO could lead to an inadvertent criticality during MODE 6.

APPLICABILITY This LCO is applicable in MODE 6 to ensure that the fuel in the reactor 

vessel will remain subcritical. The required boron concentration ensures 

a keff ≤ 0.95. Above MODE 6, LCO 3.1.1, "SHUTDOWN MARGIN 

(SDM)," ensures that an adequate amount of negative reactivity is 

available to shut down the reactor and maintain it subcritical.

The Applicability is modified by a Note. The Note states that the limits on 

boron concentration are only applicable to the refueling canal and the 

refueling cavity when those volumes are connected to the RCS. When 

the refueling canal and the refueling cavity are isolated from the RCS, no 

potential path for boron dilution exists.

ACTIONS A.1

Continuation of positive reactivity additions (including actions to reduce 

boron concentration) is contingent upon maintaining the unit in 

compliance with the LCO. If the boron concentration of any coolant 
Boron Concentration

B 3.9.1

Westinghouse STS B 3.9.1-3 Rev. 4.0

BASES

ACTIONS (continued)

volume in the RCS, the refueling canal, or the refueling cavity is less than 

its limit, all operations involving positive reactivity additions must be 

suspended immediately.

Suspension of positive reactivity additions shall not preclude moving a 

component to a safe position. Operations that individually add limited 

positive reactivity (e.g., temperature fluctuations from inventory addition 

or temperature control fluctuations), but when combined with all other 

operations affecting core reactivity (e.g., intentional boration) result in 

overall net negative reactivity addition, are not precluded by this action.

A.2

In addition to immediately suspending positive reactivity additions, 

boration to restore the concentration must be initiated immediately.

In determining the required combination of boration flow rate and 

concentration, no unique Design Basis Event must be satisfied. The only 

requirement is to restore the boron concentration to its required value as 

soon as possible. In order to raise the boron concentration as soon as 

possible, the operator should begin boration with the best source 

available for unit conditions.

Once actions have been initiated, they must be continued until the boron 

concentration is restored. The restoration time depends on the amount of 

boron that must be injected to reach the required concentration.

SURVEILLANCE SR 3.9.1.1

REQUIREMENTS

This SR ensures that the coolant boron concentration in the RCS, and 

connected portions of the refueling canal and the refueling cavity, is within 

the COLR limits. The boron concentration of the coolant in each required 

volume is determined periodically by chemical analysis. Prior to reconnecting portions of the refueling canal or the refueling cavity to the 

RCS, this SR must be met per SR 3.0.4. If any dilution activity has 

occurred while the cavity or canal were disconnected from the RCS, this 

SR ensures the correct boron concentration prior to communication with 

the RCS.

[ A minimum Frequency of once every 72 hours is a reasonable amount of 

time to verify the boron concentration of representative samples. The 

Frequency is based on operating experience, which has shown 72 hours 

to be adequate.
Boron Concentration

B 3.9.1

Westinghouse STS B 3.9.1-4 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. FSAR, Chapter [15].
[Unborated Water Source Isolation Valves]

B 3.9.2

Westinghouse STS B 3.9.2-1 Rev. 4.0

B 3.9 REFUELING OPERATIONS

B 3.9.2 [ Unborated Water Source Isolation Valves ]

BASES

BACKGROUND During MODE 6 operations, all isolation valves for reactor makeup water 

sources containing unborated water that are connected to the Reactor 

Coolant System (RCS) must be closed to prevent unplanned boron 

dilution of the reactor coolant. The isolation valves must be secured in 

the closed position.

The Chemical and Volume Control System is capable of supplying 

borated and unborated water to the RCS through various flow paths. 

Since a positive reactivity addition made by reducing the boron 

concentration is inappropriate during MODE 6, isolation of all unborated 

water sources prevents an unplanned boron dilution.

APPLICABLE The possibility of an inadvertent boron dilution event (Ref. 1) occurring

SAFETY during MODE 6 refueling operations is precluded by adherence to this

ANALYSES LCO, which requires that potential dilution sources be isolated. Closing 

the required valves during refueling operations prevents the flow of 

unborated water to the filled portion of the RCS. The valves are used to 

isolate unborated water sources. These valves have the potential to 

indirectly allow dilution of the RCS boron concentration in MODE 6. By 

isolating unborated water sources, a safety analysis for an uncontrolled 

boron dilution accident in accordance with the Standard Review Plan 

(Ref. 2) is not required for MODE 6.

The RCS boron concentration satisfies Criterion 2 of 

10 CFR 50.36(c)(2)(ii).

LCO This LCO requires that flow paths to the RCS from unborated water 

sources be isolated to prevent unplanned boron dilution during MODE 6 

and thus avoid a reduction in SDM.

APPLICABILITY In MODE 6, this LCO is applicable to prevent an inadvertent boron 

dilution event by ensuring isolation of all sources of unborated water to 

the RCS.

For all other MODES, the boron dilution accident was analyzed and was 

found to be capable of being mitigated.
[Unborated Water Source Isolation Valves]

B 3.9.2

Westinghouse STS B 3.9.2-2 Rev. 4.0

BASES

ACTIONS The ACTIONS Table has been modified by a Note that allows separate 

Condition entry for each unborated water source isolation valve.

A.1

Preventing inadvertent dilution of the reactor coolant boron concentration 

is dependent on maintaining the unborated water isolation valves secured 

closed. Securing the valves in the closed position ensures that the valves 

cannot be inadvertently opened. The Completion Time of "immediately" 

requires an operator to initiate actions to close an open valve and secure 

the isolation valve in the closed position immediately. Once actions are 

initiated, they must be continued until the valves are secured in the closed 

position.

A.2

Due to the potential of having diluted the boron concentration of the 

reactor coolant, SR 3.9.1.1 (verification of boron concentration) must be 

performed whenever Condition A is entered to demonstrate that the 

required boron concentration exists. The Completion Time of 4 hours is 

sufficient to obtain and analyze a reactor coolant sample for boron 

concentration.

