Text

Report of Technical Specification Bases Changes
	ML20203M087
Person / Time
Site:	Grand Gulf
Issue date:	07/21/2020
From:	Emily Larson; Entergy Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	GNRO-2020/00022
	Download: ML20203M087 (326)
	v • d • e

Entergy Operations, Inc.

P.O. Box 756 Port Gibson, Mississippi 39150 Eric A. Larson Site Vice President Grand Gulf Nuclear Station Tel: 601-437-7500 10 CFR 50.71 GNRO-2020/00022 July 21, 2020 ATTN: Document Control Desk U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

Report of Technical Specification Bases Changes Grand Gulf Nuclear Station Unit 1 Docket Number 50-416 License Number NPF-29

Dear Sir or Madam:

Pursuant to Grand Gulf Nuclear Station (GGNS) Technical Specification (TS) 5.5.11 and 10 CFR 50.71(e) Entergy Operations Inc. hereby submits an update of all changes made to the GGNS TS Bases since the last submittal (GNRO-2018/00029, dated August 20, 2018)

[ML18232A261].

Sincerely, Eric A. Larson EAL/saw

Attachment:

1: Technical Specification Bases Change Summary 2: Technical Specification Bases Pages cc: NRC Region IV - Regional Administrator NRC Senior Resident Inspector, Grand Gulf Nuclear Station State Health Officer, Mississippi Department of Health NRC Project Manager

GRNO-2020/00022 Attachment 1 Technical Specification Bases Change Summary LBDCR No. Topic Affected Pages Remove requirement for carbon dioxide line for fire protection and 2018-027 B 3.6-87 and B3.6-89 instrument air line for moderate energy break.

Correct a typographical graphical error that occurred at the top of Pages B 3.6-58, B 3.6-59, B 3.6-59a and 2018-048 B 3.6-58, B 3.6-59, B 3.6-59a and B B 3.6-59b 3.6-59b.

Change TS Bases section header SR 3.3.6.1.8 to SR 3.3.6.1.9 to reflect 2018-054 B 3.3-170 insertion of new SR 3.3.6.1.8 in Amendment 197.

Correct of previous LBDCR B 3.3-9e, B 3.3-23c, B 3.3-67 and 2018-069 implementation errors. B 3.4-20a License Amendment 211 (8/2/16) deleted Technical Specification Section 5.5.6, lnservice Testing Program, and defined a separate B 3.4-20a, B 3.4-21, B 3.5-12, 2018-085 lnservice Testing Program that meets B 3.5-13a, B 3.5-14, B 3.6-34 and 1 0CFR590.55a(f). TS Bases SR B 3.6-35 3.4.4.3, SR 3.5.1.7, and 3.6.1.6.1 still references ASME Section IX and TS Section 5.5.6 for relief valve testing.

Provides updates to associated setpoint calculations and instrument B 3.3-2, B 3.3-2a, B 3.3-4, B 3.3-26, uncertainty calculations due to B 3.3-27, B 3.3-27a, B 3.3-27b, 2018-114 replacement of pressure transmitters B 3.3-67, B 3.3-67a, B 3,3-67b, as part of the project to replace the B 3.3-68, B 3.3-68a, B 3.3-69, turbine Electrohydraulic Control B 3.3-74 and B 3.3-74a System (EHC).

2018-126 Correction of typographical error B 3.3-170 B 3.1-18, B3.1-25, B 3.1-31, B 3.1-35, B 3.1-40, B 3.1-41, B 3.1-42, B 3.1-43, B 3.1-48, B 3.1-49, B 3.2-4, B 3.2-8, B 3.2-11, B 3.3-23c, B 3.3-24, B 3.3-25, B 3.3-26, B 3.3-27, B. 3.3-27a, B 3.3-27b, Change for relocation of Surveillance B 3.3-27c (deleted), B 3.3-28, 2018-127 Frequency Requirements to Licensee B 3.3-29a, B 3.3-29b, B 3.3-29c, control (TSTF-425) (Amendment 219). B 3.3-29d (deleted)

B 3.3-29e (deleted), B 3.3-36, B 3.3-37, B 3.3-38, B 3.3-46, B 3.3-47, B 3.3-48, B 3.3-59, B 3.3-60, B 3.3-65, B 3.3-66, B 3.3-74, B 3.3-75, B 3.3-76, B 3.3-77, B 3.3-84, B 3.3-85,

GNRO-2020/00022 LBDCR No. Topic Affected Pages B 3.3-86, B 3.3-121, B 3.3-122, B 3.3-122a, B 3.3-123, B 3.3-133,B 3.3-134, B 3.3-135, B 3.3-168, B 3.3-169, B 3.3-170, B 3.3-170a, B 3.3-181, B 3.3-182, B 3.3-183, B 3.3-192, B 3.3-193, B 3.3-194, B 3.3-205, B 3.3-206, B 3.3-207, B 3.3-212, B 3.3-213, B 3.3-217, B 3.3-231, B 3.3-237, B 3.3-238, B 3.4-7, B 3.4-11, B 3.4-12, B 3.4-15, B 3.4-16, B 3.4-20, B 3.4-26, B 3.4-36, B 3.4-36a, B 3.4-37, B 3.4-41, B 3.4-46, B 3.4-46a, B 3.4-51, B 3.4-51a, B 3.4-57, B 3.4-59, B 3.4-62, B 3.5-9, B 3,5-10, B 3.5-11, B 3.5-12, B 3.5-13a, B 3.5-18, B 3.5-18a, B 3.5-18b, B 3.5-19, B 3.5-19a, B 3.5-24a, B 3.5-25, B 3.5-26, B 3.6-11, B 3.6-12, B 3.6-13, B 3.6-22, B 3.6-24, B 3.6-25, B 3.6-28, B 3.6-31, B 3.6-35, B 3.6-39, B 3.6-40, B 3.6-40a, B 3.6-43, Change for relocation of Surveillance 2018-127 B 3.6-46, B 3.6-47, B 3.6-52, Frequency Requirements to Licensee (continued) B 3.6-55, B 3.6-59, B 3.6-59a, control (TSTF-425) (Amendment 219).

B 3.6-63, B 3.6-64, B 3.6-65, B 3.6-76, B 3.6-81, B 3.6-82, B 3.6-86a, B 3.6-87a, B 3.6-93, B 3.6-94, B 3.6-95, B 3.6-100, B 3.6-101, B 3.6-105, B 3.6-105a, B 3.6-111, B 3.6-118, B 3.6-119, B 3.6-122, B 3.6-125, B 3.6-130, B 3.6-131, B 3.7-6, B 3.7-7, B 3.7-10, B 3.7-16b, B 3.7-21, B 3.7-24, B 3.7-26, B 3.7-30, B 3.8-15, B 3.8-15a, B 3.8-16, B 3.8-17, B 3.8-18, B 3.8-18a (deleted), B 3.8-20, B 3.8-22, B 3.8-23, B 3.8-24, B 3.8-25a, B 3.8-26, B 3.8-27, B 3.8-28, B 3.8-30, B 3.8-30a, B 3.8-31, B 3.8-33, B 3.8-34, B 3.8-46, B 3.8-48, B 3.8-49, B 3.8-56, B 3.8-56a, B 3.8-57, B 3.8-58, B 3.8-59, B 3.8-67, B 3.8-68, B 3.8-78, B 3.8-83, B 3.9-4, B 3.9-7, B 3.9-10, B 3.9-18, B 3.9-21, B 3.9-24, B 3.9-28,

GNRO-2020/00022 LBDCR No. Topic Affected Pages B 3.9-28b, B 3.9-28c (deleted)

Change for relocation of Surveillance B 3.9-33, B 3.9-34, B 3.10-9, 2018-127 Frequency Requirements to Licensee B 3.10-13, B 3.10-19, B 3.10-23, (continued) control (TSTF-425) (Amendment 219). B 3.10-24, B 3.10-27, B 3.10-36, and B-3.10-37 B 3.3-93, B 3.3-94, B 3.3-95, B 3.3-96, B 3.3-97, B 3.3-99, B 3.3-102, B 3.3-105, B 3.3-111, B 3.3-113, B 3.3-116, B 3.3-124, B 3.3-124a, B 3.3-124b, B 3.3-124c, B 3.3-124d, B 3.3-124e, B 3.3-124f, B 3.3-124g, B 3.3-124h, B 3.3-125, B 3.3-125a, B 3.3-125b, B 3.3-125c, B 3.3-125d B 3.3-126, B 3,3-127, B 3.3-128, B 3.3-129, B 3.3-130, B 3.3-131, B 3.3-132, B 3.3-133, B3.3-134, B 3.3-134a, B 3.3-135, B 3.3-140, B 3.3-148, B 3.3-159, B 3.3-160, B 3.3-166, B 3.3-167, B 3.3-170a, B 3.3-175, B 3.3-177, B 3.3-178, B 3.5-1, B 3.5-6, B 3.5-6a, Adoption of TSTF-542, RPV WIC B 3.5-9, B 3.5-10, B. 3.5-11, B 3.5-12, 2018-128 (Drain Time LAR) (Amendment 218). B 3.5-13a, B 3.5-14, B 3.5-15, B 3.5-15a, B 3.5-16, B 3.5-16a, B 3.5-16b, B 3.5-17, B 3.5-18, B 3.5-18a, B 3.5-18b, B 3.5-19, B 3.5-19a, B 3.5-20, B 3.5-21, B 3.5-22, B 3.5-26, B 3.6-16, B 3.6-16a, B 3.6-20, B 3.6-21, B 3.6-54, B 3.6-83, B 3.6-85, B 3.6-86, B 3.6-90, B 3.6-93, B 3.6-98, B 3.6-98a, B 3.6-99, B 3.6-100, B 3.7-9, B 3.7-14, B 3.7-16, B 3.7-16a, B 3.7-17a, B 3.7-18, B 3.7-20 (deleted), B 3.7-21, B 3.8-35, B 3.8-37, B 3.8-38, B 3.8-39, B 3.8-41, B 3.8-60, B 3.8-61, B 3.8-63, B 3.8-80, B 3.8-81, B 3.8-82 and B 3.10-2 Implement Amendment 222, Adoption B 2.0-1, B 2.0-2, B 2.0-3, B 2.0-3a of Technical Specifications Task 2018-129 (deleted), B 2.0-4, B 2.0-6, B 3.2-5 Force Traveler TSTF-564, Revision 2, and B 3.2-6 Safety Limit MCPR.

Implement TSTF-529, Clarify Use and B 3.0-1, B 3.0-3, B 3.0-4, B 3.0-5, 2018-130 Application Rules for TS LCO and SR B 3.0-7, B 3.0-12, B 3.0-13, B 3.0-13a Motherhood Statements (3.0.x). and B 3.0-13b

GNRO-2020/00022 LBDCR No. Topic Affected Pages B 3.3-6a, B3.3-9d, B 3.3-27a and 2018-136 Correction of typographical errors.

B 3.3-29b Align wording of bases statement with 2019-007 the Standard Technical Specifications B 3.3-57 as recommended by TSTF-539.

Remove erroneously state form the technical specification bases that the required control rod block functions provided by the Rod Withdrawal Limiter are adversely impacted with a 2019-098 Main Turbine Bypass Valve open and B 3.3-46 and B 3.3-47 should therefore be considered inoperable if operating with a bypass valve open above 35% RTP. Due to the implementation of an engineering change this is no longer the case.

Incorporation of Cycle 23 use of B 2.0-2, B 2.0-3, B 2.0-6, B 3.2-1 2020-026 GNF3 fuel into the bases. And B 3.2-9

GNRO-2020/00022 Attachment 2 Technical Specification Bases Pages

Reactor Core SLs B 2.1.1 B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 Reactor Core SLs BASES BACKGROUND GDC 10 (Ref. 1) requires, and SLs ensure, that specified acceptable fuel design limits are not exceeded during steady state operation, normal operational transients, and anticipated operational occurrences (AOOs).

The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Because fuel damage is not directly observable, a stepback approach is used to establish an SL, such that the MCPR is not less than the limit specified in Specification 2.1.1.2. MCPR greater than the specified limit represents a conservative margin relative to the conditions required to maintain fuel cladding integrity.

The fuel cladding is one of the physical barriers that separate the radioactive materials from the environs. The integrity of this cladding barrier is related to its relative freedom from perforations or cracking.

Although some corrosion or use related cracking may occur during the life of the cladding, fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding perforations, however, can result from thermal stresses, which occur from reactor operation significantly above design conditions.

While fission product migration from cladding perforation is just as measurable as that from use related cracking, the thermally caused cladding perforations signal a threshold beyond which still greater thermal stresses may cause gross, rather than incremental, cladding deterioration. Therefore, the fuel cladding SL is defined with a margin to the conditions that would produce onset of transition boiling (i.e.,

MCPR = 1.00). These conditions represent a significant departure from the condition intended by design for planned operation. This is accomplished by having a Safety Limit Minimum Critical Power Ratio (SLMCPR) design basis, referred to as SLMCPR95/95, which corresponds to a 95% probability at a 95% confidence level (the 95/95 MCPR criterion) that transition boiling will not occur.

(continued)

GRAND GULF B 2.0-1 LBDCR 18129

Reactor Core SLs B 2.1.1 BASES BACKGROUND Operation above the boundary of the nucleate boiling regime (continued) could result in excessive cladding temperature because of the onset of transition boiling and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding water (zirconium water) reaction may take place.

This chemical reaction results in oxidation of the fuel cladding to a structurally weaker form. This weaker form may lose its integrity, resulting in an uncontrolled release of activity to the reactor coolant.

APPLICABLE The fuel cladding must not sustain damage as a result of SAFETY ANALYSES normal operation and AOOs. The Tech Spec SL is set generically on a fuel product MCPR correlation basis as the MCPR which corresponds to a 95% probability at a 95% confidence level that transition boiling will not occur, referred to as SLMCPR95/95.

The Reactor Protection System setpoints (LCO 3.3.1.1, "Reactor Protection System (RPS) Instrumentation"), in combination with other LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System water level, pressure, and THERMAL POWER level that would result in reaching the MCPR SL.

2.1.1.1 Fuel Cladding Integrity The use of the fuel vendor's critical power correlations is valid for critical power calculations at pressures 685 psig and core flows 10% of rated (Ref. 6, 7, and 8). For operation at low pressures or low flows, the fuel cladding integrity SL is established by a limiting condition on core THERMAL POWER, with the following basis:

Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low power and flow will always be > 4.5 psi. Analyses show that with a bundle flow of 28 x 103 lb/hr, bundle pressure drop is nearly independent of bundle power and has a value of 3.5 psi. Thus the bundle flow with a 4.5 psi driving head will be > 28 x 103 lb/hr. Full scale (continued)

GRAND GULF B 2.0-2 LBDCR 20026

Reactor Core SLs B 2.1.1 BASES APPLICABLE 2.1.1.1 Fuel Cladding Integrity (continued)

SAFETY ANALYSES ATLAS test data taken at pressures from 14.7 psia to 800 psia indicate that the fuel assembly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER > 44.2% RTP. Thus a THERMAL POWER limit of 21.8% RTP [1.2 / (4408 MWt/800 bundles)] for reactor pressure < 685 psig is conservative. Because of the design thermal hydraulic compatibility of the reload fuel designs, this justification and the associated low pressure and low flow limits remain applicable for future cycles of cores containing these fuel designs.

2.1.1.2 MCPR The fuel cladding integrity SL is set such that no significant fuel damage is calculated to occur if the limit is not violated. Since the parameters that results in fuel damage are not directly observable during reactor operation, the thermal and hydraulic conditions that result in the onset of transition boiling have been used to mark the beginning of the region in which fuel damage could occur. Although it is recognized that the onset of transition boiling would not result in damage to BWR fuel rods, the critical power at which boiling transition is calculated to occur has been adopted as a convenient limit. The Technical Specification SL value is dependent on the fuel product line and the corresponding MCPR correlation, which is cycle independent. The value is based on the Critical Power Ratio (CPR) data statistics and a 95% probability with 95%

confidence that rods are not susceptible to boiling transition, reference as MCPR95/95.

The MCPR SL is determined using a statistical model that combines all the uncertainties in operating parameters and the procedure used to calculated critical power. The probability of the occurrence of boiling transition is determined using the approved General Electric Critical Power correlations. Details of the fuel cladding integrity SL calculation are given in Reference 6. Reference 6 also includes a tabulation of the uncertainties used in the determination of the MCPR SL and of the nominal values of the parameters used in the MCPR SL statistical analysis.

The SL is based on GNF2 and GNF 3 fuels. For cores with a single fuel product line, the SLMCPR95/95 is the MCPR95/95 for the fuel type. For cores loaded with a mix of applicable fuel types, the SLMCPR95/95 is based on the largest (i.e., most limiting) of the MCPR values for the fuel product lines that are fresh-or once-burnt at the start of the cycle, (continued)

GRAND GULF B 2.0-3 LBDCR 20026

Reactor Core SLs B 2.1.1 BASES APPLICABLE 2.1.1.3 Reactor Vessel Water Level SAFETY ANALYSES During MODES 1 and 2, the reactor vessel water level is required to be above the top of the active fuel to provide core cooling capability. With fuel in the reactor vessel during periods when the reactor is shut down, consideration must be given to water level requirements due to the effect of decay heat. If the water level should drop below the top of the active irradiated fuel during this period, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation in the event that the water level becomes less than two-thirds of the core height. The reactor vessel water level SL has been established at the top of the active irradiated fuel to provide a point that can be monitored and to also provide adequate margin for effective action.

SAFETY LIMITS The reactor core SLs are established to protect the integrity of the fuel clad barrier to the release of radioactive materials to the environs. SL 2.1.1.1 and SL 2.1.1.2 ensure that the core operates within the fuel design criteria.

SL 2.1.1.3 ensures that the reactor vessel water level is greater than the top of the active irradiated fuel in order to prevent elevated clad temperatures and resultant clad perforation.

APPLICABILITY SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in all MODES.

(continued)

GRAND GULF B 2.0-4 LBDCR 18129

Reactor Core SLs B 2.1.1 BASES (continued)

REFERENCES 10 CFR 50, Appendix A, GDC 10.

ANF-524(P)(A), Revision 2, Supplements 1 and 2, November 1990.

deleted

10 CFR 50.67, Accident Source Term.@

deleted

NEDE-24011-P-A, GESTAR-II (latest approved revision).

NEDC-33292P, GEXL17 Correlation for GNF2 Fuel (latest

approved revision)

NEDC-3380P, GEXL21 Correlation for GNF3 Fuel (latest approved

revision)

GRAND GULF B 2.0-6 LBDCR 20026

LCO Applicability B 3.0 B 3.0 LIMITING CONDITION FOR OPERATION (LCO) APPLICABILITY BASES LCOs LCO 3.0.1 through LCO 3.0.9 establish the general requirements applicable to all Specifications and apply at all times, unless otherwise stated.

LCO 3.0.1 LCO 3.0.1 establishes the Applicability statement within each individual Specification as the requirement for when the LCO is required to be met (i.e., when the unit is in the MODES or other specified conditions of the Applicability statement of each Specification).

LCO 3.0.2 LCO 3.0.2 establishes that upon discovery of a failure to meet an LCO, the associated ACTIONS shall be met. The Completion Time of each Required Action for an ACTIONS Condition is applicable from the point in time that an ACTIONS Condition is entered, unless otherwise specified.

The Required Actions establish those remedial measures that must be taken within specified Completion Times when the requirements of an LCO are not met. This Specification establishes that:

a. Completion of the Required Actions within the specified Completion Times constitutes compliance with a Specification; and

b. Completion of the Required Actions is not required when an LCO is met within the specified Completion Time, unless otherwise specified.

There are two basic types of Required Actions. The first type of Required Action specifies a time limit in which the LCO must be met. This time limit is the Completion Time to restore an inoperable system or component to OPERABLE status or to restore variables to within specified limits. If this type of Required Action is not completed within the specified Completion Time, a shutdown may be required to place the unit in a MODE or condition in which the Specification is not applicable. (Whether stated as a Required Action or not, correction of the entered Condition is an action that may always be considered upon entering ACTIONS.) The second type of Required Action specifies the remedial measures that permit continued operation of the (continued)

GRAND GULF B 3.0-1 LBDCR 18130

LCO Applicability B 3.0 BASES (continued)

LCO 3.0.3 LCO 3.0.3 establishes the actions that must be implemented when an LCO is not met and:

a. An associated Required Action and Completion Time is not met and no other Condition applies; or

b. The condition of the unit is not specifically addressed by the associated ACTIONS. This means that no combination of Conditions stated in the ACTIONS can be made that exactly corresponds to the actual condition of the unit. Sometimes, possible combinations of Conditions are such that entering LCO 3.0.3 is warranted; in such cases, the ACTIONS specifically state a Condition corresponding to such combinations and also that LCO 3.0.3 be entered immediately.

This Specification delineates the time limits for placing the unit in a safe MODE or other specified condition when operation cannot be maintained within the limits for safe operation as defined by the LCO and its ACTIONS. It is not intended to be used as an operational convenience that permits routine voluntary removal of redundant systems or components from service in lieu of other alternatives that would not result in redundant systems or components being inoperable.

Upon entering LCO 3.0.3, 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is allowed to prepare for an orderly shutdown before initiating a change in unit operation. This includes time to permit the operator to coordinate the reduction in electrical generation with the load dispatcher to ensure the stability and availability of the electrical grid. The time limits specified to enter lower MODES of operation permit the shutdown to proceed in a controlled and orderly manner that is well within the specified maximum cooldown rate and within the capabilities of the unit, assuming that only the minimum required equipment is OPERABLE. This reduces thermal stresses on components of the Reactor Coolant System and the potential for a plant upset that could challenge safety systems under conditions to which this Specification applies. The use and interpretation of specified times to complete the actions of LCO 3.0.3 are consistent with the discussion of Section 1.3, Completion Times.

(continued)

GRAND GULF B 3.0-3 LBDCR 18130

LCO Applicability B 3.0 BASES LCO 3.0.3 A unit shutdown required in accordance with LCO 3.0.3 may be (continued) terminated and LCO 3.0.3 exited if any of the following occurs:

a. The LCO is now met,

b. The LCO is no longer applicable,

c. A Condition exists for which the Required Actions have now been performed or

d. ACTIONS exist that do not have expired Completion Times. These Completion Times are applicable from the point in time that the Condition is initially entered and not from the time LCO 3.0.3 is exited.

The time limits of Specification 3.0.3 allow 37 hours4.282407e-4 days 0.0103 hours 6.117725e-5 weeks 1.40785e-5 months for the unit to be in MODE 4 when a shutdown is required during MODE 1 operation. If the unit is in a lower MODE of operation when a shutdown is required, the time limit for entering the next lower MODE applies. If a lower MODE is entered in less time than allowed, however, the total allowable time to enter MODE 4, or other applicable MODE, is not reduced. For example, if MODE 2 is entered in 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , then the time allowed for entering MODE 3 is the next 11 hours1.273148e-4 days 0.00306 hours 1.818783e-5 weeks 4.1855e-6 months , because the total time for entering MODE 3 is not reduced from the allowable limit of 13 hours1.50463e-4 days 0.00361 hours 2.149471e-5 weeks 4.9465e-6 months . Therefore, if remedial measures are completed that would permit a return to MODE 1, a penalty is not incurred by having to enter a lower MODE of operation in less than the total time allowed.

In MODES 1, 2, and 3, LCO 3.0.3 provides actions for Conditions not covered in other Specifications. The requirements of LCO 3.0.3 do not apply in MODES 4 and 5 because the unit is already in the most restrictive Condition required by LCO 3.0.3. The requirements of LCO 3.0.3 do not apply in other specified conditions of the Applicability (unless in MODE 1, 2, or 3) because the ACTIONS of individual Specifications sufficiently define the remedial measures to be taken.

Exceptions to LCO 3.0.3 are provided in instances where requiring a unit shutdown, in accordance with LCO 3.0.3, would not provide appropriate remedial measures for the associated condition of the unit. An example of this is in LCO 3.7.6, "Fuel Pool Water Level." LCO 3.7.6 has an Applicability of "During movement of irradiated fuel (continued)

GRAND GULF B 3.0-4 LBDCR 1830

LCO Applicability B 3.0 BASES LCO 3.0.3 assemblies in the associated fuel storage pool." Therefore, (continued) this LCO can be applicable in any or all MODES. If the LCO and the Required Actions of LCO 3.7.6 are not met while in MODE 1, 2, or 3, there is no safety benefit to be gained by placing the unit in a shutdown condition. The Required Action of LCO 3.7.6 of "Suspend movement of irradiated fuel assemblies in the associated fuel storage pool(s)" is the appropriate Required Action to complete in lieu of the actions of LCO 3.0.3. These exceptions are addressed in the individual Specifications.

LCO 3.0.4 LCO 3.0.4 establishes limitations on changes in MODES or other specified conditions in the Applicability when an LCO is not met. It allows placing the unit in a MODE or other specified condition stated in that Applicability (e.g., the Applicability desired to be entered) when unit conditions are such that the requirements of the LCO would not be met, in accordance with either LCO 3.0.4.a, LCO 3.0.4.b, or LCO 3.0.4.c.

LCO 3.0.4.a allows entry into a MODE or other specified condition in the Applicability with the LCO not met when the associated ACTIONS to be entered following entry into the MODE or other specified condition in the Applicability will permit continued operation within the MODE or other specified condition for an unlimited period of time. Compliance with ACTIONS that permit continued operation of the unit for an unlimited period of time in a MODE or other specified condition provides an acceptable level of safety for continued operation. This is without regard to the status of the unit before or after the MODE change. Therefore, in such cases, entry into a MODE or other specified condition in the Applicability may be made and the Required Actions followed after entry into the Applicability.

For example, LCO 3.0.4.a may be used when the Required Action to be entered states that an inoperable instrument channel must be placed in the trip condition within the Completion Time. Transition into a MODE or other specified in condition in the Applicability may be made in accordance with LCO 3.0.4 and the channel is subsequently placed in the tripped condition within the Completion Time, which begins when the Applicability is entered. If the instrument channel cannot be placed in the tripped condition and the subsequent default ACTION ("Required Action and associated Completion Time not met") allows the OPERABLE train to be placed in operation, use of LCO 3.0.4.a is acceptable because the subsequent ACTIONS to be entered following entry into the MODE include ACTIONS (place the OPERABLE train in operation) that permit safe plant operation for an unlimited period of time in the MODE or other specified condition to be entered.

(continued)

GRAND GULF B 3.0-5 LBDCR 1830

LCO Applicability B 3.0 BASES LCO 3.0.5 provide an exception to LCO 3.0.2 (e.g., to not comply with (continued) the applicable Required Action(s)) to allow the performance of SRs to demonstrate:

a. The OPERABILITY of the equipment being returned to service; or

b. The OPERABILITY of other equipment.

The administrative controls ensure the time the equipment is returned to service in conflict with the requirements of the ACTIONS is limited to the time absolutely necessary to perform the allowed SRs. This Specification does not provide time to perform any other preventive or corrective maintenance. LCO 3.0.5 should not be used in lieu of other practicable alternatives that comply with Required Actions and that do not require changing the MODE or other specified conditions in the Applicability in order to demonstrate equipment is OPERABLE. LCO 3.0.5 is not intended to be used repeatedly.

An example of demonstrating equipment is OPERABLE with the Required Actions not met is opening a manual valve that was closed to comply with Required Actions to isolate a flowpath with excessive Reactor Coolant System (RCS) Pressure Isolation Valve (PIV) leakage in order to perform testing to demonstrate that RCS PIV leakage is now within limit.

Examples of demonstrating equipment OPERABILITY include instances in which it is necessary to take an inoperable channel or trip system out of a tripped condition that was directed by a Required Action, if there is no Required Action Note for this purpose. An example of verifying OPERABILITY of equipment removed from service is taking a tripped channel out of the tripped condition to permit the logic to function and indicate the appropriate response during performance of required testing on the inoperable channel. Example of demonstrating the OPERABILITY of other equipment are taking an inoperable channel or trip system out of the tripped condition 1) to prevent the trip function from occurring during the performance of an SR on another channel in the other trip system, or

2) to permit the logic to function and indicate the appropriate response during the performance of an SR on another channel in the same trip system.

The administrative controls in LCO 3.0.5 apply in all cases to systems or components in Chapter 3 of the Technical Specifications, as long as the testing could not be conducted while complying with the Required Actions. This includes the realignment or repositioning of redundant or alternate equipment or trains previously manipulated to comply with ACTIONS, as well as equipment removed from service or declared inoperable to comply with ACTIONS.

(continued)

GRAND GULF B 3.0-7 LBDCR 1830

SR Applicability B 3.0 BASES SR 3.0.2 The 25% extension does not significantly degrade the (continued) reliability that results from performing the Surveillance at its specified Frequency. This is based on the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the SRs. The exceptions to SR 3.0.2 are those Surveillances for which the 25% extension of the interval specified in the Frequency does not apply. These exceptions are stated in the individual Specifications. For example, the requirements of regulations take precedence over the TS. The TS cannot in and of themselves extend a test interval specified in the regulations. Therefore, there is a Note in the Frequency stating, "SR 3.0.2 is not applicable."

When a Section 5.5, Programs and Manuals, specification states that the provisions of SR 3.0.2 are applicable, a 25% extension of the testing interval, whether stated in the specification or incorporated by reference, is permitted.

As stated in SR 3.0.2, the 25% extension also does not apply to the initial portion of a periodic Completion Time that requires performance on a "once per..." basis. The 25% extension applies to each performance after the initial performance. The initial performance of the Required Action, whether it is a particular Surveillance or some other remedial action, is considered a single action with a single Completion Time. One reason for not allowing the 25% extension to this Completion Time is that such an action usually verifies that no loss of function has occurred by checking the status of redundant or diverse components or accomplishes the function of the inoperable equipment in an alternative manner.

The provisions of SR 3.0.2 are not intended to be used repeatedly to extend Surveillance intervals (other than those consistent with refueling intervals) or periodic Completion Time intervals beyond those specified.

SR 3.0.3 SR 3.0.3 establishes the flexibility to defer declaring affected equipment inoperable or an affected variable outside the specified limits when a Surveillance has not been performed within the specified Frequency. A delay period of up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or up to the limit of the specified Frequency, whichever is greater, applies from the point in time that it is discovered that the Surveillance has not been performed in accordance with SR 3.0.2, and not at the (continued)

GRAND GULF B 3.0-12 LBDCR 1830

SR Applicability B 3.0 BASES SR 3.0.3 time that the specified Frequency was not met.

(continued)

This delay period provides adequate time to perform Surveillances that have been missed. This delay period permits the performance of a Surveillance before complying with Required Actions or other remedial measures that might preclude performance of the Surveillance.

When a Section 5.5, Programs and Manuals, specification states that the provisions of SR 3.0.3 are applicable, it permits the flexibility to defer declaring the testing requirement not met in accordance with SR 3.0.3 when the testing has not been completed within the testing interval (including the allowance of SR 3.0.2 if invoked by Section 5.5 specification).

The basis for this delay period includes consideration of unit conditions, adequate planning, availability of personnel, the time required to perform the Surveillance, the safety significance of the delay in completing the required Surveillance, and the recognition that the most probable result of any particular Surveillance being performed is the verification of conformance with the requirements.

When a Surveillance with a Frequency based not on time intervals, but upon specified unit conditions, operating situations, or requirements of regulations (e.g., prior to entering MODE 1 after each fuel loading, or in accordance with 10 CFR 50 Appendix J, as modified by approved exemptions, etc.) is discovered to not have been performed when specified, SR 3.0.3 allows for the full delay period of up to the specified Frequency to perform the Surveillance. However, since there is not a time interval specified, the missed Surveillance should be performed at the first reasonable opportunity.

SR 3.0.3 provides a time limit for, and allowances for the performance of, Surveillances that become applicable as a consequence of MODE changes imposed by Required Actions.

SR 3.0.3 is only applicable if there is a reasonable expectation the associated equipment is OPERABLE or that variables are within limits, and it is expected that the Surveillance will be met when performed. Many factors should be considered, such as the period of time since the Surveillance was last performed, or whether the Surveillance, or a portion thereof, has ever been performed, and any other indications, tests, or activities that might support the expectation that the Surveillance will be met when performed. An example of the use of SR 3.0.3 would be a relay contact that was not tested as required in accordance with a particular SR, but previous successful performances of the SR included the relay contact; the adjacent, physically connected relay contacts were tested during the SR performance; the subject relay contact has been tested by (continued)

GRAND GULF B 3.0-13 /%'&5

SR Applicability B 3.0 BASES SR 3.0.3 another SR; or historical operation of the subject relay contact has been (continued) successful. It is not sufficient to infer the behavior of the associated equipment from the performance of similar equipment. The rigor of determining whether there is a reasonable expectation a Surveillance will be met when performed should increase based on the length of time since the last performance of the Surveillance. If the Surveillance has been performed recently, a review of the Surveillance history and equipment performance may be sufficient to support a reasonable expectation that the Surveillance will be met when performed.

For Surveillances that have not been performed for a long period or that have never been performed, a rigorous evaluation based on objective evidence should provide a high degree of confidence that the equipment is OPERABLE. The evaluation should be documented in sufficient detail to allow a knowledgeable individual to understand the basis for the determination.

Failure to comply with specified Frequencies for SRs is expected to be an infrequent occurrence. Use of the delay period established by SR 3.0.3 is a flexibility which is not intended to be used repeatedly to extend Surveillance intervals. While up to 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months or the limit of the specified Frequency is provided to perform the missed Surveillance, it is expected that the missed Surveillance will be performed at the first reasonable opportunity. The determination of the first reasonable opportunity should include consideration of the impact on plant risk (from delaying the Surveillance as well as any plant configuration changes required or shutting the plant down to perform the Surveillance) and impact on any analysis assumptions, in addition to unit conditions, planning, availability of personnel, and the time required to perform the Surveillance. This risk impact should be managed through the program in place to implement 10 CFR 50.65(a)(4) and its implementation guidance, NRC Regulatory Guide 1.182 Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants. This Regulatory Guide addresses consideration of temporary and aggregate risk impacts, determination of risk management actions thresholds, and risk management action up to and including plant shutdown. The missed Surveillance should be treated as an emergent condition as discussed in the Regulatory Guide. The risk evaluation may use quantitative, qualitative, or blended methods. The degree of depth and rigor of the evaluation should be commensurate with the importance of the component. Missed Surveillances for important components should be analyzed quantitatively. If the results of the risk evaluation determine the risk increase is significant, this evaluation should be used to determine the safest course of action. All missed Surveillances will be placed in the licensees Corrective Action Program.

GRAND GULF B 3.0-13a LBDCR 1830

SR Applicability B 3.0 BASES SR 3.0.3 If a Surveillance is not completed within the allowed delay period, then (continued) the equipment is considered inoperable or the variable then is considered outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon expiration of the delay period. If a Surveillance is failed within the delay period, then the equipment is inoperable, or the variable is outside the specified limits and the Completion Times of the Required Actions for the applicable LCO Conditions begin immediately upon the failure of the Surveillance.

(continued)

GRAND GULF B 3.0-13b LBDCR 1830

Control Rod OPERABILITY B 3.1.3 BASES (continued)

SURVEILLANCE SR 3.1.3.1 REQUIREMENTS The position of each control rod must be determined, to ensure adequate information on control rod position is available to the operator for determining control rod OPERABILITY and controlling rod patterns.

Control rod position may be determined by the use of OPERABLE position indicators, by moving control rods to a position with an OPERABLE indicator, or by the use of other appropriate methods. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.3.2 Deleted SR 3.1.3.3 Control rod insertion capability is demonstrated by inserting each partially or fully withdrawn control rod at least one notch and observing that the control rod moves. The control rod may then be returned to its original position. This ensures the control rod is not stuck and is free to insert on a scram signal. This Surveillance is modified by a Note identifying that the Surveillance is not required to be performed when THERMAL POWER is less than or equal to the actual LPSP of the RPC since the notch insertions may not be compatible with the requirements of BPWS (LCO 3.1.6) and the RPC (LCO 3.3.2.1). This Note also provides a time allowance such that the Surveillance is not required to be performed until the next scheduled control rod testing for control rods of the same class (i.e., fully withdrawn or partially withdrawn). This Note provides this allowance to prevent unnecessary perturbations in reactor operation to perform this testing on a control rod whose surveillance class (i.e., fully withdrawn or partially withdrawn) has changed. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. At any time, if a control rod is immovable, a determination of that control rod's trippability (OPERABILITY) must be made and appropriate action taken.

(continued)

GRAND GULF B 3.1-18 LBDCR 18127

Control Rod Scram Times B 3.1.4 BASES SURVEILLANCE SR 3.1.4.2 (continued)

REQUIREMENTS the tested sample are determined to be "slow." If more than 7.5% of the sample is declared to be "slow" per the criteria in Table 3.1.4-1, additional control rods are tested until this 7.5% criterion (e.g., 7.5% of the entire sample size) is satisfied, or until the total number of "slow" control rods (throughout the core, from all surveillances) exceeds the LCO limit. For planned testing, the control rods selected for the sample should be different for each test. Data from inadvertent scrams should be used whenever possible to avoid unnecessary testing at power, even if the control rods with data were previously tested in a sample. The 7.5% of sample size criteria is intended to align with the 7.5% of the total control rods allowed to have scram times that exceed the specified limit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.4.3 When work that could affect the scram insertion time is performed on a control rod or the CRD System, testing must be done to demonstrate that each affected control rod retains adequate scram performance over the range of applicable reactor pressures from zero to the maximum permissible pressure. The scram testing must be performed once before declaring the control rod OPERABLE. The required scram time testing must demonstrate that the affected control rod is still within acceptable limits. The limits for reactor pressures < 950 psig are established based on a high probability of meeting the acceptance criteria at reactor pressures 950 psig. Limits for 950 psig are found in Table 3.1.4-1. If testing demonstrates the affected control rod does not meet these limits, but is within the 7 second limit of Table 3.1.4-1 Note 2, the control rod can be declared OPERABLE and "slow."

Specific examples of work that could affect the scram times (continued)

GRAND GULF B 3.1-25 LBDCR 18127

Control Rod Scram Accumulators B 3.1.5 BASES ACTIONS D.1 (continued) that all insertable control rods are inserted and that the reactor is in a condition that does not require the active function (i.e., scram) of the control rods. This Required Action is modified by a Note stating that the Required Action is not applicable if all control rods associated with the inoperable scram accumulators are fully inserted, since the function of the control rods has been performed.

SURVEILLANCE SR 3.1.5.1 REQUIREMENTS SR 3.1.5.1 requires that the accumulator pressure be checked periodically to ensure adequate accumulator pressure exists to provide sufficient scram force. The primary indicator of accumulator OPERABILITY is the accumulator pressure. A minimum accumulator is well below the expected pressure of 1750 psig (Ref. 2). Declaring the accumulator inoperable when the minimum pressure is not maintained pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator pressure of 1520 psig ensures that significant degradation in scram times does not occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 4.3.2.5.5.

2. UFSAR, Section 4.6.1.1.2.5.3.

3. UFSAR, Section 5.2.2.2.3.

4. UFSAR, Section 15.4.1.

GRAND GULF B 3.1-31 LBDCR 18127

Control Rod Pattern B 3.1.6 BASES ACTIONS B.1 and B.2 (continued) withdrawals have. Required Action B.1 is modified by a Note that allows the affected control rods to be bypassed in RACS in accordance with SR 3.3.2.1.9 to allow insertion only.

With nine or more OPERABLE control rods not in compliance with BPWS, the reactor mode switch must be placed in the shutdown position within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the reactor mode switch in shutdown, the reactor is shut down, and therefore does not meet the applicability requirements of this LCO. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable to allow insertion of control rods to restore compliance, and is appropriate relative to the low probability of a CRDA occurring with the control rods out of sequence.

