Text

Part 4 of 6 - Tech Spec Pages for Amendments 231 and 212 for North Anna, Units 1 & 2. Pages B 3.3.3-1 Through B 3.5.6-5
	ML021220254
Person / Time
Site:	North Anna
Issue date:	04/05/2002
From:	; Office of Nuclear Reactor Regulation
To:	;
References
	TAC MB0799, TAC MB0800
	Download: ML021220254 (186)
	v • d • e

PAM Instrumentation B 3.3.3 B 3.3 INSTRUMENTATION B 3.3.3 Post Accident Monitoring (PAM)

Instrumentation BASES BACKGROUND The primary purpose of the PAM instrumentation is to display unit variables that provide information required by the control room operators during accident situations. This information provides the necessary support for the operator to take the manual actions for which no automatic control is provided and that are required for safety systems to accomplish their safety functions for Design Basis Accidents (DBAs).

The OPERABILITY of the accident monitoring instrumentation ensures that there is sufficient information available on selected unit parameters to monitor and to assess unit status and behavior following an accident.

The availability of accident monitoring instrumentation is important so that responses to corrective actions can be observed and the need for, and magnitude of, further actions

-can be determined. These essential instruments are identified by Reference 1 addressing the recommendations of Regulatory Guide 1.97 (Ref.

2) as required by Supplement 1 to NUREG-0737 (Ref. 3).

The instrument channels required to be OPERABLE by this LCO include two classes of parameters identified during unit specific implementation of Regulatory Guide 1.97 as Type A and Category I variables.

Type A variables are included in this LCO because they provide the primary information required for the control room operator to take specific manually controlled actions for which no automatic control is provided, and that are required for safety systems to accomplish their safety functions for DBAs. Primary information is defined as information that is essential for the direct accomplishment of the specific safety functions; it does not include those variables that are associated with contingency actions that may also be identified in written procedures.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.3.3-1

PAM Instrumentation B 3.3.3 BASES BACKGROUND Category I variables are the key variables deemed risk (continued) significant because they are needed to:

"* Determine whether other systems important to safety are performing their intended functions;

"* Provide information to the operators that will enable them to determine the likelihood of a gross breach of the barriers to radioactivity release; and

"* Provide information regarding the release of radioactive materials to allow for early indication of the need to initiate action necessary to protect the. public, and to estimate the magnitude of any impending threat.

These key variables are identified by the plant specific Regulatory Guide 1.97 analyses (Ref.

1).

This report identifies the plant specific Type A and Category I variables and provides justification for deviating from the NRC proposed list of Category I variables.

The specific instrument Functions listed in Table 3.3.3-1 are discussed in the LCO section.

APPLICABLE The PAM instrumentation ensures the operability of SAFETY ANALYSES Regulatory Guide 1.97 Type A and Category I variables so that the control room operating staff can:

"* Perform the diagnosis specified in the emergency operating procedures (these variables are restricted to pre-planned actions for the primary success path of DBAs),

e.g., loss of coolant accident (LOCA);

"* Take the specified, pre-planned, manually controlled actions, for which no automatic control is provided, and that are required for safety systems to accomplish their safety function;

"* Determine whether systems important to safety are performing their intended functions;

"* Determine the likelihood of a gross breach of the barriers to radioactivity release;

"* Determine if a gross breach of a barrier has occurred; and (continued)

Revision 0 North Anna Units 1 and 2 B 3.3.3-2

PAM Instrumentation B 3.3.3 BASES APPLICABLE

Initiate action necessary to protect the public and to SAFETY ANALYSES estimate the magnitude of any impending threat.

(continued)

PAM instrumentation that meets the definition of Type A in Regulatory Guide 1.97 satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii). Category I, non-Type A, instrumentation must be retained in TS because it is intended to assist operators in minimizing the consequences of accidents.

Therefore, Category I, non-Type A, variables are important for reducing public risk.

LCO The PAM instrumentation LCO provides OPERABILITY requirements for Regulatory Guide 1.97 Type A monitors, which provide information required by the control room operators to perform certain manual actions specified in the plant Emergency Operating Procedures. These manual actions ensure that a system can accomplish its safety function, and are credited in the safety analyses. Additionally, this LCO addresses Regulatory Guide 1.97 instruments that have been designated Category I, non-Type A.

The OPERABILITY of the PAM instrumentation ensures there is sufficient information available on selected unit parameters to monitor and assess unit status following an accident.

