Modes 1 and 2: The plant is designed to operate with all reactor coolant loops in operation to meet DNB design criteria during all normal operations and anticipated transients. With less than all loops operating, the plant must be in at least Hot Standby within 1 hour.

Mode 3: A single RCS loop provides sufficient decay heat removal, but single failure considerations require all loops in operation when the rod control system is energized, and at least one loop when de-energized.

Mode 4: A single RCS loop or RHR loop provides sufficient decay heat removal, but single failure considerations require at least 2 loops OPERABLE. If RCS loops are not OPERABLE, two RHR loops must be OPERABLE.

Mode 5: Single failure considerations require two RHR loops OPERABLE.

Support systems: For SW and CC, component redundancy is necessary to ensure no single active component failure causes loss of decay heat removal. One piping path of SW and CC is adequate when it supports both RHR loops. Procedures require two RHR, two CC, and two SW pumps powered from two different vital buses.

Four-loop substitution: Four filled RCS loops with at least two SGs at ≥5% NR level may substitute for one RHR loop, ensuring a single failure does not cause loss of decay heat removal.

Flow and mixing: Operation of one RCP or one RHR pump provides adequate flow to ensure mixing, prevent stratification, and produce gradual reactivity changes during boron concentration reductions. The reactivity change rate will be within the capability of operator recognition and control.

RCP start restriction (below POPS enable temp): Restrictions prevent RCS pressure transients caused by energy additions from the secondary system that could exceed Appendix G limits. The RCS is protected by either: (1) restricting pressurizer water volume (providing expansion volume), or (2) restricting RCP starts to when SG secondary water temperature is < 50°F above each RCS cold leg temperature.

(Amendment No. 328)

The pressurizer code safety valves operate to prevent the RCS from being pressurized above its Safety Limit of 2735 psig. Each safety valve is designed to relieve 420000 lbs/hr of saturated steam at the valve setpoint.

Shutdown (3.4.2): The relief capacity of a single safety valve is adequate to relieve any overpressure condition during shutdown. If no safety valves are OPERABLE, an operating RHR loop connected to the RCS provides overpressure relief capability. The Overpressure Protection System (POPS) provides a diverse means of protection at low temperature. In Mode 5, an equivalent size vent path may satisfy the safety valve requirement when no code safety valves are OPERABLE.

Operating (3.4.3): During operation, all pressurizer code safety valves must be OPERABLE. The combined relief capacity of all safety valves is greater than the maximum surge rate from a complete loss of load assuming no reactor trip until the first RPS trip setpoint is reached (no credit for direct reactor trip on loss of load) and no operation of PORVs or steam dump valves.

Testing: Demonstration of safety valve lift settings occurs only during shutdown per ASME Section XI. Surveillance allows a ±3% lift setpoint tolerance, but valves must be reset to within ±1% of lift setpoint following testing.

(Amendment No. 282)

The limit on maximum water volume ensures the parameter is maintained within the normal steady-state envelope of operation assumed in the SAR. The maximum water volume also ensures that a steam bubble is formed and the RCS is not a hydraulically solid system.

The requirement for a minimum number of pressurizer heaters OPERABLE enhances the capability to control RCS pressure and establish natural circulation.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program (SFCP).

(Amendment No. 282)

PORV and block valve OPERABILITY is determined based on the ability to perform these functions:

A. Manual PORV control — Used to control RCS pressure. This function is used for the steam generator tube rupture accident and for plant shutdown.

B. Automatic PORV control — Reduces challenges to the code safety valves for overpressurization events, including an inadvertent actuation of Safety Injection.

C. RCS pressure boundary integrity — Controlling identified leakage and ensuring the ability to detect unidentified RCPB leakage.

D. Manual block valve control (unblock/isolate) — (1) Unblock an isolated PORV to allow manual and automatic RCS pressure control (Functions A and B), and (2) isolate a PORV with excessive seat leakage (Function C).

E. Manual block valve control (stuck-open PORV) — Isolate a stuck-open PORV.

The distinction between seat leakage and other causes determines whether block valve power is maintained or removed. With seat leakage, block valve power is maintained so the PORV path remains available for overpressure protection. With other failures, power is removed to positively isolate the failed-open path.

(Amendment No. 282)

The LCO requires SG tube integrity be maintained and all tubes satisfying plugging criteria be plugged per the Steam Generator Program. A SG tube is defined as the entire length of the tube, including the tube wall, between the tube-to-tubesheet weld at the tube inlet and the tube-to-tubesheet weld at the tube outlet. The tube-to-tubesheet weld is not considered part of the tube.