SURVEILLANCE SR 3.1.6.1 REQUIREMENTS The control rod pattern is verified to be in compliance with the BPWS periodically, ensuring the assumptions of the CRDA analyses are met.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The RPC provides control rod blocks to enforce the required control rod sequence and is required to be OPERABLE when operating at 10% RTP.

REFERENCES 1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel (GESTAR II)."

2. UFSAR, Section 15.4.9.

3. NUREG-0979, "NRC Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design, Docket No. 50-447," Section 4.2.1.3.2, April 1983.

4. NUREG-0800, "Standard Review Plan," Section 15.4.9, "Radiological Consequences of Control Rod Drop Accident (BWR),"

Revision 2, July 1981.

5. 10 CFR 100.11, "Determination of Exclusion Area, Low Population Zone, and Population Center Distance."

(continued)

GRAND GULF B 3.1-35 LBDCR 18127

SLC System B 3.1.7 BASES ACTIONS E.1 (continued) concurrent with the failure of the controls rods to shut down the reactor.

F.1 If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.7.1 and SR 3.1.7.2 REQUIREMENTS SR 3.1.7.1 and SR 3.1.7.2 verify certain characteristics of the SLC System (e.g., the volume and temperature of the borated solution in the storage tank), thereby ensuring the SLC System OPERABILITY without disturbing normal plant operation. These surveillances ensure the proper borated solution and temperature, including the temperature of the pump suction piping, are maintained. Maintaining a minimum specified borated solution temperature is important to ensuring that the boron remains in solution and does not precipitate out in the storage tank or in the pump suction piping. Maintaining the temperature less than 150°F ensures the pump net positive suction head requirements for two pump operation and SLC System piping qualifications. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.1-40 LBDCR 18127

SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.3 and SR 3.1.7.5 REQUIREMENTS The requirements of 10 CFR 50.62 are met by the use of a sodium pentaborate solution enriched in the boron-10 (B-10) isotope. SR 3.1.7.3 determines whether the sodium pentaborate concentration, in conjunction with the boron enrichment, is within limits to meet the requirements of 10 CFR 50.62. SR 3.1.7.5 ensures that the parameters used in the determination of sodium pentaborate concentration are within limits. The available solution volume is the solution volume above the pump suction penetration. This surveillance requires an examination of the sodium pentaborate solution by using chemical analysis to ensure the proper weight of B-10 exists in the storage tank. SR 3.1.7.5 must be performed anytime boron or water is added to the storage tank solution to establish that the weight of B-10 is within the specified limits. This SR must be performed anytime the solution temperature is restored to 45°F, to ensure no significant boron precipitation occurred.

The time interval based Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.1.7.4 and SR 3.1.7.6 SR 3.1.7.4 verifies the continuity of the explosive charges in the injection valves to ensure proper operation will occur if required.

(continued)

GRAND GULF B 3.1-41 LBDCR 18127

SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.4 and SR 3.1.7.6 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.7.6 verifies each valve in the system is in its correct position, but does not apply to the squib (i.e., explosive) valves. Verifying the correct alignment for manual, power operated, and automatic valves in the SLC System flow path ensures that the proper flow paths will exist for system operation. A valve is also allowed to be in the nonaccident position, provided it can be aligned to the accident position from the control room, or locally by a dedicated operator at the valve controls. This is acceptable since the SLC System is a manually initiated system. This Surveillance does not apply to valves that are locked, sealed, or otherwise secured in position, since they were verified to be in the correct position prior to locking, sealing, or securing. This verification of valve alignment does not apply to valves that cannot be inadvertently misaligned, such as check valves. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct positions. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.1-42 LBDCR 18127

SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.7 REQUIREMENTS (continued) Demonstrating each SLC System pump develops a flow rate r 41.2 Jpm at a discharge pressure 1370 psig without actuating the pump's relief valve ensures that pump performance has not degraded during the fuel cycle. This minimum pump flow rate requirement ensures that, when combined with the sodium pentaborate solution concentration requirements, the rate of negative reactivity insertion from the SLC System will adequately compensate for the positive reactivity effects encountered during power reduction, cooldown of the moderator, and xenon decay. This test confirms one point on the pump design curve, and is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this Surveillance is in accordance with the INSERVICE TESTING PROGRAM.

SR 3.1.7.8 This Surveillance ensures that there is a functioning flow path from the boron solution storage tank to the RPV, including the firing of an explosive valve. The replacement charge for the explosive valve shall be from the same manufactured batch as the one fired or from another batch that has been certified by having one of that batch successfully fired.

Other administrative controls, such as those that limit the shelf life of the explosive charges, must be followed. The Surveillance may be performed in separate steps to prevent injecting boron into the RPV. An acceptable method for verifying flow from the pump to the RPV is to pump demineralized water from a test tank through one SLC subsystem and into the RPV. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.1-43 LBDCR 18127

SDV Vent and Drain Valves B 3.1.8 BASES ACTIONS C.1 (continued)

Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.1.8.1 REQUIREMENTS During normal operation, the SDV vent and drain valves should be in the open position (except when performing SR 3.1.8.2) to allow for drainage of the SDV piping. Verifying that each valve is in the open position ensures that the SDV vent and drain valves will perform their intended function during normal operation. This SR does not require any testing or valve manipulation; rather, it involves verification that the valves are in the correct position. The Surveillance Frequency are controlled under the Surveillance Frequency Control Program. Improper valve position (closed) would not affect the isolation function.

SR 3.1.8.2 During a scram, the SDV vent and drain valves should close to contain the reactor water discharged to the SDV piping. Cycling each valve through its complete range of motion (closed and open) ensures that the valve will function properly during a scram. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.1.8.3 SR 3.1.8.3 is an integrated test of the SDV vent and drain valves to verify total system performance. After receipt of a simulated or actual scram signal, the closure of the SDV vent and drain valves is verified. The closure time of 30 seconds after a receipt of a scram signal is based on the bounding leakage case evaluated in the accident analysis. Similarly, after receipt of a simulated or actual scram (continued)

GRAND GULF B 3.1-48 LBDCR 18127

SDV Vent and Drain Valves B 3.1.8 BASES SURVEILLANCE SR 3.1.8.3 (continued)

REQUIREMENTS reset signal, the opening of the SDV vent and drain valves is verified.

The LOGIC SYSTEM FUNCTIONAL TEST in LCO 3.3.1.1 and the scram time testing of control rods in LCO 3.1.3, "Control Rod OPERABILITY,"

overlap this Surveillance to provide complete testing of the assumed safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 4.6.1.1.2.4.2.6.

2. 10 CFR 50.67, Accident Source Term.

3. NUREG-0803, "Generic Safety Evaluation Report Regarding Integrity of BWR Scram System Piping," August 1981.

GRAND GULF B 3.1-49 LBDCR 18127

APLHGR B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.1 Average Planar Linear Heat Generation Rate (APLHGR)

BASES BACKGROUND The APLHGR is a measure of the average LHGR of all the fuel rods in a fuel assembly at any axial location. Limits on the APLHGR are specified to ensure that the fuel design limits identified in Reference 1 are not exceeded during anticipated operational occurrences (AOOs) and that the peak cladding temperature (PCT) during the postulated design basis loss of coolant accident (LOCA) does not exceed the limits specified in 10 CFR 50.46.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the fuel design limits are presented in the UFSAR, Chapters 4, 6, and 15, and in References 2 and 6. The analytical methods and assumptions used in evaluating Design Basis Accidents (DBAs), anticipated operational transients, and normal operations that determine APLHGR limits are presented in UFSAR, Chapters 4, 6, and 15, and in References 2, 3, 4 and 6.

Fuel design evaluations are performed to demonstrate that the 1% limit on the fuel cladding strain and other fuel design limits described in References 1 and 6 are not exceeded during AOOs for operation with LHGR up to the operating limit LHGR. APLHGR limits are developed as a function of exposure and, along with the LHGR limits, ensure adherence to fuel design limits during the limiting AOOs (Refs. 2 and 3).

LOCA analyses are performed to ensure that the above determined APLHGR limits are adequate to meet the PCT and maximum oxidation limits of 10 CFR 50.46. The analysis is performed using calculational models that are consistent with the requirements of 10 CFR 50, Appendix K. A discussion of the fuel vendor analysis codes is provided in References 5 and 6 for Siemens and GE, respectively. The PCT following a postulated LOCA is a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is not strongly influenced by the rod to rod power distribution within an assembly. The Siemens APLHGR limits specified are equivalent to the LHGR of the highest powered fuel rod assumed in the LOCA (continued)

GRAND GULF B 3.2-1 LBDCR 20026

APLHGR B 3.2.1 BASES (continued)

SURVEILLANCE SR 3.2.1.1 REQUIREMENTS APLHGRs are required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is t 21.8% RTP and periodically thereafter. They are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER t 21.8% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels. The time interval based Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 4.

2. UFSAR, Chapter 15, Appendix 15C.

3. UFSAR, Chapter 15, Appendix 15D.

4. XN-NF-80-19(P)(A), "Exxon Nuclear Methodology for Boiling Water Reactors, Neutronics Methods for Design and Analysis," Volume 1 (as supplemented).

5. XN-NF-80-19(A), "Exxon Nuclear Methodology for Boiling Water Reactors, ECCS Evaluation Model," Volume 2 (as supplemented).

6. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel (GESTAR)."

GRAND GULF B 3.2-4 LBDCR 18127

MCPR B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 Minimum Critical Power Ratio (MCPR)

BASES BACKGROUND MCPR is a ratio of the fuel assembly power that would result in the onset of boiling transition to the actual fuel assembly power. The operating limit MCPR is established to ensure that no fuel damage results during anticipated operational occurrences (AOOs) and that 99.9% of the fuel rods are not susceptible to boiling transition if the limit is not violated.

Although fuel damage does not necessarily occur if a fuel rod actually experiences boiling transition (Ref. 1), the critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion.

The onset of transition boiling is a phenomenon that is readily detected during the testing of various fuel bundle designs. Based on these experimental data, correlations have been developed to predict critical bundle power (i.e., the bundle power level at the onset of transition boiling) for a given set of plant parameters (e.g., reactor vessel pressure, flow, and subcooling). Because plant operating conditions and bundle power levels are monitored and determined relatively easily, monitoring the MCPR is a convenient way of ensuring that fuel failures due to inadequate cooling do not occur.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the AOOs to establish the operating limit MCPR are presented in the UFSAR, Chapters 4, 6, and 15, and References 2, 3, 4, and 5. To ensure that the MCPR Safety Limit (SL) is not exceeded during any transient event that occurs with moderate frequency, limiting transients have been analyzed to determine the largest reduction in critical power ratio (CPR).

The types of transients evaluated are loss of flow, increase in pressure and power, positive reactivity insertion, and coolant temperature decrease. The limiting transient yields the largest change in CPR (CPR). When the largest CPR is combined with the SLMCPR99.9%, the required operating limit MCPR is obtained.

MCPR99.9% is determined to ensure more than 99.9% of the fuel rods in the core are not susceptible to boiling transition using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the occurrence of boiling transition is determined using the approved Critical Power correlations. Details of the MCPR99.9% calculation are given in Reference 2. Reference 2 also includes a tabulation of the uncertainties and the nominal values of the parameters used in the MCPR99.9%

statistical analysis.

(continued)

GRAND GULF B 3.2-5 LBDCR 18129

MCPR B 3.2.2 BASES APPLICABLE The MCPR operating limits are derived from the MCPR99.9% value and SAFETY ANALYSES the transient analysis, and are dependent on the operating core flow (continued) and power state (MCPRf and MCPRp, respectively) to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency (Refs. 3, 4, and 5). Flow dependent MCPR limits are determined by steady state thermal hydraulic methods using the three dimensional BWR simulator code (Ref. 6) and the steady state thermal hydraulic code (Ref. 2). MCPRf curves are provided based on the maximum credible flow runout transient for Loop Manual operation. The result of a single failure or single operator error during Loop Manual operation is the runout of only one loop because both recirculation loops are under independent control.

Power dependent MCPR limits (MCPRp) are determined by approved transient analysis models. (Ref. 7). The MCPRp limits are established for a set of exposure intervals. The limiting transients are analyzed at the limiting exposure for each interval. Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which the turbine stop valve closure and turbine control valve fast closure scram trips are bypassed, high and low flow MCPRp operating limits are provided for operating between 21.8% RTP and the previously mentioned bypass power level.

The MCPR satisfies Criterion 2 of the NRC Policy Statement.

LCO The MCPR operating limits specified in the COLR MCPR99.9% value, MCPRf values, and MCPRp values are the result of the Design Basis Accident (DBA) and transient analysis. The MCPR operating limits are determined by the larger of the MCPRf and MCPRp limits, which are based on the MCPR99.9% limit specified in the COLR.

APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 21.8% RTP, the reactor is operating at a slow recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 21.8% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs.

(continued)

GRAND GULF B 3.2-6 LBDCR 18129

MCPR B 3.2.2 BASES (continued)

SURVEILLANCE SR 3.2.2.1 REQUIREMENTS The MCPR is required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is t 21.8% RTP and periodically thereafter. It is compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER reaches t 21.8% RTP is acceptable given the large inherent margin to operating limits at low power levels.

The time interval based Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.2.2.2 Because the transient analyses may take credit for conservatism in the control rod scram speed performance, it must be demonstrated that the specific scram speed distribution is consistent with that used in the transient analyses. SR 3.2.2.2 determines the actual scram speed distribution and compares it with the assumed distribution. The MCPR operating limit is then determined based either on the applicable limit associated with scram times of LCO 3.1.4, "Control Rod Scram Times," or the realistic scram times. The scram time dependent MCPR limits are contained in the COLR. This determination must be performed and any necessary changes must be implemented within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months after each set of control rod scram time tests required by SR 3.1.4.1, SR 3.1.4.2, and SR 3.1.4.4 because the effective scram speed distribution may change during the cycle or after maintenance that could affect scram times. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is acceptable due to the relatively minor changes in the actual control rod scram speed distribution expected during the fuel cycle.

REFERENCES 1. NUREG-0562, "Fuel Failures As A Consequence of Nucleate Boiling or Dry Out," June 1979.

2. NEDE-24011-P-A General Electric Standard Application for Reactor Fuel (GESTAR II).

3. UFSAR, Chapter 15, Appendix 15B.

4. UFSAR, Chapter 15, Appendix 15C.

(continued)

GRAND GULF B 3.2-8 LBDCR 18127

LHGR B 3.2.3 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 Linear Heat Generation Rate (LHGR)

BASES BACKGROUND The LHGR is a measure of the heat generation rate of a fuel rod in a fuel assembly at any axial location. Limits on the LHGR are specified to ensure that fuel design limits are not exceeded anywhere in the core during normal operation, including anticipated operational occurrences (AOOs). Exceeding the LHGR limit could potentially result in fuel damage and subsequent release of radioactive materials. Fuel design limits are specified to ensure that fuel system damage, fuel rod failure or inability to cool the fuel does not occur during the anticipated operating conditions identified in UFSAR Chapters 6 and 15.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the fuel system design are presented in the UFSAR, Chapters 4, 6, and 15, and in References 1 and 2. The fuel assembly is designed to ensure (in conjunction with the core nuclear and thermal hydraulic design, plant equipment, instrumentation, and protection system) that fuel damage will not result in the release of radioactive materials in excess of the guidelines of 10 CFR, Parts 20 and 50. The mechanisms that could cause fuel damage during operational transients and that are considered in fuel evaluations are:

a. Rupture of the fuel rod cladding caused by strain from the relative expansion of the UO2 pellet; and

b. Severe overheating of the fuel rod cladding caused by inadequate cooling.

A value of 1% strain of the fuel cladding has been defined as the limit below which fuel damage caused by overstraining of the fuel cladding is not expected to occur (Ref. 3).

Fuel design evaluations have been performed and demonstrate that the 1% fuel cladding strain design limit is not exceeded during continuous operation with LHGRs up to the (continued)

GRAND GULF B 3.2-9 LBDCR 20026

LHGR B 3.2.3 BASES ACTIONS A.1 (continued) restore the LHGR(s) to within its required limit(s) such that the plant is operating within analyzed conditions and within the design limits of the fuel rods. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is normally sufficient to restore the LHGR(s) to within its limit and is acceptable based on the low probability of a transient or Design Basis Accident occurring simultaneously with the LHGR out of specification.

B.1 If the LHGR cannot be restored to within its required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, THERMAL POWER must be reduced to < 21.8% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 21.8% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.3.1 REQUIREMENTS The LHGRs are required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is t 21.8% RTP and periodically thereafter. They are compared with the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after THERMAL POWER t 21.8% RTP is achieved is acceptable given the large inherent margin to operating limits at lower power levels. The time interval based Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 15.

2. UFSAR, Chapter 4.

3. NUREG-0800, "Standard Review Plan," Section 4.2, II.A.2(g),

Revision 2, July 1981.

GRAND GULF B 3.2-11 LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES BACKGROUND The RPS is comprised of two independent trip systems (A (continued) and B), with two logic channels in each trip system (logic channels A1 and A2, B1 and B2), as shown in Reference 1. The outputs of the logic channels in a trip system are combined in a one-out-of-two logic so either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram. This logic arrangement is referred to as one-out-of-two taken twice logic. Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for 10 seconds after the full scram signal is received. This 10 second delay on reset ensures that the scram function will be completed.

Two scram pilot valves are located in the hydraulic control unit (HCU) for each control rod drive (CRD). Each scram pilot valve is solenoid operated, with the solenoids normally energized. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram.

The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B. Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram.

The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS.

Additionally, the RPS System controls the SDV vent and drain valves such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV.

Application of TSTF-493, Rev. 4 (Ref. 17) to APRM Functions 2.a, 2.b, 2.d, 2.f; Function 9, Turbine Stop Valve Closure, and Function 10, Turbine Control Valve Fast Closure 10 CFR 50.36(c)(1)(ii)(A) requires that Technical Specifications include Limited Safety System Settings (LSSSs) for variables that have significant safety functions. LSSSs are defined by the regulation as

"...settings for automatic protective devices...so chosen that automatic protective actions will correct the abnormal situation before a safety limit is exceeded." The Analytical Limit is the limit of the process variable at (continued)

GRAND GULF B 3.3-2 LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES BACKGROUND which a protective action is initiated, as established by (continued) the safety analysis, to ensure that a safety limit (SL) is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit, therefore, ensures that the SL is not exceeded.

However, in practice, the actual settings for automatic protective channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.

The trip setpoint is a predetermined setting for a protection channel chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit, thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the channel (e.g., calibration) and uncertainties in how the channel might actually perform (e.g., repeatability), changes in the point of action of the channel over time (e.g., drift during surveillance intervals), and any other factors that may influence its actual performance (e.g., harsh accident environments). In this manner, the trip setpoint ensures that SLs are not exceeded.

Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...is capable of performing its specified safety function(s)." Relying solely on the trip setpoint to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as found" value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE because drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as found" setting of the protection channel.

Therefore, the channel would remain OPERABLE because it would have performed its safety function and the only corrective action required would be to reset the (continued)

GRAND GULF B 3.3-2a LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE environment errors (for channels that must function in harsh SAFETY ANALYSES, environments as defined by 10 CFR 50.49) are accounted for.

LCO, and APPLICABILITY The OPERABILITY of scram pilot valves and associated (continued) solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO.

The individual Functions are required to be OPERABLE in the MODES specified in the Table that may require an RPS trip to mitigate the consequences of a design basis accident or transient. To ensure a reliable scram function, a combination of Functions is required in each MODE to provide primary and diverse initiation signals.

RPS is required to be OPERABLE in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies.

Control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and therefore are not required to have the capability to scram. Provided all other control rods remain inserted, the RPS function is not required. In this condition, the required SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") and refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") ensure that no event requiring RPS will occur. During normal operation in MODES 3 and 4, all control rods are fully inserted and the Reactor Mode SwitchCShutdown Position control rod withdrawal block (LCO 3.3.2.1, "Control Rod Block Instrumentation") does not allow any control rod to be withdrawn. Under these conditions, the RPS function is not required to be OPERABLE.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Application of TSTF-493, Rev. 4 (Ref. 17) to APRM Functions 2.a, 2.b, 2.d, 2.f; Function 9, Turbine Stop Valve Closure; and Function 10, Turbine Control Valve Fast Closure Permissive and interlock setpoints allow blocking trips during plant startups, and restoring trips when the permissive conditions are not satisfied; however, they are not explicitly modeled in the safety analyses.

These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis before preventive or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy.

(continued)

GRAND GULF B 3.3-4 LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE The APRM subsystem is divided into four APRM/OPRM channels SAFETY ANALYSES, and four 2-Out-Of-4 Voter channels. Each APRM/OPRM channel LCO, and provides inputs to each of the four voter channels. The APPLICABILITY four voter channels are divided into two groups of two each, (continued) with each group of two providing inputs to one RPS trip system. The system is designed to allow one APRM/OPRM channel, but no voter channels, to be bypassed. A trip from any one un-bypassed APRM/OPRM channel will result in a half-trip" in all four of the voter channels, but no trip inputs to either RPS trip system. Since APRM Functions 2.a, 2.b, 2.d, and 2.f are implemented in the same hardware, these functions are combined with APRM Inop Function 2.c. Any Function 2.a, 2.b, 2.c, or 2.d trip from any two un-bypassed APRM/OPRM channels will result in a full trip in each of the four 2-Out-Of-4 Voter channels, which in turn results in two trip inputs to each RPS trip system logic channel (A1, A2, B1, and B2). Similarly, any Function 2.d or 2.f trip from any two un-bypassed APRM/OPRM channels will result in a full trip from each Voter channel. Three of the four APRM/OPRM channels and all four of the voter channels are required to be OPERABLE to ensure that no single failure will preclude a scram on a valid signal. In addition, to provide adequate coverage of the entire core, consistent with the design bases for APRM Functions 2.a, 2.b, and 2.d, at least 20 LPRM inputs, with at least three LPRM inputs from each of the four axial levels at which the LPRMs are located, must be operable for each APRM/OPRM channel. For the OPRM Upscale, Function 2.f, LPRMs are assigned to cells of four detectors. A minimum of 30 cells, each with a minimum of two LPRMs, must be OPERABLE for the OPRM Upscale Function 2.f to be OPERABLE. A total of 8 cells must be "responsive" in order for the OPRM Upscale Function 2.f to be OPERABLE. The number of "responsive" cells is defined as the number of operable cells (those having at least the minimum number of LPRMs), minus the number of "Cells Aligned Along the Instability Axis", minus the number of cells that are operable but have only D level operating LPRMs. The number of "Cells Aligned Along the Instability Axis" is defined in the COLR.

(continued)

GRAND GULF B 3.3-6a LBDCR 18136

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE 2.d. Average Power Range Monitor Flow Biased Simulated SAFETY ANALYSES, Thermal Power - High (continued)

LCO, and APPLICABILITY Each APRM channel uses one total drive flow signal (continued) representative of total core flow. The total drive flow signal is generated by processing logic, part of the APRM/OPRM channel, by summing up the flow calculated from two flow transmitter signal inputs, one from each of the two recirculation loop flows. The flow processing logic OPERABILITY is part of the APRM/OPRM channel OPERABILITY requirements for this Function.

The clamped Allowable Value is based on analyses that take credit for the APRM Simulated Thermal Power - High Function for mitigating the Loss of Feedwater Heating event. The THERMAL POWER time constant of < 6 seconds is based on the fuel heat transfer dynamics and provides a signal proportional to the THERMAL POWER.

The Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function is required to be OPERABLE in MODE 1 when there is the possibility of generating excessive THERMAL POWER and potentially exceeding the SL applicable to high pressure and core flow conditions (MCPR SL). During MODES 2 and 5, OTHER IRM and APRM Functions provide protection for fuel cladding integrity.

2.e 2-Out-Of-4 Voter The 2-Out-Of-4 Voter Function provides the interface between the APRM Functions, including the OPRM Upscale Function, and the final RPS trip system logic. As such, it is required to be OPERABLE in the MODES when the APRM Functions are required and is necessary to support the safety analysis applicable to each of those Functions. Therefore, the 2-Out-Of-4 Voter Function must be OPERABLE in MODES 1 and 2.

All four voter channels are required to be OPERABLE. Each voter channel includes self-diagnostic function. If any voter channel detects a critical fault in its own processing, a trip is issued from that voter channel to the associated trip system.

(continued)

GRAND GULF B 3.3-9d LBDCR 18136

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE The 2-Out-Of-4 Voter Function votes APRM Functions 2.a, 2.

SAFETY ANALYSES, b, and 2.d independently of Function 2.f. The voter also LCO, and includes separate outputs to RPS for the two independently APPLICABILITY voted sets of functions, each of which is redundant (four (continued) total outputs). Function 2.e must be declared inoperable if any of its functionality is inoperable. However, due to the independent voting of APRM trips, and the redundancy of outputs, there may be conditions where the voter function 2.e is inoperable, but trip capability for one or more of the other APRM Functions through that voter is still maintained. This may be considered when determining the condition of other APRM Functions resulting from partial inoperability of the Voter Function 2.e.

There is no Allowable Value for this Function.

2.f. Oscillation Power Range Monitor (OPRM) Upscale The OPRM Upscale trip function complies with GDC 10 and GDC 12, thereby providing protection from exceeding the fuel MCPR SL due to anticipated thermal- hydraulic power oscillations. This is accomplished by implementing the Detect and Suppress - Confirmation Density (DSS-CD) stability solution. DSS-CD introduces an enhanced detection algorithm, the Confirmation Density Algorithm (CDA) to the Option III stability solution, which reliably detects the inception of power oscillations and generates an early power suppression trip signal prior to any significant oscillation amplitude growth and MCPR degradation.

References 12 describes DSS-CD and licensing basis for the CDA. It also describes the DSS-CD Armed Region and the three additional algorithms for detecting thermal-hydraulic instability related neutron flux oscillations: (1) the period based detection algorithm (PBDA), (2) the amplitude based algorithm (ABA), and (3) the growth rate algorithm (GRA). All four algorithms are implemented in the OPRM Upscale trip function; however the safety analysis takes credit only for the CDA. The remaining three algorithms provide defense-in-depth and additional protection against unanticipated oscillations. OPRM Upscale trip function OPERABILITY is based only on the CDA.

The hardware design is unchanged from the Option III solution described in Reference 15 while the firmware/software is modified relative to Option III to reflect the CDA to the Option III algorithms.

The OPRM Upscale Function receives input signals from the LPRMs, which are combined into "cells" for evaluation by the OPRM algorithms.

DSS-CD operability requires at least eight responsive OPRM cells per channel.

(continued)

GRAND GULF B 3.3-9e LBDCR 18069

RPS Instrumentation B 3.3.1.1 BASES

SURVEILLANCE SR 3.3.1.1.1 and SR 3.3.1.1.19 REQUIREMENTS (continued) Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift on one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The agreement criteria include an expectation of overlap when transitioning between neutron flux instrumentation. The overlap between SRMs and IRMs must be demonstrated prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from SRMs to the IRMs. This will ensure that reactor power will not be increased into a neutron flux region without adequate indication. The overlap between IRMs and APRMs is of concern when reducing power into the IRM range.

On power increases, the system design will prevent further increases (by initiating a rod block) if adequate overlap is not maintained.

Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have on-scale readings such that the transition between MODE 1 and MODE 2 can be made without either APRM downscale rod block, or IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, prior to withdrawing the SRMs from the fully inserted position, IRMs are above 2/40 on range 1 before SRMs have reached the upscale rod block.

If overlap for a group of channels is not demonstrated (e.g., IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate channel(s) that are required in the current MODE or condition should be declared inoperable.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-23c LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES

SURVEILLANCE SR 3.3.1.1.2 REQUIREMENTS (continued) To ensure that the APRMs are accurately indicating the true core average power, the APRMs are calibrated to the reactor power calculated from a heat balance. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

A restriction to satisfying this SR when < 21.8% RTP is provided that requires the SR to be met only at 21.8% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POWER consistent with a heat balance when < 21.8% RTP. At low power levels, a high degree of accuracy is unnecessary because of the large inherent margin to thermal limits (MCPR and APLHGR). At 21.8% RTP, the Surveillance is required to have been satisfactorily performed in accordance with SR 3.0.2. A Note is provided which allows an increase in THERMAL POWER above 21.8% if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching or exceeding 21.8% RTP. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

SR 3.3.1.1.3 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

As noted, SR 3.3.1.1.3 is not required to be performed when entering MODE 2 from MODE 1 since testing of the MODE 2 required IRM and APRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This allows entry into MODE 2 if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MODE 2 from MODE 1.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

(continued)

GRAND GULF B 3.3-24 LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.3 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended Function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.5 and SR 3.3.1.1.6 Deleted (continued)

GRAND GULF B 3.3-25 LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.7 REQUIREMENTS (continued) LPRM gain settings are determined from the Core power distribution calculated by the Core Performance Monitoring system based on the local flux profiles measured by the Traversing Incore Probe (TIP) System.

Clean Page B 3.3-26This establishes the relative local flux profile for appropriate representative input to the APRM System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.8 and SR 3.3.1.1.11 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.8 for the designated function is modified by two Notes identified in Table 3.3.1.1.1. The first Note requires evaluation of channel performance for the condition where the as found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluating channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in channel performance prior to returning the channel to service.

Performance of these channels will be evaluated under the Corrective Action Program. Entry into the Corrective action Program ensures required review and documentation of the condition to establish a reasonable expectation for continued OPERABILITY.

The second Note requires that the as-left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP issued in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.

If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.

The second Note also requires the NTSP and the methodologies for calculating the as-left and the as-found tolerances to be in the Technical Requirements Manual.

(continued)

GRAND GULF B 3.3-26 LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.9 REQUIREMENTS (continued) The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.1.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.9 for the designated function is modified by two Notes identified in Table 3.3.1.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluating channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in channel performance prior to returning the channel to service.

Performance of these channels will be evaluated under the Corrective Action Program. Entry into the Corrective Action Program ensures required review and documentation of the condition to establish a reasonable expectation for continued OPERABILITY.

The second Note requires that the as-left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP issued in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.

If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.

The second Note also requires the NTSP and the methodologies for calculating the as-left and the as-found tolerances to be in the Technical Requirements Manual.

(continued)

GRAND GULF B 3.3-27 LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.10, SR 3.3.1.1.12 and SR 3.3.1.1.17 REQUIREMENTS A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

Note 1 states that neutron detectors are excluded from CHANNEL CALIBRATION because of the difficulty of simulating a meaningful signal.

Changes in neutron detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.1.2) and the LPRM calibration against the TIPs (SR 3.3.1.1.7). A second Note is provided that requires the APRM and IRM SRs to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1. Testing of the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads or movable links. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

Note 3 to SR 3.3.1.1.10 states that the APRM recirculation flow transmitters are excluded from CHANNEL CALIBRATION of Function 2.d, Average Power Range Monitor Flow Biased Simulated Thermal Power -

High.

SR 3.3.1.1.10 and SR 3.3.1.1.12 for the designated function is modified by two notes identified in Table 3.3.1.1-1. The first note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluating channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in channel performance prior to returning the channel to service. Performance of these channels will be evaluated under the Corrective Action Program. Entry into the Corrective Action Program ensures required review and documentation of the condition to establish a reasonable expectation for continued OPERABILITY.

(continued)

GRAND GULF B 3.3-27a LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.10, SR 3.3.1.1.12 and SR 3.3.1.1.17(continued)

REQUIREMENTS (continued)

The second note requires that the as-left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable. The second note also requires the NTSP and the methodologies for calculating the as-left and the as-found tolerances to be in the Technical Requirements Manual The only analog components involved with main signal processing are input isolation amplifiers (one per LPRM and one per flow input), a sample-and-hold circuit, and an analog-to-digital (A/D) converter. These analog components are highly reliable and very stable with virtually no drift. In addition, the sample-and-hold circuit and A/D converters are tested as part of the automatic self-test.

The processing hardware for the APRM Functions is digital and has no drift. One of the most sensitive signals, the flow processing, is automatically compared between channels. Any digital failures will be identified by the automatic self-test, CHANNEL CHECK, or in very rare cases by the CHANNEL FUNCTIONAL TEST.

The automatic self-test includes steps that check the performance and accuracy of the sample and hold circuits and the A/D converters, and the related processing. Self-test logic also periodically tests the input amplifiers and processing for accuracy. In addition, CHANNEL FUNCTIONAL TESTS include an automated "cal check" which will check the performance of all of the analog amplifiers and the entire processing loop.

The combined improvement justifies the factor-of-four increase in calibration interval, particularly in that the calibration will actually be checked at the CHANNEL FUNCTIONAL TEST and self-test frequencies.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-27b LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.13 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The functional testing of control rods, in LCO 3.1.3, "Control Rod OPERABILITY," and SDV vent and drain valves, in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlaps this Surveillance to provide complete testing of the assumed safety function.

The LOGIC SYSTEM FUNCTIONAL TEST for APRM Function 2.e simulates APRM and OPRM trip conditions at the 2-out-of-4 Voter channel inputs to check all combinations of two tripped inputs to the 2-out-of-4 logic in the voter channels and APRM related redundant RPS relays. The test is only required to include the voting logic of the 2-out-of-4 Voter channels and RPS relays not tested as part of the CHANNEL FUNCIONAL TEST.

The periodic LPRM calibrations provide an indirect test of LPRM interfaces including detectors. The design of the APRM/OPRM instrumentation allows virtually all testing and routine adjustments to be performed with no changes to the configuration (e.g., no disconnecting wires), so the risk of problems caused by the normal operation of the system is greatly reduced.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.14 This SR ensures that scrams initiated from the Turbine Stop Valve Closure, Trip Oil Pressure - Low and Turbine Control Valve Fast Closure, Trip Oil Pressure - Low Functions will not be inadvertently bypassed when THERMAL POWER is 35.4% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodology are incorporated into the actual setpoint.

If any bypass channel setpoint is nonconservative (i.e., the Functions are bypassed at 35.4% RTP, then the affected Turbine Stop Valve, Trip Oil Pressure - Low and Turbine Control Valve Fast Closure, Trip Oil Pressure

- Low Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel is considered OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-28 LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.15 (continued)

REQUIREMENTS RPS RESPONSE TIME for the APRM 2-Out-Of-4 Voter Function 2.e includes the output relays of the voter and the associated RPS relays and contactors. (The digital portion of the APRM and 2-Out-Of-4 Voter channels are excluded from RPS RESPONSE TIME testing because self-testing and calibration checks the time base of the digital electronics.

Confirmation of the time base is adequate to assure required response times are met. Neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time.) This test may be performed in one measurement or in overlapping segments, with verification that all associated components are tested.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.16 and SR 3.3.1.1.18 Deleted GRAND GULF B 3.3-29a LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES (continued)

SURVEILLANCE SR 3.3.1.1.20 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

For the APRM Functions, this test supplements the automatic self-test functions that operate continuously in the APRM/OPRM and voter channels. The CHANNEL FUNCTIONAL TEST covers the APRM/OPRM channels (including recirculation flow processing -- applicable to Function 2.b only), the 2-Out-Of-4 Voter channels, and the interface connections into the RPS trip systems from the voter channels. Any setpoint adjustment shall be consistent with the assumptions of the current plant-specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Note 1 is provided for APRM Function 2.a that requires this SR to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1. Testing the MODE 2 APRM Function cannot be performed in MODE 1 without utilizing jumpers or lifted leads. This note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2.

Note 2 is provided for APRM Functions 2.a, 2.b, and 2.c to clarify the APRM/OPRM channels and 2-Out-Of-4 Voter channels are included in the CHANNEL FUNCTIONAL TEST.

Note 3 is provided for APRM Functions 2.d and 2.f to clarify the APRM/OPRM channels and the 2-Out-Of-4 Voter channels plus the flow input function, excluding the flow transmitters, are included in the CHANNEL FUNCTIONAL TEST.

(continued)

GRAND GULF B 3.3-29b LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES (continued)

REFERENCES 1. UFSAR, Figure 7.2-1.

2. UFSAR, Section 5.2.2.

3. UFSAR, Section 6.3.3.

4. UFSAR, Chapter 15.

5. UFSAR, Section 15.4.1.

6. NEDO-23842, "Continuous Control Rod Withdrawal in the Startup Range," April 18, 1978.

7. UFSAR, Section 15.4.9.

(continued)

GRAND GULF B 3.3-29c LBDCR 18127

SRM Instrumentation B 3.3.1.2 BASES

SURVEILLANCE SR 3.3.1.2.1 and SR 3.3.1.2.3 (continued)

REQUIREMENTS gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.1.2.2 To provide adequate coverage of potential reactivity changes in the core, one SRM is required to be OPERABLE in the quadrant where CORE ALTERATIONS are being performed, and the other OPERABLE SRM must be in an adjacent quadrant containing fuel. Note 1 states that this SR is required to be met only during CORE ALTERATIONS. It is not required to be met at other times in MODE 5 since core reactivity changes are not occurring. This Surveillance consists of a review of plant logs to ensure that SRMs required to be OPERABLE for given CORE ALTERATIONS are, in fact, OPERABLE. In the event that only one SRM is required to be OPERABLE, per Table 3.3.1.2-1, footnote (b), only the

a. portion of this SR is required. Note 2 clarifies that more than one of the three requirements can be met by the same OPERABLE SRM. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-36 LBDCR 18127

SRM Instrumentation B 3.3.1.2 BASES

SURVEILLANCE SR 3.3.1.2.4 REQUIREMENTS (continued) This Surveillance consists of a verification of the SRM instrument readout to ensure that the SRM reading is greater than a specified minimum count rate. This ensures that the detectors are indicating count rates indicative of neutron flux levels within the core. Verification of the signal to noise ratio also ensures that the detectors are inserted to a normal operating level. In a fully withdrawn condition, the detectors are sufficiently removed from the fueled region of the core to essentially eliminate neutrons from reaching the detector. Any count rate obtained while fully withdrawn is assumed to be "noise" only. With few fuel assemblies loaded, the SRMs will not have a high enough count rate to satisfy the SR. Therefore, allowances are made for loading sufficient "source" material, in the form of irradiated fuel assemblies, to establish the minimum count rate.

To accomplish this, the SR is modified by a Note that states that the count rate is not required to be met on an SRM that has less than or equal to four fuel assemblies adjacent to the SRM and no other fuel assemblies are in the associated core quadrant. With four or less fuel assemblies loaded around each SRM and no other fuel assemblies in the associated quadrant, even with a control rod withdrawn the configuration will not be critical.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.2.5 Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated channel will function properly.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-37 LBDCR 18127

SRM Instrumentation B 3.3.1.2 BASES

SURVEILLANCE SR 3.3.1.2.5 (continued)

REQUIREMENTS The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.

SR 3.3.1.2.6 Performance of a CHANNEL CALIBRATION verifies the performance of the SRM detectors and associated circuitry. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The neutron detectors are excluded from the CHANNEL CALIBRATION because they cannot readily be adjusted. The detectors are fission chambers that are designed to have a relatively constant sensitivity over the range, and with an accuracy specified for a fixed useful life.