SURVEILLANCE SR 3.9.2.1

REQUIREMENTS

These valves are to be secured closed to isolate possible dilution paths. 

The likelihood of a significant reduction in the boron concentration during 

MODE 6 operations is remote due to the large mass of borated water in 

the refueling cavity and the fact that all unborated water sources are 

isolated, precluding a dilution. The boron concentration is checked every 

72 hours during MODE 6 under SR 3.9.1.1. This Surveillance 

demonstrates that the valves are closed through a system walkdown. 

[ The 31 day Frequency is based on engineering judgment and is 

considered reasonable in view of other administrative controls that will 

ensure that the valve opening is an unlikely possibility.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
[Unborated Water Source Isolation Valves]

B 3.9.2

Westinghouse STS B 3.9.2-3 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [15.2.4].

2. NUREG-0800, Section 15.4.6.

Nuclear Instrumentation

B 3.9.3

Westinghouse STS B 3.9.3-1 Rev. 4.0

B 3.9 REFUELING OPERATIONS

B 3.9.3 Nuclear Instrumentation

BASES

BACKGROUND -----------------------------------REVIEWER’S NOTE-----------------------------------

Bracketed options are provided for source range OPERABILITY 

requirements to include audible alarm or count rate function. These 

options apply to plants that assume a boron dilution event that is 

mitigated by operator response to an audible indication. For plants that 

isolate all boron dilution paths (per LCO 3.9.2), the source range 

OPERABILITY includes only a visual monitoring function.

--------------------------------------------------------------------------------------------------

The source range neutron flux monitors are used during refueling 

operations to monitor the core reactivity condition. The installed source 

range neutron flux monitors are part of the Nuclear Instrumentation 

System (NIS). These detectors are located external to the reactor vessel 

and detect neutrons leaking from the core.

The installed source range neutron flux monitors are BF3 detectors 

operating in the proportional region of the gas filled detector characteristic 

curve. The detectors monitor the neutron flux in counts per second. The 

instrument range covers six decades of neutron flux (1E+6 cps) with a 

[5]% instrument accuracy. The detectors also provide continuous visual 

indication in the control room [and an audible [alarm] [count rate] to alert 

operators to a possible dilution accident]. The NIS is designed in 

accordance with the criteria presented in Reference 1.

APPLICABLE Two OPERABLE source range neutron flux monitors are required to

SAFETY provide a signal to alert the operator to unexpected changes in core

ANALYSES reactivity such as with a boron dilution accident (Ref. 2) or an improperly 

loaded fuel assembly. [The audible count rate from the source range 

neutron flux monitors provides prompt and definite indication of any boron 

dilution. The count rate increase is proportional to the subcritical 

multiplication factor and allows operators to promptly recognize the 

initiation of a boron dilution event. Prompt recognition of the initiation of a 

boron dilution event is consistent with the assumptions of the safety 

analysis and is necessary to assure sufficient time is available for 

isolation of the primary water makeup source before SHUTDOWN 

MARGIN is lost (Ref. 2).]
Nuclear Instrumentation

B 3.9.3

Westinghouse STS B 3.9.3-2 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

The need for a safety analysis for an uncontrolled boron dilution accident 

is eliminated by isolating all unborated water sources as required by 

LCO 3.9.2, "Unborated Water Source Isolation Valves."

--------------------------------------------------------------------------------------------------

The source range neutron flux monitors satisfy Criterion 3 of 

10 CFR 50.36(c)(2)(ii).

LCO This LCO requires that two source range neutron flux monitors be 

OPERABLE to ensure that redundant monitoring capability is available to 

detect changes in core reactivity. To be OPERABLE, each monitor must 

provide visual indication [in the control room]. [In addition, at least one of 

the two monitors must provide an OPERABLE audible [alarm] [count rate] 

function to alert the operators to the initiation of a boron dilution event.]

APPLICABILITY In MODE 6, the source range neutron flux monitors must be OPERABLE 

to determine changes in core reactivity. There are no other direct means 

available to check core reactivity levels. In MODES 2, 3, 4, and 5, these 

same installed source range detectors and circuitry are also required to 

be OPERABLE by LCO 3.3.1, "Reactor Trip System (RTS) 

Instrumentation [and LCO 3.3.9, "BDPS"].

ACTIONS A.1 and A.2

With only one source range neutron flux monitor OPERABLE, 

redundancy has been lost. Since these instruments are the only direct 

means of monitoring core reactivity conditions, positive reactivity 

additions and introduction of coolant into the RCS with boron 

concentration less than required to meet the minimum boron 

concentration of LCO 3.9.1 must be suspended immediately. Suspending 

positive reactivity additions that could result in failure to meet the 

minimum boron concentration limit is required to assure continued safe 

operation. Introduction of coolant inventory must be from sources that 

have a boron concentration greater than that what would be required in 

the RCS for minimum refueling boron concentration. This may result in 

an overall reduction in RCS boron concentration, but provides acceptable 

margin to maintaining subcritical operation. Performance of Required 

Action A.1 shall not preclude completion of movement of a component to 

a safe position.
Nuclear Instrumentation

B 3.9.3

Westinghouse STS B 3.9.3-3 Rev. 4.0

BASES

ACTIONS (continued)

B.1

With no source range neutron flux monitor OPERABLE, action to restore 

a monitor to OPERABLE status shall be initiated immediately. Once 

initiated, action shall be continued until a source range neutron flux 

monitor is restored to OPERABLE status.

B.2

With no source range neutron flux monitor OPERABLE, there are no 

direct means of detecting changes in core reactivity. However, since 

positive reactivity additions are not to be made, the core reactivity 

condition is stabilized until the source range neutron flux monitors are 

OPERABLE. This stabilized condition is determined by performing 

SR 3.9.1.1 to ensure that the required boron concentration exists.

The Completion Time of once per 12 hours is sufficient to obtain and 

analyze a reactor coolant sample for boron concentration and ensures 

that unplanned changes in boron concentration would be identified. The 

12 hour Frequency is reasonable, considering the low probability of a 

change in core reactivity during this time period.