This capability is consistent with Reference 1.

LCO 3.3.3 requires two OPERABLE channels for most Functions.

Two OPERABLE channels ensure no single failure prevents operators from getting the information necessary for them to determine the safety status of the unit, and to bring the unit to and maintain it in a safe condition following an accident.

Furthermore, OPERABILITY of two channels allows a CHANNEL CHECK during the post accident phase to confirm the validity of displayed information.

The exception to the two channel requirement is Containment Isolation Valve (CIV) Position. In this case, the important information is the status of the containment penetrations.

The LCO requires one position indicator for each active CIV.

This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve and prior knowledge of a passive valve, or via system boundary status. If a normally active CIV is known to be closed and deactivated, position (continued)

North Anna Units 1 and 2 B 3.3.3-3 Revision 0

PAM Instrumentation B 3.3.3 BASES LCO indication is not needed to determine status. Therefore, the (continued) position indication for valves in this state is not required to be OPERABLE.

Table 3.3.3-1 lists all Type A and Category I variables identified by the plant specific Regulatory Guide 1.97 analyses (Ref. 1).

Type A and Category I variables are required to meet Regulatory Guide 1.97 Category I (Ref. 2) design and qualification requirements for seismic and environmental qualification, single failure criterion, utilization of emergency standby power, immediately accessible display, continuous readout, and recording of display.

Listed below are discussions of the specified instrument Functions listed in Table 3.3.3-1.

1, 2.

Power Range and Source Range Neutron Flux Power Range and Source Range Neutron Flux indication is provided to verify reactor shutdown. This indication is provided by the Gammametric channels. The two ranges are necessary to cover the full range of flux that may occur post accident.

Neutron flux is used for accident diagnosis, verification of subcriticality, and diagnosis of positive reactivity insertion.

3, 4.

Reactor Coolant System (RCS)

Hot and Cold Leg Temperatures (Wide Ranges)

RCS Hot and Cold Leg Temperature wide range indications are Category I variables provided for verification of core cooling and long term surveillance.

The RCS cold leg temperature is used in conjunction with RCS hot leg temperature to verify the unit conditions necessary to establish natural circulation in the RCS.

The channels provide indication over a range of O°F to 7000F.

North Anna Units 1 and 2 Revision 0 B 3.3.3-4

PAM Instrumentation B 3.3.3 BASES LCO

5.

Reactor Coolant System Pressure (Wide Range)

(continued)

RCS wide range pressure is a Category I variable provided for verification of core cooling and RCS integrity long term surveillance.

RCS pressure is used to verify closure of spray line valves and pressurizer power operated relief valves (PORVs).

In addition to these verifications, RCS pressure is used for determining RCS subcooling margin. RCS subcooling margin will allow termination of safety injection (SI),

if still in progress, or reinitiation of SI if it has been stopped. RCS pressure can also be used:

to determine whether to terminate actuated SI or to reinitiate stopped SI;

to determine when to reset SI and shut off low head SI;

to manually restart low head SI;

to make a decision on operation of reactor coolant pumps (RCPs); and

to make a determination on the nature of the accident in progress and where to go next in the procedure.

RCS subcooling margin is also used for unit stabilization and cooldown control.

RCS pressure is also related to three decisions about depressurization. They are:

"* to determine whether to proceed with primary system depressurization;

"* to verify termination of depressurization; and

"* to determine whether to close accumulator isolation valves during a controlled cooldown/depressurization.

Another use of RCS pressure is to determine whether to operate the pressurizer heaters.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.3.3-5

PAM Instrumentation B 3.3.3 BASES LCO

5.

Reactor Coolant System Pressure (Wide Range) (continued)

RCS pressure is a Type A variable because the operator uses this indication to monitor subcooling margin during the cooldown of the RCS following a steam generator tube rupture (SGTR) or small break LOCA. Operator actions to maintain a controlled cooldown, such as adjusting steam generator (SG) pressure or level, would use this indication.

6.

Inadequate Core Cooling Monitoring (ICCM)

System The ICCM consists of three functional. subsystems. Each subsystem is composed of two instrumentation trains. The three subsystems of ICCM are: the Reactor Vessel Level Instrumentation System (RVLIS); Core Exit Temperature Monitoring (CETM); and Subcooling Margin Monitor (SMM).

The functions provided by the subsystems are discussed below.

6.a Reactor Vessel Level Instrumentation System RVLIS is provided for verification and long term surveillance of core cooling. It is also used to determine reactor coolant inventory adequacy.