The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being (continued)

GRAND GULF B 3.3-38 LBDCR 18127

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.1, SR 3.3.2.1.2, SR 3.3.2.1.3, and REQUIREMENTS SR 3.3.2.1.4 (continued) control rod block occurs. Proper operation of the RWL is verified by SR 3.3.2.1.1 which verifies proper operation of the two-notch withdrawal limit and SR 3.3.2.1.2 which verifies proper operation of the four-notch withdrawal limit. Proper operation of the RPC is verified by SR 3.3.2.1.3 and SR 3.3.2.1.4. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. As noted, the SRs are not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after specified conditions are met (e.g., after any control rod is withdrawn in MODE 2). This allows entry into the appropriate conditions needed to perform the required SRs. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.5 The LPSP is the point at which the RPCS makes the transition between the function of the RPC and the RWL. This transition point is automatically varied as a function of power. This power level is derived from the power range neutron monitoring system (one channel to each trip system). These power setpoints must be verified periodically to be within the Allowable Values. If any LPSP is nonconservative, then the affected Functions are considered inoperable. Since this channel has both upper and lower required limits, it is not allowed to be placed in a condition to enable either the RPC or RWL Function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.6 This SR ensures the high power function of the RWL is not bypassed when power is above the HPSP. The analytical limit for the HPSP is 70%. The power level is derived from the power range neutron monitoring system. Periodic testing of the HPSP channels is required to verify the setpoint to be less than or equal to the limit. Adequate margins in accordance with setpoint methodologies are included. If the HPSP is nonconservative, then the RWL is considered inoperable. Alternatively, the HPSP can be placed in the conservative condition (nonbypass). If placed (continued)

GRAND GULF B 3.3-46 LBDCR 19098

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.6 (continued)

REQUIREMENTS in the nonbypassed condition, the SR is met and the RWL would not be considered inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.7 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.8 The CHANNEL FUNCTIONAL TEST for the Reactor Mode Switch C Shutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs.

As noted in the SR, the Surveillance is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable limits. This allows entry into MODES 3 and 4 if the Frequency is not met per SR 3.0.2.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-47 LBDCR 19098

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.9 REQUIREMENTS (continued) LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be bypassed in RACS to allow insertion of an inoperable control rod or correction of a control rod pattern not in compliance with BPWS. With the control rods bypassed in the RACS, the RPC will not control the movement of these bypassed control rods. Individual control rods may also be required to be bypassed to allow continuous withdrawal for determining the location of leaking fuel assemblies, adjustment of control rod speed, or control rod scram time testing. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator or other qualified member of the technical staff must verify the bypassing and movement of these control rods is in conformance with applicable analyses. As noted, only one bypassed control rod may be moved at a time. This restriction minimizes the potential rate of change of reactivity. Compliance with this SR allows the RPC and RWL to be OPERABLE with these control rods bypassed.

REFERENCES 1. UFSAR, Section 7.6.1.7.3.

2. UFSAR, Section 15.4.2.

3. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel" (latest approved revision).

4. "Modifications to the Requirements for Control Rod Drop Accident Mitigating Systems," BWR Owners Group, July 1986.

5. NEDO-21231, "Banked Position Withdrawal Sequence,"

January 1977.

6. NRC SER, Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17," December 27, 1987.

GRAND GULF B 3.3-48 LBDCR 18127

PAM Instrumentation B 3.3.3.1 BASES (continued)

ACTIONS A Note has been provided to modify the ACTIONS related to PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable PAM instrumentation channels provide appropriate compensatory measures for separate inoperable functions. As such, a Note has been provided that allows separate Condition entry for each inoperable PAM Function.

A.1 When one or more Functions have one required channel that is inoperable, the required inoperable channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel(s) (or in the case of a Function that has only one required channel, other non-Regulatory Guide 1.97 instrument channels to monitor the Function), the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.

B.1 If a channel has not been restored to OPERABLE status in 30 days, this Required Action specifies initiation of actions to prepare and submit a Special Report to the NRC. This report discusses the cause of the inoperability and identifies proposed restorative actions. The Special Report shall be submitted in accordance with 10 CFR 50.4 within 14 days of entering Condition B. This Action is appropriate in lieu of a (continued)

GRAND GULF B 3.3-57 LBDCR 19007

PAM Instrumentation B 3.3.3.1 BASES

ACTIONS E.1 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.

F.1 Since alternate means of monitoring primary containment area radiation have been developed and tested, the Required Action is not to shut down the plant but rather to initiate actions to prepare and submit a Special Report to the NRC. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels. The Special Report shall be submitted in accordance with 10CFR50.4 within 14 days of entering Condition F.

SURVEILLANCE The following SRs apply to each PAM instrumentation Function REQUIREMENTS in Table 3.3.3.1-1 except as noted below.

SR 3.3.3.1.1 Performance of the CHANNEL CHECK ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

The high radiation instrumentation should be compared to similar plant instruments located throughout the plant.

(continued)

GRAND GULF B 3.3-59 LBDCR 18127

PAM Instrumentation B 3.3.3.1 BASES

SURVEILLANCE SR 3.3.3.1.1 (continued)

REQUIREMENTS Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of those displays associated with the required channels of this LCO.

SR 3.3.3.1.2 Deleted SR 3.3.3.1.3 CHANNEL CALIBRATION is a complete check of the instrument loop including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

For Functions 12 and 13 the CHANNEL CALIBRATION consists of an electronic calibration of the channel, not including the detector, for range decades above 10R/hr and a one point calibration check of the detector below 10R/hr with an installed or portable gamma source. The neutron detectors are excluded from the CHANNEL CALIBRATION because they cannot readily be adjusted. The detectors are fission (continued)

GRAND GULF B 3.3-60 LBDCR 18127

Remote Shutdown System B 3.3.3.2 BASES ACTIONS A.1 (continued)

The Required Action is to restore the Function (both divisions, if applicable) to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.

B.1 If the Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.3.2.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized.

(continued)

GRAND GULF B 3.3-65 LBDCR 18127

Remote Shutdown System B 3.3.3.2 BASES SURVEILLANCE SR 3.3.3.2.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.2.2 SR 3.3.3.2.2 verifies each required Remote Shutdown System transfer switch and control circuit performs the intended function. This verification is performed from the remote shutdown panel and locally, as appropriate.

Operation of the equipment from the remote shutdown panel is not necessary. The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the plant can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations. However, this Surveillance is not required to be performed only during a plant outage.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.2.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies the channel responds to measured parameter values with the necessary range and accuracy.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.

GRAND GULF B 3.3-66 LBDCR 18127

EOC-RPT Instrumentation B 3.3.4.1 B 3.3 INSTRUMENTATION B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation BASES BACKGROUND The EOC-RPT instrumentation initiates a recirculation pump trip (RPT) to reduce the peak reactor pressure and power resulting from turbine trip or generator load rejection transients to provide additional margin to core thermal MCPR Safety Limits (SLs).

The need for the additional negative reactivity in excess of that normally inserted on a scram reflects end of cycle reactivity considerations. Flux shapes at the end of cycle are such that the control rods may not be able to ensure that thermal limits are maintained by inserting sufficient negative reactivity during the first few feet of rod travel upon a scram caused by Turbine Control Valve (TCV) Fast Closure, Trip Oil Pressure -

Low, or Turbine Stop Valve (TSV) Closure, Trip Oil Pressure - Low. The physical phenomenon involved is that the void reactivity feedback due to a pressurization transient can add positive reactivity at a faster rate than the control rods can add negative reactivity. The protection functions of the EOC-RPT have been designed to ensure safe operation of the reactor during load rejection transients. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the EOC-RPT, as well as LCOs on other system parameters and equipment performance.

Technical Specifications are required by 10 CFR 50.36 to include LSSSs for variables that have significant safety functions. LSSS are defined by the regulation as Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a SL is exceeded. The Analytical Limit is the limit of the process variable at which a protective action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.

(continued)

GRAND GULF B 3.3-67 LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

BACKGROUND The trip setpoint is a predetermined setting for a protection channel (continued) chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the channel (e.g., calibration), uncertainties in how the channel might actually perform (e.g., repeatability), changes in the point of action of the channel over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the trip setpoint ensures that SLs are not exceeded.

Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as is capable of performing its specified safety function(s). Relying solely on the NTSP to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE because drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the as-found setting of the protection channel.

Therefore, the channel would still remain OPERABLE because it would have performed its safety function and the only corrective action required would be to reset the channel within the established as-left tolerance around the trip setpoint to account for further drift during the next surveillance interval.

Although the channel is OPERABLE under these circumstances, the trip setpoint must be adjusted to a value within the as-left tolerance, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned (as-found criteria).

However, there is also some point beyond which the channel may not be able to perform its function due to, for example, greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the channels and is designated as the Allowable Value.

(continued)

GRAND GULF B 3.3-67a LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

BACKGROUND If the actual setting (as-found setpoint) of the channel is found to be (continued) conservative with respect to the Allowable Value, but is beyond the as found tolerance, the channel is OPERABLE, but degraded. The degraded condition will be further evaluated during performance of the SR. This evaluation will consist of resetting the channel setpoint to the trip setpoint (within the allowed tolerance) and evaluating the channel response. If the channel is functioning as required and expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.

The EOC-RPT instrumentation as discussed in Reference 1 is comprised of sensors that detect initiation of closure of the TSVs, or fast closure of the TCVs, combined with relays, logic circuits, and fast acting circuit breakers that interrupt the fast speed power supply to each of the recirculation pump motors. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an EOC-RPT signal to the trip logic.

When the EOC-RPT breakers trip open, the recirculation pumps downshift to slow speed. The EOC-RPT has two identical trip systems, either of which can actuate an RPT. The EOC-RPT function is met by the trip of the fast speed breakers. The slow speed breaker closure (down shift) does not have to occur to complete the EOC -RPT function.

Each EOC-RPT trip system is a two-out-of-two logic for each Function; thus, either two TSV Closure, Trip Oil Pressure - Low or two TCV Fast Closure, Trip Oil Pressure - Low signals are required for a trip system to actuate. If either trip system actuates, both recirculation pumps will trip from fast speed operation. There are two EOC-RPT breakers in series per recirculation pump. One trip GRAND GULF B 3.3-67b LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

BACKGROUND system trips one of the two EOC-RPT breakers for each (continued) recirculation pump and the second trip system trips the other EOC-RPT breaker for each recirculation pump.

APPLICABLE The TSV Closure, Trip Oil Pressure - Low and the TCV Fast SAFETY ANALYSES, Closure, Trip Oil Pressure C Low Functions are designed to LCO, and trip the recirculation pumps from fast speed operation in APPLICABILITY the event of a turbine trip or generator load rejection to mitigate the neutron flux, heat flux, and pressure transients, and to increase the margin to the MCPR SL. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that assume EOC-RPT, are summarized in References 2, 3, and 4.

To mitigate pressurization transient effects, the EOC-RPT must trip the recirculation pumps from fast speed operation after initiation of initial closure movement of either the TSVs or the TCVs. The combined effects of this trip and a scram reduce fuel bundle power more rapidly than does a scram alone, resulting in an increased margin to the MCPR SL.

Alternatively, MCPR limits for an inoperable EOC-RPT as specified in the COLR are sufficient to mitigate pressurization transient effects. The EOC-RPT function is automatically disabled when the power range neutron monitoring system indicates < 35.4% RTP.

EOC-RPT instrumentation satisfies Criterion 3 of the NRC Policy Statement.

Permissive and interlock setpoints allow the blocking of trips during plant startups, and restoration of trips when the permissive conditions are not satisfied, but they are not explicitly modeled in the Safety Analyses.

These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis, before preventive or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy.

The OPERABILITY of the EOC-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints set within the setting tolerance of the trip setpoint where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated EOC-RPT breakers. Each channel (including the associated EOC-RPT breakers) must also respond within its assumed response time.

(continued)

GRAND GULF B 3.3-68 LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

APPLICABLE Allowable Values are specified for each EOC-RPT Function SAFETY ANALYSES, specified in the Trip setpoints and the methodologies for calculation of LCO, and the as-left and as-found tolerances are described in the Technical APPLICABILITY Requirements Manual. The nominal setpoints are selected to ensure that (continued) the actual setponts remain conservative with respect to the as-found tolerance between successive CHANNEL CALIBRATIONS. After each calibration, the trip setpoints shall be left within the as-left band around the setpoint.

(continued)

GRAND GULF B 3.3-68a LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

APPLICABLE Trip setpoints are those predetermined values of output at SAFETY ANALYSES, which an action should take place. The setpoints are LCO, and compared to the actual process parameter (e.g., TSV position, and when APPLICABILITY the measured output value of the process parameter exceeds the (continued) setpoint, the associated device (e.g., trip unit) changes state. The analytical limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytical limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The specific Applicable Safety Analysis, LCO, and Applicability discussions are listed below on a Function by Function basis.

Alternatively, since this instrumentation protects against a MCPR SL violation with the instrumentation inoperable, modifications to the MCPR limits (LCO 3.2.2) may be applied to allow this LCO to be met. The MCPR penalty for the Condition EOC-RPT inoperable is specified in the COLR.

Turbine Stop Valve Closure, Trip Oil Pressure - Low Closure of the TSVs and a main turbine trip result in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, an EOC-RPT is initiated on TSV Closure, Trip Oil Pressure - Low in anticipation of the transients that would result from closure of these valves. EOC-RPT decreases reactor power and aids the reactor scram in ensuring the MCPR SL is not exceeded during the worst case transient.

Closure of the TSVs is determined by measuring the EHC fluid pressure at each stop valve. There is one pressure (continued)

GRAND GULF B 3.3-69 LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

SURVEILLANCE SR 3.3.4.1.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each required channel (continued) to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.2 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.4.1.3. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is conservative with respect to the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

SR 3.3.4.1.2 is modified by two Notes in the SR table. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. The second Note requires that the as-left setting for the channel be within the as-left tolerance of the NTSP. Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as left tolerance of the NTSP, then the channel shall be declared inoperable. The second Note also requires that NTSP and the methodologies for calculating the as-left and the as-found tolerances be in the Technical Requirements Manual.

7KH6XUYHLOODQFH)HTXHQF\LVFRQWUROOHGXQGHUWKH6XUYHLOODQFH

)UHTXHQF\&RQWURO3URJUDP.

(continued)

GRAND GULF B 3.3-74 LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

SR 3.3.4.1.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

SR 3.3.4.1.3 is modified by two Notes in the SR table. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. The second Note requires that the as-left setting for the channel be within the as-left tolerance of the NTSP. Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as left tolerance of the NTSP, then the channel shall be declared inoperable. The second Note also requires that NTSP and the methodologies for calculating the as-left and the as-found tolerances be in the Technical Requirements Manual.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-74a LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

SURVEILLANCE SR 3.3.4.1.4 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel would also be inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.5 This SR ensures that an EOC-RPT initiated from the TSV Closure, Trip Oil Pressure - Low and TCV Fast Closure, Trip Oil Pressure - Low Functions will not be inadvertently bypassed when THERMAL POWER is 35.4% RTP. This involves calibration of the bypass channels.

Adequate margins for the instrument setpoint methodologies are incorporated into the actual setpoint. If any bypass channel's setpoint is nonconservative (i.e., the Functions are bypassed at 35.4% RTP), the affected TSV Closure, Trip Oil Pressure - Low and TCV Fast Closure, Trip Oil Pressure - Low Functions are considered inoperable.

Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel considered OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-75 LBDCR 18127

EOC-RPT Instrumentation B 3.3.4.1 BASES

SURVEILLANCE SR 3.3.4.1.6 REQUIREMENTS (continued) This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The EOC-RPT SYSTEM RESPONSE TIME acceptance criteria are included in the applicable plant procedures.

A Note to the Surveillance states that breaker interruption time may be assumed from the most recent performance of SR 3.3.4.1.7. This is allowed since the time to open the contacts after energization of the trip coil and the arc suppression time are short and do not appreciably change, due to the design of the breaker opening device and the fact that the breaker is not routinely cycled.

Response times cannot be determined at power because operation of final actuated devices is required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.7 This SR ensures that the RPT breaker interruption time is provided to the EOC-RPT SYSTEM RESPONSE TIME test. Breaker Interruption time is defined as Breaker Response time plus Arc Suppression time. Breaker Response is the time from application of voltage to the trip coil until the main contacts separate. Arc Suppression is the time from main contact separation until the complete suppression of the electrical arc across the open contacts. Breaker Response shall be verified by testing and added to the manufacturer's design Arc Suppression time of 12 ms to determine Breaker Interruption time. The breaker arc suppression time shall be validated by the performance of periodic contact gap (continued)

GRAND GULF B 3.3-76 LBDCR 18127

EOC-RPT Instrumentation B 3.3.4.1 BASES

SURVEILLANCE SR 3.3.4.1.7 (continued)

REQUIREMENTS measurements and high potential tests on the breaker vacuum interrupters in accordance with plant procedures. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 7.6.1.8.

2. UFSAR, Section 5.2.2.

3. UFSAR, Sections 15.1.2 and 15.1.3.

4. UFSAR, Sections 15.2.2, 15.2.3 and 15.2.5.

5. GENE-770-06-1, "Bases for Changes To Surveillance Test Intervals And Allowed Out-Of-Service Times For Selected Instrumentation Technical Specifications," February 1991.

GRAND GULF B 3.3-77 LBDCR 18127

ATWS-RPT Instrumentation B 3.3.4.2 BASES

ACTIONS D.1 and D.2 (continued) recirculation pump may be removed from service since this performs the intended Function of the instrumentation (Required Action D.1). The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, both to reach MODE 2 from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems.

SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains ATWS-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary.

SR 3.3.4.2.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is (continued)

GRAND GULF B 3.3-84 LBDCR 18127

ATWS-RPT Instrumentation B 3.3.4.2 BASES

SURVEILLANCE SR 3.3.4.2.1 (continued)

REQUIREMENTS outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of this LCO.

SR 3.3.4.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.2.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.4.2.4. If the trip setting is discovered to be less conservative than the setting accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-85 LBDCR 18127

ATWS-RPT Instrumentation B 3.3.4.2 BASES

SURVEILLANCE SR 3.3.4.2.4 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers, included as part of this Surveillance, overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel(s) would be inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 5.4.1.7.10.

2. NEDE-770-06-1, "Bases For Changes To Surveillance Test Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications," February 1991.

GRAND GULF B 3.3-86 LBDCR 18127

ECCS Instrumentation B 3.3.5.1 BASES BACKGROUND Diesel Generators (continued)

Feature (ESF) buses if a loss of offsite power occurs. (Refer to Bases for LCO 3.3.8.1.)

APPLICABLE The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES, analyses of References 1, 2, and 3. The ECCS is initiated LCO, and to preserve the integrity of the fuel cladding by limiting APPLICABILITY the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of the NRC Policy Statement.

Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints set within the setting tolerances of the trip setpoint, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each ECCS subsystem must also respond within its assumed response time. Allowable Values are specified for each ECCS Function specified in Table 3.3.5.1-1. For Function 3.d, Condensate Storage Tank Level- Low, the nominal trip setpoint and methodologies for calculation of the as-left and as-found tolerances are described in the Technical Requirements Manual. The trip setpoints are selected to ensure that the setpoints remain conservative to the as-left tolerance band between CHANNEL CALIBRATIONS. After each calibration the trip setpoint shall be left within the as-left band around the nominal trip setpoint. Table 3.3.5.1-1 is modified by a footnote which is added to show that certain ECCS instrumentation Functions also perform DG initiation.

Nominal trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of (continued)

GRAND GULF B 3.3-93 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE the process parameter exceeds the setpoint, the associated SAFETY ANALYSES, device (e.g., trip unit) changes state. The analytical LCO, and limits are derived from the limiting values of the process APPLICABILITY parameters obtained from the safety analysis. The Allowable (continued) Values are derived from the analytical limits, corrected for calibration, process, and some of the instrument errors. The nominal trip setpoints are then determined, accounting for the remaining instrument errors (e.g.,

drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis accident or transient. To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals.

Functions 1.a, 2.a, and 3.a initiate automatic ECCS injection on low water level. A draining event is a slow evolution when compared to a design basis LOCA assumed to occur at full power, and thus there is adequate time to take manual actions (hours versus minutes). TS 3.5.2, Action E, prohibits plant conditions that could result in Drain Times less than one hour. Therefore, there is sufficient time for the licensed operators to take manual action to stop the draining event, and to manually start an ECCS injection/spray subsystem or the additional method of water injection.

Consequently, there is no need for automatic initiation of ECCS to respond to an unexpected draining event in Mode 4 or 5. Automatic initiation of an ECCS injection/spray subsystem, with injection rates of thousands of gpm, may be undesirable as it can lead to overflowing the RPV cavity.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Low Pressure Core Spray and Low Pressure Coolant Injection Systems 1.a, 2.a. Reactor Vessel Water Level- Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. The low pressure ECCS and associated DGs are initiated at Level 1 to ensure that core spray and flooding GRAND GULF B 3.3-94 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 1.a, 2.a. Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY functions are available to prevent or minimize fuel damage. The Reactor Vessel Water Level - Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients and accidents analyzed in References 1, 2, and 3. The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level -Low Low Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level -Low Low Low, Level 1 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling.

Two channels of Reactor Vessel Water Level -Low Low Low, Level 1 Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE, to ensure that no single instrument failure can preclude ECCS initiation. (Two channels input to LPCS and LPCI A, while the other two channels input to LPCI B and LPCI C.)

1.b, 2.b. Drywell Pressure-High High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The low pressure ECCS and associated DGs are initiated upon receipt of the Drywell Pressure - High Function in order to minimize the possibility of fuel damage. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.

Negative barometric fluctuations are accounted for in the Allowable Value.

(continued)

GRAND GULF B 3.3-95 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 1.b, 2.b. Drywell Pressure - High (continued)

SAFETY ANALYSES, LCO, and The Drywell Pressure - High Function is required to be APPLICABILITY OPERABLE when the associated ECCS and DGs are required to be OPERABLE in conjunction with times when the primary containment is required to be OPERABLE. Thus, four channels of the LPCS and LPCI Drywell Pressure - High Function are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude ECCS initiation. (Two channels input to LPCS and LPCI A, while the other two channels input to LPCI B and LPCI C.) In MODES 4 and 5, the Drywell Pressure - High Function is not required since there is insufficient energy in the reactor to pressurize the primary containment to Drywell Pressure - High setpoint.

Refer to LCO 3.5.1 for Applicability Bases for the low pressure ECCS subsystems and to LCO 3.8.1 for Applicability Bases for the DGs.

1.c, 2.c. Low Pressure Coolant Injection Pump A and Pump B Start - Time Delay Relay The purpose of this time delay is to stagger the start of the two ECCS pumps that are in each of Divisions 1 and 2, thus limiting the starting transients on the 4.16 kV emergency buses. This Function is only necessary when power is being supplied from the standby power sources (DG). However, since the time delay does not degrade ECCS operation, it remains in the pump start logic at all times. The LPCI Pump Start - Time Delay Relays are assumed to be OPERABLE in the accident and transient analyses requiring ECCS initiation. That is, the analysis assumes that the pumps will initiate when required.

There are two LPCI Pump Start - Time Delay Relays, one in each of the RHR "A" and RHR "B" pump start logic circuits. The Allowable Value for the LPCI Pump Start - Time Delay Relay is chosen to be short enough so that ECCS operation is not degraded.

Each LPCI Pump Start - Time Delay Relay Function is only required to be OPERABLE when the associated LPCI subsystem is required to be OPERABLE.

(continued)

GRAND GULF B 3.3-96 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 1.d, 2.d. Reactor Vessel Pressure - Low (Injection SAFETY ANALYSES, Permissive)

LCO, and APPLICABILITY Low reactor vessel pressure signals are used as permissives (continued) for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. The Reactor Vessel Pressure - Low is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Vessel Pressure - Low Function is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Vessel Pressure - Low signals are initiated from four pressure transmitters that sense the reactor pressure. The four pressure transmitters each drive a master and slave trip unit (for a total of eight trip units).

The Allowable Value is low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46.

Three channels of Reactor Vessel Pressure - Low Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude ECCS initiation. (Three channels are required for LPCS and LPCI A, while three other channels are required for LPCI B and LPCI C.).

(continued)

GRAND GULF B 3.3-97 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 1.g, 2.f. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and instrumentation. There is one push button for each of the APPLICABILITY two Divisions of low pressure ECCS (i.e., Division 1 ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI B and LPCI C).

The Manual Initiation Function is not assumed in any accident or transient analyses in the UFSAR. However, the Function is retained for the low pressure ECCS function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. Each channel of the Manual Initiation Function (one channel per Division) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE.

High Pressure Core Spray System 3.a. Reactor Vessel Water Level - Low Low, Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the HPCS System and associated DG are initiated at Level 2, after a confirmation delay permissive to maintain level above the top of the active fuel.

A nominal 1/2 second confirmation delay permissive is installed to avoid spurious system initiation signals. This confirmation delay permissive is limited to a maximum of a 1 second delay to support the HPCS System response time of 32 seconds assumed in the accident analysis. To insure that the confirmation delay permissive does not drift excessively it is calibrated as part of the CHANNEL FUNCTIONAL TEST required for this Function by SR 3.3.5.1.2.

The Reactor Vessel Water Level - Low Low, Level 2 is one of the Functions assumed to be OPERABLE and capable of initiating HPCS during the transients and accidents, analyzed in References 1, 2, (continued)

GRAND GULF B 3.3-99 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 3.d. Condensate Storage Tank Level - Low (continued)

SAFETY ANALYSES, LCO, and HPCS injection would be taken from the CST. However, if the APPLICABILITY water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens, and then the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the HPCS pump.

To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes. The Function is implicitly assumed in the accident and transient analyses (which take credit for HPCS) since the analyses assume that the HPCS suction source is the suppression pool.

Condensate Storage Tank Level - Low signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated trip unit can cause the suppression pool suction valve to open and the CST suction valve to close. The Condensate Storage Tank Level - Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the CST.

Two channels of the Condensate Storage Tank Level - Low Function are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS swap to suppression pool source. Thus, the Function is required to be OPERABLE in MODES 1, 2, and 3.

In MODES 4 and 5, the Function is required to be OPERABLE only when HPCS is required to be OPERABLE to fulfill the requirements of LCO 3.5.2, HPCS is aligned to the CST and the CST water level is not within the limits of SR 3.5.2.3. With CST water level within limits, a sufficient supply of water exists for injection to minimize the consequences of a vessel draindown event. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.

3.e. Suppression Pool Water LevelHigh Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the S/RVs. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of HPCS from the CST to the suppression pool (continued)

GRAND GULF B 3.3-102 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 3.h. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and if required (i.e., if the water level reaches the low water APPLICABILITY level initiation setpoint).

The Manual Initiation Function is not assumed in any accident or transient analysis in the UFSAR. However, the Function is retained for the HPCS function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button. One channel of the Manual Initiation Function is only required to be OPERABLE when the HPCS System is required to be OPERABLE.

Automatic Depressurization System 4.a, 5.a. Reactor Vessel Water Level - Low Low Low, Level 1 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, ADS receives one of the signals necessary for initiation from this Function. The Reactor Vessel Water Level - Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ADS during the accidents analyzed in Reference 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level - Low Low Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Low Low, Level 1 Function are only required to be OPERABLE when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (Two channels input to ADS trip system A while the other two channels input to ADS trip system B). Refer to LCO 3.5.1 for ADS Applicability Bases.

(continued)

GRAND GULF B 3.3-105 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

ACTIONS B.1, B.2, and B.3 (continued) untripped, and the Completion Times started concurrently for the channels in both Divisions, this results in the affected portions in both Divisions of ECCS and DG being concurrently declared inoperable.

For Required Action B.2, redundant automatic initiation capability is lost if two Function 3.a or two Function 3.b channels are inoperable and untripped in the same trip system. In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Notes are provided (the Note to Required Action B.1 and Required Action B.2) to delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable. This ensures that the proper loss of initiation capability check is performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in both Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable, untripped channels within the same variable as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCS System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

(continued)

GRAND GULF B 3.3-111 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

ACTIONS C.1 and C.2 (continued) and LPCI B, respectively. For Functions 1.d and 2.d, the affected portions of the Division are the low pressure ECCS pumps (Divisions 1 and 2, respectively).

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The Note states that Required Action C.1 is only applicable for Functions 1.c, 1.d, 2.c, and 2.d. The Required Action is not applicable to Functions 1.g, 2.f, and 3.h (which also require entry into this Condition if a channel in these Functions is inoperable), since they are the Manual Initiation Functions and are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action C.2) is allowed. Required Action C.1 is also not applicable to Function 3.c (which also requires entry into this Condition if a channel in this Function is inoperable), since the loss of one channel results in a loss of the Function (two-out-of-two logic). This loss was considered during the development of Reference 4 and considered acceptable for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed by Required Action C.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable channels within the same variable as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

(continued)

GRAND GULF B 3.3-113 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

ACTIONS E.1 and E.2 (continued)

In this situation (loss of redundant automatic initiation capability), the 7 day allowance of Required Action E.2 is not appropriate and the feature(s) associated with each inoperable channel must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of initiation capability for feature(s) in both Divisions. A Note is provided (the Note to Required Action E.1) to delineate that Required Action E.1 is only applicable to low pressure ECCS Functions. Required Action E.1 is not applicable to HPCS Functions 3.f and 3.g since the loss of one channel results in a loss of the Function (one-out-of-one logic). This loss was considered during the development of Reference 4 and considered acceptable for the 7 days allowed by Required Action E.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action E.1, the Completion Time only begins upon discovery that three channels of the variable (Pump Discharge Flow Low) cannot be automatically initiated due to inoperable channels. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

If the instrumentation that controls the pump minimum flow valve is inoperable such that the valve will not automatically open, extended pump operation with no injection path available could lead to pump overheating and failure. If there were a failure of the instrumentation such that the valve would not automatically close, a portion of the pump flow could be diverted from the reactor injection path, causing insufficient core cooling.

These consequences can be averted by the operator's manual control of the valve, which would be adequate to maintain ECCS pump (continued)

GRAND GULF B 3.3-116 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

SURVEILLANCE SR 3.3.5.1.1 REQUIREMENTS (continued) Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.5.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The required setpoint adjustments include a calibration of the HPCS Reactor Vessel Water Level - Low Low, Level 2 Function confirmation delay permissive.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-121 LBDCR 18127

ECCS Instrumentation B 3.3.5.1 BASES

SURVEILLANCE SR 3.3.5.1.3 REQUIREMENTS (continued) The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be not within its required Allowable Value specified in Table 3.3.5.1-1.

If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analyses. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than the setting accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.1.3 for Function 3.d, Condensate Storage Tank Level -Low, is modified by two Notes as identified in Table 3.3.5.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.

The second Note applied to SR 3.3.5.1.3 for Function 3.d, Condensate Storage Tank Level -Low, requires that the as- left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP).

Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the (continued)

GRAND GULF B 3.3-122 LBDCR 18127

ECCS Instrumentation B 3.3.5.1 BASES

SURVEILLANCE SR 3.3.5.1.3 (continued)

REQUIREMENTS NTSP, then the channel shall be declared inoperable. The second Note also requires that NTSP and the methodologies for calculating the as-left and the as-found tolerances be in the TRM.

SR 3.3.5.1.4 and SR 3.3.5.1.5 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.5.1.5 for Function 3.d, Condensate Storage Tank Level-Low, is modified by two Notes as identified in Table 3.3.5.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.

The second Note applied to SR 3.3.5.1.5 for Function 3.d, Condensate Storage Tank Level -Low, requires that the as- left setting for the channel be within the as-left tolerance of the NTSP. Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as- left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical (continued)

GRAND GULF B 3.3-122a LBDCR 18127

ECCS Instrumentation B 3.3.5.1 BASES

SURVEILLANCE SR 3.3.5.1.6 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.1, LCO 3.5.2, LCO 3.8.1, and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 5.2.

2. UFSAR, Section 6.3.

3. UFSAR, Chapter 15.

4. NEDC-30936-P-A, "BWR Owners' Group Technical Specification Improvement Analyses for ECCS Actuation Instrumentation, Part 2," December 1988.

5. Regulatory Guide 1.105, Setpoints for Safety-Related Instrumentation, Revision 3.

GRAND GULF B 3.3-123 LBDCR 18127

RPV Water Inventory Control Instrumentation B 3.3.5.2 B 3.3 INSTRUMENTATION B 3.3.5.2 Reactor Pressure Vessel (RPV) Water Inventory Control Instrumentation BASES BACKGROUND The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF.

If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to prevent such elevated cladding temperatures.

Technical Specifications are required by 10 CFR 50.36 to include limiting safety system settings (LSSS) for variables that have significant safety functions. LSSS are defined by the regulation as "Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the process variable at which a safety action is initiated to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur. The actual settings for the automatic isolation channels are the same as those established for the same functions in MODES 1, 2, and 3 in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS)

Instrumentation," or LCO 3.3.6.1, "Primary Containment and Drywell Isolation Instrumentation".

With the unit in MODE 4 or 5, RPV water inventory control is not required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur. Under the definition of DRAIN TIME, some penetration flow paths may be excluded from the DRAIN TIME calculation if they will be isolated by valves that will close automatically without offsite power prior to the RPV water level being equal to the TAF when actuated by RPV water level isolation instrumentation.

GRAND GULF B 3.3-124 LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES BACKGROUND (continued)

The purpose of the RPV Water Inventory Control Instrumentation is to support the requirements of LCO 3.5.2, "Reactor Pressure Vessel (RPV)

Water Inventory Control," and the definition of DRAIN TIME. There are functions that are required for manual initiation or operation of the ECCS injection/spray subsystem required to be OPERABLE by LCO 3.5.2 and other functions that support automatic isolation of Residual Heat Removal subsystem and Reactor Water Cleanup system penetration flow path(s) on low RPV water level.

The RPV Water Inventory Control Instrumentation supports operation of low pressure core spray (LPCS), low pressure coolant injection (LPCI),

and high pressure core spray (HPCS). The equipment involved with each of these systems is described in the Bases for LCO 3.5.2.

APPLICABLE With the unit in MODE 4 or 5, RPV water inventory control is not required SAFETY to mitigate any events or accidents evaluated in the safety analyses. RPV ANALYSES, LCO, water inventory control is required in MODES 4 and 5 to protect Safety and APPLICABILITY Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur.

A double-ended guillotine break of the Reactor Coolant System (RCS) is not postulated in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is postulated in which a single operator error or initiating event allows draining of the RPV water inventory through a single penetration flow path with the highest flow rate, or the sum of the drain rates through multiple penetration flow paths susceptible to a common mode failure (e.g.,

seismic event, loss of normal power, single human error). It is assumed, based on engineering judgment, that while in MODES 4 and 5, one ECCS injection/spray subsystem can be manually initiated to maintain adequate reactor vessel water level.

As discussed in References 1, 2, 3, 4, and 5, operating experience has shown RPV water inventory to be significant to public health and safety.

Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

Permissive and interlock setpoints are generally considered as nominal values without regard to measurement accuracy.

GRAND GULF B 3.3-124a LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Low Pressure Core Spray and Low Pressure Coolant Injection Systems 1.a, 2.a. Reactor Vessel Pressure - Low (Injection Permissive)

Low reactor vessel pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. While it is assured during Modes 4 and 5 that the reactor vessel pressure will be below the ECCS maximum design pressure, the Reactor Vessel Pressure - Low signals are assumed to be operable and capable of permitting initiation of the ECCS.

The Reactor Vessel Pressure - Low signals are initiated from four pressure transmitters that sense the reactor vessel pressure. The four pressure transmitters each drive a master and slave trip unit. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic for each Division.

The Allowable Value is low enough to prevent overpressuring the equipment in the low pressure ECCS.

Three channels of Reactor Vessel Pressure - Low Function per associated ECCS Division are only required to be OPERABLE in MODES 4 and 5 when ECCS Manual Initiation is required to be OPERABLE, since these channels support the manual initiation Function. In addition, the channels are only required when the associated ECCS subsystem is required to be OPERABLE by LCO 3.5.2.

1.b, 1.c, 2.b. Low Pressure Coolant Injection and Low Pressure Core Spray Pump Discharge Flow - Low (Bypass)

The minimum flow instruments are provided to protect the associated low pressure ECCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump.

One flow transmitter per ECCS pump is used to detect the associated subsystems' flow rates. The logic is arranged such that each transmitter causes its associated minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is exceeded. The LPCI minimum flow valves are time delayed such that the valves will not open for 10 seconds after the switches detect low flow. The time delay is provided to limit reactor vessel inventory loss during the startup of the Residual Heat Removal (RHR) shutdown cooling mode (for RHR A and RHR B).

GRAND GULF B 3.3-124b LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The Pump Discharge Flow - Low Allowable Values are high enough to ensure that the pump flow rate is sufficient to protect the pump.

One channel of the Pump Discharge Flow - Low Function is required to be OPERABLE in MODES 4 and 5 when the associated LPCS or LPCI pump is required to be OPERABLE by LCO 3.5.2 to ensure the pumps are capable of injecting into the Reactor Pressure Vessel when manually initiated.

1.d, 2.c. Manual Initiation The Manual Initiation push button channels introduce signals into the appropriate ECCS logic to provide manual initiation capability. There is one push button for each of the two Divisions of low pressure ECCS (i.e.,

Division 1 ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI B and LPCI C). The only manual initiation function required to be OPERABLE is that associated with the ECCS subsystem required to be OPERABLE by LCO 3.5.2.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

High Pressure Core Spray System 3 .a. Condensate Storage Tank Level - Low Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source. Normally the suction valves between HPCS and the CST are open and water for HPCS injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens, and then the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the HPCS pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.

Condensate Storage Tank Level - Low signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated trip unit can cause the suppression pool suction valve to open and the CST suction valve to close.

The Condensate Storage Tank Level - Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the CST.

One channel of the Condensate Storage Tank Level - Low Function is only required to be OPERABLE when HPCS is required to be OPERABLE to fulfill the requirements of LCO 3.5.2 and HPCS is aligned to the CST.

GRAND GULF B 3.3-124c LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 3.b, 3.c. HPCS Pump Discharge Pressure - High (Bypass) and HPCS System Flow Rate - Low (Bypass)

The minimum flow instruments are provided to protect the HPCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow and high pump discharge pressure are sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump or the discharge pressure is low (indicating the HPCS pump is not operating).

One flow transmitter is used to detect the HPCS System's flow rate. The logic is arranged such that the transmitter causes the minimum flow valve to open, provided the HPCS pump discharge pressure, sensed by another transmitter, is high enough (indicating the pump is operating).

The logic will close the minimum flow valve once the closure setpoint is exceeded. (The valve will also close upon HPCS pump discharge pressure decreasing below the setpoint.)

The HPCS System Flow Rate - Low and HPCS Pump Discharge Pressure - High Allowable Value is high enough to ensure that pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core.

The HPCS Pump Discharge Pressure - High Allowable Value is set high enough to ensure that the valve will not be open when the pump is not operating.

One channel of each Function associated with one pump is required to be OPERABLE when HPCS is required to be OPERABLE by LCO 3.5.2 in MODES 4 and 5.

RHR System Isolation 4.a - Reactor Vessel Water Level - Low. Level 3 The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level - Low, Level 3 Function is only required to be OPERABLE when automatic isolation of the associated RHR penetration flow path is credited in calculating DRAIN TIME.

Reactor Vessel Water Level - Low, Level 3 signals are initiated from four level transmitters (two per trip system) that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. While four channels (two channels per trip system) of the Reactor Vessel Water GRAND GULF B 3.3-124d LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Level - Low, Level 3 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.

The Reactor Vessel Water Level - Low, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low, Level 3 Allowable Value (LCO 3.3.1.1), since the capability to cool the fuel may be threatened.

This Function isolates the Group 3 valves.

Reactor Water Cleanup (RWCU) System Isolation 5 .a - Reactor Vessel Water level - Low Low, Level 2 The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level - Low Low, Level 2 Function associated with RWCU System isolation may be credited for automatic isolation of penetration flow paths associated with the RWCU System.

Reactor Vessel Water Level - Low Low, Level 2 is initiated from two channels per trip system that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. While four channels (two channels per trip system) of the Reactor Vessel Water Level - Low, Level 2 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low, Level 2 Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level - Low Low, Level 2 Function is only required to be OPERABLE when automatic isolation of the associated penetration flow path is credited in calculating DRAIN TIME.

This Function isolates the Group 8 valves.