[ C.1

With no audible [alarm] [count rate] OPERABLE, prompt and definite 

indication of a boron dilution event, consistent with the assumptions of the 

safety analysis, is lost. In this situation, the boron dilution event may not 

be detected quickly enough to assure sufficient time is available for 

operators to manually isolate the unborated water source and stop the 

dilution prior to the loss of SHUTDOWN MARGIN. Therefore, action must 

be taken to prevent an inadvertent boron dilution event from occurring. 

This is accomplished by isolating all the unborated water flow paths to the 

Reactor Coolant System. Isolating these flow paths ensures that an 

inadvertent dilution of the reactor coolant boron concentration is 

prevented. The Completion Time of "Immediately" assures a prompt 

response by operations and requires an operator to initiate actions to 

isolate an affected flow path immediately. Once actions are initiated, they 

must be continued until all the necessary flow paths are isolated or the 

circuit is restored to OPERABLE status. ]
Nuclear Instrumentation

B 3.9.3

Westinghouse STS B 3.9.3-4 Rev. 4.0

BASES

SURVEILLANCE SR 3.9.3.1

REQUIREMENTS

SR 3.9.3.1 is the performance of a CHANNEL CHECK, which is a 

comparison of the parameter indicated on one channel to a similar 

parameter on other channels. It is based on the assumption that the two 

indication channels should be consistent with core conditions. Changes 

in fuel loading and core geometry can result in significant differences 

between source range channels, but each channel should be consistent 

with its local conditions.

[ The Frequency of 12 hours is consistent with the CHANNEL CHECK 

Frequency specified similarly for the same instruments in LCO 3.3.1.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.9.3.2

SR 3.9.3.2 is the performance of a CHANNEL CALIBRATION. This SR is 

modified by a Note stating that neutron detectors are excluded from the 

CHANNEL CALIBRATION. The CHANNEL CALIBRATION for the source 

range neutron flux monitors consists of obtaining the detector plateau or 

preamp discriminator curves, evaluating those curves, and comparing the 

curves to the manufacturer's data. [The CHANNEL CALIBRATION also 

includes verification of the audible [alarm] [count rate] function.] [ The 

18 month Frequency is based on the need to perform this Surveillance 

under the conditions that apply during a plant outage. Operating 

experience has shown these components usually pass the Surveillance 

when performed at the 18 month Frequency.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.
Nuclear Instrumentation

B 3.9.3

Westinghouse STS B 3.9.3-5 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. 10 CFR 50, Appendix A, GDC 13, GDC 26, GDC 28, and GDC 29.

2. FSAR, Section [15.2.4].

Containment Penetrations

B 3.9.4

Westinghouse STS B 3.9.4-1 Rev. 4.0

B 3.9 REFUELING OPERATIONS

B 3.9.4 Containment Penetrations

BASES

BACKGROUND During movement of [recently] irradiated fuel assemblies within 

containment, a release of fission product radioactivity within containment 

will be restricted from escaping to the environment when the LCO 

requirements are met. In MODES 1, 2, 3, and 4, this is accomplished by 

maintaining containment OPERABLE as described in LCO 3.6.1, 

"Containment." In MODE 6, the potential for containment pressurization 

as a result of an accident is not likely; therefore, requirements to isolate 

the containment from the outside atmosphere can be less stringent. The 

LCO requirements are referred to as "containment closure" rather than 

"containment OPERABILITY." Containment closure means that all 

potential escape paths are closed or capable of being closed. Since 

there is no potential for containment pressurization, the Appendix J 

leakage criteria and tests are not required.

The containment serves to contain fission product radioactivity that may 

be released from the reactor core following an accident, such that offsite 

radiation exposures are maintained well within the requirements of 

10 CFR 100. Additionally, the containment provides radiation shielding 

from the fission products that may be present in the containment 

atmosphere following accident conditions.

The containment equipment hatch, which is part of the containment 

pressure boundary, provides a means for moving large equipment and 

components into and out of containment. During movement of [recently] 

irradiated fuel assemblies within containment, the equipment hatch must 

be held in place by at least four bolts. Good engineering practice dictates 

that the bolts required by this LCO be approximately equally spaced.

The containment air locks, which are also part of the containment 

pressure boundary, provide a means for personnel access during 

MODES 1, 2, 3, and 4 unit operation in accordance with LCO 3.6.2, 

"Containment Air Locks." Each air lock has a door at both ends. The 

doors are normally interlocked to prevent simultaneous opening when 

containment OPERABILITY is required. During periods of unit shutdown 

when containment closure is not required, the door interlock mechanism 

may be disabled, allowing both doors of an air lock to remain open for 

extended periods when frequent containment entry is necessary. 

During movement of [recently] irradiated fuel assemblies within 

containment, containment closure is required; therefore, the door interlock 

mechanism may remain disabled, but one air lock door must always 

remain [capable of being] closed.
Containment Penetrations

B 3.9.4

Westinghouse STS B 3.9.4-2 Rev. 4.0

BASES

BACKGROUND (continued)

The requirements for containment penetration closure ensure that a 

release of fission product radioactivity within containment will be restricted 

to within regulatory limits.

The Containment Purge and Exhaust System includes two subsystems. 

The normal subsystem includes a 42 inch purge penetration and a 

42 inch exhaust penetration. The second subsystem, a minipurge

system, includes an 8 inch purge penetration and an 8 inch exhaust 

penetration. During MODES 1, 2, 3, and 4, the two valves in each of the 

normal purge and exhaust penetrations are secured in the closed 

position. The two valves in each of the two minipurge penetrations can 

be opened intermittently, but are closed automatically by the Engineered 

Safety Features Actuation System (ESFAS). Neither of the subsystems 

is subject to a Specification in MODE 5.

In MODE 6, large air exchangers are necessary to conduct refueling 

operations. The normal 42 inch purge system is used for this purpose, 

and all four valves are closed by the ESFAS in accordance with 

LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS) 

Instrumentation."

