Each accumulator provides a passive, immediate surge of borated water into the core through each cold leg when RCS pressure falls below accumulator pressure. No electrical power or actuation signal is required — this initial surge provides the critical first cooling mechanism during large RCS pipe ruptures.

The limits on accumulator volume, boron concentration, and nitrogen cover-pressure ensure that the assumptions used for accumulator injection in the safety analysis are met.

The accumulator power-operated isolation valves are considered “operating bypasses” per IEEE Std 279-1971, which requires bypasses of a protective function to be removed automatically when permissive conditions are not met. Because these valves fail to meet single-failure criteria, power must be removed from the accumulator isolation valves.

If a closed isolation valve cannot be immediately opened, the full capability of one accumulator is not available and prompt action is required to place the reactor in a mode where this capability is not required. Operating with one accumulator inoperable (for reasons other than a closed isolation valve or boron concentration) is limited to 24 hours to minimize exposure to a LOCA concurrent with failure of an additional accumulator that could result in unacceptable peak cladding temperatures.

Two independent ECCS subsystems ensure that sufficient emergency core cooling capability is available assuming any single active failure in either subsystem. Either subsystem operating in conjunction with the accumulators is capable of supplying sufficient core cooling to limit peak cladding temperatures within acceptable limits for all postulated break sizes, from double-ended break of the largest RCS cold leg pipe downward. Each subsystem also provides long-term core cooling capability in the recirculation mode during accident recovery.

The ECCS flow paths ensure borated water delivery to both cold legs (injection phase) and hot legs (recirculation phase).

Pump runout limits: Surveillance requirements cap maximum total pump flow at 554 gpm for centrifugal charging pumps (accounting for suction boost alignment; 560 gpm nameplate), 664 gpm for SI pumps in cold leg alignment, and 654 gpm for SI pumps in hot leg alignment (675 gpm nameplate). The maximum–minimum flow surveillance ensures the minimum individual injection line resistance assumed for the spilling line following a LOCA is met.

Safety analysis assumptions: The safety analyses account for both maximum and minimum total system resistance and branch injection line resistance to calculate maximum and minimum ECCS flow bounds.

LCO 3.0.4.b restriction: LCO 3.0.4.b is not applicable to an inoperable ECCS high head subsystem when entering Mode 4. The provisions allowing entry into a Mode with the LCO not met after risk assessment should not be applied in this circumstance due to increased risk.

The RHR interlock (tested per SR 4.5.2.i) prevents opening the RHR suction isolation valves (2RH1, 2RH2) when RCS pressure is ≥375 psig, protecting the low-pressure RHR system from RCS pressure.

With RCS temperature below 350°F, one OPERABLE ECCS subsystem is acceptable without single-failure consideration on the basis of the stable reactivity condition of the reactor and the limited core cooling requirements in Mode 4.

POPS basis: The limitation of a maximum of one SI pump or one centrifugal charging pump OPERABLE below the POPS enable temperature (specified in the PTLR) provides assurance that a mass addition pressure transient can be relieved by the operation of a single POPS relief valve.

Two independent means of preventing RCS injection are required when running an SI pump below the POPS enable temperature with potential for injecting into the RCS. Any two of the following satisfy this requirement:

1. A manual isolation valve locked in the closed position
2. Two manual isolation valves closed
3. One motor-operated valve closed with breaker de-energized and control circuit fuses removed
4. One air-operated valve closed with air supply maintained to ensure it remains closed

RCP seal injection flow is restricted because it is NOT isolated during Safety Injection (SI) actuation — any flow diverted to the RCP seals is diverted from the ECCS injection path. The limit is therefore based on safety analysis assumptions for flow diversion.

The LCO is not strictly a flow limit but a flow limit based on line resistance: both line pressure and flow must be known to establish proper line resistance. The resistance is determined assuming RCS pressure at normal operating pressure and charging pump discharge pressure ≥ 2430 psig. Charging pump header pressure is used rather than RCS pressure because it is more representative of flow diversion during an accident. The charging flow control valve must be full open because it is designed to fail open.

Surveillance exemption: SR 4.0.4 is exempt for up to 4 hours after RCS pressure stabilizes within ±20 psig of normal operating pressure when entering Mode 3 — the exemption allows time to establish the conditions necessary to correctly set the manual throttle valves.

The RWST minimum volume and boron concentration limits ensure three things simultaneously:

1. Sufficient water is available within containment to permit recirculation cooling flow to the core (the sump must have adequate inventory for long-term recirculation).
2. The reactor will remain subcritical in the cold condition following a small LOCA, assuming complete mixing of RWST, RCS, and ECCS water volumes with all control rods inserted except the most reactive assembly (ARI-1 — stuck rod out).
3. The reactor will remain subcritical in the cold condition following a large break LOCA (break flow area > 3.0 sq ft), assuming complete mixing with all control rods assumed out (ARO).

The boron concentration limits also ensure a post-LOCA sump pH between 7.0 and 10.0 for the solution recirculated within containment. This pH band minimizes iodine evolution and minimizes chloride and caustic stress corrosion on mechanical systems. The minimum volume limit includes an allowance for water not usable due to tank discharge line location or other physical characteristics.