The RVLIS provides a measurement of the collapsed liquid level above the upper core plate. The collapsed level represents the amount of liquid mass that is in the reactor vessel above the core. Measurement of the collapsed water level is selected because it is an indication of the water inventory.

6.b Reactor Coolant System Subcooling Margin Monitor The RCS SMM is a Category I variable provided for verification of core cooling. The SMM subsystem calculates the margin to saturation for the RCS from inputs of wide range RCS pressure transmitters and the average of the five highest temperature core exit thermocouples. The two trains of SMM receive inputs from separate trains of pressure transmitters and core exit thermocouples (CETs).

(continued)

North Anna Units 1 and 2 Revision 0 B 3.3.3-6

PAM Instrumentation B 3.3.3 BASES LCO 6.b Reactor Coolant System Subcooling Margin Monitor (continued)

The SMM indicators are redundant to the information provided by the RCS hot and cold leg temperature and RCS wide range pressure indicators. RCS subcooling margin will allow termination of SI, if still in progress, or reinitiating of SI if it has been secured. RCS subcooling margin is also used for unit stabilization, cooldown control, and RCP trip criteria. The SMM indicates the degree of subcooling from -350F (superheated) to +200°F (subcooled).

6.c Core Exit Temperature Monitoring CETM is provided for verification and long term surveillance of core cooling. Two OPERABLE CETs per channel are required in each core quadrant to provide indication of radial distribution of the coolant temperature rise across representative regions of the core. Two sets of two thermocouples ensure a single failure will not disable the ability to determine the radial temperature gradient. Monitoring of the CETs is available through the Inadequate Core Cooling Monitor.

Different CETs are connected to their respective

channel, so a single CET failure does not affect both channels. The following CET indication is provided in the control room:

"* Five hottest thermocouples (ranked from highest to lowest);

"* Maximum, Average, and Minimum temperatures for each quadrant; and

"* Average of the five high thermocouples.

7.

Containment Sump Water Level (Wide Range)

Containment Sump Water Level is provided for verification and long term surveillance of RCS integrity.

Containment Sump Water Level is used for accident diagnosis.

North Anna Units 1 and 2 Revision 0 B 3.3.3-7

PAM Instrumentation B 3.3.3 BASES LCO 8, 9.

Containment Pressure and Containment Pressure Wide Range (continued)

Containment Pressure and Containment Pressure Wide Range are provided for verification of RCS and containment OPERABILITY.

Containment Pressure channels are used to verify Safety Injection (SI) initiation and Phase A isolation on a Containment Pressure-High signal. These channels are also used to verify closure of the Main Steam Trip Valves on a Containment Pressure-Intermediate High High signal.

The Containment Pressure channels are also used to verify initiation of Containment Spray and Phase B isolation on a Containment Pressure-High High signal.

10. Penetration Flow Path Containment Isolation Valve Position CIV Position is provided for verification of Containment OPERABILITY, and Phase A and Phase B isolation.

When used to verify Phase A and Phase B isolation, the important information is the isolation status of the containment penetrations. The LCO requires one channel of valve position indication in the control room to be OPERABLE for each active CIV in a containment penetration flow path, i.e., two total channels of CIV position indication for a penetration flow path with two active valves. For containment penetrations with only one active CIV having control room indication, Note (b) requires a single channel of valve position indication to be OPERABLE. This is sufficient to redundantly verify the isolation status of each isolable penetration either via indicated status of the active valve, as applicable, and prior knowledge of a passive valve, or via system boundary status. If a normally active CIV is known to be closed and deactivated, position indication is not needed to determine status. Therefore, the position indication for valves in this state is not required to be OPERABLE.

Note (a) to the Required Channels states that the Function is not required for isolation valves whose associated penetration is isolated by at least one closed and deactivated automatic valve, closed manual valve, blind flange, or check valve with flow through the valve secured. Each penetration is treated separately and each penetration flow path is considered a separate function. Therefore, separate Condition entry is allowed for each inoperable penetration flow path.

North Anna Units 1 and 2 Revision 0 B 3.3.3-8

PAM Instrumentation B 3.3.3 BASES LCO

11. Containment Area Radiation (High Range)

(continued)

Containment Area Radiation is provided to monitor for the potential of significant radiation releases and to provide release assessment for use by operators in determining the need to invoke site emergency plans.

Containment radiation level is used to determine if adverse containment conditions exist.