[ The minipurge system remains operational in MODE 6, and all four valves 

are also closed by the ESFAS.

[or]

The minipurge system is not used in MODE 6. All four 8 inch valves are 

secured in the closed position. ]

The other containment penetrations that provide direct access from 

containment atmosphere to outside atmosphere must be isolated on at 

least one side. Isolation may be achieved by an OPERABLE automatic 

isolation valve, or by a manual isolation valve, blind flange, or equivalent. 

Equivalent isolation methods must be approved and may include use of a 

material that can provide a temporary, atmospheric pressure, ventilation 

barrier for the other containment penetrations during [recently] irradiated 

fuel movements (Ref. 1).

APPLICABLE During movement of irradiated fuel assemblies within containment, the

SAFETY most severe radiological consequences result from a fuel handling 

ANALYSES accident [involving handling recently irradiated fuel]. The fuel handling 

accident is a postulated event that involves damage to irradiated fuel 

(Ref. 2). Fuel handling accidents, analyzed in Reference 3, include 

dropping a single irradiated fuel assembly and handling tool or a heavy 

object onto other irradiated fuel assemblies. The requirements of 

LCO 3.9.7, "Refueling Cavity Water Level," in conjunction with a minimum
Containment Penetrations

B 3.9.4

Westinghouse STS B 3.9.4-3 Rev. 4.0

BASES

APPLICABLE SAFETY ANALYSES (continued)

decay time of 100 hours prior to [irradiated fuel movement with 

containment closure capability or a minimum decay time of [x] days 

without containment closure capability], ensures that the release of fission 

product radioactivity, subsequent to a fuel handling accident, results in 

doses that are well within the guideline values specified in 10 CFR 100. 

Standard Review Plan, Section 15.7.4, Rev. 1 (Ref. 3), defines "well 

within" 10 CFR 100 to be 25% or less of the 10 CFR 100 values. The 

acceptance limits for offsite radiation exposure will be 25% of 10 CFR 100 

values or the NRC staff approved licensing basis (e.g., a specified 

fraction of 10 CFR 100 limits).

Containment penetrations satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO -----------------------------------REVIEWER’S NOTE-----------------------------------

The allowance to have containment personnel air lock doors open and 

penetration flow paths with direct access from the containment 

atmosphere to the outside atmosphere to be unisolated during fuel 

movement is based on (1) confirmatory dose calculations of a fuel 

handling accident as approved by the NRC staff which indicate 

acceptable radiological consequences and (2) commitments from the 

licensee to implement acceptable administrative procedures that ensure 

in the event of a refueling accident (even though the containment fission 

product control function is not required to meet acceptable dose 

consequences) that the open air lock can and will be promptly closed 

following containment evacuation and that the open penetration(s) can 

and will be promptly closed. The time to close such penetrations or 

combination of penetrations shall be included in the confirmatory dose 

calculations.

--------------------------------------------------------------------------------------------------

This LCO limits the consequences of a fuel handling accident [involving 

handling recently irradiated fuel] in containment by limiting the potential 

escape paths for fission product radioactivity released within containment. 

The LCO requires any penetration providing direct access from the 

containment atmosphere to the outside atmosphere to be closed except 

for the OPERABLE containment purge and exhaust penetrations [and the 

containment personnel air locks]. For the OPERABLE containment purge 

and exhaust penetrations, this LCO ensures that these penetrations are 

isolable by the Containment Purge and Exhaust Isolation System. The 

OPERABILITY requirements for this LCO ensure that the automatic purge 

and exhaust valve closure times specified in the FSAR can be achieved 

and, therefore, meet the assumptions used in the safety analysis to 

ensure that releases through the valves are terminated, such that 

radiological doses are within the acceptance limit.
Containment Penetrations

B 3.9.4

Westinghouse STS B 3.9.4-4 Rev. 4.0

BASES

LCO (continued)

The LCO is modified by a Note allowing penetration flow paths with direct 

access from the containment atmosphere to the outside atmosphere to be 

unisolated under administrative controls. Administrative controls ensure 

that 1) appropriate personnel are aware of the open status of the 

penetration flow path during movement of irradiated fuel assemblies 

within containment, and 2) specified individuals are designated and 

readily available to isolate the flow path in the event of a fuel handling 

accident.

The containment personnel air lock doors many be open during 

movement of [recently] irradiated fuel in the containment provided that 

one door is capable of being closed in the event of a fuel handling 

accident. Should a fuel handling accident occur inside containment, one 

personnel air lock door will be closed following an evacuation of 

containment.

APPLICABILITY The containment penetration requirements are applicable during 

movement of [recently] irradiated fuel assemblies within containment 

because this is when there is a potential for the limiting fuel handling 

accident. In MODES 1, 2, 3, and 4, containment penetration 

requirements are addressed by LCO 3.6.1. In MODES 5 and 6, when 

movement of irradiated fuel assemblies within containment is not being 

conducted, the potential for a fuel handling accident does not exist. 

[Additionally, due to radioactive decay, a fuel handling accident involving 

handling recently irradiated fuel (i.e., fuel that has occupied part of a 

critical reactor core within the previous [x] days) will result in doses that 

are well within the guideline values specified in 10 CFR 100 even without 

containment closure capability.] Therefore, under these conditions no 

requirements are placed on containment penetration status.

-----------------------------------REVIEWER’S NOTE-----------------------------------

The addition of the term "recently" associated with handling irradiated fuel 

in all of the containment function Technical Specification requirements is 

only applicable to those licensees who have demonstrated by analysis 

that after sufficient radioactive decay has occurred, off-site doses 

resulting from a fuel handling accident remain below the Standard Review 

Plan limits (well within 10 CFR 100).

Additionally, licensees adding the term "recently" must make the following 

commitment which is consistent with NUMARC 93-01, Revision 4, 

Section 11.3.6.5 "Safety Assessment for Removal of Equipment from 

Service During Shutdown Conditions," subheading "Containment -

Primary (PWR)/Secondary (BWR)."