A SG tube has tube integrity when it satisfies the three SG performance criteria:

1. Structural integrity — Provides a margin of safety against tube burst or collapse under normal and accident conditions. Primary membrane stress intensity must not exceed yield strength for all ASME Code Service Level A (normal) and Level B (upset/abnormal) transients.

2. Accident induced leakage — Ensures primary-to-secondary leakage caused by a design basis accident (other than SGTR) is within accident analysis assumptions. The accident analysis assumes accident induced leakage does not exceed 1 gpm per SG. This includes any leakage existing prior to the accident plus leakage induced during the accident.

3. Operational leakage — Provides an observable indication of SG tube conditions during operation. Limited to 150 gallons per day primary-to-secondary through any one SG (per LCO 3.4.7.2). This limit is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or main steam line break.

Actions may be entered independently for each SG tube (per Note). If tube integrity is not maintained, Hot Standby within 6 hours and Cold Shutdown within 36 hours.

(Amendment No. 291)

3/4.4.7.1 Leakage Detection Systems: The RCS leakage detection systems monitor and detect leakage from the RCPB, consistent with the recommendations of Regulatory Guide 1.45, “Reactor Coolant Pressure Boundary Leakage Detection Systems” (May 1973).

3/4.4.7.2 Operational Leakage:

Unidentified leakage: Industry experience shows the unidentified portion of RCS leakage can be reduced to a threshold value of less than 1 gpm, sufficiently low to ensure early detection of additional leakage.

Identified leakage: The 10 gpm limit provides allowance for a limited amount of leakage from known sources whose presence will not interfere with detection of UNIDENTIFIED LEAKAGE.

Pressure boundary leakage: PRESSURE BOUNDARY LEAKAGE of any magnitude is unacceptable since it may be indicative of an impending gross failure of the pressure boundary. The presence of any pressure boundary leakage requires the unit to be promptly placed in Cold Shutdown. Leakage past seals and gaskets is NOT pressure boundary leakage.

Primary-to-secondary leakage: The 150 gallons per day per SG limit is based on the operational leakage performance criterion in NEI 97-06. The limit, in conjunction with the Steam Generator Program, is an effective measure for minimizing the frequency of SGTRs. The dose analyses are based on total primary-to-secondary leakage from all SGs of 1 gpm as a result of accident induced conditions (per 10 CFR 50.67). The 150 gpd limit is measured at room temperature per EPRI guidelines. If leakage cannot be assigned to an individual SG, all primary-to-secondary leakage should be conservatively assumed to be from one SG.

Pressure Isolation Valves (PIVs): The function of RCS PIVs is to separate the high-pressure RCS from attached low-pressure systems. Leakage through both series PIVs in a line must be included as IDENTIFIED LEAKAGE. A known component of identified leakage before operation begins is the least of the two individual leak rates for leaking series PIVs. The main purpose of the PIV leakage limit is to prevent overpressure failure of the low-pressure portions of connecting systems. PIV leakage could lead to a LOCA outside of containment — an unanalyzed accident that could degrade low-pressure injection capability.

Actions: The 4-hour action time allows time to verify leakage rates and either identify unidentified leakage or reduce leakage to within limits. In Cold Shutdown, pressure stresses on the RCPB are much lower and further deterioration is much less likely.

Surveillances: RCS water inventory balance must be performed at steady state. Steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows. A Note provides a 12-hour allowance after establishing steady state to collect and process all necessary data. Primary-to-secondary leakage is determined using continuous process radiation monitors or radiochemical grab sampling per EPRI guidelines.

(Amendment No. 304)

In Modes 1-4, operation within the LCO limits for DOSE EQUIVALENT I-131 and DOSE EQUIVALENT XE-133 is necessary to limit the potential consequences of a steam line break (SLB) or steam generator tube rupture (SGTR) to within acceptance criteria. Violation of the LCO may result in coolant radioactivity levels that could, in the event of an SLB or SGTR, lead to doses exceeding acceptance criteria.

DE I-131 > LCO limit: Samples at 4-hour intervals must demonstrate specific activity < 60.0 μCi/gm. Must be restored within 48 hours. The 48-hour completion time is acceptable since an iodine spike is expected to restore to normal concentration within this period, and there is a low probability of an SLB or SGTR during this time.