12. Containment Hydrogen Analyzers Containment hydrogen analyzers are provided to detect high hydrogen concentration conditions that represent a potential for containment breach from a hydrogen explosion. This variable is also important in verifying the adequacy of mitigating actions. The containment hydrogen analyzers are shared between units.

13. Pressurizer Level Pressurizer Level is used to determine whether to terminate SI, if still in progress, or to reinitiate SI if it has been stopped. Knowledge of pressurizer water level is also used to verify the unit conditions necessary to establish natural circulation in the RCS and to verify that the unit is maintained in a safe shutdown condition.

14,

15. Steam Generator Water Level (Wide and Narrow Ranges)

SG Water Level is provided to monitor operation of decay heat removal via the SGs. Both wide and narrow ranges are Category I indications of SG level. The wide range level covers a span of +7 to -41 feet from nominal full load water level. The narrow range instrument covers from +7 to -5 feet of nominal full load water level.

The level signals are inputs to the unit computer, control room indicators, and the Auxiliary Feedwater System.

SG Water Level is used to:

"* identify the affected SG following a tube rupture;

"* verify that the intact SGs are an adequate heat sink for the reactor; (continued)

North Anna Units 1 and 2 B 3.3.3-9 Revision 0

PAM Instrumentation B 3.3.3 BASES LCO 14, 15. Steam Generator Water Level (Wide and Narrow Ranges)

(conti nued)

"* determine the nature of the accident in progress (e.g., verify a SGTR); and

"* verify unit conditions for termination of SI during secondary unit High Energy Line Breaks (HELBs) outside containment.

Operator action is based on the control room indication of SG level. The RCS response during a design basis small break LOCA depends on the break size. For a certain range of break sizes, a secondary heat sink is necessary to remove decay heat. Narrow range level is a Type A variable because the operator must manually raise and control SG level.

16. Emergency Condensate Storage Tank (ECST) Level ECST Level is provided to ensure water supply for auxiliary feedwater (AFW).

The ECST provides the ensured safety grade water supply for the AFW System. Inventory is monitored by a 0% to 100% level indication and ECST Level is displayed on a control room indicator.

The DBAs that require AFW are the loss of offsite electric power, loss of normal feedwater, SGTR, steam line break (SLB),

and small break LOCA.

The ECST is the initial source of water for the AFW System. However, as the ECST is depleted, manual operator action is necessary to replenish the ECST.

17. Steam Generator Pressure SG pressure is a Category I variable and provides an indication of the integrity of a steam generator. This indication can provide important information in the event of a faulted or ruptured steam generator.

18. High Head Safety Injection (HHSI)

Flow Total HHSI flow to the RCS cold legs is a Type A variable and provides an indication of the total borated water supplied to the RCS. For the small break LOCA, HHSI flow may be the only source of borated water that is injected (continued)

North Anna Units 1 and 2 Revision 0 B 3.3.3-10

PAM Instrumentation B 3.3.3 BASES LCO

18. High Head Safety Injection (HHSI)

Flow (continued) into the RCS. Total HHSI flow is a Type A variable because it provides an indication to the operator for the RCP trip criteria.

APPLICABILITY The PAM instrumentation LCO is applicable in MODES 1, 2, and 3. These variables are related to the diagnosis and pre-planned actions required to mitigate DBAs.

The applicable DBAs are assumed to occur in MODES 1, 2, and 3. In MODES 4, 5,

and 6, unit conditions are such that the likelihood of an event that would require PAM instrumentation is low; therefore, the PAM instrumentation is not required to be OPERABLE in these MODES.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently.for each Function listed on Table 3.3.3-1. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A applies when one or more Functions have one required channel that is inoperable. Required Action A.1 requires restoring the inoperable channel to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel (or in the case of a Function that has only one required channel, other non-Regulatory Guide 1.97 instrument channels to monitor the Function), the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.

B.1 Condition B applies when the Required Action and associated Completion Time for Condition A are not met. This Required Action specifies initiation of actions in Specification 5.6.6, which requires a written report to be submitted to the NRC immediately. This report discusses the results of the (continued)

North Anna Units 1 and 2 ACTIONS Revision 0 B 3.3.3-11

PAM Instrumentation B 3.3.3 BASES ACTIONS B.1 (continued) root cause evaluation of the inoperability and identifies proposed restorative actions. This action is appropriate in lieu of a shutdown requirement since alternative actions are identified before loss of functional capability, and given the likelihood of unit conditions that would require information provided by this instrumentation.