"The following guidelines are included in the assessment of systems 

removed from service during movement irradiated fuel:
Containment Penetrations

B 3.9.4

Westinghouse STS B 3.9.4-5 Rev. 4.0

BASES

APPLICABILITY (continued)

- During fuel handling/core alterations, ventilation system and 

radiation monitor availability (as defined in NUMARC 91-06) should 

be assessed, with respect to filtration and monitoring of releases from 

the fuel. Following shutdown, radioactivity in the fuel decays away 

fairly rapidly. The basis of the Technical Specification OPERABILITY 

amendment is the reduction in doses due to such decay. The goal of 

maintaining ventilation system and radiation monitor availability is to 

reduce doses even further below that provided by the natural decay.

- A single normal or contingency method to promptly close primary or 

secondary containment penetrations should be developed. Such 

prompt methods need not completely block the penetration or be 

capable of resisting pressure.

The purpose of the "prompt methods" mentioned above are to enable 

ventilation systems to draw the release from a postulated fuel handling 

accident in the proper direction such that it can be treated and 

monitored."

--------------------------------------------------------------------------------------------------

ACTIONS A.1

If the containment equipment hatch, air locks, or any containment 

penetration that provides direct access from the containment atmosphere 

to the outside atmosphere is not in the required status, including the 

Containment Purge and Exhaust Isolation System not capable of 

automatic actuation when the purge and exhaust valves are open, the 

unit must be placed in a condition where the isolation function is not 

needed. This is accomplished by immediately suspending movement of 

[recently] irradiated fuel assemblies within containment. Performance of 

these actions shall not preclude completion of movement of a component 

to a safe position.

SURVEILLANCE SR 3.9.4.1

REQUIREMENTS

This Surveillance demonstrates that each of the containment penetrations 

required to be in its closed position is in that position. The Surveillance 

on the open purge and exhaust valves will demonstrate that the valves 

are not blocked from closing. Also the Surveillance will demonstrate that 

each valve operator has motive power, which will ensure that each valve 

is capable of being closed by an OPERABLE automatic containment 

purge and exhaust isolation signal.
Containment Penetrations

B 3.9.4

Westinghouse STS B 3.9.4-6 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

[ The Surveillance is performed every 7 days during movement of [recently] 

irradiated fuel assemblies within containment. The Surveillance interval is 

selected to be commensurate with the normal duration of time to 

complete fuel handling operations. A surveillance before the start of 

refueling operations will provide two or three surveillance verifications 

during the applicable period for this LCO. As such, this Surveillance 

ensures that a postulated fuel handling accident [involving handling 

recently irradiated fuel] that releases fission product radioactivity within 

the containment will not result in a release of significant fission product 

radioactivity to the environment in excess of those recommended by 

Standard Review Plan Section 15.7.4 (Reference 3).

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.9.4.2

This Surveillance demonstrates that each containment purge and exhaust 

valve actuates to its isolation position on manual initiation or on an actual 

or simulated high radiation signal. [ The 18 month Frequency maintains 

consistency with other similar ESFAS instrumentation and valve testing 

requirements. In LCO 3.3.6, the Containment Purge and Exhaust 

Isolation instrumentation requires a CHANNEL CHECK every 12 hours 

and a COT every 92 days to ensure the channel OPERABILITY during 

refueling operations. Every 18 months a CHANNEL CALIBRATION is 

performed. The system actuation response time is demonstrated every 

18 months, during refueling, on a STAGGERED TEST BASIS. 

SR 3.6.3.5 demonstrates that the isolation time of each valve is in 

accordance with the Inservice Testing Program requirements. These 

Surveillances performed during MODE 6 will ensure that the valves are 

capable of closing after a postulated fuel handling accident [involving 

handling recently irradiated fuel] to limit a release of fission product 

radioactivity from the containment.
Containment Penetrations

B 3.9.4

Westinghouse STS B 3.9.4-7 Rev. 4.0

BASES

SURVEILLANCE REQUIREMENTS (continued)

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

The SR is modified by a Note stating that this Surveillance is not required 

to be met for valves in isolated penetrations. The LCO provides the 

option to close penetrations in lieu of requiring automatic actuation 

capability.

REFERENCES 1. GPU Nuclear Safety Evaluation SE-0002000-001, Rev. 0, 

May 20, 1988.

2. FSAR, Section [15.4.5].

3. NUREG-0800, Section 15.7.4, Rev. 1, July 1981.

RHR and Coolant Circulation - High Water Level

B 3.9.5

Westinghouse STS B 3.9.5-1 Rev. 4.0

B 3.9 REFUELING OPERATIONS

B 3.9.5 Residual Heat Removal (RHR) and Coolant Circulation - High Water Level

BASES

BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and 

sensible heat from the Reactor Coolant System (RCS), as required by 

GDC 34, to provide mixing of borated coolant and to prevent boron 

stratification (Ref. 1). Heat is removed from the RCS by circulating 

reactor coolant through the RHR heat exchanger(s), where the heat is 

transferred to the Component Cooling Water System. The coolant is then 

returned to the RCS via the RCS cold leg(s). Operation of the RHR 

System for normal cooldown or decay heat removal is manually 

accomplished from the control room. The heat removal rate is adjusted 

by controlling the flow of reactor coolant through the RHR heat 

exchanger(s) and the bypass. Mixing of the reactor coolant is maintained 

by this continuous circulation of reactor coolant through the RHR System.

APPLICABLE If the reactor coolant temperature is not maintained below 200°F, boiling

SAFETY of the reactor coolant could result. This could lead to a loss of coolant in

ANALYSES the reactor vessel. Additionally, boiling of the reactor coolant could lead 

to a reduction in boron concentration in the coolant due to boron plating 

out on components near the areas of the boiling activity. The loss of 

reactor coolant and the reduction of boron concentration in the reactor 

coolant would eventually challenge the integrity of the fuel cladding, which 

is a fission product barrier. One train of the RHR System is required to be 

operational in MODE 6, with the water level ≥ 23 ft above the top of the 

reactor vessel flange, to prevent this challenge. The LCO does permit the 

RHR pump to be removed from operation for short durations, under the 

condition that the boron concentration is not diluted. This conditional 

stopping of the RHR pump does not result in a challenge to the fission 

product barrier.