ACTIONS A Note has been provided to modify the ACTIONS related to RPV Water Inventory Control instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPV Water Inventory Control instrumentation channels provide appropriate compensatory measures for separate GRAND GULF B 3.3-124e LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES ACTIONS (continued) inoperable Condition entry for each inoperable RPV Water Inventory Control instrumentation channel.

A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.2-1. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

B.1 and B.2 RHR System Isolation, Reactor Vessel Water Level- Low Level 3, and Reactor Water Cleanup System, Reactor Vessel Water Level - Low Low, Level 2 functions are applicable when automatic isolation of the associated penetration flow path is credited in calculating Drain Time. If the instrumentation is inoperable, Required Action B.1 directs an immediate declaration that the associated penetration flow path(s) are incapable of automatic isolation. Required Action B.2 directs calculation of DRAIN TIME. The calculation cannot credit automatic isolation of the affected penetration flow paths.

C.1 Low reactor steam dome pressure signals are used as permissives for the low pressure ECCS injection/spray subsystem manual initiation functions. If this permissive is inoperable, manual initiation of ECCS is prohibited. Therefore, the permissive must be placed in the trip condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the permissive in the trip condition, manual initiation may be performed. Prior to placing the permissive in the tripped condition, the operator can take manual control of the pump and the injection valve to inject water into the RPV.

The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is intended to allow the operator time to evaluate any discovered inoperabilities and to place the channel in trip.

D.1 and D.2 Required Actions D.1 and D.2 are intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function result in a loss of automatic suction swap for the HPCS system from the condensate storage tank to the suppression pool. The HPCS system must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the HPCS pump suction must be aligned to the suppression pool, since, if aligned, the function is already performed.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes the risk of HPCS being needed without an adequate water source while allowing GRAND GULF B 3.3-124f LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES ACTIONS (continued) time for restoration or alignment of HPCS pump suction to the suppression pool.

E.1 If an LPCI or LPCS Discharge Flow - Low bypass function or HPCS System Discharge Pressure - High or Flow Rate - Low bypass function is inoperable, there is a risk that the associated ECCS pump could overheat when the pump is operating and the associated injection valve is not fully open. In this condition, the operator can take manual control of the pump and the injection valve to ensure the pump does not overheat. If a manual initiation function is inoperable, the ECCS subsystem pumps can be started manually and the valves can be opened manually, but this is not the preferred condition.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time was chosen to allow time for the operator to evaluate and repair any discovered inoperabilities. The Completion Time is appropriate given the ability to manually start the ECCS pumps and open the injection valves and to manually ensure the pump does not overheat.

F.1 With the Required Action and associated Completion Time of Conditions C, D, or E not met, the associated ECCS injection/spray subsystem may be incapable of performing the intended function, and must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RPV Water REQUIREMENTS Inventory Control instrument Function are found in the SRs column of Table 3.3.5.2-1.

SR 3.3.5.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK guarantees that undetected outright channel failure is limited; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL FUNCTIONAL TEST.

GRAND GULF B 3.3-124g LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES SURVEILLANCE Agreement criteria are determined by the plant staff, based on a REQUIREMENTS combination of the channel instrument uncertainties, including indication (continued) and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.5.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.2.3 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3 .5 .2 overlaps this Surveillance to complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Information Notice 84-81 "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," November 1984.

2. Information Notice 86- 74, "Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves," August 1986.

3. Generic Letter 92-04, "Resolution of the Issues Related to Reactor Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR 50.54(F). "August 1992.

4. NRC Bulletin 93-03, "Resolution of lssues Related to Reactor Vessel Water Level Instrumentation in BWRs." May 1993.

5. Information Notice 94-52, "Inadvertent Containment Spray and Reactor Vessel Draindown at Millstone l," July 1994.

GRAND GULF B 3.3-124h LBDCR 18128, 18127

RCIC System Instrumentation B 3.3.5.3 B 3.3 INSTRUMENTATION B 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation BASES BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is unavailable, such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System."

This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RCIC instrumentation, as well as LCOs on other reactor system parameters and equipment performance.

Technical Specifications are required by 10 CFR 50.36 to include LSSSs for variables that have significant safety functions. LSSS are defined by the regulation as Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.

The trip setpoint is a predetermined setting for a protection channel chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the channel (e.g., calibration), uncertainties in how the channel might actually perform (e.g., repeatability), changes in the point of action of the (continued)

GRAND GULF B 3.3-125 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES BACKGROUND (continued) channel over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the trip setpoint ensures that SLs are not exceeded. Therefore, for Function 3, Condensate Storage Tank Level-Low, the trip setpoint meets the definition of an LSSS (Ref. 2).

The Allowable Value specified in Table 3.3.5.3-1 serves as the LSSS such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value. As such, the Allowable Value differs from the trip setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a SL is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...being capable of performing its specified safety function(s)." Relying solely on the trip setpoint to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as-found" value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE because drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as-found" setting of the protection channel.

Therefore, the channel would still be OPERABLE because it would have performed its safety function and the only corrective action required would be to reset the channel within the established as-left tolerance around trip setpoint to account for further drift during the next surveillance interval.

Note that, although the channel is OPERABLE under these circumstances, the trip setpoint must be left adjusted to a value within the as-left tolerance, in accordance with uncertainty assumptions stated in the (continued)

GRAND GULF B 3.3-125a LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES BACKGROUND (continued) referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned (as-found criteria).

However, there is also some point beyond which the channel may not be able to perform its function due to, for example, greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the channels and is designated as the Allowable Value. If the actual setting (as-found setpoint) of the channel is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, the channel is OPERABLE, but degraded. The degrade condition will be further evaluated during performance of the SR. This evaluation will consist of resetting the channel setpoint to the trip setpoint (within the allowed tolerance), and evaluating the channel response. If the channel is functioning as required and expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.

The RCIC System may be initiated by either automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level -

Low Low, Level 2. The variable is monitored by four transmitters that are connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement. Once initiated, the RCIC logic seals in and can be reset by the operator only when the reactor vessel water level signals have cleared.

The RCIC test line isolation valves close on a RCIC initiation signal to allow full system flow.

The RCIC System also monitors the water levels in the condensate storage tank (CST) and the suppression pool, since these are the two sources of water for RCIC operation. Reactor grade water in the CST is the normal source. Upon receipt of a RCIC initiation signal, the CST suction valve is automatically signaled to open (it is normally in the open position) unless the pump suction from the suppression pool valve is open. If the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens and then the CST suction valve automatically closes. Two level transmitters are used (continued)

GRAND GULF B 3.3-125b LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

BACKGROUND to detect low water level in the CST. Either switch can (continued) cause the suppression pool suction valve to open and the CST suction valve to close. The suppression pool suction valve also automatically opens and the CST suction valve closes if high water level is detected in the suppression pool (one-out-of-two logic similar to the CST water level logic). To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other automatically closes.

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip (two-out-of-two logic), at which time the RCIC steam supply valve closes (the injection valve also closes due to the closure of the steam supply valves) to prevent overflow into the main steam lines. The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).

APPLICABLE The function of the RCIC System is to provide makeup SAFETY ANALYSES, coolant to the reactor in response to transient events.

LCO, and The RCIC System is not an Engineered Safety Feature APPLICABILITY System and no credit is taken in the safety analysis for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the RCIC System, and therefore its instrumentation, are included as required by the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the RCIC System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.3-1. Each Function must have a required number of OPERABLE channels with their setpoints set within the setting tolerance of the trips setpoints where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each channel must also respond within its assumed response time.

Allowable Values are specified for each RCIC System instrumentation Function specified in Table 3.3.5.3-1. For Function 3, Condensate Storage Tank Level- Low, the nominal trip setpoint and methodologies for calculation of the as-left and as-found tolerances are described in the Technical Requirements Manual. The trip setpoints are selected to ensure that the setpoints remain conservative to the as-left (continued)

GRAND GULF B 3.3-125c LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE tolerance band between CHANNEL CALIBRATIONS. After each SAFETY ANALYSES calibration the trip setpoint shall be left within the as-LCO, and left band around the nominal trip setpoint. Nominal trip APPLICABIITY setpoints are those predetermined values of output at which (continued) an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytical limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytical limits, corrected for calibration, process, and some of the instrument errors. The nominal trip setpoints are then determined, accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

Note that, although the channel is OPERABLE under these circumstances, the trip setpoint must be left adjusted to a value within the as-left tolerance, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned as-found criteria.

(continued)

GRAND GULF B 3.3-125d LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE The individual Functions are required to be OPERABLE in SAFETY ANALYSES, MODE 1, and in MODES 2 and 3 with reactor steam dome LCO, and pressure > 150 psig, since this is when RCIC is required to APPLICABILITY be OPERABLE. (Refer to LCO 3.5.3 for Applicability Bases (continued) for the RCIC System.)

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water Level - Low Low, Level 2 Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level above the top of the active fuel.

Reactor Vessel Water Level - Low Low, Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value is set high enough such that for complete loss of feedwater flow, the RCIC System flow (with high pressure core spray assumed to fail) will be sufficient to avoid initiation of low pressure ECCS at Level 1.

Four channels of Reactor Vessel Water Level - Low Low, Level 2 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

2. Reactor Vessel Water Level - High, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal closes (continued)

GRAND GULF B 3.3-126 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE 2. Reactor Vessel Water Level - High, Level 8 (continued)

SAFETY ANALYSES, LCO, and the RCIC steam supply valve to prevent overflow into the APPLICABILITY main steam lines (MSLs).

Reactor Vessel Water Level -High, Level 8 signals for RCIC are initiated from two level transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level - High, Level 8 Allowable Value is high enough to preclude closure of the steam supply valve of the RCIC system during normal operation, yet low enough to close the steam supply valve prior to water overflowing into the MSLs.

Two channels of Reactor Vessel Water Level - High, Level 8 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

3. Condensate Storage Tank Level - Low Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source. Normally the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens and then the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the RCIC pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.

Two level transmitters are used to detect low water level in the CST. The Condensate Storage Tank Level - Low Function (continued)

GRAND GULF B 3.3-127 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE 3. Condensate Storage Tank Level - Low (continued)

SAFETY ANALYSES, LCO, and Allowable Value is set high enough to ensure adequate pump APPLICABILITY suction head while water is being taken from the CST.

Two channels of Condensate Storage Tank Level - Low Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source. Refer to LCO 3.5.3 for RCIC Applicability Bases.

4. Suppression Pool Water Level - High Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the safety/relief valves. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of RCIC from the CST to the suppression pool to eliminate the possibility of RCIC continuing to provide additional water from a source outside primary containment. This Function satisfies Criterion 3 of the NRC Policy Statement. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.

Suppression pool water level signals are initiated from two level transmitters. The Allowable Value for the Suppression Pool Water Level - High Function is set low enough to ensure that RCIC will be aligned to take suction from the suppression pool before the water level reaches the point at which suppression design loads would be exceeded.

Two channels of Suppression Pool Water Level - High Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source. Refer to LCO 3.5.3 for RCIC Applicability Bases.

(continued)

GRAND GULF B 3.3-128 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE 5. Manual Initiation SAFETY ANALYSES, LCO, and The Manual Initiation push button switch introduces a signal APPLICABILITY into the RCIC System initiation logic that is redundant to (continued) the automatic protective instrumentation and provides manual initiation capability. There is one push button for the RCIC System.

The Manual Initiation Function is not assumed in any accident or transient analyses in the UFSAR. However, the Function is retained for the RCIC function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button. One channel of Manual Initiation is required to be OPERABLE when RCIC is required to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RCIC System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel.

A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.3-1 in the accompanying LCO. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

(continued)

GRAND GULF B 3.3-129 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

ACTIONS B.1 and B.2 (continued)

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 channels in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of RCIC initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel Water Level - Low Low, Level 2 channels in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.

(continued)

GRAND GULF B 3.3-130 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

ACTIONS C.1 (continued)

A risk based analysis was performed and determined that an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref. 1) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.1). A Required Action (similar to Required Action B.1), limiting the allowable out of service time if a loss of automatic RCIC initiation capability exists, is not required. This Condition applies to the Reactor Vessel Water Level -

High, Level 8 Function, whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation capability. As stated above, this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable. This Condition also applies to the Manual Initiation Function. Since this Function is not assumed in any accident or transient analysis, a total loss of manual initiation capability (Required Action C.1) for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed. The Required Action does not allow placing a channel in trip since this action would not necessarily result in the safe state for the channel in all events.

D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple inoperable, untripped channels within the same Function result in automatic component initiation capability being lost for the feature(s). For Required Action D.1, the RCIC System is the only associated feature. In this case, automatic component initiation capability is lost if two Function 3 channels or two Function 4 channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of RCIC initiation capability. As noted, Required Action D.1 is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned, the Function is already performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

(continued)

GRAND GULF B 3.3-131 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

ACTIONS D.1, D.2.1, and D.2.2 (continued)

For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool).

Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression pool, which also performs the intended function. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the RCIC System piping remains filled with water. If it is not desired to perform Required Actions D.2.1 and D.2.2, Condition E must be entered and its Required Action taken.

E.1 With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCIC REQUIREMENTS System instrumentation Function are found in the SRs column of Table 3.3.5.3-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated (continued)

GRAND GULF B 3.3-132 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

SURVEILLANCE Conditions and Required Actions may be delayed as follows:

REQUIREMENTS (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 2 and 5; and (b) for up (continued) to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 1, 3, and 4 provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 1) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary.

SR 3.3.5.3.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with the channels required by the LCO.

(continued)

GRAND GULF B 3.3-133 LBDCR 18128 LBDCR 18127

RCIC System Instrumentation B 3.3.5.3 BASES

SURVEILLANCE SR 3.3.5.3.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.3.3 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.3-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be re-adjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.3.4 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter with the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.3.4 for Function 3, Condensate Storage Tank Level-Low, is modified by two Notes as identified in Table 3.3.5.3-1. The first Note require evaluation of channel performance for the condition where the as-found setting for (continued)

GRAND GULF B 3.3-134 LBDCR 18128 LBDCR 18127

RCIC System Instrumentation B 3.3.5.3 BASES

SURVEILLANCE SR 3.3.5.3.4 (continued)

REQUIREMENTS the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.

The second Note applied to SR 3.3.5.3.4 for Function 3, Condensate Storage Tank Level-Low, requires that the as-left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP).

Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable. The second Note also requires that the NTSP and the methodologies for calculating the as-left and the as-found tolerances be in the TRM.

(continued)

GRAND GULF B 3.3-134a LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

SURVEILLANCE SR 3.3.5.3.5 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. NEDE-770-06-2, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

2. Regulatory Guide 1.105, Setpoints for Safety-Related Instrumentation, Revision 3.

GRAND GULF B 3.3-135 LBDCR 18128 LBDCR 18127

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE setpoints are selected to ensure that the setpoints do not SAFETY ANALYSES, exceed the Allowable Value between CHANNEL CALIBRATIONS.

LCO, and Operation with a trip setpoint less conservative than the APPLICABILITY nominal trip setpoint, but within its Allowable Value, is (continued) acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

Certain Emergency Core Cooling Systems (ECCS) and RCIC valves (e.g., minimum flow) also serve the dual function of automatic isolation valves. The signals that isolate these valves are also associated with the automatic initiation of the ECCS and RCIC. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.5.1, "ECCS Instrumentation," and LCO 3.3.5.3, "RCIC Instrumentation," and are not included in this LCO.

In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment," and LCO 3.6.5.1, "Drywell," as applicable.

Functions that have different Applicabilities are discussed below in the individual Functions discussion.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

(continued)

GRAND GULF B 3.3-140 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.g. Containment and Drywell Ventilation Exhaust SAFETY ANALYSES, Radiation - High (continued)

LCO, and APPLICABILITY Four channels of Containment and Drywell Ventilation Exhaust - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. Two upscale-Hi Hi, one upscale-Hi Hi and one downscale, or two downscale signals from the same trip system actuate the trip system and initiate isolation of the associated containment and drywell isolation valves.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding and to ensure offsite doses remain below 10 CFR 20 and 10 CFR 50.67 limits.

The Function is required to be OPERABLE during movement of recently irradiated fuel assemblies in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures (due to dropped fuel assemblies) must be provided to ensure offsite dose limits are not exceeded. Due to radioactive decay, this Function is only required to isolate primary containment during those fuel handling accidents involving the handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

This Function isolates the Group 7 valves.

2.h. Manual Initiation The Manual Initiation push button channels introduce signals into the primary containment and drywell isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.

There are four push buttons for the logic, two manual initiation push buttons per trip system. There is no (continued)

GRAND GULF B 3.3-148 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

APPLICABLE 5.a. Ambient Temperature - High (continued)

SAFETY ANALYSES, LCO, and Function are available and are required to be OPERABLE to APPLICABILITY ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are set low enough to detect a leak equivalent to 25 gpm.

The RHR Equipment Room Ambient Temperature - High Functions are only required to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, insufficient pressure and temperature are available to develop a significant steam leak in this piping and significant water leakage is protected by the Reactor Vessel Water Level - Low, Level 3 Function.

This function isolates the Group 3 valves.

5.b. Reactor Vessel Water Level - Low, Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break. The Reactor Vessel Water Level - Low, Level 3 Function associated with RHR Shutdown Cooling System isolation is not directly assumed in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs. The RHR Shutdown Cooling System isolation on Level 3 supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event through the 1E12-F008 and 1E12-F009 valves caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System.

Reactor Vessel Water Level - Low, Level 3 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water Level - Low, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

(continued)

GRAND GULF B 3.3-159 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

APPLICABLE 5.b. Reactor Vessel Water Level - Low, Level 3 (continued)

SAFETY ANALYSES, LCO, and The Reactor Vessel Water Level - Low, Level 3 Allowable Value was APPLICABILITY chosen to be the same as the RPS Reactor Vessel Water Level - Low, Level 3 Allowable Value (LCO 3.3.1.1) since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level - Low, Level 3 Function is required to be OPERABLE in MODE 3 with reactor pressure less than the RHR permissive pressure to prevent this potential flow path from lowering reactor vessel level to the top of the fuel. This instrumentation is required to be OPERABLE in MODES 1 and 2 and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR cut-in permissive pressure to support actions to ensure that offsite dose limits of 10CFR100 are not exceeded.

Otherwise, this function is only required to be operable when automatic isolation of the associated RHR system penetration flow path is credited in calculating drain time (See LCO 3.3.5.2). The definition of drain time allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level dropping below the TAF, but if the instrument function is inoperable, the automatic closure cannot be credited and a drain time calculation must be re-performed.

This Function isolates the Group 3 valves.

(continued)

GRAND GULF B 3.3-160 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

ACTIONS H.1 and H.2 (continued)

If the channel is not restored to OPERABLE status or placed in trip, or any Required Action of Condition F or G is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

I.1 and I.2 If the channel is not restored to OPERABLE status within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystem inoperable or isolating the RWCU System.

The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System.

J.1, J.2.1, J.2.2, and J.2.3 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the RHR Shutdown Cooling System suction from the reactor vessel flow path should be isolated. However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem is OPERABLE; and secondary containment isolation capability (i.e., at least one isolation valve and (continued)

GRAND GULF B 3.3-166 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

ACTIONS J.1, J.2.1, J.2.2, and J.2.3 (continued) associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each secondary containment penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases. This may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillances may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.

K.1 and K.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path(s) should be isolated (Required Action K.1). Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable instrumentation. Alternately, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies must be immediately suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe condition.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Isolation Instrumentation Function are found in the SRs column of Table 3.3.6.1-1.

The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains (continued)

GRAND GULF B 3.3-167 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

SURVEILLANCE trip capability. Upon completion of the Surveillance, or REQUIREMENTS expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be (continued) returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 5 and 6) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the PCIVs or drywell isolation valves will isolate the penetration flow path(s) when necessary.

SR 3.3.6.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

(continued)

GRAND GULF B 3.3-168 LBDCR 18127

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

SURVEILLANCE SR 3.3.6.1.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.1.3 The calibration of trip units consists of a test to provide a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1. For Function 1.c, Main Steam Line Flow High, there is a plant specific program which verifies the instrument channel functions by verifying the as-left and as-found settings are consistent with those established by the setpoint methodology. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.1.4, SR 3.3.6.1.5, and SR 3.3.6.1.7 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-169 LBDCR 18127

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

SURVEILLANCE SR 3.3.6.1.6 and SR 3.3.6.1.8 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on isolation valves in LCO 3.6.1.3 and LCO 3.6.5.3 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.1.9 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis.

Testing is performed only on channels where the assumed response time does not correspond to the diesel generator (DG) start time. For channels assumed to respond within the DG start time, sufficient margin exists in the 10 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. Testing of the closure times of the MSIVs is not included in this Surveillance since the closure time of the MSIVs is tested by SR 3.6.1.3.6. ISOLATION SYSTEM RESPONSE TIME acceptance criteria for this instrumentation is included in the applicable plant procedures.

As Noted, the channel sensor may be excluded from response time testing. This allowance to not perform specific response time testing of the sensors is applicable when the alternate testing requirements and restrictions of Reference 7 are performed. As stated in Reference 7, analysis has demonstrated that other Technical Specification testing requirements (CHANNEL CALIBRATIONS, CHANNEL CHECKS, CHANNEL FUNCTIONAL TESTS, and LOGIC SYSTEM FUNCTIONAL TESTS) and actions taken in response to NRC Bulletin 90-01 Supplement 1 are sufficient to identify failure modes or degradation in (continued)

GRAND GULF B 3.3-170 LBDCR 18127

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

SURVEILLANCE SR 3.3.6.1.9 (continued)

REQUIREMENTS instrument response times and assure operation of the analyzed instrument loops within acceptable limits. Reference 7 also identifies that there are no known channel sensor failure modes identified that can be detected by response time testing that cannot also be detected by other Technical Specification required surveillances. Therefore, when the requirements, including sensor types, of Reference 7 are complied with, adequate assurance of the response time of the sensors is provided.

This assurance of the response time of the sensors when combined with the response time testing of the remainder of the channel ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The calibration shall be performed such that fast ramp or step change to system components during calibrations is performed to verify that the response of the transmitter to the input change is prompt. Technicians shall monitor for response time degradation during the performance of calibrations.

Technicians shall be appropriately trained to ensure they are aware of the consequences of instrument response time degradation. These items are commitments made per Reference 8. If the alternate testing requirements of Reference 7 are not complied with then the entire channel will be response time tested including the sensors.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-170a LBDCR 18127 LBDCR 18128

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

APPLICABLE 1. Reactor Vessel Water Level - Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY Reactor Vessel Water Level - Low Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was chosen to be the same as the High Pressure Core Spray (HPCS)/Reactor Core Isolation Cooling (RCIC) Reactor Vessel Water Level - Low Low, Level 2 Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," and LCO 3.3.5.3, "Reactor Core Isolation Cooling (RCIC) System Instrumentation"), since this could indicate the capability to cool the fuel is being threatened.

The Reactor Vessel Water Level - Low Low, Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS);

thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required.

2. Drywell Pressure - High High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation of high drywell pressure supports actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

(continued)

GRAND GULF B 3.3-175 LBDCR 18128

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

APPLICABLE 3, 4. Fuel Handling Area Ventilation and Pool Sweep Exhaust SAFETY ANALYSES, Radiation -High High (continued)

LCO, and APPLICABILITY channels of Fuel Handling Area Ventilation Exhaust Radiation -

High High Function and four channels of Fuel Handling Area Pool Sweep Exhaust Radiation - High High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.

The Exhaust Radiation - High High Functions are required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, these Functions are not required. In addition, the Functions are required to be OPERABLE during movement of recently irradiated fuel assemblies in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures (due to dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded. Due to radioactive decay, these Functions are only required to isolate secondary containment during those fuel handling accidents involving the handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

5. Manual Initiation The Manual Initiation push button channels introduce signals into the secondary containment isolation logic that are redundant to the automatic protective instrumentation channels, and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for the secondary containment isolation instrumentation as required by the NRC approved licensing basis.

(continued)

GRAND GULF B 3.3-177 LBDCR 18128

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

APPLICABLE 5. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and Four channels of the Manual Initiation Function are APPLICABILITY available and are required to be OPERABLE in MODES 1, 2, and 3 and during movement of recently irradiated fuel assemblies in the secondary containment, since these are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to secondary containment isolation instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable secondary containment isolation instrumentation channel.

A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , depending on the Function, has been shown to be acceptable (Refs. 3 and 4) to permit restoration of any inoperable channel to OPERABLE status.

Functions that share common instrumentation with the RPS have a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed out of service time consistent with the time provided for the associated RPS instrumentation channels. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the (continued)

GRAND GULF B 3.3-178 LBDCR 18128

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

SURVEILLANCE SR 3.3.6.2.1 REQUIREMENTS (continued) Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the indicated parameter for one instrument channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-181 LBDCR 18127

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

SURVEILLANCE SR 3.3.6.2.3 REQUIREMENTS (continued) Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.2-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.2.4 and SR 3.3.6.2.5 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.6.2.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing, performed on SCIVs and the SGT System in LCO 3.6.4.2 and LCO 3.6.4.3, respectively, overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-182 LBDCR 18127

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

SURVEILLANCE SR 3.3.6.2.7 REQUIREMENTS This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis.

Testing is performed only on channels where the assumed response time does not correspond to the diesel generator (DG) start time. For channels assumed to respond within the DG start time, sufficient margin exists in the 10 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. Testing of the closure times of the isolation dampers is not included in this Surveillance since the closure time of the isolation dampers is tested by SR 3.6.4.2.2. ISOLATION SYSTEM RESPONSE TIME acceptance criteria for this instrumentation is included in the applicable plant procedures.

A Note to the Surveillance states that the radiation detectors may be excluded from ISOLATION SYSTEM RESPONSE TIME testing. This Note is necessary because of the difficulty of generating an appropriate detector input signal and because the principles of detector operation virtually ensure an instantaneous response time. Response time for radiation detector channels shall be measured from detector output or the input of the first electronic component in the channel.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-183 LBDCR 18127

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES

ACTIONS C.1 and C.2 (continued) status within the allowable out of service time, Condition D must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action could either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

D.1 With any Required Action and associated Completion Time not met, the associated RHR containment spray subsystem may be incapable of performing the intended function and the RHR containment spray subsystem associated with inoperable untripped channels must be declared inoperable immediately.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RHR REQUIREMENTS Containment Spray System Function are located in the SRs column of Table 3.3.6.3-1.

The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains RHR containment spray initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RHR containment spray will initiate when necessary.

SR 3.3.6.3.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter (continued)

GRAND GULF B 3.3-192 LBDCR 18127

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES

SURVEILLANCE SR 3.3.6.3.1 (continued)

REQUIREMENTS indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.3.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.3.3 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.3-1. If the (continued)

GRAND GULF B 3.3-193 LBDCR 18127

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES

SURVEILLANCE SR 3.3.6.3.3 (continued)

REQUIREMENTS trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.3.4 and SR 3.3.6.3.5 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.6.3.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.6.1.7, "Residual Heat Removal (RHR) Containment Spray," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-194 LBDCR 18127

SPMU System Instrumentation B 3.3.6.4 BASES

ACTIONS D.1 (continued)

With any Required Action and associated Completion Time not met, the associated SPMU subsystem may be incapable of performing the intended function and the SPMU subsystem associated with inoperable, untripped channels must be declared inoperable immediately.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each SPMU REQUIREMENTS System Function are located in the SRs column of Table 3.3.6.4-1.

The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains suppression pool makeup initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the SPMU will initiate when necessary.

SR 3.3.6.4.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

(continued)

GRAND GULF B 3.3-205 LBDCR 18127

SPMU System Instrumentation B 3.3.6.4 BASES

SURVEILLANCE SR 3.3.6.4.1 (continued)

REQUIREMENTS Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of the LCO.

SR 3.3.6.4.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.4.3 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.4-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-206 LBDCR 18127

SPMU System Instrumentation B 3.3.6.4 BASES

SURVEILLANCE SR 3.3.6.4.4 and SR 3.3.6.4.5 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.6.4.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.6.2.4, "Suppression Pool Makeup (SPMU) System," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 7.3.1.1.9.

2. UFSAR, Section 6.2.7.3.

3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

GRAND GULF B 3.3-207 LBDCR 18127

Relief and LLS Instrumentation B 3.3.6.5 BASES (continued)

ACTIONS B.1 and B.2 (continued) from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains relief or LLS initiation capability, as applicable. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel surveillance. That analysis demonstrated the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the relief and LLS valves will initiate when necessary.

SR 3.3.6.5.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.5.2 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.6.5.3. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be (continued)

GRAND GULF B 3.3-212 LBDCR 18127

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE SR 3.3.6.5.2 (continued)

REQUIREMENTS equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.5.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.5.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed for S/RVs in LCO 3.4.4 and LCO 3.6.1.6 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 5.2.2.

2. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

GRAND GULF B 3.3-213 LBDCR 18127

CRFA System Instrumentation B 3.3.7.1 BASES ACTIONS B.1 (continued)

With the required action and completion time not met, the associated isolation dampers must be closed. This effectively establishes the isolation made of CRFA operation.

The 1-hour completion time is intended to allow the operator time to establish this mode of operation. It is acceptable because it minimizes risk while allowing time to establish the CRFA subsystem in operation.

SURVEILLANCE The Surveillance is also modified by a Note to indicate REQUIREMENTS that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains CRFA System initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

SR 3.3.7.1.1 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.7.3, "Control Room Fresh Air (CRFA) System," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-217 LBDCR 18127

LOP Instrumentation B 3.3.8.1 BASES

SURVEILLANCE SR 3.3.8.1.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.8.1.2 and SR 3.3.8.1.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.8.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 8.3.1.

2. UFSAR, Section 5.2.

3. UFSAR, Section 6.3.

4. UFSAR, Chapter 15.

(continued)

GRAND GULF B 3.3-231 LBDCR 18127

RPS Electric Power Monitoring B 3.3.8.2 BASES

ACTIONS D.1 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 4 or 5, with any control rod withdrawn from a core cell containing one or more fuel assemblies, the operator must immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies (Required Action D.1). This Required Action results in the least reactive condition for the reactor core and ensures that the safety function of the RPS (e.g., scram of control rods) is not required. All actions must continue until the applicable Required Actions are completed.

SURVEILLANCE SR 3.3.8.2.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, undervoltage, and underfrequency channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only required to be performed while the plant is in a condition in which the loss of the RPS bus will not jeopardize steady state power operation (the design of the system is such that the power source must be removed from service to conduct the Surveillance). The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is intended to indicate an outage of sufficient duration to allow for scheduling and proper performance of the Surveillance. The Note in the Surveillance is based on guidance provided in Generic Letter 91-09 (Ref. 3).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.8.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-237 LBDCR 18127

RPS Electric Power Monitoring B 3.3.8.2 BASES

SURVEILLANCE SR 3.3.8.2.3 REQUIREMENTS (continued) Performance of a system functional test demonstrates a required system actuation (simulated or actual) signal. The discrete relays/logic of the system will automatically trip open the associated power monitoring assembly circuit breaker. Only one signal per power monitoring assembly is required to be tested. This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class 1E circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 8.3.1.1.5.

2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

3. NRC Generic Letter 91-09, "Modification of Surveillance Interval for the Electric Protective Assemblies in Power Supplies for the Reactor Protection System."

GRAND GULF B 3.3-238 LBDCR 18127

Recirculation Loops Operating B 3.4.1 BASES (continued)

SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This SR ensures the recirculation loop flows are within the allowable limits for mismatch. At low core flow (i.e., < 70% of rated core flow), the MCPR requirements provide larger margins to the fuel cladding integrity Safety Limit such that the potential adverse effect of early boiling transition during a LOCA is reduced. A larger flow mismatch can therefore be allowed when core flow is < 70% of rated core flow. The recirculation loop jet pump flow, as used in this Surveillance, is the summation of the flows from all of the jet pumps associated with a single recirculation loop.

The mismatch is measured in terms of percent of rated core flow. This Surveillance can be met by verifying that the recirculation loop drive flow mismatch, when two loops are in operation, is < 5% of rated recirculation drive flow with core flow t 70% of rated core flow and < 10% of rated recirculation drive flow with core flow < 70% of rated core flow.

This SR is not required when both loops are not in operation since the mismatch limits are meaningless during single loop or natural circulation operation. The Surveillance must be performed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after both loops are in operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.4-7 LBDCR 18127

FCVs B 3.4.2 BASES ACTIONS B.1 (continued)

If the FCVs are not deactivated (locked up) and cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This brings the unit to a condition where the flow coastdown characteristics of the recirculation loop are not important. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS Hydraulic power unit pilot operated isolation valves located between the servo valves and the common "open" and "close" lines are required to close in the event of a loss of hydraulic pressure. When closed, these valves inhibit FCV motion by blocking hydraulic pressure from the servo valve to the common open and close lines as well as to the alternate subloop. This Surveillance verifies FCV lockup on a loss of hydraulic pressure.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.2.2 This SR ensures the overall average rate of FCV movement at all positions is maintained within the analyzed limits.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.4-11 LBDCR 18127

FCVs B 3.4.2 BASES REFERENCES 1. UFSAR, Section 15.3.2.

2. UFSAR, Section 15.4.5.

GRAND GULF B 3.4-12 LBDCR 18127

Jet Pumps B 3.4.3 BASES (continued)

SURVEILLANCE SR 3.4.3.1 REQUIREMENTS This SR is designed to detect significant degradation in jet pump performance that precedes jet pump failure (Ref. 2). This SR is required to be performed only when the loop has forced recirculation flow since surveillance checks and measurements can only be performed during jet pump operation. The jet pump failure of concern is a complete mixer displacement due to jet pump beam failure. Jet pump plugging is also of concern since it adds flow resistance to the recirculation loop. Significant degradation is indicated if the specified criteria confirm unacceptable deviations from established patterns or relationships. The allowable deviations from the established patterns have been developed based on the variations experienced at plants during normal operation and with jet pump assembly failures (Refs. 2 and 3). Since refueling activities (fuel assembly replacement or shuffle, as well as any modifications to fuel support orifice size or core plate bypass flow) can affect the relationship between core flow, jet pump flow, and recirculation loop flow, these relationships may need to be re-established each cycle. Similarly, initial entry into extended single recirculation loop operation may also require establishment of these relationships. During the initial weeks of operation under such conditions, while baselining new "established patterns,"

engineering judgment of the surveillance results is used to detect significant abnormalities which could indicate a jet pump failure.

The recirculation flow control valve (FCV) operating characteristics (loop flow versus FCV position) are determined by the flow resistance from the loop suction through the jet pump nozzles. A change in the relationship indicates a flow restriction, loss in pump hydraulic performance, leak, or new flow path between the recirculation pump discharge and jet pump nozzle. For this criterion, the loop flow versus FCV position relationship must be verified.

Total core flow can be determined from measurements of the recirculation loop drive flows. Once this relationship has been established, increased or reduced total core flow for the same recirculation loop drive flow may be an indication of failures in one or several jet pumps.

(continued)

GRAND GULF B 3.4-15 LBDCR 18127

Jet Pumps B 3.4.3 BASES SURVEILLANCE SR 3.4.3.1 (continued)

REQUIREMENTS Individual jet pumps in a recirculation loop typically do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The flow (or jet pump diffuser to lower plenum differential pressure) pattern or relationship of one jet pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. This may be indicated by an increase in the relative flow for a jet pump that has experienced beam cracks.

The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2).

Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 2.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 allows this Surveillance not to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the associated recirculation loop is in operation, since these checks can only be performed during jet pump operation. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is an acceptable time to establish conditions appropriate for data collection and evaluation.

Note 2 allows this SR not to be performed when THERMAL POWER is t 21.8% RTP. During low flow conditions, jet pump noise approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data.

REFERENCES 1. UFSAR, Section 6.3.

2. GE Service Information Letter No. 330, "Jet Pump Beam Cracks,"

June 9, 1990.

3. NUREG/CR-3052, "Closeout of IE Bulletin 80-07: BWR Jet Pump Assembly Failure," November 1984.

GRAND GULF B 3.4-16 LBDCR 18127

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.1 (continued)

REQUIREMENTS lift settings must be performed during shutdown, since this is a bench test, and in accordance with the Inservice Testing Program. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures. The safety lift setpoints will still be set within a tolerance of 1 percent, but the setpoints will be tested to within 3 percent to determine acceptance or failure of the as-found valve lift setpoint. If a valve is tested and the lift setpoint is found outside the 3 percent tolerance, two additional valves are to be tested (Reference 4).

The Frequency was selected because this Surveillance must be performed during shutdown conditions and is based on the time between refuelings.

SR 3.4.4.2 The required relief function S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to verify the mechanical portions of the automatic relief function operate as designed when initiated either by an actual or simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes valve actuation. This prevents an RPV pressure blowdown.

SR 3.4.4.3 A manual actuation of each required S/RV (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to (continued)

GRAND GULF B 3.4-20 LBDCR 18127

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by method 1), plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per the INSERVICE TESTING PROGRAM requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR.

If performed by method 2), valve OPERABILITY has been demonstrated for all installed S/RVs based upon the successful operation of a test sample of S/RVs.

1. Manual actuation of the S/RV, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g., tailpipe temperature or pressure). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the S/RVs divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

2. The sample population of S/RVs tested each refueling outage to satisfy SR 3.4.4.1 will be stroked in the relief mode during as-found testing to verify proper operation of the S/RV. Just prior to installation of the to be newly-installed S/RVs to satisfy 3.4.4.1 the valve will be stroked in the relief mode during certification testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs will perform in a similar fashion. After the S/RVs are replaced, the electrical and pneumatic connections shall be verified either through (continued)

GRAND GULF B 3.4-20a LBDCR 18085

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS mechanical/electrical inspection or test prior to the resumption of electric power generation to ensure that no damage has occurred to the S/RV during transportation and installation.

This verifies that each replaced S/RV will properly perform its intended function.

If the valve fails to actuate due only to the failure of the solenoid but is capable of opening on overpressure, the safety function of the S/RV is considered OPERABLE.

The STAGGERED TEST BASIS Frequency ensures that each solenoid for each S/RV relief-mode actuator is alternately tested. The Frequency of the required relief-mode actuator testing was developed based on the S/RV tests required by INSERVICE TESTING PROGRAM. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. (Reference 5)

REFERENCES 1. Deleted

2. UFSAR, Section 5.2.2.2.3.

3. UFSAR, Section 15.

4. GNRI-96/00134, Amendment 123 to the Operating License.

5. GNRI-96/00229, Amendment 130 to the Operating License.

6. Deleted GRAND GULF B 3.4-21 LBDCR 18085

RCS Operational LEAKAGE B 3.4.5 BASES ACTIONS C.1 and C.2 (continued) 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.5.1 REQUIREMENTS The RCS LEAKAGE is monitored by a variety of instruments designed to quantify the various types of LEAKAGE. Leakage detection instrumentation is discussed in more detail in the Bases for LCO 3.4.7, "RCS Leakage Detection Instrumentation." Sump level is typically monitored to determine actual LEAKAGE rates. However, any method may be used to quantify LEAKAGE within the guidelines of Reference 7.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).

3. 10 CFR 50, Appendix A, GDC 55.

4. GEAP-5620, "Failure Behavior in ASTM A106B Pipes Containing Axial Through - Wall Flaws," April 1968.

5. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants,"

October 1975.

6. UFSAR, Section 5.2.5.5.3.

7. Regulatory Guide 1.45, May 1973 with exceptions per UFSAR Appendix 3A.

GRAND GULF B 3.4-26 LBDCR 18127

RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS (continued) samples, are sufficient to alert the operating staff to an unexpected increase in unidentified LEAKAGE.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval is sufficient to detect increasing RCS leakage. The Required Action provides 7 days to restore another RCS leakage monitor to OPERABLE status to regain the intended leakage detection diversity.