DE XE-133 > LCO limit: Must be restored within 48 hours on the same basis (noble gas spike expected to restore within this period).

TS 3.0.4.c allowance: A Note permits use of TS 3.0.4.c provisions, allowing entry into applicable MODES while relying on Actions while the specific activity LCO limit is not met. This is acceptable due to significant conservatism in the specific activity limit and the low probability of a limiting event. (Tested: 2019 Q84 — crew IS permitted to raise TAVG above 500 °F and enter Mode 1/2 while RCS activity exceeds LCO 3.4.9 limit, per LCO 3.0.4.c.)

If DE I-131 > 60 μCi/gm or action completion times not met: Hot Standby within 6 hours and Cold Shutdown within 30 hours.

SR 4.4.9.1 — Gamma isotopic analysis measures noble gas specific activity per SFCP. The measurement is the sum of degassed gamma activities and gaseous gamma activities. If a specific noble gas nuclide listed in the definition of DOSE EQUIVALENT XE-133 is not detected, it should be assumed present at the minimum detectable activity. Due to the inherent difficulty in detecting Kr-85 (masking from F-18 and I-134), it is acceptable to include the minimum detectable activity for Kr-85.

SR 4.4.9.2 — Ensures iodine specific activity remains within limit during normal operation and following fast power changes when iodine spiking is more apt to occur. The sample frequency of 2 to 6 hours after a power change > 15% RTP within a 1-hour period is established because iodine levels peak during this time following spike initiation. Samples at other times would provide inaccurate results.

(Amendment No. 318)

P/T Limits (3.4.10.1): Temperature and pressure changes during heatup and cooldown are limited per ASME Boiler and Pressure Vessel Code, Section XI, Appendix G. Allowable combinations of pressure and temperature for specific rate changes are below and to the right of the PTLR limit lines. Cooldown rate limits between those presented may be obtained by interpolation.

The SG secondary side must not be pressurized above 200 psig if SG temperature is below 70°F.

The heatup and cooldown curves are composite curves constructed from point-by-point comparison of steady-state data, finite rate data, and reactor vessel/head flange data. The heatup curve represents different restrictions than the cooldown curve because the thermal gradient directions through the vessel wall are reversed, altering the location of tensile stress between outer and inner walls. The criticality limit curve must be ≥40°F above the heatup or cooldown curve.

Fracture toughness properties of ferritic reactor vessel materials are determined per NRC Standard Review Plan and ASTM E185-82. P/T limit curves are calculated using the most limiting value of the nil-ductility reference temperature (RT_NDT) at the 1/4T and 3/4T locations of the beltline and extended beltline materials. Reactor operation and fast neutron irradiation (E > 1 MeV) can cause an increase in RT_NDT. The adjusted reference temperature (ART) is predicted based on fluence and the copper and nickel content of the material, using Regulatory Guide 1.99, Rev. 2. Neutron fluence as a function of Effective Full Power Years (EFPY) is calculated per Regulatory Guide 1.190.

Pressurizer P/T Limits (3.4.10.2): Although the pressurizer operates in temperature ranges above those where non-ductile failure is a concern, operating limits (100°F/hr heatup, 200°F/hr cooldown, 320°F spray ΔT) ensure compatibility with the fatigue analysis performed per ASME Code.

Overpressure Protection Systems (3.4.10.3): The OPERABILITY of two POPS valves or an RCS vent of >3.14 in² ensures the RCS is protected from pressure transients exceeding Appendix G limits when any cold leg is ≤ POPS enable temperature. Either POPS valve has adequate relieving capability to protect the RCS when the transient is limited to either: (1) start of an idle RCP with SG secondary water temperature ≤ 50°F above RCS cold leg temperatures, or (2) start of an Intermediate Head SI pump into a water-solid RCS, or start of a High Head SI pump with a running Positive Displacement pump into a water-solid RCS.

The minimum power sources for POPS operability consist of a normal (offsite) and emergency (battery) power source for each train. Emergency diesel generators are NOT required for POPS to meet single failure criteria and therefore are NOT required for POPS OPERABILITY.

LCO 3.0.4.b is not applicable to an inoperable POPS when entering MODE 4. There is an increased risk entering Mode 4 from Mode 5 with an inoperable POPS. The provisions of LCO 3.0.4.b (which allow entry into a MODE with the LCO not met after a risk assessment) should not be applied in this circumstance.

(Amendment No. 328)