The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO Only one RHR loop is required for decay heat removal in MODE 6, with 

the water level ≥ 23 ft above the top of the reactor vessel flange. Only 

one RHR loop is required to be OPERABLE, because the volume of 

water above the reactor vessel flange provides backup decay heat 

removal capability. At least one RHR loop must be OPERABLE and in 

operation to provide:

a. Removal of decay heat,

b. Mixing of borated coolant to minimize the possibility of criticality, and

c. Indication of reactor coolant temperature.
RHR and Coolant Circulation - High Water Level

B 3.9.5

Westinghouse STS B 3.9.5-2 Rev. 4.0

BASES

LCO (continued)

An OPERABLE RHR loop includes an RHR pump, a heat exchanger, 

valves, piping, instruments, and controls to ensure an OPERABLE flow 

path and to determine the low end temperature. The flow path starts in 

one of the RCS hot legs and is returned to the RCS cold legs.

The LCO is modified by a Note that allows the required operating RHR 

loop to be removed from operation for up to 1 hour per 8 hour period, 

provided no operations are permitted that would dilute the RCS boron 

concentration by introduction of coolant into the RCS with boron 

concentration less than required to meet the minimum boron 

concentration of LCO 3.9.1. Boron concentration reduction with coolant 

at boron concentrations less than required to assure the RCS boron 

concentration is maintained is prohibited because uniform concentration 

distribution cannot be ensured without forced circulation. This permits 

operations such as core mapping or alterations in the vicinity of the 

reactor vessel hot leg nozzles and RCS to RHR isolation valve testing. 

During this 1 hour period, decay heat is removed by natural convection to 

the large mass of water in the refueling cavity.

APPLICABILITY One RHR loop must be OPERABLE and in operation in MODE 6, with the 

water level ≥ 23 ft above the top of the reactor vessel flange, to provide 

decay heat removal. The 23 ft water level was selected because it 

corresponds to the 23 ft requirement established for fuel movement in 

LCO 3.9.7, "Refueling Cavity Water Level." Requirements for the RHR 

System in other MODES are covered by LCOs in Section 3.4, Reactor 

Coolant System (RCS), and Section 3.5, Emergency Core Cooling 

Systems (ECCS). RHR loop requirements in MODE 6 with the water 

level < 23 ft are located in LCO 3.9.6, "Residual Heat Removal (RHR) 

and Coolant Circulation - Low Water Level."

ACTIONS RHR loop requirements are met by having one RHR loop OPERABLE 

and in operation, except as permitted in the Note to the LCO.

A.1

If RHR loop requirements are not met, there will be no forced circulation 

to provide mixing to establish uniform boron concentrations. Suspending 

positive reactivity additions that could result in failure to meet the 

minimum boron concentration limit is required to assure continued safe 

operation. Introduction of coolant inventory must be from sources that 

have a boron concentration greater than that what would be required in 

the RCS for minimum refueling boron concentration. This may result in 

an overall reduction in RCS boron concentration, but provides acceptable 

margin to maintaining subcritical operation.
RHR and Coolant Circulation - High Water Level

B 3.9.5

Westinghouse STS B 3.9.5-3 Rev. 4.0

BASES

ACTIONS (continued)

A.2

If RHR loop requirements are not met, actions shall be taken immediately 

to suspend loading of irradiated fuel assemblies in the core. With no 

forced circulation cooling, decay heat removal from the core occurs by 

natural convection to the heat sink provided by the water above the core. 

A minimum refueling water level of 23 ft above the reactor vessel flange 

provides an adequate available heat sink. Suspending any operation that 

would increase decay heat load, such as loading a fuel assembly, is a 

prudent action under this condition.

A.3

If RHR loop requirements are not met, actions shall be initiated and 

continued in order to satisfy RHR loop requirements. With the unit in 

MODE 6 and the refueling water level ≥ 23 ft above the top of the reactor 

vessel flange, corrective actions shall be initiated immediately.

A.4, A.5, A.6.1, and A.6.2

If no RHR is in operation, the following actions must be taken:

a. The equipment hatch must be closed and secured with [four] bolts,

b. One door in each air lock must be closed, and

c. Each penetration providing direct access from the containment 

atmosphere to the outside atmosphere must be either closed by a 

manual or automatic isolation valve, blind flange, or equivalent, or 

verified to be capable of being closed by an OPERABLE 

Containment Purge and Exhaust Isolation System.

With RHR loop requirements not met, the potential exists for the coolant 

to boil and release radioactive gas to the containment atmosphere. 

Performing the actions described above ensures that all containment 

penetrations are either closed or can be closed so that the dose limits are 

not exceeded.

The Completion Time of 4 hours allows fixing of most RHR problems and 

is reasonable, based on the low probability of the coolant boiling in that 

time.
RHR and Coolant Circulation - High Water Level

B 3.9.5

Westinghouse STS B 3.9.5-4 Rev. 4.0

BASES

SURVEILLANCE SR 3.9.5.1

REQUIREMENTS

This Surveillance demonstrates that the RHR loop is in operation and 

circulating reactor coolant. The flow rate is determined by the flow rate 

necessary to provide sufficient decay heat removal capability and to 

prevent thermal and boron stratification in the core. [ The Frequency of 

12 hours is sufficient, considering the flow, temperature, pump control, 

and alarm indications available to the operator in the control room for 

monitoring the RHR System.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. FSAR, Section [5.5.7].
RHR and Coolant Circulation - Low Water Level

B 3.9.6

Westinghouse STS B 3.9.6-1 Rev. 4.0

B 3.9 REFUELING OPERATIONS

B 3.9.6 Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level

BASES

BACKGROUND The purpose of the RHR System in MODE 6 is to remove decay heat and 

sensible heat from the Reactor Coolant System (RCS), as required by 

GDC 34, to provide mixing of borated coolant, and to prevent boron 

stratification (Ref. 1). Heat is removed from the RCS by circulating 

reactor coolant through the RHR heat exchangers where the heat is 

transferred to the Component Cooling Water System. The coolant is then 

returned to the RCS via the RCS cold leg(s). Operation of the RHR 

System for normal cooldown decay heat removal is manually 

accomplished from the control room. The heat removal rate is adjusted 

by controlling the flow of reactor coolant through the RHR heat 

exchanger(s) and the bypass lines. Mixing of the reactor coolant is 

maintained by this continuous circulation of reactor coolant through the 

RHR System.