The 7 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.

E.1 and E.2 With both the gaseous and particulate drywell atmospheric monitor channels and the drywell air cooler condensate flow rate monitor inoperable, the only means of detecting LEAKAGE is the drywell floor drain sump monitoring system. This Condition does not provide the required diverse means of leakage detection. The Required Action is to restore either of the inoperable monitoring systems to OPERABLE status within 30 days to regain the intended leakage detection diversity. The 30 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.

F.1 and F.2 If any Required Action of Condition A, B, C, D, or E cannot be met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems.

G.1 With all required monitors inoperable, no required automatic means of monitoring LEAKAGE are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires the performance of a CHANNEL CHECK of the required drywell atmospheric monitoring system. The check gives reasonable confidence that the channel is operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.4-36 LBDCR 18127

RCS Leakage Detection Instrumentation B 3.4.7 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.7.2 This SR requires the performance of a CHANNEL FUNCTIONAL TEST of the required RCS leakage detection instrumentation. The test ensures that the monitors can perform their function in the desired manner. The test also verifies the relative accuracy of the instrumentation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.4-36a LBDCR 18127

RCS Leakage Detection Instrumentation B 3.4.7 BASES SURVEILLANCE SR 3.4.7.3 REQUIREMENTS (continued) This SR requires the performance of a CHANNEL CALIBRATION of the required RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrumentation, including the instruments located inside the drywell. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program..

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30.

2. Regulatory Guide 1.45, Revision 0, Reactor Coolant Pressure Boundary Leakage Detection System. May 1973.

3. GEAP-5620, "Failure Behavior in ASTM A106B Pipes Containing Axial Through C Wall Flaws," April 1968.

4. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants,"

October 1975.

5. UFSAR, Section 5.2.5.5.3.

6. UFSAR, Section 5.2.5.2.

GRAND GULF B 3.4-37 LBDCR 18127

RCS Specific Activity B 3.4.8 BASES (continued)

SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This Surveillance is performed to ensure iodine remains within limit during normal operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that requires this Surveillance to be performed only in MODE 1 because the level of fission products generated in other MODES is much less.

REFERENCES 10 CFR 50.67, Accident Source Term.

UFSAR, Section 15.6.4.

GRAND GULF B 3.4-41 LBDCR 18127

RHR Shutdown Cooling System - Hot Shutdown B 3.4.9 BASES ACTIONS B.1, B.2, and B.3 (continued) separately for each occurrence involving a loss of coolant circulation.

Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling system or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.4.9.1 REQUIREMENTS This Surveillance verifies that one RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This Surveillance is modified by a Note allowing sufficient time to align the RHR System for shutdown cooling operation after clearing the pressure interlock that isolates the system, or for placing a recirculation pump in operation. The Note takes exception to the requirements of the Surveillance being met (i.e., forced coolant circulation is not required for this initial 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period), which also allows entry into the Applicability of this Specification in accordance with SR 3.0.4 since the Surveillance will not be "not met" at the time of entry into the Applicability.

SR 3.4.9.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling system subsystems and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of (continued)

GRAND GULF B 3.4-46 LBDCR 18127

RHR Shutdown Cooling System - Hot Shutdown B 3.4.9 BASES important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.

Accumulated gas should be eliminated or brought within the acceptance criteria limits.

RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY.

The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

This SR is modified by a Note that states the SR is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam dome pressure is < the RHR cut in permissive pressure. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to entering the Applicability.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

REFERENCES None.

GRAND GULF B 3.4-46a LBDCR 18127

RHR Shutdown Cooling System - Cold Shutdown B 3.4.10 BASES SURVEILLANCE SR 3.4.10.1 (continued)

REQUIREMENTS determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.10.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling subsystems and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system highpoints and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration.

Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.

Accumulated gas should be eliminated or brought within the acceptance criteria limits.

RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas inrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used (continued)

GRAND GULF B 3.4-51 LBDCR 18127

RHR Shutdown Cooling System - Cold Shutdown B 3.4.10 BASES to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

REFERENCES None.

GRAND GULF B 3.4-51a LBDCR 18127

RCS P/T Limits B 3.4.11 BASES ACTIONS C.1 and C.2 (continued)

Operation outside the P/T limits in other than MODES 1, 2, and 3 (including defueled conditions) must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses. The Required Action must be initiated without delay and continued until the limits are restored.

Besides restoring the P/T limit parameters to within limits, an evaluation is required to determine if RCS operation is allowed. This evaluation must verify that the RCPB integrity is acceptable and must be completed before approaching criticality or heating up to > 200°F. Several methods may be used, including comparison with pre-analyzed transients, new analyses, or inspection of the components. ASME Section XI, Appendix E (Ref. 6), may be used to support the evaluation; however, its use is restricted to evaluation of the beltline.

SURVEILLANCE SR 3.4.11.1 REQUIREMENTS Verification that operation is within limits is required when RCS pressure and temperature conditions are undergoing planned changes. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Surveillance for heatup and cooldown, or inservice leakage and hydrostatic testing may be discontinued when the criteria given in the relevant plant procedure for ending the activity are satisfied.

This SR has been modified by a Note that requires this Surveillance to be performed only during system heatup and cooldown operations and inservice leakage and hydrostatic testing.

(continued)

GRAND GULF B 3.4-57 LBDCR 18127

RCS P/T Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.5, SR 3.4.11.6, and SR 3.4.11.7 REQUIREMENTS (continued) Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other P/T limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LCO limits.

The flange temperatures must be verified to be above the limits before and while tensioning the vessel head bolting studs to ensure that once the head is tensioned the limits are satisfied. When in MODE 4 with RCS temperature 80°F, checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature 100°F, monitoring of the flange temperature is required to ensure the temperatures are within the limits.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.11.8 and SR 3.4.11.9 Differential temperatures within the applicable limits ensure that thermal stresses resulting from increases in THERMAL POWER or recirculation loop flow during single recirculation loop operation will not exceed design allowances. Performing the Surveillance within 15 minutes before beginning such an increase in power or flow rate provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the change in operation.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.9 is to compare the temperatures of the operating recirculation loop and the idle loop.

(continued)

GRAND GULF B 3.4-59 LBDCR 18127

Reactor Steam Dome Pressure B 3.4.12 BASES APPLICABILITY In MODES 3, 4, and 5, the limit is not applicable because (continued) the reactor is shut down. In these MODES, the reactor pressure is well below the required limit, and no anticipated events will challenge the overpressure limits.

ACTIONS A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident while pressure is greater than the limit is minimal.

B.1 If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS Verification that reactor steam dome pressure is 1045 psig ensures that the initial conditions of the vessel overpressure protection analysis are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control PClean rogram.

REFERENCES 1. UFSAR, Section 5.2.

2. UFSAR, Section 15.

GRAND GULF B 3.4-62 LBDCR 18127

ECCS Operating B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) RPV WATER INVENTORY CONTROL AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.1 ECCS Operating BASES BACKGROUND The ECCS is designed, in conjunction with the primary and secondary containment, to limit the release of radioactive materials to the environment following a loss of coolant accident (LOCA). The ECCS uses two independent methods (flooding and spraying) to cool the core during a LOCA. The ECCS network is composed of the High Pressure Core Spray (HPCS) System, the Low Pressure Core Spray (LPCS)

System, and the low pressure coolant injection (LPCI) mode of the Residual Heat Removal (RHR) System. The ECCS also consists of the Automatic Depressurization System (ADS). The suppression pool provides the required source of water for the ECCS. Although no credit is taken in the safety analyses for the condensate storage tank (CST), it is capable of providing a source of water for the HPCS System.

On receipt of an initiation signal, each associated ECCS pump automatically starts; simultaneously the system aligns, and the pump injects water, taken either from the CST or suppression pool, into the Reactor Coolant System (RCS) as RCS pressure is overcome by the discharge pressure of the ECCS pump. Although the system is initiated, ADS action is delayed by a timer, allowing the operator to interrupt the timed sequence if the system is not needed. The HPCS pump discharge pressure almost immediately exceeds that of the RCS, and the pump injects coolant into the spray sparger above the core. If the break is small, HPCS will maintain coolant inventory, as well as vessel level, while the RCS is still pressurized. If HPCS fails to maintain water level above Level 1, it is backed up by automatic initiation of ADS in combination with LPCI and LPCS. In this event, the ADS would time out and open the selected safety/relief valves (S/RVs), depressurizing the RCS and allowing the LPCI and LPCS to overcome RCS pressure and inject coolant into the vessel. Alternately, procedures may direct this automatic function be inhibited until subsequently required. If the break is large, RCS pressure initially drops rapidly, and the LPCI and LPCS systems cool the core.

(continued)

GRAND GULF B 3.5-1 LBDCR 18128

ECCS Operating B 3.5.1 BASES (continued)

ACTIONS A draining event is a slow evolution when compared to a design basis LOCA assumed to occur at full power, and thus there is adequate time to take manual actions (hours versus minutes). TS 3.5.2, Action E, prohibits plant conditions that could result in Drain Times less than one hour.

Therefore, there is sufficient time for the licensed operators to take manual action to stop the draining event, and to manually start an ECCS injection/spray subsystem or the additional method of water injection.

Consequently, there is no need for automatic initiation of ECCS to respond to an unexpected draining event in Mode 4 or 5. Automatic initiation of an ECCS injection/spray subsystem, with injection rates of thousands of gpm, may be undesirable as it can lead to overflowing the RPV cavity.

A Note prohibits the application of LCO 3.0.4.b to an inoperable HPCS subsystem. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable HPCS subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 If any one low pressure ECCS injection/spray subsystem is inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE subsystems provide adequate core cooling during a LOCA. However, overall ECCS reliability is reduced because a single failure in one of the remaining OPERABLE subsystems concurrent with a LOCA may result in the ECCS not being able to perform its intended safety function. The 7 day Completion Time is based on a reliability study (Ref. 12) that evaluated the impact on ECCS availability by assuming that various components and subsystems were taken out of service. The results were used to calculate the average availability of ECCS equipment needed to mitigate the consequences of a LOCA as a function of allowed outage times (i.e., Completion Times).

(continued)

GRAND GULF B 3.5-6 LBDCR 18128

ECCS Operating B 3.5.1 BASES ACTIONS B.1 and B.2 If the HPCS System is inoperable, and the RCIC System is verified to be OPERABLE (when RCIC is required to be OPERABLE), the HPCS System must be restored to OPERABLE status within 14 days. In this Condition, adequate core cooling is ensured by the OPERABILITY of the redundant and diverse low pressure ECCS injection/spray subsystems in conjunction with the ADS. Also, the RCIC System will automatically provide makeup water at most reactor operating pressures. Verification of RCIC OPERABILITY within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is therefore required when HPCS is inoperable and RCIC is required to be OPERABLE. This may be performed by an administrative check, by examining logs or other information, to determine if RCIC is out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the RCIC System. However, if the OPERABILITY of the RCIC System cannot be verified and RCIC is required to be OPERABLE, Condition D must be immediately entered. If a single active component fails concurrent with a design basis LOCA, there is a potential, depending on the specific failure, that the minimum required ECCS equipment will not be available. A 14 day Completion Time is based on the results of a reliability study (Ref. 12) and has been found to be acceptable through operating experience.

(continued)

GRAND GULF B 3.5-6a LBDCR 18128

ECCS Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.1 (continued)

REQUIREMENTS susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

SR 3.5.1.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves potentially capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

LPCI subsystems may be considered OPERABLE during alignment and operation for decay heat removal with reactor steam dome pressure less than the RHR cut in permissive pressure in MODE 3, if capable of being manually realigned (remote or local) to the LPCI mode and not otherwise inoperable. This allows operation in the RHR shutdown cooling mode during MODE 3 if necessary or alignment to allow for the operation of the ADHRS when MODE 4 is reached.

(continued)

GRAND GULF B 3.5-9 LBDCR 18127

ECCS Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.2 (continued)

REQUIREMENTS The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.

SR 3.5.1.3 Verification that ADS accumulator supply pressure is 150 psig assures adequate air pressure for reliable ADS operation. The accumulator on each ADS valve provides pneumatic pressure for valve actuation. The designed pneumatic supply pressure requirements for the accumulator are such that, following a failure of the pneumatic supply to the accumulator, at least two valve actuations can occur with the drywell at 70% of design pressure (Ref. 15). The ECCS safety analysis assumes only one actuation to achieve the depressurization required for operation of the low pressure ECCS. This minimum required pressure of 150 psig is provided by the ADS Instrument Air Supply System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.1.4 The performance requirements of the ECCS pumps are determined through application of the 10 CFR 50, Appendix K, criteria (Ref. 8). This periodic Surveillance is performed (in accordance with the ASME requirements (Ref. 19) for the ECCS pumps) to verify that the ECCS pumps will develop the flow rates required by the respective analyses.

The ECCS pump flow rates ensure that adequate core cooling is provided to satisfy the acceptance criteria of 10 CFR 50.46 (Ref. 10).

The pump flow rates are verified against a system head that is equivalent to the RPV pressure expected during a LOCA. The total system pump outlet pressure is adequate to overcome the elevation head pressure between the pump suction and the vessel discharge, the piping friction losses, and RPV pressure present during LOCAs. These values may be established during pre-operational testing.

(continued)

GRAND GULF B 3.5-10 LBDCR 18127

ECCS Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.4 (continued)

REQUIREMENTS The Frequency for this Surveillance is in accordance with the INSERVICE TESTING PROGRAM requirements.

SR 3.5.1.5 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance test verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCS, LPCS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup, and actuation of all automatic valves to their required positions. This Surveillance also ensures that the HPCS System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

(continued)

GRAND GULF B 3.5-11 LBDCR 18127

ECCS Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.6 REQUIREMENTS (continued) The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes valve actuation. This prevents an RPV pressure blowdown.

SR 3.5.1.7 A manual actuation of each required ADS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by method 1), plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per the INSERVICE TESTING PROGRAM requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and (continued)

GRAND GULF B 3.5-12 LBDCR 18127

ECCS Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7 (continued)

REQUIREMENTS alternately tested. The Frequency of the required relief-mode actuator testing was developed based on the tests required by the INSERVICE TESTING PROGRAM. The testing Frequency required by the INSERVICE TESTING PROGRAM is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.5.1.8 This SR ensures that the HPCS System response time is less than or equal to the maximum value assumed in the accident analysis. Specific testing of the ECCS actuation instrumentation inputs into the HPCS System ECCS SYSTEM RESPONSE TIME is not required by this SR.

Specific response time testing of this instrumentation is not required since these actuation channels are only assumed to respond within the diesel generator start time; therefore, sufficient margin exists in the diesel generator 10 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test (Ref. 17). The diesel generator starting and any sequence loading delays along with the Reactor Vessel Water Level -

Low Low, Level 2 confirmation delay permissive must be added to the HPCS System equipment response times to obtain the HPCS System ECCS SYSTEM RESPONSE TIME. The acceptance criterion for the HPCS System ECCS SYSTEM RESPONSE TIME is d 32 seconds.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.5-13a LBDCR 18127

ECCS Operating B 3.5.1 BASES REFERENCES 1. FSAR, Section 6.3.2.2.3.

2. FSAR, Section 6.3.2.2.4.

3. FSAR, Section 6.3.2.2.1.

4. FSAR, Section 6.3.2.2.2.

5. FSAR, Section 15.2.8.

6. FSAR, Section 15.6.4.

7. FSAR, Section 15.6.5.

8. 10 CFR 50, Appendix K.

9. FSAR, Section 6.3.3.

10. 10 CFR 50.46.

11. FSAR, Section 6.3.3.3.

12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr. (NRC),

"Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.

13. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

14. FSAR, Section 6.3.3.7.8

15. FSAR, Section 7.3.1.1.1.4.2.

16. GNRI-96/00229, Amendment 130 to the Operating License.

17. NEDO-32291-A, "System Analyses for Elimination of Selected Response Time Testing Requirements," October 1995.

18. GNRI-97/00181, Amendment 133 to the Operating License.

19. ASME/ANSI OM-1987, Operation and Maintenance of Nuclear Pumps in Light Water Reactor Power Plants.

20. Deleted (continued)

GRAND GULF B 3.5-14 LBDCR 18085

RPV Water Inventory Control B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS) RPV WATER INVENTORY CONTROL AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.2 Reactor Pressure Vessel (RPV) Water Inventory Control BASES BACKGROUND The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF.

If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to prevent such elevated cladding temperatures.

APPLICABLE With the unit in MODE 4 or 5, RPV water inventory control is not SAFETY ANALYSES required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material to the environment should an unexpected draining event occur. A double-ended guillotine break of the Reactor Coolant System (RCS) is not postulated in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is considered in which single operator error or initiating event allows draining of the RPV water inventory through a single penetration flow path with the highest flow rate, or the sum of the drain rates through multiple penetration flow paths susceptible to a common mode failure (e.g., seismic event, loss of normal power, single human error). It is assumed, based on engineering judgment, that while in MODES 4 and 5, one low pressure ECCS injection/spray subsystem can maintain adequate reactor vessel water level.

(continued)

GRAND GULF B 3.5-15 LBDCR 18128

RPV Water Inventory Control B 3.5.2 BASES APPLICABLE As discussed in References 1, 2, 3, 4, and 5, operating experience has SAFETY shown RPV water inventory to be significant to public health and safety.

ANALYSES Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR (continued) 50.36(c)(2)(ii).

LCO The RPV water level must be controlled in MODES 4 and 5 to ensure that if an unexpected draining event should occur, the reactor coolant water level remains above the top of the active irradiated fuel as required by Safety Limit 2.1.1.3.

The Limiting Condition for Operation (LCO) requires the DRAIN TIME of RPV water inventory to the TAF to be t 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . A DRAIN TIME of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months is considered reasonable to identify and initiate action to mitigate unexpected draining of reactor coolant. An event that could cause loss of RPV water inventory and result in the RPV water level reaching the TAF in greater than 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months does not represent a significant challenge to Safety Limit 2.1.1.3 and can be managed as part of normal plant operation.

One ECCS injection/spray subsystem is required to be OPERABLE and capable of being manually started to provide defense-in-depth should an unexpected draining event occur. At least one of the required ECCS subsystems must have an OPERABLE diesel generator capable of supplying electrical power. An ECCS injection/spray subsystem is defined as either one of the three Low Pressure Coolant Injection (LPCI) subsystems, one Low Pressure Core Spray (LPCS) System, or the High Pressure Core Spray (HPCS) System. The LPCI subsystem and the LPCS System consist of one motor driven pump, piping, and valves to transfer water from the suppression pool to the reactor pressure vessel (RPV). The HPCS System consists of one motor driven pump, piping, and valves to transfer water from the suppression pool or condensate storage tank (CST) to the RPV. Management of gas voids is important to ECCS injection/spray subsystem OPERABILITY.

The LCO is modified by a Note which allows a required LPCI subsystem to be aligned for decay heat removal in MODE 4 or 5 and considered OPERABLE for the ECCS function, if it can be manually realigned (remote or local) to the LPCI mode and is not otherwise inoperable.

Because of the restrictions on DRAIN TIME, sufficient time will be available following an unexpected draining event to manually align and initiate LPCI subsystem operation to maintain RPV water inventory prior to the RPV water level reaching the TAF.

(continued)

GRAND GULF B 3.5-15a LBDCR 18128

RPV Water Inventory Control B 3.5.2 BASES (continued)

APPLICABILITY RPV water inventory control is required in MODES 4 and 5.

Requirements on water inventory control in other MODES are contained in LCOs in Section 3.3., Instrumentation, and other LCOs in Section 3.5, ECCS, RPV Water Inventory Control, and RCIC. RPV water inventory control is required to protect Safety Limit 2.1.1.3 which is applicable whenever irradiated fuel is in the reactor vessel.

ACTIONS A.1 and B.1 If the required ECCS injection/spray subsystem is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In this Condition, the LCO controls on DRAIN TIME minimize the possibility that an unexpected draining event could necessitate the use of the ECCS injection/spray subsystem, however the defense-in-depth provided by the ECCS injection/spray subsystem is lost. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time for restoring the required ECCS injection/spray subsystem to OPERABLE status is based on engineering judgment that considers the LCO controls on DRAIN TIME and the low probability of an unexpected draining event that would result in loss of RPV water inventory.

If the inoperable ECCS injection/spray subsystem is not restored to OPERABLE status within the required Completion Time, action must be initiated immediately to establish a method of water injection capable of operating without offsite electrical power. The method of water injection includes the necessary instrumentation and controls, water sources and pumps and valves needed to add water to the RPV or refueling cavity should an unexpected draining event occur. The method of water injection may be manually initiated and may consist of one or more systems or subsystems, and must be able to access water inventory capable of maintaining the RPV water level above the TAF for t 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

If recirculation of injected water would occur, it may be credited in determining the necessary water volume.

(continued)

GRAND GULF B 3.5-16 LBDCR 18128

RPV Water Inventory Control B 3.5.2 BASES ACTIONS C.1, C.2, and C.3 (continued)

With the DRAIN TIME less than 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months but greater than or equal to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , compensatory measures should be taken to ensure the ability to implement mitigating actions should an unexpected draining event occur.

Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material. Additional actions are taken to ensure that radioactive material will be contained, diluted, and processed prior to being released to the environment.

The secondary containment provides a controlled volume in which fission products can be contained, diluted, and processed prior to release to the environment. Required Action C.1 requires verification of the capability to establish the secondary containment boundary in less than the DRAIN TIME. The required verification confirms actions to establish the secondary containment boundary are preplanned and necessary materials are available. The secondary containment boundary is considered established when one Standby Gas Treatment (SGT) subsystem is capable of maintaining a negative pressure in the secondary containment with respect to the environment.

Verification that the secondary containment boundary can be established must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The required verification is an administrative activity and does not require manipulation or testing of equipment. Secondary containment penetration flow paths form a part of the secondary containment boundary. Required Action C.2 requires verification of the capability to isolate each secondary containment penetration flow path in less than the DRAIN TIME. The required verification confirms actions to isolate the secondary containment penetration flow paths are preplanned and necessary materials are available. Power operated valves are not required to receive automatic isolation signals if they can be closed manually within the required time.

(continued)

GRAND GULF B 3.5-16a LBDCR 18128

RPV Water Inventory Control B 3.5.2 ACTIONS C.1, C.2, and C.3 (continued)

One SGT subsystem is capable of maintaining the secondary containment at a negative pressure with respect to the environment and filter gaseous releases. Required Action C.3 requires verification of the capability to place one SGT subsystem in operation in less than the DRAIN TIME. The required verification confirms actions to place a SGT subsystem in operation are preplanned and necessary materials are available. Verification that a SGT subsystem can be placed in operation must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The required verification is an administrative activity and does not require manipulation or testing of equipment.

D.1, D.2, D.3, and D.4 With the DRAIN TIME less than 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , mitigating actions are implemented in case an unexpected draining event should occur. Note that if the DRAIN TIME is less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , Required Action E.1 is also applicable.

Required Action D.1 requires immediate action to establish an additional method of water injection augmenting the ECCS injection/spray subsystem required by the LCO. The additional method of water injection includes the necessary instrumentation and controls, water sources, and pumps and valves needed to add water to the RPV or refueling cavity:

should an unexpected draining event occur. The Note to Required Action D.1 states that either the ECCS injection/spray subsystem or the additional method of water injection must be capable of operating without offsite electrical power. The additional method of water injection may be manually initiated and may consist of one or more systems or subsystems. The additional method of water injection must be able to access water inventory capable of being injected to maintain the RPV water level above the TAF for t 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The additional method of water injection and the ECCS injection/spray subsystem may share all or part of the same water sources. If recirculation of injected water would occur, It may be credited in determining the required water volume.

Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material. Additional actions are taken to ensure that radioactive material will be contained, diluted, and processed prior to being released to the environment.

(continued)

GRAND GULF B 3.5-16b LBDCR 18128

RPV Water Inventory Control B 3.5.2 ACTIONS D.1, D.2, D.3, and D.4 (continued)

The secondary containment provides a control volume in which fission products can be contained, diluted, and processed prior to release to the environment. Required Action D.2 requires that actions be immediately initiated to establish the secondary containment boundary. With the secondary containment boundary established one SGT subsystem is capable of maintaining a negative pressure in the secondary containment with respect to the environment.

The secondary containment penetrations form a part of the secondary containment boundary. Required Action D.3 requires that actions be immediately initiated to verify that each secondary containment penetration flow path is isolated or to verify that it can be manually isolated from the control room.

One SGT subsystem is capable of maintaining the secondary containment at a negative pressure with respect to the environment and filter gaseous releases. Required Action D.4 requires that actions be immediately initiated to verify that at least one SGT subsystem is capable of being placed in operation. The required verification is an administrative activity and does not require manipulation or testing of equipment.

E.1 If the Required Actions and associated Completion times of Conditions C or Dare not met or if the DRAIN TIME is less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , actions must be initiated immediately to restore the DRAIN TIME to t 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . In this condition, there may be insufficient time to respond to an unexpected draining event to prevent the RPV water inventory from reaching the TAF.

Note that Required Actions D.1. D.2. D.3, and D.4 are also applicable when DRAIN TIME is less than 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

(continued)

GRAND GULF B 3.5-17 LBDCR 18128

RPV Water Inventory Control B 3.5.2 BASES (continued)

SURVEILLANCE SR 3.5.2.1 REQUIREMENTS The Surveillance verifies that the DRAIN TIME of RPV water inventory to the TAF is 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The period of 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months is considered reasonable to identify and initiate action to mitigate draining of reactor coolant. Loss of RPV water inventory that would result in the RPV water level reaching the TAF in greater than 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months does not represent a significant challenge to Safety Limit 2.1.1.3 and can be managed as part of normal plant operation.

The definition of DRAIN TIME states that realistic cross-sectional areas and drain rates are used in the calculation. A realistic drain rate may be determined using a single, step-wise, or integrated calculation considering the changing RPV water level during a draining event. For a Control Rod RPV penetration flow path with the Control Rod Drive Mechanism removed and not replaced with a blank flange, the realistic cross-sectional area is based on the control rod blade seated in the control rod guide tube. If the control rod blade will be raised from the penetration to adjust or verify seating of the blade, the exposed cross-sectional area of the RPV penetration flow path is used.

The definition of DRAIN TIME excludes from the calculation those penetration flow paths connected to an intact closed system, or isolated by manual or automatic valves that are locked, sealed, or otherwise secured in the closed position, blank flanges, or other devices that prevent flow of reactor coolant through the penetration flow paths. A blank flange or other bolted device must be connected with a sufficient number of bolts to prevent draining in the event of an Operating Basis Earthquake. Normal or expected leakage from closed systems or past isolation devices is permitted. Determination that a system is intact and closed or isolated must consider the status of branch lines and ongoing plant maintenance and testing activities.

The Residual Heat Removal (RHR) Shutdown Cooling System is only considered an intact closed system when misalignment issues (Reference 6) have been precluded by functional valve interlocks or by isolation devices, such that redirection of RPV water out of an RHR subsystem is precluded.

Further. RHR Shutdown Cooling System is only considered an intact closed system if its controls have not been transferred to Remote Shutdown, which disables the interlocks and isolation signals.

The exclusion of penetration flow paths from the determination of DRAIN TIME must consider the potential effects of a single operator error or initiating event on items supporting maintenance and testing (rigging, scaffolding, temporary shielding, piping plugs, snubber removal, Freeze seals, etc.). If failure of such items could result and would cause a draining event from a closed system or between the RPV and the (continued)

GRAND GULF B 3.5-18 LBDCR 18127, 18128

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 REQUIREMENTS (continued) isolation device, the penetration flow path may not be excluded from the DRAIN TIME calculation.

Surveillance Requirement 3.0.1 requires SRs to be met between performances. Therefore, any changes in plant conditions that would change the DRAIN TIME requires that a new DRAIN TIME be determined.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.2 and SR 3.5.2.3 The minimum water level of 12 ft 8 inches required for the suppression pool is periodically verified to ensure that the suppression pool will provide adequate net positive suction head (NPSH) for the ECCS pumps, recirculation volume, and vortex prevention. With the suppression pool water level less than the required limit, the required ECCS injection/spray subsystem is inoperable unless aligned to an OPERABLE CST. HPCS is also inoperable if the low CST level suction swap to the suppression pool is enabled with suppression pool level less than the required limit.

With the low CST level suction swap to the suppression pool disabled, HPCS is operable only if the CST level is > 18 ft. This level equates to a volume of approximately 169,000 gallons. Because of vortexing however, the usable volume will be less. At an indicated level of 18 ft with the suction swap disabled the usable volume will be approximately 137,000 gallons at 8175 gpm. This is sufficient volume to allow for operators time to attempt to terminate the inventory loss prior to fuel uncovery. There is no analytical basis for a specific CST volume requirement in response to a draindown event during shutdown. At an indicated level of 22 ft (low CST alarm level) with the suction swap disabled the usable volume will be approximately 174,000 gallons at 8175 gpm.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.5-18a LBDCR 18127, 18128

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.4 REQUIREMENTS (continued) The flow path piping has the potential to develop voids and pockets of entrained air. Maintaining the pump discharge lines of the required ECCS injection/spray subsystems full of water ensures that the ECCS subsystem will perform properly. This may also prevent a water hammer following an ECCS initiation signal. One acceptable method of ensuring the lines are full is to vent at the high points. This Surveillance Frequency is controlled under the Surveillance Frequency Control Program SR 3.5.2.5 Verifying the correct alignment for manual, power operated, and automatic valves in the required ECCS subsystem flow paths provides assurance that the proper flow paths will be available for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an (continued)

GRAND GULF B 3.5-18b LBDCR 18127, 18128

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.5 (continued)

REQUIREMENTS initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

In MODES 4 and 5, the RHR System may operate in the shutdown cooling mode, or be aligned to allow alternate means to remove decay heat and sensible heat from the reactor. Therefore, RHR valves that are required for LPCI subsystem operation may be aligned for decay heat removal. One LPCI subsystem of the RHR System may be considered OPERABLE for the ECCS function if all the required valves in the LPCI flow path can be manually realigned (remote or local) to allow injection into the RPV and the system is not otherwise inoperable. This will ensure adequate core cooling if an inadvertent vessel draindown should occur.

The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.

SR 3.5.2.6 Verifying that the required ECCS injection/spray subsystem can be manually started and operate for at least 10 minutes demonstrates that the subsystem is available to mitigate a draining event. Testing the ECCS injection/spray subsystem through the test return line is necessary to avoid overfilling the refueling cavity. The minimum operating time of 10 minutes was based on engineering, judgement. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.5-19 LBDCR 18127, 18128

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.7 REQUIREMENTS Verifying that each valve credited for automatically isolating a penetration flow path actuates to the isolation position on an actual or simulated RPV water level isolation signal is required to prevent RPV water inventory from dropping below the TAF should an unexpected draining event occur. The current Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.8 The required ECCS subsystem is required to have a manual start capability.

This Surveillance verifies that a manual initiation signal will cause the required LCPI subsystem or LCPS System to start and operate as designed, including pump startup and actuation of all automatic valves to their required positions. The HPCS system is verified to start manually from a standby configuration, and includes the ability to override the RPV Level 8 injection valve isolation.

The current Surveillance Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

GRAND GULF B 3.5-19a LBDCR 18127, 18128

RPV Water Inventory Control B 3.5.2 BASES (continued)

REFERENCES 1. Information Notice 84-81 "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup,"November 1984.UFSAR, Section 6.3.3.4.

2. Information Notice 86-74. "Reduction of Reactor Coolant Inventory

Because of Misalignment of RHR Valves" August 1986.

3 Generic Letter 92-04. "Resolution of the Issues Related to Reactor

Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR

50.54 f) "August 1992.

4 NRC Bulletin 93-03. "Resolution of Issues Related to Reactor

Vessel Water Level Instrumentation in BWRs" May 1993.

5. Information Notice 94-52. "Inadvertent Containment Spray arid

Reactor Vessel Draindown at Millstone 1" July 1994.

6 General Electric Service Information Letter No. 388, "RHR Valve

Misalignment During Shutdown Cooling Operation for BWR 3/4/5/6," February 1983.

GRAND GULF B 3.5-20 LBDCR 18128

RCIC System B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS), RPV WATER INVENTORY CONTROL, AND REACTOR CORE ISOLATION COOLING (RCIC) SYSTEM B 3.5.3 RCIC System BASES BACKGROUND The RCIC System is not part of the ECCS; however, the RCIC System is included with the ECCS section because of their similar functions.

The RCIC System is designed to operate either automatically or manually following reactor pressure vessel (RPV) isolation accompanied by a loss of coolant flow from the feedwater system to provide adequate core cooling and control of RPV water level. Under these conditions, the High Pressure Core Spray (HPCS) and RCIC systems perform similar functions. The RCIC System design requirements ensure that the criteria of Reference 1 are satisfied.

The RCIC System (Ref. 2) consists of a steam driven turbine pump unit, piping, and valves to provide steam to the turbine, as well as piping and valves to transfer water from the suction source to the core via the feedwater system line. Suction piping is provided from the condensate storage tank (CST) and the suppression pool. Pump suction is normally aligned to the CST to minimize injection of suppression pool water into the RPV. However, if the CST water supply is low, or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the RCIC System. The steam supply to the turbine is piped from main steam line A, upstream of the inboard main steam line isolation valve.

The RCIC System is designed to provide core cooling for a wide range of reactor pressures, 150 psig to 1177 psig. Upon receipt of an initiation signal, the RCIC turbine accelerates to a specified speed. As the RCIC flow increases, the turbine control valve is automatically adjusted to maintain design flow. Exhaust steam from the RCIC turbine is discharged to the suppression pool. A full flow test line is provided to route water from and to the CST to allow testing of the RCIC System during normal operation without injecting water into the RPV.

(continued)

GRAND GULF B 3.5-21 LBDCR 18128

RCIC System B 3.5.3 BASES BACKGROUND The RCIC pump is provided with a minimum flow bypass line, (continued) which discharges to the suppression pool. The valve in this line automatically opens to prevent pump damage due to overheating when other discharge line valves are closed. To ensure rapid delivery of water to the RPV and to minimize water hammer effects, the RCIC System discharge line "keep fill" system is designed to maintain the pump discharge line filled with water.

APPLICABLE The function of the RCIC System is to respond to transient SAFETY ANALYSES events by providing makeup coolant to the reactor. The RCIC System is not an Engineered Safety Feature System and no credit is taken in the safety analyses for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the system is included in the Technical Specifications as required by the NRC Policy Statement.

LCO The OPERABILITY of the RCIC System provides adequate core cooling such that actuation of any of the ECCS subsystems is not required in the event of RPV isolation accompanied by a loss of feedwater flow. The RCIC System has sufficient capacity to maintain RPV inventory during an isolation event. Management of gas voids is important to RCIC System OPERABILITY.

APPLICABILITY The RCIC System is required to be OPERABLE in MODE 1, and MODES 2 and 3 with reactor steam dome pressure > 150 psig since RCIC is the primary non-ECCS water source for core cooling when the reactor is isolated and pressurized. In MODES 2 and 3 with reactor steam dome pressure 150 psig, the ECCS injection/spray subsystem can provide sufficient flow to the vessel. In MODES 4 and 5, RCIC is not required to be OPERABLE since RPV water inventory control is required by LCO 3.5.2, RPV Water Level Inventory Control.

ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable RCIC system. There is an increased risk associated with entering a MODE or other specified condition in the Applicability with an inoperable RCIC system and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the (continued)

GRAND GULF B 3.5-22 LBDCR 18128

RCIC System B 3.5.3 BASES (continued)

SURVEILLANCE SR 3.5.3.1 REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

SR 3.5.3.2 Verifying the correct alignment for manual, power operated, and automatic valves in the RCIC flow path provides assurance that the proper flow path will exist for RCIC operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. For the RCIC System, this SR also includes the steam flow path for the turbine and the flow controller position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The Surveillance is modified by a Note which exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent flow path if directed.

(continued)

GRAND GULF B 3.5-24a LBDCR 18127

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.3 and SR 3.5.3.4 REQUIREMENTS (continued) The RCIC pump flow rates ensure that the system can maintain reactor coolant inventory during pressurized conditions with the RPV isolated.

The flow tests for the RCIC System are performed at two different pressure ranges such that system capability to provide rated flow is tested both at the higher and lower operating ranges of the system.

Additionally, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the RCIC System diverts steam flow. Since the required reactor steam pressure must be available to perform SR 3.5.3.3 and SR 3.5.3.4, sufficient time is allowed after adequate pressure and flow are achieved to perform these SRs. Reactor startup is allowed prior to performing the low pressure Surveillance because the reactor pressure is low and the time to satisfactorily perform the Surveillance is short. The reactor pressure is allowed to be increased to normal operating pressure since it is assumed that the low pressure test has been satisfactorily completed and there is no indication or reason to believe that RCIC is inoperable.

Therefore, these SRs are modified by Notes that state the Surveillances are not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the reactor steam pressure and flow are adequate to perform the test.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.3.5 The RCIC System is required to actuate automatically to perform its design function. This Surveillance verifies that with a required system initiation signal (actual or simulated) the automatic initiation logic of RCIC will cause the system to operate as designed, including actuation of the system throughout its emergency operating sequence, (continued)

GRAND GULF B 3.5-25 LBDCR 18127

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.5 (continued)

REQUIREMENTS automatic pump startup and actuation of all automatic valves to their required positions. This Surveillance test also ensures that the RCIC System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5., "Reactor Core Isolation Cooling (RCIC) System Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 33.

2. UFSAR, Section 5.4.6.2.

3. Memorandum from R. L. Baer (NRC) to V. Stello, Jr. (NRC),

"Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.

GRAND GULF B 3.5-26 LBDCR 18127, 18128

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS D.1 and D.2 (continued) does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of 10 CFR 50, Appendix J (Ref. 2), as modified by approved exemptions. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The leakage rate testing requirements include the airlock test connection valves (Type C leakage tests). The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate.

The SR has been modified by two Notes. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a DBA. Note 2 has been added to this SR, requiring the results to be evaluated against the acceptance criteria of SR 3.6.1.1.1. This ensures that air lock leakage is properly accounted for in determining the overall primary containment leakage rate. Since the overall primary containment leakage rate is only applicable in MODES 1, 2, and 3 operation, the Note 2 requirement is imposed only during these MODES.

SR 3.6.1.2.2 The seal air flask pressure is verified to be at 90 psig to ensure that the seal system remains viable. It must be checked because it could bleed down during or (continued)

GRAND GULF B 3.6-11 LDC 18127

Primary Containment Air Locks B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.2 (continued)

REQUIREMENTS following access through the air lock, which occurs regularly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.2.3 The air lock interlock mechanism is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of an air lock are designed to withstand the maximum expected post accident primary containment pressure (Ref. 3), closure of either door will support primary containment OPERABILITY. Thus, the interlock feature supports primary containment OPERABILITY while the air lock is being used for personnel transit in and out of the containment. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-12 LBDCR 18127

Primary Containment Air Locks B 3.6.1.2 BASES SURVEILLANCE SR 3.6.1.2.4 REQUIREMENTS (continued) A seal pneumatic system test to ensure that pressure does not decay at a rate equivalent to > 2 psig for a period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months from an initial pressure of 90 psig is an effective leakage rate test to verify system performance.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 3.8.

2. 10 CFR 50, Appendix J.

3. UFSAR, Table 6.2-13.

GRAND GULF B 3.6-13 LBDCR 18127

PCIVs B 3.6.1.3 BASES LCO are listed with their associated stroke times in the applicable plant (continued) procedures. Purge valves with resilient seals, MSIVs, and hydrostatically tested valves must meet additional leakage rate requirements. Other PCIV leakage rates are addressed by LCO 3.6.1.1, "Primary Containment," as Type B or C testing.