APPLICABLE If the reactor coolant temperature is not maintained below 200°F, boiling

SAFETY of the reactor coolant could result. This could lead to a loss of coolant in

ANALYSES the reactor vessel. Additionally, boiling of the reactor coolant could lead 

to a reduction in boron concentration in the coolant due to the boron 

plating out on components near the areas of the boiling activity. The loss 

of reactor coolant and the reduction of boron concentration in the reactor 

coolant will eventually challenge the integrity of the fuel cladding, which is 

a fission product barrier. Two trains of the RHR System are required to 

be OPERABLE, and one train in operation, in order to prevent this 

challenge.

The RHR System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO In MODE 6, with the water level < 23 ft above the top of the reactor vessel 

flange, both RHR loops must be OPERABLE. Additionally, one loop of 

RHR must be in operation in order to provide:

a. Removal of decay heat,

b. Mixing of borated coolant to minimize the possibility of criticality, and

c. Indication of reactor coolant temperature.

This LCO is modified by two Notes. Note 1 permits the RHR pumps to be 

removed from operation for ≤ 15 minutes when switching from one train to 

another. The circumstances for stopping both RHR pumps are to be 

limited to situations when the outage time is short [and the core outlet 
RHR and Coolant Circulation - Low Water Level

B 3.9.6

Westinghouse STS B 3.9.6-2 Rev. 4.0

BASES

LCO (continued)

temperature is maintained > 10 degrees F below saturation temperature]. 

The Note prohibits boron dilution or draining operations when RHR forced 

flow is stopped.

Note 2 allows one RHR loop to be inoperable for a period of 2 hours 

provided the other loop is OPERABLE and in operation. Prior to 

declaring the loop inoperable, consideration should be given to the 

existing plant configuration. This consideration should include that the 

core time to boil is short, there is no draining operation to further reduce 

RCS water level and that the capability exists to inject borated water into 

the reactor vessel. This permits surveillance tests to be performed on the 

inoperable loop during a time when these tests are safe and possible.

An OPERABLE RHR loop consists of an RHR pump, a heat exchanger, 

valves, piping, instruments and controls to ensure an OPERABLE flow 

path and to determine the low end temperature. The flow path starts in 

one of the RCS hot legs and is returned to the RCS cold legs.

Both RHR pumps may be aligned to the Refueling Water Storage Tank to 

support filling or draining the refueling cavity or for performance of 

required testing.

APPLICABILITY Two RHR loops are required to be OPERABLE, and one RHR loop must 

be in operation in MODE 6, with the water level < 23 ft above the top of 

the reactor vessel flange, to provide decay heat removal. Requirements 

for the RHR System in other MODES are covered by LCOs in 

Section 3.4, Reactor Coolant System (RCS), and Section 3.5, Emergency 

Core Cooling Systems (ECCS). RHR loop requirements in MODE 6 with 

the water level ≥ 23 ft are located in LCO 3.9.5, "Residual Heat Removal 

(RHR) and Coolant Circulation - High Water Level."

ACTIONS A.1 and A.2

If less than the required number of RHR loops are OPERABLE, action 

shall be immediately initiated and continued until the RHR loop is restored 

to OPERABLE status and to operation or until ≥ 23 ft of water level is 

established above the reactor vessel flange. When the water level is 

≥ 23 ft above the reactor vessel flange, the Applicability changes to that of 

LCO 3.9.5, and only one RHR loop is required to be OPERABLE and in 

operation. An immediate Completion Time is necessary for an operator 

to initiate corrective actions.
RHR and Coolant Circulation - Low Water Level

B 3.9.6

Westinghouse STS B 3.9.6-3 Rev. 4.0

BASES

ACTIONS (continued)

B.1

If no RHR loop is in operation, there will be no forced circulation to 

provide mixing to establish uniform boron concentrations. Suspending 

positive reactivity additions that could result in failure to meet the 

minimum boron concentration limit is required to assure continued safe 

operation. Introduction of coolant inventory must be from sources that 

have a boron concentration greater than that what would be required in 

the RCS for minimum refueling boron concentration. This may result in 

an overall reduction in RCS boron concentration, but provides acceptable 

margin to maintaining subcritical operation.

B.2

If no RHR loop is in operation, actions shall be initiated immediately, and 

continued, to restore one RHR loop to operation. Since the unit is in 

Conditions A and B concurrently, the restoration of two OPERABLE RHR 

loops and one operating RHR loop should be accomplished expeditiously.

B.3, B.4, B.5.1, and B.5.2

If no RHR is in operation, the following actions must be taken:

a. The equipment hatch must be closed and secured with [four] bolts,

b. One door in each air lock must be closed, and

c. Each penetration providing direct access from the containment 

atmosphere to the outside atmosphere must be either closed by a 

manual or automatic isolation valve, blind flange, or equivalent, or 

verified to be capable of being closed by an OPERABLE 

Containment Purge and Exhaust Isolation System.

With RHR loop requirements not met, the potential exists for the coolant 

to boil and release radioactive gas to the containment atmosphere. 

Performing the actions stated above ensures that all containment 

penetrations are either closed or can be closed so that the dose limits are 

not exceeded.