Valves on the containment airlock bulkhead have a design function as a primary containment isolation when the airlock inner door is inoperable per LCO 3.6.1.2 or during performance of airlock barrel testing or pneumatic tubing testing or at any time the inner airlock door/bulkhead is breached.

However, these valves are Primary Containment Isolation Valves as required by LCO 3.6.1.3 at all times.

This LCO provides assurance that the PCIVs will perform their designed safety functions to minimize the loss of reactor coolant inventory, and establish the primary containment boundary during accidents.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations of these MODES. Therefore, PCIVs are not required to be OPERABLE. Certain valves are required to be OPERABLE to prevent release of radioactive material during a postulated fuel handling accident involving the handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ). These valves are those whose associated isolation instrumentation is required to be OPERABLE according to LCO 3.3.6.1, "Function 2.g." (This does not include the valves that isolate the associated instrumentation.)

ACTIONS The ACTIONS are modified by a Note allowing penetration flow path(s) to be unisolated intermittently under administrative controls. These controls consist of stationing a dedicated (continued)

GRAND GULF B 3.6-16 LBDCR 18128

RPV Water Inventory Control B 3.5.2 BASES ACTIONS C.1, C.2, and C.3 (continued)

With the DRAIN TIME less than 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months but greater than or equal to 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months , compensatory measures should be taken to ensure the ability to implement mitigating actions should an unexpected draining event occur.

Should a draining event lower the reactor coolant level to below the TAF, there is potential for damage to the reactor fuel cladding and release of radioactive material. Additional actions are taken to ensure that radioactive material will be contained, diluted, and processed prior to being released to the environment.

The secondary containment provides a controlled volume in which fission products can be contained, diluted, and processed prior to release to the environment. Required Action C.1 requires verification of the capability to establish the secondary containment boundary in less than the DRAIN TIME. The required verification confirms actions to establish the secondary containment boundary are preplanned and necessary materials are available. The secondary containment boundary is considered established when one Standby Gas Treatment (SGT) subsystem is capable of maintaining a negative pressure in the secondary containment with respect to the environment.

Verification that the secondary containment boundary can be established must be performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The required verification is an administrative activity and does not require manipulation or testing of equipment. Secondary containment penetration flow paths form a part of the secondary containment boundary. Required Action C.2 requires verification of the capability to isolate each secondary containment penetration flow path in less than the DRAIN TIME. The required verification confirms actions to isolate the secondary containment penetration flow paths are preplanned and necessary materials are available. Power operated valves are not required to receive automatic isolation signals if they can be closed manually within the required time.

(continued)

GRAND GULF B 3.5-16a LBDCR 18128

PCIVs B 3.6.1.3 BASES ACTIONS D.1, D.2, and D.3 (continued) verification that those isolation devices outside primary containment and potentially capable of being mispositioned are in the correct position. For the isolation devices inside primary containment, the time period specified as "prior to entering MODE 2 or 3, from MODE 4 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of administrative controls that will ensure that isolation device misalignment is an unlikely possibility.

For the primary containment purge valve with resilient seal that is isolated in accordance with Required Action D.1, SR 3.6.1.3.5 must be performed at least once every 92 days. This provides assurance that degradation of the resilient seal is detected and confirms that the leakage rate of the primary containment purge valve does not increase during the time the penetration is isolated. Since more reliance is placed on a single valve while in this Condition, it is prudent to perform the SR more often. Therefore, a Frequency of once per 92 days was chosen and has been shown acceptable based on operating experience.

E.1 and E.2 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

F.1 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies in the primary and (continued)

GRAND GULF B 3.6-20 LBDCR 18128

PCIVs B 3.6.1.3 BASES ACTIONS F.1 (continued) secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe condition. Also, if applicable, action must be immediately initiated to restore the valves to OPERABLE status. This allows RHR to remain in service while actions are being taken to restore the valve.

SURVEILLANCE SR 3.6.1.3.1 REQUIREMENTS This SR verifies that the 20 inch primary containment purge valves are closed as required or, if open, open for an allowable reason. If a purge valve is open in violation of this SR, the valve is considered inoperable. If the inoperable valve is not otherwise known to have excessive leakage when closed, it is not considered to have leakage outside of the limits.

The SR is also modified by a Note (Note 1) stating that primary containment purge valves are only required to be closed in MODES 1, 2, and 3. At times other than MODE 1, 2, or 3 when the purge valves are required to be capable of closing (e.g., during movement of recently irradiated fuel assemblies) pressurization concerns are not present and the purge valves are allowed to be open (automatic isolation capability would be required by SR 3.6.1.3.4 and SR 3.6.1.3.7).

The SR is modified by a Note (Note 2) stating that the SR is not required to be met when the purge valves are open for the stated reasons. The Note states that these valves may be opened for pressure control, ALARA, or air quality considerations for personnel entry, or for Surveillances, or special testing of the purge system that require the valves to be open (e.g., testing of the containment and drywell ventilation radiation monitors). These primary containment (continued)

GRAND GULF B 3.6-21 LBDCR 18128

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.1 (continued)

REQUIREMENTS purge valves are capable of closing in the environment following a LOCA.

Therefore, these valves are allowed to be open for limited periods of time.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.2 This SR verifies that each primary containment isolation manual valve and blind flange that is located outside primary containment, drywell, and steam tunnel, and not locked, sealed, or otherwise secured and is required to be closed during accident conditions, is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the primary containment boundary is within design limits. This SR does not require any testing or valve manipulation. Rather, it involves verification that those devices outside primary containment, drywell, and steam tunnel, and capable of being mispositioned, are in the correct position. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Two Notes are added to this SR. The first Note applies to valves and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these devices, once they have been verified to be in the proper position, is low. A second Note is included to clarify that PCIVs open under administrative controls are not required to meet the SR during the time the PCIVs are open. This SR does not apply to valves that are locked, sealed, or otherwise secured in the closed position, since these were verified to be in the correct position upon locking, sealing, or securing.

(continued)

GRAND GULF B 3.6-22 LBDCR 18127

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.5 REQUIREMENTS (continued) For primary containment purge valves with resilient seals, additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J (Ref. 3),

is required to ensure OPERABILITY. Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Additionally, this SR must be performed for all purge valves within 92 days following any purge valve failing to meet it's acceptance criteria. This ensures that any common mode seal degradation is identified.

The Once within 92 day Frequency is accordance with the INSERVICE TESTING PROGRAM as is modified by a note that indicates that all valves do not have to be retested due to the failure of another valve, provided they have been tested within 92 days prior to any valve failing to meet it's acceptance criteria.

The SR is modified by a Note stating that the primary containment purge valves are only required to meet leakage rate testing requirements in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, purge valve leakage must be minimized to ensure offsite radiological release is within limits. At other times when the purge valves are required to be capable of closing (e.g., during handling of recently irradiated fuel),

pressurization concerns are not present and the purge valves are not required to meet any specific leakage criteria.

SR 3.6.1.3.6 Verifying that the full closure isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY. The full closure isolation time test ensures that the MSIV will isolate in a time period that does not (continued)

GRAND GULF B 3.6-24 LBDCR 18127

PCIVs B 3.6.1.3 BASES SURVEILLANCE SR 3.6.1.3.7 (continued)

REQUIREMENTS each automatic PCIV will actuate to its isolation position on a primary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.7 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.3.8 The analyses in Reference 2 is based on leakage that is less than the specified leakage rate. Leakage through any single main steam line must be 100 scfh when tested at a pressure of 12.1 psig. Leakage through all four steam lines must be 250 scfh when tested at Pa (12.1 psig).

The MSIV leakage rate must be verified to be in accordance with the leakage test requirements of Reference 3, as modified by approved exemptions. A Note is added to this SR which states that these valves are only required to meet this leakage limit in MODES 1, 2 and 3. In the other conditions, the Reactor Coolant System is not pressurized and specific primary containment leakage limits are not required.

SR 3.6.1.3.9 Surveillance of hydrostatically tested lines provides assurance that the calculation assumptions of Reference 2 is met.

This SR is modified by a Note that states these valves are only required to meet the combined leakage rate in MODES 1, 2, and 3 since this is when the Reactor Coolant System is (continued)

GRAND GULF B 3.6-25 LBDCR 18127

PCIVs B 3.6.1.4 BASES ACTIONS B.1 and B.2 (continued) required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.4.1 REQUIREMENTS Verifying that primary containment to auxiliary building differential pressure is within limits ensures that operation remains within the limits assumed in the primary containment analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 6.2.1.

2. UFSAR, Section 6.2.1.1.4.2.

3. UFSAR, Section 6.2.

GRAND GULF B 3.6-28 LBDCR 18127

Primary Containment Air Temperature B 3.6.1.5 BASES SURVEILLANCE SR 3.6.1.5.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 6.2.

GRAND GULF B 3.6-31 LBDCR 18127

LLS Valves B 3.6.1.6 BASES ACTIONS C.1 and C.2 If two or more LLS valves are inoperable, there could be excessive short duration S/RV cycling during an overpressure event. The plant must be brought to a condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.6.1 REQUIREMENTS A manual actuation of each required LLS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by method 1), plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per the INSERVICE TESTING PROGRAM requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR.

If performed by method 2), valve OPERABILITY has been demonstrated for all installed LLS valves based upon the successful operation of a test sample of S/RVs.

1. Manual actuation of the LLS valve, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g., tailpipe temperature or pressure). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the LLS valves divert steam flow upon opening.

Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

2. The sample population of S/RVs tested each refueling outage to satisfy SR 3.4.4.1 will be stroked in the relief mode during as-found testing to verify proper operation of the S/RV. Just prior to installation of the to be newly-installed S/RVs to satisfy SR 3.4.4.1 the valve will be stroked in the relief mode during certification testing to verify proper operation of the S/RV.

(continued)

GRAND GULF B 3.6-34 LBDCR 18085

LLS Valves B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.1 (continued)

REQUIREMENTS The successful performance of the test sample of S/RVs provides reasonable assurance that the remaining installed S/RVs will be perform in a similar fashion. After the S/RVs are replaced, the electrical and pneumatic connections shall be verified either through mechanical/electrical inspection or test prior to the resumption of electric power generation to ensure that no damage has occurred to the S/RV during transportation and installation. This verifies that each replaced S/RV will properly perform its intended function.

The STAGGERED TEST BASIS Frequency ensures that both solenoids for each LLS valve relief-mode actuator are alternatively tested. The Frequency of the required relief-mode actuator testing is based on the tests required by the INSERVICE TESTING PROGRAM. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

SR 3.6.1.6.2 The LLS designed S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to verify that the mechanical portions (i.e., solenoids) of the automatic LLS function operate as designed when initiated either by an actual or simulated automatic initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes valve actuation. This prevents a reactor pressure vessel pressure blowdown.

REFERENCES 1. GESSAR-II, Appendix 3B, Attachment A, Section 3BA.8.

2. FSAR, Section 5.2.2.2.3.3.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

4. Deleted

5. GNRI-96/00229, Amendment 130 to the Operating License.

GRAND GULF B 3.6-35 LBDCR 18127

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves in the RHR containment spray mode flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Two Notes have been added to this SR. The first Note allows RHR containment spray subsystems to be considered OPERABLE during alignment to and operation in the RHR shutdown cooling mode when below the RHR cut in permissive pressure in MODE 3, if capable of being manually realigned and not otherwise inoperable. At these low pressures and decay heat levels (the reactor is shut down in MODE 3), a reduced complement of subsystems should provide the required containment pressure mitigation function thereby allowing operation of an RHR shutdown cooling loop when necessary. The second Note exempts system vent flow paths opened under administrative control. The administrative control should be proceduralized and include stationing a dedicated individual at the system vent flow path who is in continuous communication with the operators in the control room. This individual will have a method to rapidly close the system vent path if directed.

SR 3.6.1.7.2 RHR Containment Spray System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR suppression pool spray subsystems and may also prevent water hammer and pump cavitation. Selection of RHR Containment Spray System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

GRAND GULF B 3.6-39 LBDCR 18127

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.2 (continued)

REQUIREMENTS The RHR Containment Spray System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Containment Spray System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.

Accumulated gas should be eliminated or brought within the acceptance criteria limits.

RHR Containment Spray System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY.

The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

SR 3.6.1.7.3 Verifying each RHR pump develops a flow rate 7450 gpm while operating in the suppression pool cooling mode with flow through the associated heat exchanger ensures that pump performance has not degraded below the required flow rate during the cycle. It is tested in the pool cooling mode to demonstrate pump OPERABILITY without spraying down equipment in primary containment. Flow is a normal test of centrifugal pump performance required by the ASME Code,Section XI (Ref. 2). This test confirms one point on the pump design curve and is indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.

(continued)

GRAND GULF B 3.6-40 LBDCR 18127

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.4 REQUIREMENTS This SR verifies that each RHR containment spray subsystem automatic valve actuates to its correct position upon receipt of an actual or simulated automatic actuation signal. Actual spray initiation is not required to meet this SR. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.3.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.7.5 This surveillance is performed to verify the spray nozzles are not obstructed. This surveillance may be accomplished by verifying the nozzle openings are free of material that would obstruct the flow of water or the performance of an air flow test through each nozzle. The type of testing utilized should be based on system operating history and the availability of the appropriate testing equipment. UFSAR Section 6.2.2.2 (Reference 3) defines preoperational testing performed on the system, which is not required to be duplicated by the performance of this surveillance testing. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-40a LBDCR 18127

FWLCS B 3.6.1.8 BASES (continued)

ACTIONS C.1 (continued)

Required Action C.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.8.1 REQUIREMENTS Proper operation of the RHR jockey pump is required to verify the capability of the FWLCS to provide sufficient sealing water to each isolated section of each feedwater line to initiate and maintain the fluid seal for long term leakage control. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 15.6.5.

2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.6-43 LBDCR 18127

MSIV LCS B 3.6.1.9 BASES ACTIONS C.1 (continued)

If the MSIV LCS subsystem cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action C.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Times is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.9.1 REQUIREMENTS Each outboard MSIV LCS blower is operated for 15 minutes to verify OPERABILITY. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-46 LBDCR 18127

MSIV LCS B 3.6.1.9 BASES SURVEILLANCE REQUIREMENTS SR 3.6.1.9.2 (continued)

Deleted SR 3.6.1.9.3 A system functional test is performed to ensure that the MSIV LCS will operate through its operating sequence. This includes verifying that the automatic positioning of the valves and the operation of each interlock and timer are correct, that the blowers start and develop the required flow rate and the necessary vacuum. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.7.1.

2. FSAR, Section 15.6.5.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.6-47 LBDCR 18127

Suppression Pool Average Temperature B 3.6.2.1 BASES ACTIONS E.1 and E.2 (continued) basis maximum allowable values for primary containment temperature or pressure.

SURVEILLANCE SR 3.6.2.1.1 REQUIREMENTS The suppression pool average temperature is regularly monitored to ensure that the required limits are satisfied. Average temperature is determined by taking an arithmetic average of the functional suppression pool water temperature channels. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. When heat is being added to the suppression pool by testing, however, it is necessary to monitor suppression pool temperature more frequently. The 5 minute Frequency during testing is justified by the rates at which testing will heat up the suppression pool, has been shown to be acceptable based on operating experience, and provides assurance that allowable pool temperatures are not exceeded. The 5 minute Frequency is further justified in view of other indications available in the control room, including alarms, to alert the operator to an abnormal suppression pool average temperature condition.

REFERENCES 1. UFSAR, Section 6.2.

2. UFSAR, Section 15.2.

GRAND GULF B 3.6-52 LBDCR 18127

Suppression Pool Water Level B 3.6.2.2 BASES APPLICABLE swell loads for a DBA LOCA, and calculated loads due to S/RV SAFETY ANALYSES discharges. Suppression pool water level must be maintained (continued) within the limits specified so that the safety analysis of Reference 1 remains valid.

Suppression pool water level satisfies Criteria 2 and 3 of the NRC Policy Statement.

LCO A limit that suppression pool water level be 18 ft 4-1/12 inches and 18 ft 9-3/4 inches is required to ensure that the primary containment conditions assumed for the safety analysis are met. Either the high or low water level limits were used in the safety analysis, depending upon which is conservative for a particular calculation.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause significant loads on the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced because of the pressure and temperature limitations in these MODES. Requirements for suppression pool level in MODE 4 or 5 are addressed in LCO 3.5.2, "RPV Water Inventory Control."

ACTIONS A.1 With suppression pool water level outside the limits, the conditions assumed for the safety analysis are not met. If water level is below the minimum level, the pressure suppression and iodine scrubbing function still exists as long as horizontal vents are covered, RCIC turbine exhaust is covered, and S/RV quenchers are covered. If suppression pool water level is above the maximum level, protection against overpressurization still exists due to the margin in the peak containment pressure analysis and due to OPERABLE containment sprays. Prompt action to restore the suppression pool water level to within the normal range is prudent, however, to retain the margin to weir wall overflow from an inadvertent upper pool dump and reduce the risks of increased pool swell and dynamic loading. Therefore, continued operation for a limited time is allowed. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient to restore suppression pool water level to within specified limits. Also, it takes into account the low probability of an event impacting the suppression pool water level occurring during this interval.

(continued)

GRAND GULF B 3.6-54 LBDCR 18128

Suppression Pool Water Level B 3.6.2.2 BASES ACTIONS B.1 and B.2 (continued)

If suppression pool water level cannot be restored to within limits within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.2.1 REQUIREMENTS Verification of the suppression pool water level is to ensure that the required limits are satisfied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 6.2.

2. ER 97/0089-00-00, ECCS Suction Strainer Installation.

GRAND GULF B 3.6-55 LBDCR 18127

RHR Suppression Pool Cooling B 3.6.2.3 BASES ACTIONS B.1 (continued)

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action B.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, an establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1 With two RHR suppression pool cooling subsystems inoperable, one subsystem must be restored to OPERABLE status within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . In this condition, there is a substantial loss of the primary containment pressure and temperature mitigation function. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is based on this loss of function and is considered acceptable due to the low probability of a DBA and the potential avoidance of a plant shutdown transient that could result in the need for the RHR suppression pool cooling subsystems to operate.

D.1 and D.2 If the Required Actions and required Completion Time of Condition C cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

GRAND GULF B 3.6-58 LBDCR 18048

RHR Suppression Pool Cooling B 3.6.2.2 BASES SURVEILLANCE SR 3.6.2.3.1 REQUIREMENTS Verifying the correct alignment for manual, power operated, and automatic valves, in the RHR suppression pool cooling mode flow path provides assurance that the proper flow path exists for system operation.

This SR does not apply to valves that are locked, sealed, or otherwise secured in position since these valves were verified to be in the correct position prior to being locked, sealed, or secured. A valve is also allowed to be in the nonaccident position, provided it can be aligned to the accident position within the time assumed in the accident analysis. This is acceptable, since the RHR suppression pool cooling mode is manually initiated. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.2.3.2 RHR Suppression Pool Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR suppression pool cooling subsystems and may also prevent water hammer and pump cavitation.

Selection of RHR Suppression Pool Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration.

Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The RHR Suppression Pool Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas GRAND GULF B 3.6-59 LBDCR 18127

RHR Suppression Pool Cooling B 3.6.2.2 BASES SURVEILLANCE SR 3.6.2.3.2 (continued)

REQUIREMENTS is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Suppression Pool Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.

Accumulated gas should be eliminated or brought within the acceptance criteria limits.

RHR Suppression Pool Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY.

The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

SR 3.6.2.3.3 Verifying each RHR pump develops a flow rate 7450 gpm, with flow through the associated heat exchangers to the suppression pool, ensures that pump performance has not degraded during the cycle. Flow is a normal test of centrifugal pump performance required by ASME Section XI (Ref. 2). This test confirms one point on the pump design curve, and the results are indicative of overall performance. Such inservice inspections confirm component OPERABILITY, trend performance, and detect incipient failures by indicating abnormal performance. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.

GRAND GULF B 3.6-59a LBDCR 18127

RHR Suppression Pool Cooling B 3.6.2.3 BASES REFERENCES 1. FSAR, Section 6.2.

2. ASME, Boiler and Pressure Vessel Code,Section XI.

GRAND GULF B 3.6-59b LBDCR 18048

SPMU System B 3.6.2.4 BASES ACTIONS B.1 (continued)

Therefore, the upper containment pool water temperature must be restored to within limit within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is sufficient to restore the upper containment pool to within the specified temperature limit. It also takes into account the low probability of an event occurring that would require the SPMU System.

C.1 With one SPMU subsystem inoperable for reasons other than Condition A or B, the inoperable subsystem must be restored to OPERABLE status within 7 days. The 7 day Completion Time is acceptable in light of the redundant SPMU System capabilities afforded by the OPERABLE subsystem and the low probability of a DBA occurring during this period.

D.1 and D.2 If any Required Action and required Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.2.4.1 REQUIREMENTS The upper containment pool water level is regularly monitored to ensure that the required limits are satisfied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-63 LBDCR 18127

SPMU System B 3.6.2.4 BASES SURVEILLANCE SR 3.6.2.4.2 REQUIREMENTS (continued) The upper containment pool water temperature is regularly monitored to ensure that the required limit is satisfied. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.2.4.3 Verifying the correct alignment for manual, power operated, and automatic valves in the SPMU System flow path provides assurance that the proper flow paths will exist for system operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in the correct position prior to being locked, sealed, or secured. This SR does not require any testing or valve manipulation.

Rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.2.4.4 The upper containment pool has two gates used to separate the pool into distinct sections to facilitate fuel transfer and maintenance during refueling operations and two additional gates in the separator pool weir wall extension, which, when installed, limit personnel exposure and ensure adequate water submergence of the separator when the separator is stored in the pool. The SPMU System dump line penetrations are located in the steam separator storage section of the pool. To provide the required SPMU System dump volume to the suppression pool, the gates must be removed (or placed in their stored position) to allow communication between the various pool sections. The Surveillance is modified by a Note that allows leaving (continued)

GRAND GULF B 3.6-64 LBDCR 18127

SPMU System B 3.6.2.4 BASES SURVEILLANCE SR 3.6.2.4.4 (continued)

REQUIREMENTS the gates installed if the Suppression Pool Low Level limit is increased to 18 ft 5 1/12 inches. (See Reference 3). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The provision to allow gate installation in MODES 1, 2, and 3 results in isolating a portion of the SPMU System dump volume. This provision does not apply to the separator pool weir wall extension gates. These gates are not readily accessible with the upper containment pool at its required level.

Supporting analyses have shown that increasing the minimum suppression pool level adequately compensates for water trapped by isolating the fuel storage and/or fuel transfer canal areas.

SR 3.6.2.4.5 This SR requires a verification that each SPMU subsystem automatic valve actuates to its correct position on receipt of an actual or simulated automatic initiation signal. This includes verification of the correct automatic positioning of the valves and of the operation of each interlock and timer. As noted, actual makeup to the suppression pool may be excluded. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.4.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a NOTE that excludes makeup to the suppression pool. Since all active components are testable, makeup to the suppression pool is not required.

(continued)

GRAND GULF B 3.6-65 LBDCR 18127

Primary Containment and Drywell Hydrogen Igniters B 3.6.3.2 BASES (continued)

SURVEILLANCE SR 3.6.3.2.1 and SR 3.6.3.2.2 REQUIREMENTS These SRs verify that there are no physical problems that could affect the igniter operation. Since the igniters are mechanically passive, they are not subject to mechanical failure. The only credible failures are loss of power or burnout. The verification that each required igniter is energized is performed by circuit current versus voltage measurement.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program. SR 3.6.3.2.2 is modified by a Note that indicates that the Surveillance is not required to be performed until 92 days after four or more igniters in the division are discovered to be inoperable.

SR 3.6.3.2.3 and SR 3.6.3.2.4 These functional tests are performed to verify system OPERABILITY.

The current draw to develop a surface temperature of t 1700°F is verified for igniters in inaccessible areas, e.g., in a high radiation area.

Additionally, the surface temperature of each accessible igniter is measured to be t 1700°F to demonstrate that a temperature sufficient for ignition is achieved. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-76 LBDCR 18127

Drywell Purge System B 3.6.3.3 BASES ACTIONS B.1 and B.2 (continued) provided by one division of the hydrogen igniters. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time allows a reasonable period of time to verify that a loss of hydrogen control function does not exist. The verification may be performed as an administrative check by examining logs or other information to determine the availability of the alternate hydrogen control system. It does not mean to perform the surveillances needed to demonstrate OPERABILITY of the alternate hydrogen control system. If the ability to perform the hydrogen control function is maintained, continued operation is permitted with two drywell purge subsystems inoperable for up to 7 days. Seven days is a reasonable time to allow two drywell purge subsystems to be inoperable because the hydrogen control function is maintained and because of the low probability of the occurrence of an accident.

C.1 If any Required Action and associated Completion Time cannot be met, the plant must be brought to a MODE in which the LCO does not apply.

To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.3.3.1 REQUIREMENTS Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated channel will function properly. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.3.3.2 Operating each drywell purge subsystem from the control room for 15 minutes ensures that each subsystem is OPERABLE and (continued)

GRAND GULF B 3.6-81 LBDCR 18127

Drywell Purge System B 3.6.3.3 BASES SURVEILLANCE SR 3.6.3.3.2 (continued)

REQUIREMENTS that all associated controls are functioning properly. It also ensures that blockage, compressor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.3.3.3 Operating each drywell purge subsystem for > 15 minutes and verifying that each drywell purge subsystem flow rate is > 1000 scfm ensures that each subsystem is capable of maintaining drywell hydrogen concentrations below the flammability limit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.3.3.4 This SR verifies that the pressure differential required to open the vacuum breakers is < 1.0 psid and that the isolation valve differential pressure actuation instrumentation opens the valve at 0.0 to 1.0 psid (drywell minus containment). This SR includes a CHANNEL CALIBRATION of the isolation valve differential pressure actuation instrumentation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Regulatory Guide 1.7, Revision 1.

2. UFSAR, Section 6.2.5.

3. Technical Specification Amendment 145 to GGNS Operating License.

GRAND GULF B 3.6-82 LBDCR 18127

Secondary Containment B 3.6.4.1 B 3.6 CONTAINMENT SYSTEMS B 3.6.4.1 Secondary Containment BASES BACKGROUND The function of the secondary containment is to contain, dilute, and hold up fission products that may leak from primary containment following a Design Basis Accident (DBA). In conjunction with operation of the Standby Gas Treatment (SGT) System and closure of certain valves whose lines penetrate the secondary containment, the secondary containment is designed to reduce the activity level of the fission products prior to release to the environment and to isolate and contain fission products that are released during certain operations that take place inside primary containment (e.g., during movement of recently irradiated fuel assemblies in the primary or secondary containment), when primary containment is not required to be OPERABLE, or that take place outside primary containment.

The secondary containment is a structure that completely encloses the primary containment and those components that may be postulated to contain primary system fluid. This structure forms a control volume that serves to hold up and dilute the fission products. It is possible for the pressure in the control volume to rise relative to the environmental pressure (e.g., due to pump/motor heat load additions). To prevent ground level exfiltration while allowing the secondary containment to be designed as a conventional structure, the secondary containment requires support systems to maintain the control volume pressure at less than the external pressure.

The isolation devices for the penetrations in the secondary containment boundary are a part of the secondary containment barrier. To maintain this barrier:

a. All secondary containment penetrations required to be closed during accident conditions are either:

1. capable of being closed by an OPERABLE secondary containment automatic isolation system, or (continued)

GRAND GULF B 3.6-83 LBDCR 18128

Secondary Containment B 3.6.4.1 BASES LCO to the environment. For the secondary containment to be (continued) considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that require primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during movement of recently irradiated fuel assemblies in the primary or secondary containment. Due to radioactive decay, secondary containment is required to be OPERABLE only during that fuel movement involving the handling of recently irradiated fuel (i.e.,

fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.

B.1 If the secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

(continued)

GRAND GULF B 3.6-85 LBDCR 18128

Secondary Containment B 3.6.4.1 BASES ACTIONS C.1 (continued)

Movement of recently irradiated fuel assemblies in the primary or secondary containment can be postulated to cause significant fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. Therefore, movement of recently irradiated fuel assemblies must be immediately suspended if the secondary containment is inoperable.

Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position.

Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.1.1 and SR 3.6.4.1.2 REQUIREMENTS Verifying that Auxiliary Building and Enclosure Building equipment hatches, blowout panels, and one access door in each access opening are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur.

Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application the term "sealed" has no connotation of leak tightness.

Maintaining secondary containment OPERABILITY requires verifying one door in the access opening is closed, except when the access opening is being used for entry and exit or when maintenance is being performed on an access opening. No maintenance should be performed that disables the closure/isolation function of (continued)

GRAND GULF B 3.6-86 LBDCR 18128

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.1 and SR 3.6.4.1.2 (continued)

REQUIREMENTS the access opening. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-86a LBDCR 18127

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.3 and SR 3.6.4.1.4 REQUIREMENTS (continued) The SGT System exhausts the secondary containment atmosphere to the environment through appropriate treatment equipment. To ensure that all fission products are treated, SR 3.6.4.1.3 verifies that the SGT System will rapidly establish and maintain a pressure in the secondary containment that is less than the lowest postulated pressure external to the secondary containment boundary.

SR 3.6.4.1.4 demonstrates that each OPERABLE SGT subsystem can maintain a reduced pressure in the secondary containment sufficient to allow the secondary containment to be in thermal equilibrium at steady state conditions. The test criterion specified by SR 3.6.4.1.4 includes an allowance for building degradation between performances of the surveillance. This allowance represents additional building in-leakage of 115 scfm.

The primary purpose of these SRs is to ensure secondary containment boundary integrity. The secondary purpose of (continued)

GRAND GULF B 3.6-87 LBDCR 18027

Secondary Containment B 3.6.4.1 BASES SURVEILLANCE SR 3.6.4.1.3 and SR 3.6.4.1.4 (continued)

REQUIREMENTS these SRs is to ensure that the SGT subsystem, being used for the test, functions as designed. There is a separate LCO 3.6.4.3 with Surveillance Requirements which serves the primary purpose of ensuring OPERABILITY of the SGT system. The inoperability of the SGT system does not necessarily constitute a failure of these Surveillances relative to the secondary containment OPERABILITY. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 15.6.5.

2. UFSAR, Section 15.7.4.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.6-87a LBDCR 18127

SCIVs B 3.6.4.2 BASES BACKGROUND Analysis have shown that in addition to building leakage (continued) paths, the failure of nonqualified lines 2 inches and smaller penetrating the secondary containment plus the following additional failures will not jeopardize the functional integrity of the secondary containment by providing a leakage path which exceeds the capacity of the standby gas treatment system.

System Failure Fire Protection (water) Critical Crack Fire Protection (carbon dioxide) Critical Crack Plant Service Water Critical Crack Plant Chilled Water Critical Crack Instrument Air Critical Crack In the absence of other active failures, analyses have shown that the required negative pressure can be maintained given the additional failure of a single nonisolated line as large as 4 inches. As a result, the following lines which penetrate the secondary containment and terminate there (i.e., they do not continue through the secondary containment and also penetrate the primary containment) are provided with a single isolation valve, rather than two, at the secondary penetration:

a. 4-inch makeup water supply line

b. 3-inch domestic water supply line

c. 4-inch RHR backwash line

d. 3-inch backwash transfer pump discharge line

e. 3-inch floor and equipment drain line The single isolation valve for each of the above lines is an air-operated valve which fails closed; in addition, each operator is provided with redundant solenoid valves which receive actuation signals from redundant sources. In this manner, it is ensured that, given any single failure, only one of the above lines will be nonisolated, which as stated above is within the capacity of the SGTS.

continued)

GRAND GULF B 3.6-89 LBDCR 18027

SCIVs B 3.6.4.2 BASES APPLICABLE Maintaining SCIVs OPERABLE with isolation times within SAFETY ANALYSES limits ensures that fission products will remain trapped (continued) inside secondary containment so that they can be treated by the SGT System prior to discharge to the environment.

SCIVs satisfy Criterion 3 of the NRC Policy Statement.

LCO SCIVs form a part of the secondary containment boundary. The SCIV safety function is related to control of offsite radiation releases resulting from DBAs.

The power operated automatic isolation dampers and valves are considered OPERABLE when their isolation times are within limits.

Additionally, power operated automatic dampers and valves are required to actuate on an automatic isolation signal.

The normally closed isolation dampers and valves, rupture disks, or blind flanges are considered OPERABLE when manual dampers and valves are closed or open in accordance with appropriate administrative controls, automatic dampers and valves are de-activated and secured in their closed position, rupture disks or blind flanges are in place. The SCIVs covered by this LCO, along with their associated stroke times, if applicable, are listed in the applicable plant procedures.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to the primary containment that leaks to the secondary containment.

Therefore, OPERABILITY of SCIVs is required.

In MODES 4 and 5, the probability and consequences of these events are reduced due to pressure and temperature limitations in these MODES.

Therefore, maintaining SCIVs OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as during movement of recently irradiated fuel assemblies (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ). Moving recently irradiated fuel assemblies in the primary or secondary containment may also occur in MODES 1, 2, and 3.

(continued)

GRAND GULF B 3.6-90 LBDCR 18128

SCIVs B 3.6.4.2 BASES ACTIONS C.1 and C.2 (continued) reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LCO does not apply. If applicable, the movement of recently irradiated fuel assemblies in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

Required Action D.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

SURVEILLANCE SR 3.6.4.2.1 REQUIREMENTS This SR verifies each secondary containment isolation manual valve, damper, rupture disk, and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that post accident leakage of radioactive fluids or gases outside of the secondary containment boundary is within design limits. This SR does not require any testing or SCIV manipulation. Rather, it involves verification that those SCIVs in secondary containment that are capable of being mispositioned are in the correct position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-93 LBDCR 18127, 18128

SCIVs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.1 (continued)

REQUIREMENTS Two Notes have been added to this SR. The first Note applies to valves, dampers, rupture disks, and blind flanges located in high radiation areas and allows them to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted during MODES 1, 2, and 3 for ALARA reasons. Therefore, the probability of misalignment of these SCIVs, once they have been verified to be in the proper position, is low.

A second Note has been included to clarify that SCIVs that are open under administrative controls are not required to meet the SR during the time the SCIVs are open.

SR 3.6.4.2.2 Verifying the isolation time of each power operated, automatic SCIV is within limits is required to demonstrate OPERABILITY. The isolation time test ensures that the SCIV will isolate in a time period less than or equal to that assumed in the safety analyses. Generally, SCIVs must close within 120 seconds to support the functioning of the Standby Gas Treatment System. SCIVs may have analytical closure times based on a function other than secondary containment isolation, in which case the more restrictive time applies. The Frequency of this SR is in accordance with the INSERVICE TESTING PROGRAM.

SR 3.6.4.2.3 Verifying that each automatic SCIV closes on a secondary containment isolation signal is required to prevent leakage of radioactive material from secondary containment following a DBA or other accidents. This SR ensures that each automatic SCIV will actuate to the isolation position on a secondary containment isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.6 overlaps this SR to provide complete testing of the safety function.

(continued)

GRAND GULF B 3.6-94 LBDCR 18127

SCIVs B 3.6.4.2 BASES SURVEILLANCE SR 3.6.4.2.3 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 15.6.5.

2. UFSAR, Section 6.2.3.

3. UFSAR, Section 15.7.4.

GRAND GULF B 3.6-95 LBDCR 18127

SGT System B 3.6.4.3 BASES APPLICABILITY In MODES 4 and 5, the probability and consequences of these (continued) events are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the SGT System OPERABLE is not required in MODE 4 or 5, except for other situations under which significant releases of radioactive material can be postulated, such as or during movement of recently irradiated fuel assemblies in the primary or secondary containment. Due to radioactive decay, the SGT System is required to be OPERABLE only during fuel movement involving the handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

ACTIONS A.1 With one SGT subsystem inoperable, the inoperable subsystem must be restored to OPERABLE status within 7 days. In this Condition, the remaining OPERABLE SGT subsystem is adequate to perform the required radioactivity release control function. However, the overall system reliability is reduced because a single failure in the OPERABLE subsystem could result in the radioactivity release control function not being adequately performed. The 7 day Completion Time is based on consideration of such factors as the availability of the OPERABLE redundant SGT subsystem and the low probability of a DBA occurring during this period.

B.1 If the SGT subsystem cannot be restored to OPERABLE status within the required Completion Time in MODE 1, 2, or 3, the plant must be brought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

(continued)

GRAND GULF B 3.6-98 LBDCR 18128

SGT System B 3.6.4.3 BASES ACTIONS B.1 (continued)

Required Action C.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

C.1, C.2.1, and C.2.2 During movement of recently irradiated fuel assemblies in the primary or secondary containment when Required Action A.1 cannot be completed within the required Completion Time, the OPERABLE SGT subsystem (continued)

GRAND GULF B 3.6-98a LBDCR 18128

SGT System B 3.6.4.3 BASES ACTIONS C.1 and C.2 (continued) should be immediately placed in operation. This Required Action ensures that the remaining subsystem is OPERABLE, that no failures that could prevent automatic actuation have occurred, and that any other failure would be readily detected.

An alternative to Required Action C.1 is to immediately suspend activities that represent a potential for releasing a significant amount of radioactive material to the secondary containment, thus placing the unit in a Condition that minimizes risk. If applicable, movement of recently irradiated fuel assemblies must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

The Required Actions of Condition C have been modified by a Note stating that LCO 3.0.3 is not applicable. If moving recently irradiated fuel assemblies while in MODE 4 or 5, LCO 3.0.3 would not specify any action. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, in either case, inability to suspend movement of recently irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown.

D.1 If both SGT subsystems are inoperable in MODE 1, 2, or 3, the SGT System may not be capable of supporting the required radioactivity release control function. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

(continued)

GRAND GULF B 3.6-99 LBDCR18128

SGT System B 3.6.4.3 BASES ACTIONS D.1 (continued)

Required Action D.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

E.1 When two SGT subsystems are inoperable, if applicable, movement of recently irradiated fuel assemblies in the primary and secondary containment must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.6.4.3.1 REQUIREMENTS Operating each SGT subsystem from the control room for 15 continuous minutes ensures that both subsystems are OPERABLE and that all associated controls are functioning properly. It also ensures that blockage, fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.4.3.2 This SR verifies that the required SGT filter testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, charcoal adsorber efficiency, minimum system flow rate, and the physical properties of the activated charcoal (general use and following specific operations).

(continued GRAND GULF B 3.6-100 LBDCR 18127, 18128

SGT System B 3.6.4.3 BASES SURVEILLANCE SR 3.6.4.3.2 (continued)

REQUIREMENTS Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.6.4.3.3 The SR requires verification that each SGT subsystem starts upon recipt of an actual or simulated initiation signal.

The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 41.

2. UFSAR, Section 6.5.3.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.6-101 LBDCR 18127

Drywell B 3.6.5.1 BASES SURVEILLANCE SR 3.6.5.1.1 (continued)

REQUIREMENTS the safety analysis. The normal Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If during the performance of this required Surveillance the drywell bypass leakage rate is greater than the drywell bypass leakage limit the Surveillance Frequency is increased to every 48 months. If during the performance of the subsequent consecutive Surveillance the drywell bypass leakage rate is less than or equal to the drywell bypass leakage limit, the Frequency specified in the Surveillance Frequency Control Program may be resumed. If during the performance of two consecutive Surveillances the drywell bypass leakage is greater than the drywell bypass leakage limit the Surveillance Frequency is increased to at least once every 24 months. The 24 months Frequency is maintained until during the performance of two consecutive surveillances the drywell bypass leakage rate is less than or equal to the drywell bypass leakage limit, at which time the Frequency specified in the Surveillance Frequency Control Program. For two Surveillances to be considered consecutive the Surveillances must be performed at least 12 months apart.