The Completion Time of 4 hours allows fixing of most RHR problems and 

is reasonable, based on the low probability of the coolant boiling in that 

time.
RHR and Coolant Circulation - Low Water Level

B 3.9.6

Westinghouse STS B 3.9.6-4 Rev. 4.0

BASES

SURVEILLANCE SR 3.9.6.1

REQUIREMENTS

This Surveillance demonstrates that one RHR loop is in operation and 

circulating reactor coolant. The flow rate is determined by the flow rate 

necessary to provide sufficient decay heat removal capability and to 

prevent thermal and boron stratification in the core. In addition, during 

operation of the RHR loop with the water level in the vicinity of the reactor 

vessel nozzles, the RHR pump suction requirements must be met. [ The 

Frequency of 12 hours is sufficient, considering the flow, temperature, 

pump control, and alarm indications available to the operator for 

monitoring the RHR System in the control room.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

SR 3.9.6.2

Verification that the required pump is OPERABLE ensures that an 

additional RCS or RHR pump can be placed in operation, if needed, to 

maintain decay heat removal and reactor coolant circulation. Verification 

is performed by verifying proper breaker alignment and power available to 

the required pump. [ The Frequency of 7 days is considered reasonable 

in view of other administrative controls available and has been shown to 

be acceptable by operating experience.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]
RHR and Coolant Circulation - Low Water Level

B 3.9.6

Westinghouse STS B 3.9.6-5 Rev. 4.0

BASES

REFERENCES 1. FSAR, Section [5.5.7].

Refueling Cavity Water Level

B 3.9.7

Westinghouse STS B 3.9.7-1 Rev. 4.0

B 3.9 REFUELING OPERATIONS

B 3.9.7 Refueling Cavity Water Level

BASES

BACKGROUND The movement of irradiated fuel assemblies within containment requires a 

minimum water level of 23 ft above the top of the reactor vessel flange. 

During refueling, this maintains sufficient water level in the containment, 

refueling canal, fuel transfer canal, refueling cavity, and spent fuel pool. 

Sufficient water is necessary to retain iodine fission product activity in the 

water in the event of a fuel handling accident (Refs. 1 and 2). Sufficient 

iodine activity would be retained to limit offsite doses from the accident to 

< 25% of 10 CFR 100 limits, as provided by the guidance of Reference 3.

APPLICABLE During movement of irradiated fuel assemblies, the water level in the

SAFETY refueling canal and the refueling cavity is an initial condition design

ANALYSES parameter in the analysis of a fuel handling accident in containment, as 

postulated by Regulatory Guide 1.25 (Ref. 1). A minimum water level of 

23 ft (Regulatory Position C.1.c of Ref. 1) allows a decontamination factor 

of 100 (Regulatory Position C.1.g of Ref. 1) to be used in the accident 

analysis for iodine. This relates to the assumption that 99% of the total 

iodine released from the pellet to cladding gap of all the dropped fuel 

assembly rods is retained by the refueling cavity water. The fuel pellet to 

cladding gap is assumed to contain 10% of the total fuel rod iodine 

inventory (Ref. 1).

The fuel handling accident analysis inside containment is described in 

Reference 2. With a minimum water level of 23 ft and a minimum decay 

time of [X] hours prior to fuel handling, the analysis and test programs 

demonstrate that the iodine release due to a postulated fuel handling 

accident is adequately captured by the water and offsite doses are 

maintained within allowable limits (Refs. 4 and 5).

Refueling cavity water level satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO A minimum refueling cavity water level of 23 ft above the reactor vessel 

flange is required to ensure that the radiological consequences of a 

postulated fuel handling accident inside containment are within 

acceptable limits, as provided by the guidance of Reference 3.

APPLICABILITY LCO 3.9.7 is applicable when moving irradiated fuel assemblies within 

containment. The LCO minimizes the possibility of a fuel handling 

accident in containment that is beyond the assumptions of the safety

analysis. If irradiated fuel assemblies are not present in containment, 

there can be no significant radioactivity release as a result of a postulated 

fuel handling accident. Requirements for fuel handling accidents in the 

spent fuel pool are covered by LCO 3.7.15, "Fuel Storage Pool Water 

Level."
Refueling Cavity Water Level

B 3.9.7

Westinghouse STS B 3.9.7-2 Rev. 4.0

BASES

ACTIONS A.1

With a water level of < 23 ft above the top of the reactor vessel flange, all 

operations involving or movement of irradiated fuel assemblies within the 

containment shall be suspended immediately to ensure that a fuel 

handling accident cannot occur.

The suspension of fuel movement shall not preclude completion of 

movement of a component to a safe position.

SURVEILLANCE SR 3.9.7.1

REQUIREMENTS

Verification of a minimum water level of 23 ft above the top of the reactor 

vessel flange ensures that the design basis for the analysis of the 

postulated fuel handling accident during refueling operations is met. 

Water at the required level above the top of the reactor vessel flange 

limits the consequences of damaged fuel rods that are postulated to 

result from a fuel handling accident inside containment (Ref. 2).

[ The Frequency of 24 hours is based on engineering judgment and is 

considered adequate in view of the large volume of water and the normal 

procedural controls of valve positions, which make significant unplanned 

level changes unlikely.

OR

The Surveillance Frequency is controlled under the Surveillance 

Frequency Control Program.

-----------------------------------REVIEWER’S NOTE-----------------------------------

Plants controlling Surveillance Frequencies under a Surveillance 

Frequency Control Program should utilize the appropriate Frequency 

description, given above, and the appropriate choice of Frequency in the 

Surveillance Requirement.

------------------------------------------------------------------------------------------------ ]

REFERENCES 1. Regulatory Guide 1.25, March 23, 1972.

2. FSAR, Section [15.4.5].

3. NUREG-0800, Section 15.7.4.

4. 10 CFR 100.10.
Refueling Cavity Water Level

B 3.9.7

Westinghouse STS B 3.9.7-3 Rev. 4.0

BASES

REFERENCES (continued)

5. Malinowski, D. D., Bell, M. J., Duhn, E., and Locante, J., WCAP7828, Radiological Consequences of a Fuel Handling Accident, 

December 1971.