SR 3.6.5.1.2 The exposed accessible drywell interior and exterior surfaces are inspected to ensure there are no apparent physical defects that would prevent the drywell from performing its intended function. This SR ensures that drywell structural integrity is maintained. The Frequency was chosen so that the interior and exterior surfaces of the drywell can be inspected in conjunction with the inspections of the primary containment required by 10 CFR 50, Appendix J (Ref. 2). Due to the passive nature of the drywell structure, the specified Frequency is sufficient to identify (continued)

GRAND GULF B 3.6-105 LBDCR 18127

Drywell B 3.6.5.1 BASES SURVEILLANCE SR 3.6.5.1.2 (continued)

REQUIREMENTS component degradation that may affect drywell structural integrity.

SR 3.6.5.1.3 This SR requires a test to be performed to verify air lock leakage of the drywell air lock at pressures 3 psid. This Surveillance verifies that the drywell air lock leakage rate supports meeting the drywell bypass leakage limit (SR 3.6.5.1.1). For performance monitoring purposes the test administrative limit on drywell air lock leakage is 2 scfh. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 6 and Chapter 15.

2. 10 CFR 50, Appendix J.

4. GNRI-96/00162, Issuance of Amendment No. 126 to Facility Operating License No. NPF Grand Gulf Nuclear Station, Unit 1 (TAC No. M94176), dated August 1, 1996.

GRAND GULF B 3.6-105a LBDCR 18127

Drywell Air Lock B 3.6.5.2 BASES ACTIONS D.1 and D.2 (continued) based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.5.2.1 REQUIREMENTS The air lock door interlock is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of the air lock are designed to withstand the maximum expected post accident drywell pressure, closure of either door will support drywell OPERABILITY. Thus, the door interlock feature supports drywell OPERABILITY while the air lock is being used for personnel transit in and out of the drywell. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The Surveillance is modified by a Note requiring the Surveillance to be performed only upon entry into the drywell.

(continued)

GRAND GULF B 3.6-111 LBDCR 18127

Drywell Isolation Valve(s)

B 3.6.5.3 BASES SURVEILLANCE SR 3.6.5.3.1 REQUIREMENTS This SR ensures that the 20 inch drywell purge isolation valves are closed as required or, if open, open for an allowable reason. This SR is intended to be used for drywell purge isolation valves that are fully qualified to close under accident conditions; therefore, these valves are allowed to be open for limited periods of time. This SR has been modified by a Note indicating the SR is not required to be met when the drywell purge supply or exhaust valves are open for pressure control, ALARA or air quality considerations for personnel entry, or Surveillances or special testing of the purge system (e.g., testing of the containment and drywell ventilation radiation monitors) that require the valves to be open provided that, in MODES 1 and 2 the 20 inch and 6 inch containment vent and purge system supply and exhaust lines are isolated. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.5.3.2 This SR requires verification that each drywell isolation manual valve and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that drywell bypass leakage is maintained to a minimum. Due to the location of these devices, the Frequency specified as "prior to entering MODE 2 or 3 from MODE 4, if not performed in the previous 92 days," is appropriate because of the inaccessibility of the devices and because these devices are operated under administrative controls and the probability of their misalignment is low.

Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1, 2, and 3. Therefore, the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A second Note is included to clarify that the drywell isolation valves that are open under administrative controls are not required to meet the SR during the time that the devices are open.

(continued)

GRAND GULF B 3.6-118 LBDCR 18127

Drywell Isolation Valve(s)

B 3.6.5.3 BASES SURVEILLANCE SR 3.6.5.3.3 REQUIREMENTS (continued) Verifying that the isolation time of each power operated, automatic drywell isolation valve is within limits is required to demonstrate OPERABILITY.

The isolation time test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. The isolation time and Frequency of this SR are in accordance with the INSERVICE TESTING PROGRAM.

SR 3.6.5.3.4 Verifying that each automatic drywell isolation valve closes on a drywell isolation signal is required to prevent bypass leakage from the drywell following a DBA. This SR ensures each automatic drywell isolation valve will actuate to its isolation position on a drywell isolation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.1.7 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 6.2.4.

2. GNRI-96/00162, Issuance of Amendment No. 126 to Facility Operating License No. NPF Grand Gulf Nuclear Station, Unit 1 (TAC No. M94176), dated August 1, 1996.

GRAND GULF B 3.6-119 LBDCR 18127

Drywell Pressure B 3.6.5.4 BASES (continued)

SURVEILLANCE SR 3.6.5.4.1 REQUIREMENTS This SR provides assurance that the limitations on drywell-to-primary containment differential pressure stated in the LCO are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 6.2.1.

2. UFSAR, Section 3.8.

3. UFSAR, Section 6.2.1.1.6.

4. UFSAR, Section 6.2.7.

GRAND GULF B 3.6-122 LBDCR 18127

Drywell Air Temperature B 3.6.5.5 BASES SURVEILLANCE SR 3.6.5.5.1 (continued)

REQUIREMENTS The drywell average air temperature is the arithmetical average of the temperatures at the following locations:

Elevation Azimuth

a. ~119'-0" 20° A 70°

b. ~119'-0" 110° A 160°

c. ~119'-0" 200° A 250°

d. ~119'-0" 290° A 340°

°. ~139'-0" 20° A 70°

f. ~139'-0" 110° A 160°

g. ~139'-0" 200° A 250°

h. ~139'-0" 290° A 340°

i. ~166'-0" 20° A 70°

j. ~166'-0" 110° A 160°

k. ~166'-0" 200° A 250°

l. ~166'-0" 290° A 340° The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 6.2.

GRAND GULF B 3.6-125 LBDCR 18127

Drywell Vacuum Relief System B 3.6.5.6 BASES SURVEILLANCE SR 3.6.5.6.1 REQUIREMENTS Each vacuum breaker and its associated isolation valve is verified to be closed (except when being tested in accordance with SR 3.6.5.6.2 and SR 3.6.5.6.3 or when the vacuum breakers or isolation valves are performing their intended design function) to ensure that this potential large bypass leakage path is not present. This Surveillance is performed by observing the vacuum breaker or associated isolation valve position indication. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Two Notes are added to this SR. The first Note allows drywell vacuum breakers or isolation valves opened in conjunction with the performance of a Surveillance to not be considered as failing this SR. These periods are controlled by plant procedures and do not represent inoperable drywell vacuum breakers or isolation valves. A second Note is included to clarify that vacuum breakers or isolation valves open due to an actual differential pressure, are not considered as failing this SR.

SR 3.6.5.6.2 Each vacuum breaker and its associated isolation valve must be cycled to ensure that it opens adequately to perform its design function and returns to the fully closed position.

This Surveillance includes a CHANNEL FUNCTIONAL TEST of the isolation valve differential pressure actuation instrumentation. This provides assurance that the safety analysis assumptions are valid. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-130 LBDCR 18127

Drywell Vacuum Relief System B 3.6.5.6 BASES SURVEILLANCE SR 3.6.5.6.3 REQUIREMENTS Verification of the opening pressure differential is necessary to ensure that the safety analysis assumption that the vacuum breaker or isolation valve will open fully at a differential pressure of 1.0 psid is valid. This SR verifies that the pressure differential required to open the vacuum breakers is < 1.0 psid and that the isolation valve differential pressure actuation instrumentation opens the valve at 0.0 to 1.0 psid for the drywell purge vacuum relief subsystem and -1.0 to 0.0 psid for the post-LOCA vacuum relief subsystems (drywell minus containment). This SR includes a CHANNEL CALIBRATION of the isolation valve differential pressure actuation instrumentation. This Surveillance includes a calibration of the position indication as necessary. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 6.2.

2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.6-131 LBDCR 18127

SSW System and UHS B 3.7.1 BASES ACTIONS F.1 and F.2 (continued)

If both SSW subsystems are inoperable, more than one of the UHS cooling towers have inoperable cooling tower fan(s), or the UHS basin is inoperable for reasons other than condition C, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full Clpower conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR ensures adequate long term (30 days) cooling can be maintained. With the UHS water source below the minimum level, the UHS basin must be declared inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.2 Operating each cooling tower fan for 15 minutes ensures that all fans are OPERABLE and that all associated controls are functioning properly.

It also ensures that fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.3 Verifying the correct alignment for each required manual, power operated, and automatic valve in each SSW subsystem flow path provides assurance that the proper flow paths will exist for SSW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.

(continued)

GRAND GULF B 3.7-6 LBDCR 18127

SSW System and UHS B 3.7.1 BASES SURVEILLANCE SR 3.7.1.3 (continued)

REQUIREMENTS This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

Isolation of the SSW System to components or systems does not necessarily affect the OPERABILITY of the SSW subsystem. As such, when all SSW pumps, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the SSW subsystem needs to be evaluated to determine if it is still OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.4 This SR verifies that the automatic isolation valves of the SSW System will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by use of an actual or simulated initiation signal. This SR also verifies the automatic start capability of the SSW pump and cooling tower fans in each subsystem. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.5.1.6 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Regulatory Guide 1.27, Revision 2, January 1976.

2. UFSAR, Section 9.2.1.

3. UFSAR, Table 9.2-3.

4. UFSAR, Section 6.2.1.1.3.3.

5. UFSAR, Chapter 15.

6. UFSAR, Section 6.2.2.3.

7. UFSAR, Table 6.2-2.

8. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.7-7 LBDCR 18127

HPCS SWS B 3.7.2 BASES (continued)

LCO The HPCS SWS is required to be OPERABLE to ensure that the HPCS System will operate as required. An OPERABLE HPCS SWS consists of an OPERABLE pump; and an OPERABLE flow path, capable of taking suction from the UHS basin and transferring the water to the appropriate unit equipment.

The OPERABILITY of the UHS is discussed in LCO 3.7.1. However, the OPERABILITY of the basin cooling tower fans does not affect the OPERABILITY of the HPCS SWS, due to the limited heat removal during its operation.

APPLICABILITY In MODES 1, 2, and 3, the HPCS SWS is required to be OPERABLE to support OPERABILITY of the HPCS System since it is required to be OPERABLE in these MODES.

In MODES 4 and 5, the OPERABILITY requirements of the HPCS SWS and the UHS are determined by the HPCS System.

ACTIONS A.1 When the HPCS SWS is inoperable, the capability of the HPCS System to perform its intended function cannot be ensured. Therefore, if the HPCS SWS is inoperable, the HPCS System must be declared inoperable immediately and the applicable Conditions of LCO 3.5.1, "ECCS - Operating," or LCO 3.5.2, "RPV Water Inventory Control,"

entered.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS Verifying the correct alignment for each required manual, power operated, and automatic valve in the HPCS service water flow path provides assurance that the proper flow paths will exist for HPCS service water operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in correct position prior to locking, sealing, or securing.

A valve is also allowed to be in the nonaccident position and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that (continued)

GRAND GULF B 3.7-9 LBDCR 18128

HPCS SWS B 3.7.2 BASES SURVEILLANCE SR 3.7.2.1 (continued)

REQUIREMENTS those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

Isolation of the HPCS SWS to components or systems may render those components or systems inoperable, but may not affect the OPERABILITY of the HPCS SWS. As such, when all HPCS SWS pumps, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the HPCS SWS needs to be evaluated to determine if it is still OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.2.2 This SR verifies that the automatic isolation valves of the HPCS SWS will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by use of an actual or simulated initiation signal. This SR also verifies the automatic start capability of the HPCS SWS pump. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.5.1.6 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 9.2.1.

2. UFSAR, Chapter 6.

3. UFSAR, Chapter 15.

GRAND GULF B 3.7-10 LBDCR 18127

CRFA System B 3.7.3 BASES LCO individual at the opening who is in continuous communication (continued) with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

APPLICABILITY In MODES 1, 2, and 3, the CRFA System must be OPERABLE to ensure that the CRE will remain habitable during and following a DBA, since the DBA could lead to a fission product release.

In MODES 4 and 5, the probability and consequences of a DBA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the CRFA System OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one CRFA subsystem inoperable for reasons other than an inoperable CRE boundary, the inoperable CRFA subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE CRFA subsystem is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE subsystem could result in loss of CRFA System function. The 7 day Completion Time is based on the low probability of a DBA occurring during this time period, and that the remaining subsystem can provide the required capabilities.

B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of DBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

(continued)

GRAND GULF B 3.7-14 LBDCR 18128

CRFA System B 3.7.3 BASES ACTIONS C.1 (continued)

(continued)

Required Action C.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1 If both CRFA subsystems are inoperable in MODE 1, 2, or 3 for reasons other than an inoperable CRE, the CRFA System may not be capable of performing the intended function and the unit is in a condition outside of the accident analyses. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

(continued)

GRAND GULF B 3.7-16 LBDCR 18128

CRFA System B 3.7.3 ACTIONS D.1 (continued)

(continued)

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action E.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

GRAND GULF B 3.7-16a LBDCR 18128

CRFA System B 3.7.3 BASES (continued)

SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that a subsystem in a standby mode starts from the control room on demand and continues to operate. Standby systems should be checked periodically to ensure that they start and function properly. Operation for t 15 continuous minutes demonstrates OPERABILITY of the system. Periodic operation ensures that blockages fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.3.2 This SR verifies that the required CRFA testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, and minimum system flow rate. Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.3.3 This SR verifies that each CRFA subsystem starts and operates and that the isolation valves close in 4 seconds on an actual or simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.7.1.1 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.3.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air inleakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

(continued)

GRAND GULF B 3.7-16b LBDCR 18127

Control Room AC System B 3.7.4 BASES APPLICABLE accidents (e.g., LOCA, main steam line break).

The Control Room AC System satisfies Criterion 3 of the NRC Policy Statement.

(continued)

GRAND GULF B 3.7-17a LDC 18128

Control Room AC System B 3.7.4 BASES (continued)

LCO Two independent and redundant subsystems of the Control Room AC System are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other subsystem. Total system failure could result in the equipment operating temperature exceeding limits.

The Control Room AC System is considered OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both subsystems. These components include the cooling coils, fans, chillers, compressors, ductwork, dampers, and associated instrumentation and controls. The heating coils are not required for Control Room AC System OPERABILITY.

APPLICABILITY In MODE 1, 2, or 3, the Control Room AC System must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY limits.

In MODES 4 and 5, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room AC System OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one control room AC subsystem inoperable, the inoperable control room AC subsystem must be restored to OPERABLE status within 30 days. With the unit in this condition, the remaining OPERABLE control room AC subsystem is adequate to perform the control room air conditioning function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in loss of the control room air conditioning function. The 30 day Completion Time is based on the low probability of an event occurring requiring control room isolation, the consideration that the remaining subsystem can provide the required protection, and the availability of alternate cooling methods.

(continued)

GRAND GULF B 3.7-18 LBDCR 18128

Control Room AC System B 3.7.4 BASES SURVEILLANCE SR 3.7.4.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the control room heat load assumed in the safety analysis.

The SR consists of a combination of testing and calculation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.4.

2. FSAR, Section 9.4.1.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.7-21 LBDCR 18127, 18128

Main Condenser Offgas B 3.7.5 BASES ACTIONS B.1, and B.2 (continued) inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.5.1 and 3.7.5.2 REQUIREMENTS SR 3.7.5.2, requires an isotopic analysis of an offgas sample to ensure that the required limits are satisfied. The noble gases to be sampled include Xe-133, Xe-135, Xe-138, Kr-85, Kr-87, and Kr-88. If the measured rate of radioactivity increases significantly (by 50% after correcting for expected increases due to changes in THERMAL POWER),

an isotopic analysis is also performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the increase is noted as required by SR 3.7.5.1, to ensure that the increase is not indicative of a sustained increase in the radioactivity rate. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.5.2 is modified by a Note indicating that the SR is not required to be performed until 31 days after any SJAE is in operation. Only in this condition can radioactive fission gases be in the Main Condenser Offgas System at significant rates.

REFERENCES 1. FSAR, Section 15.7.1.

2. NUREG-0800.

3. 10 CFR 100.

4. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.7-24 LBDCR 18127

Fuel Pool Water Level B 3.7.6 BASES (continued)

LCO The specified water level preserves the assumption of the fuel handling accident analysis (Ref. 2. As such, it is the minimum required for fuel movement within the spent fuel storage pool and upper containment fuel storage pool.

APPLICABILITY This LCO applies whenever movement of irradiated fuel assemblies occurs in the associated fuel storage racks since the potential for a release of fission products exists.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not a sufficient reason to require a reactor shutdown.

When the initial conditions for an accident cannot be met, steps should be taken to preclude the accident from occurring. With either fuel pool level less than required, the movement of irradiated fuel assemblies in the associated storage pool is suspended immediately. Suspension of this activity shall not preclude completion of movement of an irradiated fuel assembly to a safe position. This effectively precludes a spent fuel handling accident from occurring.

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR verifies that sufficient water is available in the event of a fuel handling accident. The water level in the spent fuel storage pool and upper containment fuel storage pool must be checked periodically. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.7-26 LBDCR 18127

Main Turbine Bypass System B 3.7.7 BASES (continued)

B.1 If the Main Turbine Bypass System cannot be restored to OPERABLE status or the LHGR and MCPR limits for two or more inoperable Main Turbine Bypass valves are not applied, THERMAL POWER must be reduced to < 70% RTP. As discussed in the Applicability section, operation at <70% RTP results in sufficient margin to the required limits, and the Main Turbine Bypass system is not required to protect fuel integrity during the feedwater controller failure, maximum demand event.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Cycling each Main Turbine Bypass valve through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will function when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.7.2 The Main Turbine Bypass System is required to actuate automatically to perform its design function. This SR demonstrates that, with the required system initiation signals, the valves will actuate to their required position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES None GRAND GULF B 3.7-30 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.1 REQUIREMENTS (continued) This SR ensures proper circuit continuity for the offsite AC electrical power supply to the onsite distribution network and availability of offsite AC electrical power. The breaker alignment verifies that each breaker is in its correct position to ensure that distribution buses and loads are connected to their preferred power source and that appropriate independence of offsite circuits is maintained. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.2 and SR 3.8.1.21 These SRs help to ensure the availability of the standby electrical power supply to mitigate DBAs and transients and maintain the unit in a safe shutdown condition.

To minimize the wear on moving parts that do not get lubricated when the engine is not running, these SRs have been modified by Notes (the Note for SR 3.8.1.21 and Note 2 for SR 3.8.1.2) to indicate that all DG starts for these Surveillances may be preceded by an engine prelube period and followed by a warmup period prior to loading.

For the purposes of this testing, the DGs are started from standby conditions. Standby conditions for a DG mean that the diesel engine coolant and oil are being continuously circulated and temperature is being maintained consistent with manufacturer recommendations for DG 11 and DG 12. For DG 13, standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation.

In order to reduce stress and wear on diesel engines, the manufacturer recommends that the DGs be gradually accelerated to synchronous speed prior to loading. These modified start procedures are the intent of Note 3 of SR 3.8.1.2, which is only applicable when such procedures are used.

(continued)

GRAND GULF B 3.8-15 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.2 and SR 3.8.1.21 (continued)

REQUIREMENTS (continued)

SR 3.8.1.21 requires that, the DG starts from standby conditions and achieves required voltage and frequency within 10 seconds. The DG's ability to maintain the required voltage and frequency is tested by those SRs which require DG loading. The 10 second start requirement supports the assumptions in the design basis LOCA analysis (Ref. 5).

The start requirements may not be applicable to 3.8.1.2 (see Note 3 of SR 3.8.1.2), when a modified start procedure as described above is used.

If a modified start is not used, the start requirements of SR 3.8.1.21 apply.

Since SR 3.8.1.21 does require a 10 second start for each DG, it is more restrictive than SR 3.8.1.2, and it may be performed in lieu of SR 3.8.1.2.

This is the intent of Note 1 of SR 3.8.1.2. Similarly, the performance of SR 3.8.1.12 or SR 3.8.12.19 also satisfies the requirements of SR 3.8.1.2 and SR 3.8.1.21. In addition to the SR requirements, the time for the DG to reach steady state operation is periodically monitored (data is taken once per 6 months during the performance of SR 3.8.1.21) and the trend evaluated to identify degradation of governor and voltage regulator performance.

The DGs are started for this test by using one of the following signals:

manual, simulated loss of offsite power by itself, simulated loss of offsite power in conjunction with an ESF actuation test signal, or an ESF actuation test signal by itself.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.8.1.3 This Surveillance demonstrates that the DGs are capable of synchronizing and accepting greater than or equal to the equivalent of the maximum expected accident loads. A minimum run time of 60 minutes is required to stabilize engine temperatures, while minimizing the time that the DG is connected to the offsite source.

(continued)

GRAND GULF B 3.8-15a LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.3 (continued)

REQUIREMENTS Although no power factor requirements are established by this SR, the DG is normally operated at a power factor between 0.9 lagging and 1.0.

The 0.9 value is conservative with respect to the design rating of the machine, while 1.0 is an operational limitation to ensure circulating currents are minimized. The load band for DG 11 and 12 is provided to avoid routine overloading of the TDI DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Note 1 modifies this Surveillance to indicate that diesel engine runs for this Surveillance may include gradual loading, as recommended by the manufacturer, so that mechanical stress and wear on the diesel engine are minimized.

Note 2 modifies this Surveillance by stating that momentary transients because of changing bus loads do not invalidate this test.

Note 3 indicates that this Surveillance shall be conducted on only one DG at a time in order to avoid common cause failures that might result from offsite circuit or grid perturbations.

Note 4 stipulates a prerequisite requirement for performance of this SR.

A successful DG start must precede this test to credit satisfactory performance.

SR 3.8.1.4 This SR provides verification that the level (expressed as an equivalent volume in gallons) of fuel oil in the day tank is at or above the level which ensures adequate fuel oil for a minimum of 30 minutes of DG operation at the maximum expected post LOCA load.

(continued)

GRAND GULF B 3.8-16 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.4 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.5 Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Periodic removal of water from the fuel oil day tanks eliminates the necessary environment for bacterial survival. This is an effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is for preventive maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of this Surveillance.

SR 3.8.1.6 This Surveillance demonstrates that each required fuel oil transfer pump operates and transfers fuel oil from its associated storage tank to its associated day tank. It is required to support the continuous operation of standby power sources. This Surveillance provides assurance that the fuel oil transfer pump is OPERABLE, the fuel oil piping system is intact, the fuel delivery piping is not obstructed, and the controls and control systems for automatic fuel transfer systems are OPERABLE.

(continued)

GRAND GULF B 3.8-17 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.6 (continued)

REQUIREMENTS The design of the fuel transfer systems is such that pumps operate automatically in order to maintain an adequate volume of fuel oil in the day tanks during or following DG testing. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.7 Under accident conditions, loads are sequentially connected to the bus by the load sequencing panel. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the bus power supplies due to high motor starting currents. The load sequencing ensures that sufficient time exists for the bus power supply to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 2 provides a summary of the automatic loading of ESF buses.

This Surveillance is a manual test of the load shedding and sequencing panels and verifies the load shedding and sequencing panels respond within design criteria to the following test inputs: LOCA, bus undervoltage, bus undervoltage followed by LOCA, and LOCA followed by bus undervoltage.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.1.8 Transfer of each 4.16 kV ESF bus power supply from the normal offsite circuit to the alternate offsite circuit demonstrates the OPERABILITY of the alternate circuit. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.8-18 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.9 (continued)

REQUIREMENTS

2) tripping its associated single largest load with the DG solely supplying the bus.

If this load were to trip, it would result in the loss of the DG. As required by IEEE-308 (Ref. 13), the load rejection test is acceptable if the increase in diesel speed does not exceed 75% of the difference between synchronous speed and the overspeed trip setpoint, or 15% above synchronous speed, whichever is lower. For the Grand Gulf Nuclear Station the lower value results from the first criteria.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related systems are aligned to another offsite source. This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.

This SR has been modified by two Notes. Note 1 states; Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

Note 2 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of 0.9 for DG 11 and DG 13 and 0.89 for DG 12. These power factors are representative of the actual inductive loading the DGs would see under design (continued)

GRAND GULF B 3.8-20 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.10 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related systems are aligned to another offsite source. This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.

This SR has been modified by a two Notes. Note 1 states that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

Note 2 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of 0.9 for DG 11 and DG 13 and 0.89 for DG 12. These power factors are representative of the actual inductive loading the DGs would see under design basis accident conditions. Under certain conditions, however, Note 2 allows the surveillance to be conducted at a power factor above the limit. These conditions occur when grid voltage is high, and the additional field excitation needed to get the power factor to within the limits results in voltages on the emergency busses that are too high.

Under these conditions, the power factor should be maintained as close as practicable to the limit while still maintaining acceptable voltage limits on the emergency busses. In other circumstances, the grid voltage (continued)

GRAND GULF B 3.8-22 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.11 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related systems are aligned to another offsite source. This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.

This SR is modified by two Notes. The reason for Note 1 is to minimize wear and tear on the DGs during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil being continuously circulated and temperature maintained consistent with manufacturer recommendations for DG 11 and DG 12.

For DG 13, standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation.

Note 2 is not applicable to DG 13. The reason for Note 2 is that performing the Surveillance would remove a required offsite circuit from service, perturb the electrical distribution system, and challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

(continued)

GRAND GULF B 3.8-23 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.12 REQUIREMENTS (continued) This Surveillance demonstrates that the DG automatically starts and achieves the required voltage and frequency within the specified time (10 seconds) from the design basis actuation signal (LOCA signal) and operates for 5 minutes. The 5 minute period provides sufficient time to demonstrate stability. SR 3.8.1.12.d ensures that emergency loads are energized from the offsite electrical power system on an ECCS signal without loss of offsite power.

The requirement to verify the connection and power supply of permanent and auto-connected loads is intended to satisfactorily show the relationship of these loads to the loading logic for loading onto offsite power. In certain circumstances, many of these loads cannot actually be connected or loaded without undue hardship or potential for undesired operation. For instance, ECCS injection valves are not desired to be stroked open, high pressure injection systems are not capable of being operated at full flow, or RHR systems performing a decay heat removal function are not desired to be realigned to the ECCS mode of operation.

In lieu of actual demonstration of the connection and loading of these loads, testing that adequately shows the capability of the offsite power system to perform these functions is acceptable. This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related systems are aligned to another offsite source. This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.

(continued)

GRAND GULF B 3.8-24 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 (continued)

REQUIREMENTS minor problems that are not immediately detrimental to emergency operation of the DG.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related systems are aligned to another offsite source. This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.

(continued)

GRAND GULF B 3.8-25a LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.13 (continued)

REQUIREMENTS The SR is modified by a Note. Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.14 Regulatory Guide 1.9 (Ref. 3) requires demonstration that the DGs can start and run continuously at full load capability for an interval of not less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 22 hours2.546296e-4 days 0.00611 hours 3.637566e-5 weeks 8.371e-6 months of which is at a load equivalent to the continuous rating of the DG, and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of which is at a load equivalent to 110% of the continuous duty rating of the DG. An exception to the loading requirements is made for DG 11 and DG 12. DG 11 and DG 12 are operated for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months at a load greater than or equal to the maximum expected post accident load. Load carrying capability testing of the Transamerica Delaval Inc. (TDI) diesel generators (DG 11 and DG 12) has been limited to a load less than that which corresponds to 185 psig brake mean effective pressure (BMEP). Therefore, full load testing is performed at a load 5450 kW but < 5740 kW (Ref. 15). The DG starts for this Surveillance can be performed either from standby or hot conditions. The provisions for prelube and warmup, discussed in SR 3.8.1.2, and for gradual loading, discussed in SR 3.8.1.3, are applicable to this SR.

In order to ensure that the DG is tested under load conditions that are as close to design conditions as possible, testing must be performed using a power factor (continued)

GRAND GULF B 3.8-26 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS 0.9. This power factor is chosen to be representative of the actual design basis inductive loading that the DG could experience. During the test the generator voltage and frequency is 4160 +/- 416 volts and 58.8 Hz and 63 Hz within 10 seconds after the start signal and the steady state generator voltage and frequency is maintained within 4160 +/- 416 volts and 60 +/- 1.2 Hz for the duration of the test.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This Surveillance is modified by three Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. The DG 11 and 12 load band is provided to avoid routine overloading of the TDI DG. Routine overloading may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Similarly, momentary power factor transients above the limit do not invalidate the test. Note 2 stipulates that credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

Note 3 ensures that the DG is tested under load conditions that are as close to design basis conditions as possible. When synchronized with offsite power, testing should be performed at a power factor of 0.9 for DG 11 and DG 13 and 0.89 for DG 12. These power factors are representative of (continued)

GRAND GULF B 3.8-27 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.15 (continued)

REQUIREMENTS and frequency within 10 seconds. The 10 second time is derived from the requirements of the accident analysis to respond to a design basis large break LOCA.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR has been modified by two Notes. Note 1 ensures that the test is performed with the diesel sufficiently hot. The requirement that the diesel has operated for at least 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months at full load conditions or until operating temperatures stabilized prior to performance of this Surveillance is based on manufacturer recommendations for achieving hot conditions. The DG 11 and 12 load band is provided to avoid routine overloading of the TDI DG. Routine overloads may result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Momentary transients due to changing bus loads do not invalidate this test. Note 2 allows all DG starts to be preceded by an engine prelube period to minimize wear and tear on the diesel during testing.

SR 3.8.1.16 As required by Regulatory Guide 1.9 (Ref. 3) this Surveillance ensures that the manual synchronization and load transfer from the DG to each required offsite source can be made and that the DG can be returned to ready-to-load status when offsite power is restored. It also ensures that the undervoltage logic is reset to allow the DG to reload if a subsequent loss of offsite power occurs. The DG is considered to be in ready-to-load status when the DG is at rated speed and voltage, the output breaker is open and can receive an auto-close signal on bus undervoltage, and the load sequence logic is reset.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related (continued)

GRAND GULF B 3.8-28 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.17 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related distribution subsystem) connected to one offsite source, while the remaining safety-related systems are aligned to another offsite source. This minimizes the possibility of common cause failures resulting from offsite/grid voltage perturbations.

Credit may be taken for unplanned events that satisfy this SR. Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.18 Under accident conditions, loads are sequentially connected to the bus by the load sequencing panel. The sequencing logic controls the permissive and starting signals to motor breakers to prevent overloading of the bus power supplies due to high motor starting currents. The 10% load sequence time interval tolerance ensures that sufficient time exists for the bus power supplies to restore frequency and voltage prior to applying the next load and that safety analysis assumptions regarding ESF equipment time delays are not violated. Reference 2 provides a summary of the automatic loading of ESF buses.

(continued)

GRAND GULF B 3.8-30 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.8-30a LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.18 (continued)

REQUIREMENTS This SR is modified by a Note. The reason for the Note is that performing the Surveillance during these MODES would challenge plant safety systems. Credit may be taken for unplanned events that satisfy this SR.

Examples of unplanned events may include:

1) Unexpected operational events which cause the equipment to perform the function specified by this Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

SR 3.8.1.19 In the event of a DBA coincident with a loss of offsite power, the DGs are required to supply the necessary power to ESF systems so that the fuel, RCS, and containment design limits are not exceeded.

This Surveillance demonstrates the DG operation, as discussed in the Bases for SR 3.8.1.11, during a loss of offsite power actuation test signal in conjunction with an ECCS initiation signal. For the purposes of this Surveillance the DG 13 autoconnected emergency loads are verified to be energized in 20 seconds. In lieu of actual demonstration of connection and loading of loads, testing that adequately shows the capability of the DG system to perform these functions is acceptable.

This testing may include any series of sequential, overlapping, or total steps so that the entire connection and loading sequence is verified.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Testing performed for this SR is normally conducted with the DG being tested (and the associated safety-related (continued)

GRAND GULF B 3.8-31 LBDCR 18127

AC Sources Operating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.20 (continued)

REQUIREMENTS This surveillance is performed when the unit is shut down. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose of this testing, the DGs must be started from standby conditions, that is, with the engine coolant and oil continuously circulated and temperature maintained consistent with manufacturer recommendations for DG 11 and DG 12. For DG 13, standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation.

SR 3.8.1.21 (See SR 3.8.1.2)

(continued)

GRAND GULF B 3.8-33 LBDCR 18127

AC Sources Operating B 3.8.1 BASES (continued)

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. UFSAR, Chapter 8.

3. Regulatory Guide 1.9, Revision 3.

4. UFSAR, Chapter 6.

5. UFSAR, Chapter 15.

6. Regulatory Guide 1.93.

7. Generic Letter 84-15, July 2, 1984.

8. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

9. 10 CFR 50, Appendix A, GDC 18.

10. Not used.

11. ANSI C84.1, 1982.

12. ASME, Boiler and Pressure Vessel Code,Section XI.

13. IEEE Standard 308.

14. Not used.

15. Letter from E.G. Adensam to L.F. Dale, dated July 1984.

16. GNRI-96/00151, Amendment 124 to the Operating License.

17. Generic Letter 94-01, May 31, 1994.

18. GNRI-98/00016, Amendment 134 to the Operating License.

19. GNRI-2000/00065, Grand Gulf Nuclear Station, Unit 1 - Issuance of Amendment Re: Generic Changes to Improved Standard Technical Specifications, Amendment 142 to the Operating License.

20. ER-GG-2002-0466, Evaluation of P75 Standby Diesel Generators to Regulatory Guide 1.9, Rev. 3.

GRAND GULF B 3.8-34 LBDCR 18127

AC Sources Shutdown B 3.8.2 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.2 AC Sources Shutdown BASES BACKGROUND A description of the AC sources is provided in the Bases for LCO 3.8.1, "AC Sources Operating."

APPLICABLE The OPERABILITY of the minimum AC sources during MODES 4 SAFETY ANALYSES and 5 and during movement of recently irradiated fuel assemblies in the primary or secondary containment ensures that:

a. The unit can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate AC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving recently irradiated fuel. Due to radioactive decay, AC electrical power is only required to mitigate fuel handling accidents involving the handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

In general, when the unit is shut down the Technical Specifications (TS) requirements ensure that the unit has the capability to mitigate the consequences of postulated accidents. However, assuming a single failure and concurrent loss of all offsite or loss of all onsite power is not required. The rationale for this is based on the fact that many Design Basis Accidents (DBAs), which are analyzed in MODES 1, 2, and 3, have no specific analyses in MODES 4 and 5. Worst case bounding events are deemed not credible in MODES 4 and 5 because the energy contained within the reactor pressure boundary, reactor coolant temperature and pressure, and the corresponding stresses (continued)

GRAND GULF B 3.8-35 LBDCR 18128

AC Sources Shutdown B 3.8.2 BASES LCO support, assuming a loss of the offsite circuit. Similarly, (continued) when the high pressure core spray (HPCS) is required to be OPERABLE, a separate offsite circuit to the Division 3 Class 1E onsite electrical power distribution subsystem, or an OPERABLE Division 3 DG, ensure an additional source of power for the HPCS. This additional source for Division 3 is not necessarily required to be connected to be OPERABLE.

Either the circuit required by LCO Item a, or a circuit required to meet LCO Item c may be connected, with the second source available for connection.

Together, OPERABILITY of the required offsite circuit(s) and DG(s) ensures the availability of sufficient AC sources to operate the plant in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving recently irradiated fuel).

Automatic initiation of the required DG during shutdown conditions is specified in LCO 3.3.8.1, LOP Instrumentation.

The qualified offsite circuit(s) must be capable of maintaining rated frequency and voltage while connected to their respective ESF bus(es),

and accepting required loads during an accident. Qualified offsite circuits are those that are described in the UFSAR and are part of the licensing basis for the plant. The offsite circuit consists of incoming breakers and disconnects to the ESF transformers and the respective circuit path including feeder breakers to all 4.16 kV ESF buses required by LCO 3.8.8.

The required DG must be capable of starting, accelerating to rated speed and voltage, and connecting to its respective ESF bus on detection of bus undervoltage, and accepting required loads. This sequence must be accomplished within 10 seconds. Each DG must also be capable of accepting required loads within the assumed loading sequence intervals, and must continue to operate until offsite power can be restored to the ESF buses. These capabilities are required to be met from a variety of initial conditions such as: DG in standby with the engine hot and DG in standby with the engine at ambient conditions. Additional DG capabilities must be demonstrated to meet required Surveillances, e.g., capability of the DG to revert to standby status on an ECCS signal while operating in parallel test mode.

(continued)

GRAND GULF B 3.8-37 LBDCR 18128

AC Sources Shutdown B 3.8.2 BASES LCO an integral part of offsite circuit and DG OPERABILITY since (continued) its inoperability impacts the ability to start and maintain energized loads required OPERABLE by LCO 3.8.8.

It is acceptable for divisions to be cross tied during shutdown conditions, permitting a single offsite power circuit to supply all required AC electrical power distribution subsystems.

As described in Applicable Safety Analyses, in the event of an accident during shutdown, the TS are designed to maintain the plant in a condition such that, even with a single failure, the plant will not be in immediate difficulty.

APPLICABILITY The AC sources required to be OPERABLE in MODES 4 and 5 and during movement of recently irradiated fuel assemblies in the primary or secondary containment provide assurance that:

a. Systems that provide core cooling;

b. Systems needed to mitigate a fuel handling accident involving recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The AC power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.1.

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving recently irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of recently irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

(continued)

GRAND GULF B 3.8-38 LBDCR 18128

AC Sources Shutdown B 3.8.2 BASES ACTIONS A.1 (continued)

An offsite circuit is considered inoperable if it is not available to one required ESF division. If two or more ESF 4.16 kV buses are required per LCO 3.8.8, division(s) with offsite power available may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS and movement of recently irradiated fuel. By the allowance of the option to declare required features inoperable with no offsite power available, appropriate restrictions can be implemented in accordance with the affected required feature(s) LCOs' ACTIONS.

A.2.1, A.2.2, A.2.3, B.1, B.2, and B.3 With the offsite circuit not available to all required divisions, the option still exists to declare all required features inoperable. Since this option may involve undesired administrative efforts, the allowance for sufficiently conservative actions is made. With the required DG inoperable, the minimum required diversity of AC power sources is not available. It is, therefore, required to suspend CORE ALTERATIONS, and movement of recently irradiated fuel assemblies in the primary and secondary containment.

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize probability of the occurrence of postulated events. It is further required to initiate action immediately to restore the required AC sources and to continue this action until restoration is accomplished in order to provide the necessary AC power to the plant safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required AC electrical power sources should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.

(continued)

GRAND GULF B 3.8-39 LDC 18128

AC Sources Shutdown B 3.8.2 BASES SURVEILLANCE SR 3.8.2.1 (continued)

REQUIREMENTS with the DG(s) that is not required to be OPERABLE. Refer to the corresponding Bases for LCO 3.8.1 for a discussion of each SR.

This SR is modified by two Notes. The reason for the Note 1 is to preclude requiring the OPERABLE DG(s) from being paralleled with the offsite power network or otherwise rendered inoperable during the performance of SRs, and to preclude de-energizing a required 4160 V ESF bus or disconnecting a required offsite circuit during performance of SRs. With limited AC sources available, a single event could compromise both the required circuit and the DG. It is the intent that these SRs must still be capable of being met, but actual performance is not required during periods when the DG and offsite circuit is required to be OPERABLE.

Note 2 states that SRs 3.8.1.12 and 3.8.1.19 are not required to be met when its associated ECCS subsystem(s) are not required to be OPERABLE. These SRs demonstrate the DG response to an ECCS signal (either alone or in conjunction with a loss-of-power signal). This is consistent with the ECCS instrumentation requirements that do not require ECCS signals when the ECCS system is not required to be OPERABLE.

REFERENCES None.

GRAND GULF B 3.8-41 LBDCR 18128

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS E.1 (continued)

With a Required Action and associated Completion Time not met, or the stored diesel fuel oil, lube oil or starting air subsystem not within limits for reasons other than addressed by Conditions A through D, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.

SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for 7 days at its surveillance testing capacity as prescribed by Technical Specifications (5740 KW for Division 1 and 2, 3300 KW for Division 3). This capacity exceeds the maximum expected post LOCA loading. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.2 This Surveillance ensures that sufficient lube oil inventory is available to support at least 7 days of maximum expected post LOCA load operation for each DG. This requirement is based on the DG manufacturer's consumption values for the run time of the DG. Implicit in this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the DG when the DG lube oil sump does not hold adequate inventory for 7 days of maximum expected post LOCA load operation without the level reaching the manufacturer's recommended minimum level.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.8-46 LBDCR 18127

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.3 (continued)

REQUIREMENTS limits, would not have an immediate effect on DG operation. This Surveillance ensures the availability of high quality fuel oil for the DGs.

Fuel oil degradation during long term storage shows up as an increase in insolubles, mostly due to oxidation. The presence of insolubles does not mean that the fuel oil will not burn properly in a diesel engine. However, the insolubles can cause fouling of filters and fuel oil injection equipment, which can cause engine failure.

The Frequency of these Surveillances on the stored fuel oil takes into consideration fuel oil degradation trends indicating that overall fuel oil quality is unlikely to change between Frequency intervals.

SR 3.8.3.4 This Surveillance ensures that, without the aid of the refill compressor, sufficient air start capacity for each DG is available. For DG 11 and DG 12 the starting air system is required to have a minimum capacity for one emergency DG start attempt above the air pressure interlock, and multiple manual start attempts below the interlock, without recharging the air start receivers. For DG 13 the starting air system is required to have a minimum capacity for five successive DG start attempts without recharging the air start receivers. The pressure specified in this SR reflects the value at which this can be accomplished, but is not so high as to result in failing the limit due to normal cycling of the recharge compressor.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This Surveillance Requirement is met for a given division when one of the two starting air trains for the respective diesel generator meets the pressure specified in the Surveillance Requirement.

(continued)

GRAND GULF B 3.8-48 LBDCR 18127

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.5 REQUIREMENTS (continued) Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Periodic removal of water from the storage tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is for preventative maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of the Surveillance.

REFERENCES 1. UFSAR, Section 9.5.4.

2. Regulatory Guide 1.137.

3. ANSI N195, Appendix B, 1976.

(continued)

GRAND GULF B 3.8-49 LBDCR 18127

DC Sources Operating B 3.8.4 BASES (continued)

ACTIONS E.1 With the Division 3 DC electrical power subsystem inoperable for reasons other than its associated battery charger inoperable, the HPCS System may be incapable of performing its intended functions and must be immediately declared inoperable. This declaration also requires entry into applicable Conditions and Required Actions of LCO 3.5.1, "ECCS Operating."

F.1 and F.2 If the Division 3 DC electrical power subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. The Completion Time to bring the unit to MODE 4 is consistent with the time required in Regulatory Guide 1.93 (Ref. 7).

SURVEILLANCE SR 3.8.4.1 REQUIREMENTS Verifying battery terminal voltage while on float charge helps to ensure the effectiveness of the charging system and the ability of the batteries to perform their intended function. Float charge is the condition in which the charger is supplying the continuous charge required to overcome the internal losses of a battery (or battery cell) and maintain the battery (or battery cell) in a fully charged state. The voltage requirements are based on the nominal design voltage of the battery and are consistent with the initial voltages assumed in the battery sizing calculations. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.2 Visual inspection to detect corrosion of the battery cells and connections, or measurement of the resistance of each inter-cell, inter-rack, inter-tier, and terminal connection, provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance.

(continued)

GRAND GULF B 3.8-56 LBDCR 18127

DC Sources Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.2 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.4.3 Visual inspection of the battery cells, cell plates, and battery racks provides an indication of physical damage or abnormal deterioration that could potentially degrade battery performance. The presence of physical damage or deterioration does not necessarily represent a failure of this SR, provided an evaluation determines that the physical damage or deterioration does not affect the OPERABILITY of the battery (its ability to perform its design function).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.8-56a LBDCR 18127

DC Sources Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.4 and SR 3.8.4.5 REQUIREMENTS (continued) Visual inspection and resistance measurements of inter-cell, inter-rack, inter-tier, and terminal connections provides an indication of physical damage or abnormal deterioration that could indicate degraded battery condition. The anti-corrosion material is used to ensure good electrical connections and to reduce terminal deterioration. The visual inspection for corrosion is not intended to require removal of and inspection under each terminal connection.

The removal of visible corrosion is a preventive maintenance SR. The presence of visible corrosion does not necessarily represent a failure of this SR, provided visible corrosion is removed during performance of this Surveillance. For the purposes of this SR oxidation is not considered corrosion provided the resistance of the connection(s) is within limits.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.8.4.6 Battery charger capability requirements are based on the design capacity of the chargers (Ref. 4). According to Regulatory Guide 1.32 (Ref. 10),

the battery charger supply is required to be based on the largest combined demands of the various steady state loads and the charging capacity to restore the battery from the design minimum charge state to the fully charged state, irrespective of the status of the unit during these demand occurrences. The minimum required amperes and duration ensure that these requirements can be satisfied.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.8-57 LBDCR 18127

DC Sources Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.7 REQUIREMENTS (continued) A battery service test is a special test of the battery's capability, as found, to satisfy the design requirements (battery duty cycle) of the DC electrical power system. The discharge rate and test length (4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months for Division 1 and Division 2 and 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for Division 3) correspond to the design duty cycle requirements as specified in Reference 4.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 allows the once per 60 months performance of SR 3.8.4.8 in lieu of SR 3.8.4.7. This substitution is acceptable because SR 3.8.4.8 represents a more severe test of battery capacity than SR 3.8.4.7. The reason for Note 2 is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. The Division 3 test may be performed in MODE 1, 2, or 3 in conjunction with HPCS system outages. Credit may be taken for unplanned events that satisfy the Surveillance.

SR 3.8.4.8 A battery performance test is a test of constant current capacity of a battery, normally done in the as found condition, after having been in service, to detect any change in the capacity determined by the acceptance test. The test is intended to determine overall battery degradation due to age and usage.

The acceptance criteria for this Surveillance is consistent with IEEE-450 (Ref. 9) and IEEE-485 (Ref. 12). These references recommend that the battery be replaced if its capacity is below 80% of the manufacturer's rating. A capacity of 80% shows that the battery rate of deterioration is increasing, even if there is ample capacity to meet the load requirements.

(continued)

GRAND GULF B 3.8-58 LBDCR 18127

DC Sources Operating B 3.8.4 BASES SURVEILLANCE SR 3.8.4.8 (continued)

REQUIREMENTS The normal Surveillance Frequency is controlled under the Surveillance Frequency Control Program. If the battery shows degradation, or if the battery has reached 85% of its expected life and capacity is < 100% of the manufacturer's rating, the Surveillance Frequency is reduced to 12 months. However, if the battery shows no degradation but has reached 85% of its expected life, the Surveillance Frequency is only reduced to 24 months for batteries that retain capacity 100% of the manufacturer's rating. Degradation is indicated when the battery capacity drops by more than 10% of rated capacity relative to its capacity on the previous performance test or is below 90% of the manufacturer's rating. These Frequencies are based on the recommendations in IEEE-450 (Ref. 9).

This SR is modified by a Note. The reason for the Note is that performing the Surveillance would remove a required DC electrical power subsystem from service, perturb the electrical distribution system, and challenge safety systems. The Division 3 test may be performed in MODE 1, 2, or 3 in conjunction with HPCS system outages. Credit may be taken for unplanned events that satisfy the Surveillance.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 17.

2. Regulatory Guide 1.6, March 10, 1971.

3. IEEE Standard 308, 1978.

4. UFSAR, Section 8.3.2.

5. UFSAR, Chapter 6.

6. UFSAR, Chapter 15.

7. Regulatory Guide 1.93, December 1974.

8. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

9. IEEE Standard 450, 1987.

10. Not used.

11. Regulatory Guide 1.129, December 1974.

12. IEEE Standard 485.

GRAND GULF B 3.8-59 LBDCR 18127

DC Sources Shutdown B 3.8.5 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.5 DC Sources Shutdown BASES BACKGROUND A description of the DC sources is provided in the Bases for LCO 3.8.4, "DC Sources Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref.

2), assume that Engineered Safety Feature systems are OPERABLE.

The DC electrical power system provides normal and emergency DC electrical power for the diesel generators, emergency auxiliaries, and control and switching during all MODES of operation.

The OPERABILITY of the DC subsystems is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum DC electrical power sources during MODES 4 and 5 and during movement of irradiated fuel assemblies in the primary or secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate DC electrical power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving recently irradiated fuel. Due to radioactive decay, DC electrical power is only required to mitigate fuel handling accidents involving the handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

The DC sources satisfy Criterion 3 of the NRC Policy Statement.

(continued)

GRAND GULF B 3.8-60 LBDCR 18128

DC Sources Shutdown B 3.8.5 BASES LCO 1 or 2 onsite Class 1E DC electrical power distribution (continued) subsystem(s) required by LCO 3.8.8, "Distribution Systems - Shutdown" is required to be OPERABLE. Similarly, when the High Pressure Core Spray (HPCS) System is required to be OPERABLE, the Division 3 DC electrical power subsystem associated with the Division 3 onsite Class 1E DC electrical power distribution subsystem required to be OPERABLE by LCO 3.8.8 is required to be OPERABLE. In addition to the preceding subsystems required to be OPERABLE, a Class 1E battery or battery charger and the associated control equipment and interconnecting cabling capable of supplying power to the remaining Division 1 or 2 onsite Class 1E DC electrical power distribution subsystem(s), when portions of both Division 1 and 2 DC electrical power distribution subsystem are required to be OPERABLE by LCO 3.8.8. This ensures the availability of sufficient DC electrical power sources to operate the unit in a safe manner and to mitigate the consequences of postulated events during shutdown (e.g., fuel handling accidents involving recently irradiated fuel).

APPLICABILITY The DC electrical power sources required to be OPERABLE in MODES 4 and 5 and during movement of recently irradiated fuel assemblies in the primary or secondary containment provide assurance that:

a. Required features to provide core cooling;

b. Required features needed to mitigate a fuel handling accident involving recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) are available;

c. Required features necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown condition or refueling condition.

The DC electrical power requirements for MODES 1, 2, and 3 are covered in LCO 3.8.4.

(continued)

GRAND GULF B 3.8-61 LBDCR 18128

DC Sources Shutdown B 3.8.5 BASES ACTIONS C.1, C.2.1, C.2.2, and C.2.3 (continued)

If more than one DC distribution subsystem is required according to LCO 3.8.8, the DC subsystems remaining OPERABLE with one or more DC power sources inoperable for reasons other than an inoperable battery charger may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, and recently irradiated fuel movement. By allowing the option to declare required features inoperable with associated DC power source(s) inoperable, appropriate restrictions are implemented in accordance with the affected system LCOs' ACTIONS. In many instances this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS, and movement of recently irradiated fuel assemblies).

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required DC electrical power subsystems and to continue this action until restoration is accomplished in order to provide the necessary DC electrical power to the plant safety systems.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required DC electrical power subsystems should be completed as quickly as possible in order to minimize the time during which the plant safety systems may be without sufficient power.

SURVEILLANCE SR 3.8.5.1 REQUIREMENTS SR 3.8.5.1 requires performance of all Surveillances required by SR 3.8.4.1 through SR 3.8.4.8. Therefore, see the corresponding Bases for LCO 3.8.4 for a discussion of each SR.

This SR is modified by a Note. The reason for the Note is to preclude requiring the OPERABLE DC sources from being discharged below their capability to provide the required (continued)

GRAND GULF B 3.8-63 LBDCR 18128

Battery Cell Parameters B 3.8.6 BASES ACTIONS A.1, A.2, and A.3 (continued)

Continued operation is only permitted for 31 days before battery cell parameters must be restored to within Category A and B limits. Taking into consideration that while battery capacity is degraded, sufficient capacity exists to perform the intended function and to allow time to fully restore the battery cell parameters to normal limits, this time is acceptable for operation prior to declaring the DC batteries inoperable.

B.1 When any battery parameter is outside the Category C limit for any connected cell, sufficient capacity to supply the maximum expected load requirement is not assured and the corresponding DC electrical power subsystem must be declared inoperable. Additionally, other potentially extreme conditions, such as not completing the Required Actions of Condition A within the required Completion Time or average electrolyte temperature of representative cells falling below 60°F, also are cause for immediately declaring the associated DC electrical power subsystem inoperable.

SURVEILLANCE SR 3.8.6.1 REQUIREMENTS The SR verifies that Category A battery cell parameters are consistent with IEEE-450 (Ref. 3), which recommends regular battery inspections including float voltage, specific gravity, and electrolyte level of pilot cells.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.6.2 The inspection of specific gravity and voltage is consistent with IEEE-450 (Ref. 3). The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. In addition, within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months of a battery overcharge > 150 V, the battery must be demonstrated to meet Category B limits. This inspection is also consistent with IEEE-450 (Ref. 3), which recommends special inspections following a severe discharge or overcharge, to ensure that no significant degradation of the battery occurs as a consequence of such overcharge.

(continued)

GRAND GULF B 3.8-67 LBDCR 18127

Battery Cell Parameters B 3.8.6 BASES SURVEILLANCE SR 3.8.6.3 REQUIREMENTS (continued) This Surveillance verification that the average temperature of representative cells (every sixth connected cell) is t 60qF is consistent with a recommendation of IEEE-450 (Ref. 3).

Lower than normal temperatures act to inhibit or reduce battery capacity.

This SR ensures that the operating temperatures remain within an acceptable operating range. This limit is based on manufacturer's recommendations.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Table 3.8.6-1 This table delineates the limits on electrolyte level, float voltage, and specific gravity for three different categories. The meaning of each category is discussed below.

Category A defines the normal parameter limit for each designated pilot cell in each battery. The cells selected as pilot cells are those whose level, float voltage, and level, float specific gravity approximate the state of charge of the entire battery.

The Category A limits specified for electrolyte level are based on manufacturer's recommendations and are consistent with the guidance in IEEE-450 (Ref. 3), with the extra 1/4 inch allowance above the high water level indication for operating margin to account for temperature and charge effects. In addition to this allowance, footnote a to Table 3.8.6-1 permits the electrolyte level to be above the specified maximum level during equalizing charge, provided it is not overflowing. These limits ensure that the plates suffer no physical damage, and that adequate electron transfer capability is maintained in the event of transient conditions. IEEE-450 (Ref. 3) recommends that electrolyte level readings should be made only after the battery has been at float charge for at least 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

The Category A limit specified for float voltage is 2.13 V per cell. This value is based on the recommendation of IEEE-450 (Ref. 3), which states that prolonged operation of cells below 2.13 V can reduce the life expectancy of cells.

(continued)

GRAND GULF B 3.8-68 LBDCR 18127

Distribution Systems Operating B 3.8.7 BASES ACTIONS D.1 (continued)

With the Division 3 electrical power distribution system inoperable, the Division 3 powered systems are not capable of performing their intended functions. Immediately declaring the high pressure core spray inoperable allows the ACTIONS of LCO 3.5.1, "ECCS Operating," to apply appropriate limitations on continued reactor operation.

E.1 Condition E corresponds to a level of degradation in the electrical distribution system that causes a required safety function to be lost.

When more than one Condition is entered, and this results in the loss of a required function, the plant is in a condition outside the accident analysis.

Therefore, no additional time is justified for continued operation. LCO 3.0.3 must be entered immediately to commence a controlled shutdown.

SURVEILLANCE SR 3.8.7.1 REQUIREMENTS Meeting this Surveillance verifies that the AC and DC electrical power distribution systems are functioning properly, with the correct circuit breaker alignment. The correct breaker alignment ensures the appropriate separation and independence of the electrical divisions is maintained, and the appropriate voltage is available to each required bus.

The verification of proper voltage availability on the buses ensures that the required voltage is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

3. Regulatory Guide 1.93, December 1974.

4. UFSAR, Section 8.3.

5. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.8-78 LBDCR 18127

Distribution Systems Shutdown B 3.8.8 B 3.8 ELECTRICAL POWER SYSTEMS B 3.8.8 Distribution Systems Shutdown BASES BACKGROUND A description of the AC and DC electrical power distribution systems is provided in the Bases for LCO 3.8.7, "Distribution Systems Operating."

APPLICABLE The initial conditions of Design Basis Accident and SAFETY ANALYSES transient analyses in the UFSAR, Chapter 6 (Ref. 1) and Chapter 15 (Ref.

2), assume Engineered Safety Feature (ESF) systems are OPERABLE.

The AC and DC electrical power distribution systems are designed to provide sufficient capacity, capability, redundancy, and reliability to ensure the availability of necessary power to ESF systems so that the fuel, Reactor Coolant System, and containment design limits are not exceeded.

The OPERABILITY of the AC and DC electrical power distribution system is consistent with the initial assumptions of the accident analyses and the requirements for the supported systems' OPERABILITY.

The OPERABILITY of the minimum AC and DC electrical power sources and associated power distribution subsystems during MODES 4 and 5 and during movement of recently irradiated fuel assemblies in the primary or secondary containment ensures that:

a. The facility can be maintained in the shutdown or refueling condition for extended periods;

b. Sufficient instrumentation and control capability is available for monitoring and maintaining the unit status; and

c. Adequate power is provided to mitigate events postulated during shutdown, such as a fuel handling accident involving recently irradiated fuel. Due to radioactive decay, AC and DC electrical power is only (continued)

GRAND GULF B 3.8-80 LBDCR 18128

Distribution Systems Shutdown B 3.8.8 BASES (continued)

LCO Various combinations of subsystems, equipment, and components are required OPERABLE by other LCOs, depending on the specific plant condition. Implicit in those requirements is the required OPERABILITY of necessary support required features. This LCO explicitly requires energization of the portions of the electrical distribution system necessary to support OPERABILITY of Technical Specifications' required systems, equipment, and components both specifically addressed by their own LCOs, and implicitly required by the definition of OPERABILITY.

Maintaining these portions of the distribution system energized ensures the availability of sufficient power to operate the plant in a safe manner to mitigate the consequences of postulated events during shutdown (e.g.,

fuel handling accidents involving recently irradiated fuel).

APPLICABILITY The AC and DC electrical power distribution subsystems required to be OPERABLE in MODES 4 and 5 and during movement of recently irradiated fuel assemblies in the primary or secondary containment provide assurance that:

a. Systems that provide core cooling;

b. Systems needed to mitigate a fuel handling accident involving recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ) are available;

c. Systems necessary to mitigate the effects of events that can lead to core damage during shutdown are available; and

d. Instrumentation and control capability is available for monitoring and maintaining the unit in a cold shutdown or refueling condition.

The AC and DC electrical power distribution subsystem requirements for MODES 1, 2, and 3 are covered in LCO 3.8.7.

(continued)

GRAND GULF B 3.8-81 LBDCR 18128

Distribution Systems Shutdown B 3.8.8 BASES (continued)

ACTIONS The ACTIONS are modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not sufficient reason to require a reactor shutdown.

A.1, A.2.1, A.2.2, A.2.3, and A.2.4 Although redundant required features may require redundant divisions of electrical power distribution subsystems to be OPERABLE, one OPERABLE distribution subsystem division may be capable of supporting sufficient required features to allow continuation of CORE ALTERATIONS, and recently irradiated fuel movement. By allowing the option to declare required features associated with an inoperable distribution subsystem inoperable, appropriate restrictions are implemented in accordance with the affected distribution subsystem LCO's Required Actions. In many instances, this option may involve undesired administrative efforts. Therefore, the allowance for sufficiently conservative actions is made (i.e., to suspend CORE ALTERATIONS and movement of recently irradiated fuel assemblies in the primary and secondary containment).

Suspension of these activities shall not preclude completion of actions to establish a safe conservative condition. These actions minimize the probability of the occurrence of postulated events. It is further required to immediately initiate action to restore the required AC and DC electrical power distribution subsystems and to continue this action until restoration is accomplished in order to provide the necessary power to the plant safety systems.

Notwithstanding performance of the above conservative Required Actions, a required residual heat removal shutdown cooling (RHR-SDC) subsystem may be inoperable. In this case, Required Actions A.2.1 through A.2.4 do not adequately address the concerns relating to coolant circulation and heat removal. Pursuant to LCO 3.0.6, the RHR-SDC ACTIONS (continued)

GRAND GULF B 3.8-82 LBDCR 18128

Distribution Systems Shutdown B 3.8.8 BASES ACTIONS A.1, A.2.1, A.2.2, A.2.3, A.2.4, and A.2.5 (continued) would not be entered. Therefore, Required Action A.2.5 is provided to direct declaring RHR-SDC inoperable, which results in taking the appropriate RHR-SDC ACTIONS.

The Completion Time of immediately is consistent with the required times for actions requiring prompt attention. The restoration of the required distribution subsystems should be completed as quickly as possible in order to minimize the time the plant safety systems may be without power.

SURVEILLANCE SR 3.8.8.1 REQUIREMENTS This Surveillance verifies that the required AC and DC electrical power distribution subsystems are functioning properly, with the buses energized. The verification of proper voltage availability on the required buses ensures that the required power is readily available for motive as well as control functions for critical system loads connected to these buses. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Chapter 6.

2. UFSAR, Chapter 15.

GRAND GULF B 3.8-83 LBDCR 18127

Refueling Equipment Interlocks B 3.9.1 BASES ACTIONS A.1, A.2.1, and A.2.2 (continued) control rods to be withdrawn in accordance with LCO 3.10.6 while complying with these actions. This verification that all required control rods are fully inserted is in addition to the periodic verifications required by SR 3.9.3.1 and SR 3.10.6.2. Like Required Action A.1, Required Actions A.2.1 and A.2.2 ensure that unacceptable operations are blocked (e.g., loading fuel into a cell with the control rod withdrawn.)

The alternative option (Required Actions A.2.1 and A.2.2) also allows fuel movement to continue rather than halting refueling activities to perform SR 3.9.1.1 should it become due before completion of fuel movement activities.

This option should not be used to eliminate the first performance of the SR before starting in-vessel fuel movements. The objective of the option is to provide flexibility under limited circumstances, not to disable the refueling interlocks indefinitely and is only allowed for a period not to exceed 31 days, after which time performance of the SR 3.9.1.1 would be required.

SURVEILLANCE SR 3.9.1.1 REQUIREMENTS Performance of a CHANNEL FUNCTIONAL TEST demonstrates each required refueling equipment interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. The CHANNEL FUNCTIONAL TEST may be performed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Should this SR become due before completion of fuel movement activities, fuel movement may continue rather than halting refueling activities to perform the SR provided that Required Actions A.2.1 and A.2.2 are met. As discussed above, this option should not be used to (continued)

GRAND GULF B 3.9-4 LBDCR 18127

Refuel Position One-Rod-Out Interlock B 3.9.2 BASES (continued)

SURVEILLANCE SR 3.9.2.1 REQUIREMENTS Proper functioning of the refuel position one-rod-out interlock requires the reactor mode switch to be in refuel. During control rod withdrawal in MODE 5, improper positioning of the reactor mode switch could, in some instances, allow improper bypassing of required interlocks. Therefore, this Surveillance imposes an additional level of assurance that the refuel position one-rod-out interlock will be OPERABLE when required. By "locking" the reactor mode switch in the proper position (i.e., removing the reactor mode switch key from the console while the reactor mode switch is positioned in refuel), an additional administrative control is in place to preclude operator errors from resulting in unanalyzed operation.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.9.2.2 Performance of a CHANNEL FUNCTIONAL TEST on each channel demonstrates the associated refuel position one-rod-out interlock will function properly when a simulated or actual signal indicative of a required condition is injected into the logic. The CHANNEL FUNCTIONAL TEST may be performed by any series of sequential, overlapping, or total channel steps so that the entire channel is tested.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. To perform the required testing, the applicable condition must be entered (i.e., a control rod must be withdrawn from its full-in position). Therefore, this SR has been modified by a Note that states the CHANNEL FUNCTIONAL TEST is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after any control rod is withdrawn.

(continued)

GRAND GULF B 3.9-7 LBDCR 18127

Control Rod Position Indication B 3.9.3 BASES APPLICABLE Control rod position satisfies Criterion 3 of the NRC Policy SAFETY ANALYSES Statement.

(continued)

LCO All control rods must be fully inserted during applicable refueling conditions to minimize the probability of an inadvertent criticality during refueling.

APPLICABILITY During MODE 5, loading fuel into core cells with control rods withdrawn may result in inadvertent criticality. Therefore, the control rods must be inserted before loading fuel into a core cell. All control rods must be inserted before loading fuel to ensure that a fuel loading error does not result in loading fuel into a core cell with the control rod withdrawn.

In MODES 1, 2, 3, and 4, the reactor pressure vessel head is on, and no fuel loading activities are possible. Therefore, this Specification is not applicable in these MODES.

ACTIONS A.1 With all control rods not fully inserted during the applicable conditions, an inadvertent criticality could occur that is not analyzed in the UFSAR. All fuel loading operations must be immediately suspended. Suspension of these activities shall not preclude completion of movement of a component to a safe position.

SURVEILLANCE SR 3.9.3.1 REQUIREMENTS During refueling, to ensure that the reactor remains subcritical, all control rods must be fully inserted prior to and during fuel loading.

Periodic checks of the control rod position ensure this condition is maintained.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program (continued)

GRAND GULF B 3.9-10 LBDCR 18127

Control Rod OPERABILITY Refueling B 3.9.5 BASES SURVEILLANCE SR 3.9.5.1 and SR 3.9.5.2 (continued)

REQUIREMENTS The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.9.5.1 is modified by a Note that allows 7 days after withdrawal of the control rod to perform the Surveillance. This acknowledges that the control rod must first be withdrawn before performance of the Surveillance and therefore avoids potential conflicts with SR 3.0.3 and SR 3.0.4.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. UFSAR, Section 15.4.1.1.

GRAND GULF B 3.9-18 LBDCR 18127

RPV Water Level Irradiated Fuel B 3.9.6 BASES SURVEILLANCE SR 3.9.6.1 (continued)

REQUIREMENTS level limits the consequences of damaged fuel rods, which are postulated to result from a fuel handling accident in containment (Ref. 2).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program REFERENCES 1. Appendix B to Regulatory Guide 1.183, July 2000.

2. UFSAR, Section 15.7.4.

3. NUREG-0800, Section 15.0.1.

4. NUREG-0831, Supplement 6, Section 16.4.2.

5. 10 CFR 50.67, Accident Source Term.

GRAND GULF B 3.9-21 LBDCR 18127

RPV Water Level New Fuel or Control Rods B 3.9.7 BASES SURVEILLANCE SR 3.9.7.1 (continued)

REQUIREMENTS met. Water at the required level limits the consequences of damaged fuel rods, which are postulated to result from a fuel handling accident in containment (Ref. 2).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program REFERENCES 1. Appendix B to Regulatory Guide 1.183, July 2000.

2. UFSAR, Section 15.7.4.

3. NUREG-0800, Section 15.0.1.

4. NUREG-0831, Supplement 6, Section 16.4.2.

5. 10 CFR 50.67, Accident Source Term.

GRAND GULF B 3.9-24 LBDCR 18127

RHR High Water Level B 3.9.8 BASES ACTIONS B.1, B.2, B.3, and B.4 (continued) ensuring secondary containment is OPERABLE, one standby gas treatment subsystem is OPERABLE, and secondary containment isolation capability (i.e.,

at least one isolation valve and associated instrumentation in each associated penetration not isolated that is assumed to be isolated to mitigate radioactivity releases are OPERABLE or other acceptable administrative controls to assure isolation capability). This may be performed as an administrative check, by examining logs or other information, to determine whether the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, a surveillance may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.

C.1 and C.2 If no decay heat removal subsystem (RHR shutdown cooling subsystem or ADHRS) is in operation, an alternate method of coolant circulation is required to be established within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The Completion Time is modified such that 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling subsystem or ADHRS), the reactor coolant temperature must be periodically monitored to ensure proper functioning of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.9.8.1 REQUIREMENTS This Surveillance demonstrates that the RHR shutdown cooling subsystem or ADHRS is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.9-28 LBDCR 18127

RHR High Water Level B 3.9.8 BASES SURVEILLANCE SR 3.9.8.2 REQUIREMENTS RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the required RHR shutdown cooling subsystem(s) and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.

RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum (continued)

GRAND GULF B 3.9-28a LBDCR 14044

RHR High Water Level B 3.9.8 BASES SUREVEILLANCE SR 3.9.8.2 REQUIREMENTS (continued) potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILTY. The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

REFERENCES AECM-90/0135, MAEC-90/0236, ER-GG-2007-0028 GRAND GULF B 3.9-28b LBDCR 18127

RHR Low Water Level B 3.9.9 BASES (continued)

SURVEILLANCE SR 3.9.9.1 REQUIREMENTS This Surveillance demonstrates that one RHR shutdown cooling subsystem or ADHRS is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program SR 3.9.9.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling subsystems and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met. Accumulated gas should be eliminated or brought within the acceptance criteria limits.

(continued)

GRAND GULF B 3.9-33 LBDCR 18127

RHR Low Water Level B 3.9.9 BASES SURVEILLANCE SR 3.9.9.2 (continued)

REQUIREMENTS RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY.

The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

REFERENCES AECM-90/0135, MAEC-90/0236, ER-GG-2007-0028.

GRAND GULF B 3.9-34 LBDCR 18127

Inservice Leak and Hydrostatic Testing Operation B 3.10.1 BASES APPLICABLE coolant activity above the limits of LCO 3.4.8, "Reactor SAFETY ANALYSES Coolant System (RCS) Specific Activity," are minimized. In (continued) addition, the secondary containment will be OPERABLE, in accordance with this Special Operations LCO, and will be capable of handling any airborne radioactivity or steam leaks that could occur during the performance of hydrostatic or leak testing. The required pressure testing conditions provide adequate assurance that the consequences of a steam leak will be conservatively bounded by the consequences of the postulated main steam line break outside of primary containment described in Reference 2. Therefore, these requirements will conservatively limit radiation releases to the environment.

In the unlikely event of any primary system leak that could result in draining of the RPV, the reactor vessel would rapidly depressurize. The make-up capability required in MODE 4 by LCO 3.5.2, "RPV Water Inventory Control," would be more than adequate to keep the RPV water level above the TAF under this low decay heat load condition. Small system leaks would be detected by leakage inspections before significant inventory loss occurred.

For the purposes of this test, the protection provided by normally required MODE 4 applicable LCOs, in addition to the secondary containment requirements required to be met by this Special Operations LCO, will ensure acceptable consequences during normal hydrostatic test conditions and during postulated accident conditions.

As described in LCO 3.0.7, compliance with Special Operations LCOs is optional, and therefore, no criteria of the NRC Policy Statement apply.

Special Operations LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

LCO As described in LCO 3.0.7, compliance with this Special Operations LCO is optional. Operation at reactor coolant temperatures > 200qF, can be in accordance with Table 1.1-1 for MODE 3 operation without meeting this Special Operations LCO or its ACTIONS. This option may be required due to P/T limits, however, which require testing at temperatures (continued)

GRAND GULF B 3.10-2 LBDCR 18128

Reactor Mode Switch Interlock Testing B 3.10.2 BASES (continued)

REFERENCES 1. UFSAR, Section 7.2.1.1.

2. UFSAR, Section 15.4.1.1.

GRAND GULF B 3.10-9 LBDCR 18127

Single Control Rod Withdrawal - Hot Shutdown B 3.10.3 BASES ACTIONS A.1 (continued) added, which clarifies that this Required Action is only applicable if the requirements not met are for an affected LCO.

A.2.1 and A.2.2 Required Actions A.2.1 and A.2.2 are alternative Required Actions that can be taken instead of Required Action A.1 to restore compliance with the normal MODE 3 requirements, thereby exiting this Special Operations LCO's Applicability. Actions must be initiated immediately to insert all insertable control rods. Actions must continue until all such control rods are fully inserted. Placing the reactor mode switch in the shutdown position will ensure that all inserted rods remain inserted and restore operation in accordance with Table 1.1-1. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to place the reactor mode switch in the shutdown position provides sufficient time to normally insert the control rods.

SURVEILLANCE SR 3.10.3.1, SR 3.10.3.2, and SR 3.10.3.3 REQUIREMENTS The other LCOs made applicable in this Special Operations LCO are required to have their Surveillances met to establish that this Special Operations LCO is being met. If the local array of control rods is inserted and disarmed while the scram function for the withdrawn rod is not available, periodic verification in accordance with SR 3.10.3.2 is required to preclude the possibility of criticality. SR 3.10.3.2 has been modified by a Note, which clarifies that this SR is not required to be met if SR 3.10.3.1 is satisfied for LCO 3.10.3.d.1 requirements, since SR 3.10.3.2 demonstrates that the alternative LCO 3.10.3.d.2 requirements are satisfied. Also, SR 3.10.3.3 verifies that all control rods other than the control rod being withdrawn are fully inserted. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.10-13 LBDCR 18127

Single Control Rod Withdrawal - Cold Shutdown B 3.10.4 BASES (continued)

SURVEILLANCE SR 3.10.4.1, SR 3.10.4.2, SR 3.10.4.3, and SR 3.10.4.4 REQUIREMENTS The other LCOs made applicable by this Special Operations LCO are required to have their associated Surveillances met to establish that this Special Operations LCO is being met. If the local array of control rods is inserted and disarmed while the scram function for the withdrawn rod is not available, periodic verification is required to ensure that the possibility of criticality remains precluded. Verification that all the other control rods are fully inserted is required to meet the SDM requirements. Verification that a control rod withdrawal block has been inserted ensures that no other control rods can be inadvertently withdrawn under conditions when position indication instrumentation is inoperable for the affected control rod. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.10.4.2 and SR 3.10.4.4 have been modified by Notes, which clarify that these SRs are not required to be met if the alternative requirements demonstrated by SR 3.10.4.1 are satisfied.

REFERENCES 1. UFSAR, Section 15.4.1.1.

GRAND GULF B 3.10-19 LBDCR 18127

Single CRD Removal - Refueling B 3.10.5 BASES (continued)

ACTIONS A.1, A.2.1, and A.2.2 If one or more of the requirements of this Special Operations LCO are not met, the immediate implementation of these Required Actions restores operation consistent with the normal requirements for failure to meet LCO 3.3.1.1, LCO 3.3.8.2, LCO 3.9.1, LCO 3.9.2, LCO 3.9.4, and LCO 3.9.5 (i.e., all control rods inserted) or with the allowances of this Special Operations LCO. The Completion Times for Required Action A.1, Required Action A.2.1, and Required Action A.2.2 are intended to require these Required Actions be implemented in a very short time and carried through in an expeditious manner to either initiate action to restore the CRD and insert its control rod, or initiate action to restore compliance with this Special Operations LCO. Actions must continue until either Required Action A.2.1 or Required Action A.2.2 is satisfied.

SURVEILLANCE SR 3.10.5.1, SR 3.10.5.2, SR 3.10.5.3, SR 3.10.5.4, and REQUIREMENTS SR 3.10.5.5 Verification that all the control rods, other than the control rod withdrawn for the removal of the associated CRD, are fully inserted is required to ensure the SDM is within limits. Verification that the local five by five array of control rods other than the control rod withdrawn for the removal of the associated CRD, is inserted and disarmed electrically or hydraulically, while the scram function for the withdrawn rod is not available, is required to ensure that the possibility of criticality remains precluded. Verification that a control rod withdrawal block has been inserted ensures that no other control rods can be inadvertently withdrawn under conditions when position indication instrumentation is inoperable for the withdrawn control rod. The Surveillance for LCO 3.1.1, "SHUTDOWN MARGIN (SDM)," which is made applicable by this Special Operations LCO, is required in order to establish that this Special Operations LCO is being met. Verification that no other CORE ALTERATIONS are being made is required to ensure the assumptions of the safety analysis are satisfied.

Periodic verification of the administrative controls established by this Special Operations LCO is prudent to preclude the possibility of an inadvertent criticality. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.10-23 LBDCR 18127

Single CRD Removal - Refueling B 3.10.5 BASES (continued)

REFERENCES 1. UFSAR, Section 15.4.1.1.

GRAND GULF B 3.10-24 LBDCR 18127

Multiple Control Rod Withdrawal - Refueling B 3.10.6 BASES (continued)

APPLICABILITY Operation in MODE 5 is controlled by existing LCOs. The exceptions from other LCO requirements (e.g., the ACTIONS of LCO 3.9.3, LCO 3.9.4 or LCO 3.9.5) allowed by this Special Operations LCO are appropriately controlled by requiring all fuel to be removed from cells whose "full in" indicators are allowed to be bypassed.

ACTIONS A.1, A.2, A.3.1, and A.3.2 If one or more of the requirements of this Special Operations LCO are not met, the immediate implementation of these Required Actions commences activities which will restore operation consistent with the normal requirements for refueling (i.e., all control rods inserted in core cells containing one or more fuel assemblies) or with the exceptions granted by this Special Operations LCO. The Completion Times are intended to require that these Required Actions be implemented in a very short time and carried through in an expeditious manner.

SURVEILLANCE SR 3.10.6.1, SR 3.10.6.2, and SR 3.10.6.3 REQUIREMENTS Periodic verification of the administrative controls established by this Special Operations LCO is prudent to preclude the possibility of an inadvertent criticality. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 15.4.1.1.

GRAND GULF B 3.10-27 LBDCR 18127

SDM Test - Refueling B 3.10.8 BASES (continued)

SURVEILLANCE SR 3.10.8.1, SR 3.10.8.2 and SR 3.10.8.3 REQUIREMENTS The other LCOs made applicable in this Special Operations LCO are required to have applicable Surveillances met to establish that this Special Operations LCO is being met. However, the control rod withdrawal sequences during the SDM tests may be enforced by the RPC (LCO 3.3.2.1, Function 1b, MODE 2 requirements) or by a second licensed operator or other qualified member of the technical staff. As noted, either the applicable SRs for the RPC (LCO 3.3.2.1) must be satisfied according to the applicable Frequencies (SR 3.10.8.2), or the proper movement of control rods must be verified (SR 3.10.8.3). This latter verification (i.e., SR 3.10.8.3) must be performed during control rod movement to prevent deviations from the specified sequence. These surveillances provide adequate assurance that the specified test sequence is being followed.

SR 3.10.8.4 Periodic verification of the administrative controls established by this LCO will ensure that the reactor is operated within the bounds of the safety analysis. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.10.8.5 A coupling verification such as described in the Bases for SR 3.1.3.5 is performed to ensure the control rod is connected to the control rod drive mechanism and will perform its intended function when necessary. The verification is required to be performed any time a control rod is withdrawn to the "full out" notch position or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not being moved as well as operating experience related to uncoupling events.

(continued)

GRAND GULF B 3.10-36 LBDCR 18127

SDM Test - Refueling B 3.10.8 BASES SURVEILLANCE SR 3.10.8.6 REQUIREMENTS (continued) CRD charging water header pressure verification is performed to ensure the motive force is available to scram the control rods in the event of a scram signal. A minimum accumulator pressure is specified, below which the capability of the accumulator to perform its intended function becomes degraded and the accumulator is considered inoperable. The minimum accumulator pressure of 1520 psig is well below the expected pressure of 1750 psig. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, GESTAR II" (latest approved revision).

2. Letter, T. A. Pickens (BWROG) to G. C. Lainas (NRC),

"Amendment 17 to General Electric Licensing Topical Report NEDE-24011-P-A," August 15, 1986.

GRAND GULF B 3.10-37 LBDCR 18127

GNRO-2020/00022, Report of Technical Specification Bases Changes

Contents

Text

SUBJECT:

Dear Sir or Madam:

Attachment:

Navigation menu

GNRO-2020/00022, Report of Technical Specification Bases Changes

Text

SUBJECT:

Dear Sir or Madam:

Attachment:

Navigation menu

Search