C.'

Condition C applies when one or more Functions have two inoperable required channels (i.e., two channels inoperable in the same Function). Required Action C.1 requires restoring one channel in the Function(s) to OPERABLE status within 7 days. The Completion Time of 7 days is based on the relatively low probability of an event requiring PAM instrument operation and the availability of alternate means to obtain the required information. Continuous operation with two required channels inoperable in a Function is not acceptable because the alternate indications may not fully meet all performance qualification requirements applied to the PAM instrumentation. Therefore, requiring restoration of one inoperable channel of the Function limits the risk that the PAM Function will be in a degraded condition should an accident occur.

D.1 and D.2 If the Required Action and associated Completion Time of Condition D is not met the unit must be brought to a MODE where the requirements of this LCO do not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power in an orderly manner and without challenging unit systems.

SURVEILLANCE A Note has been added to the SR Table to clarify that REQUIREMENTS SR 3.3.3.1 and SR 3.3.3.3 apply to each PAM instrumentation Function in Table 3.3.3-1 with the exception that SR 3.3.3.3 is not required to be performed on the containment hydrogen analyzers or the containment isolation valve position (continued)

North Anna Units 1 and 2 B 3.3.3-12 Revision 0

PAM Instrumentation B 3.3.3 BASES SURVEILLANCE indication. SR 3.3.3.2 is required to be performed on the REQUIREMENTS containment hydrogen analyzers. SR 3.3.3.4 is required for (continued) the containment isolation valve position indication.

SR 3.3.3.1 Performance of the CHANNEL CHECK once every 31 days ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION. The high radiation instrumentation should be compared to similar unit instruments located throughout the unit.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. If the channels are within the criteria, it is an indication that the channels are OPERABLE.

As specified in the SR, a CHANNEL CHECK is only required for those channels that are normally energized.

The Frequency of 31 days is based on operating experience that demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.3.2 A CHANNEL CALIBRATION is performed on the containment hydrogen analyzers every 92 days and uses a gas solution containing a one volume percent (+/- 0.25%) of hydrogen and a sample of four volume percent (+/- 0.25%) of hydrogen with the balance of each gas sample being nitrogen. The containment hydrogen analyzer heat trace system is verified OPERABLE as a part of this surveillance.

North Anna Units 1 and 2 Revi sion 0 B 3.3.3-13

PAM Instrumentation B 3.3.3 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.3.3 A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor.

The test verifies that the channel responds to measured parameter with the necessary range and accuracy. This SR is modified by a Note that excludes neutron detectors. Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the CET sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element. The Frequency is based on operating experience and consistency with the typical industry refueling cycle.

SR 3.3.3.4 SR 3.3.3.4 is the performance of a TADOT of containment isolation valve position indication. This TADOT is performed every 18 months. The test shall independently verify the OPERABILITY of containment isolation valve position indication against the actual position of the valves.

The Frequency is based on the known reliability of the Functions, and has been shown to be acceptable through operating experience.

REFERENCES

1. Technical Report PE-0013.

2. Regulatory Guide 1.97, May 1983.

3.

NUREG-0737, Supplement 1, "TMI Action Items."

North Anna Units 1 and 2 Revision 0 B 3.3.3-14

Remote Shutdown System B 3.3.4 B 3.3 INSTRUMENTATION B 3.3.4 Remote Shutdown System BASES BACKGROUND APPLICABLE SAFETY ANALYSES The Remote Shutdown System provides the control room operator with sufficient instrumentation and controls to maintain the unit in a safe shutdown condition from a location other than the control room. This capability is necessary to protect against the possibility that the control room becomes inaccessible. A safe shutdown condition is defined as MODE 3. With the unit in MODE 3, the Auxiliary Feedwater (AFW)

System and the steam generator (SG) power operated relief valves (PORVs) can be used to remove core decay heat and meet all safety requirements. The long term supply of water for the AFW System and the ability to borate the Reactor Coolant System (RCS) from outside the control room allows extended operation in MODE 3.

If the control room becomes inaccessible, the operators can establish control at the auxiliary shutdown panel, and maintain the unit in MODE 3. Not all controls and necessary transfer switches are located at the auxiliary shutdown panel.

Some controls and transfer switches will have to be operated locally at the switchgear, motor control panels, or other local stations. The unit automatically reaches MODE 3 following a unit shutdown and can be maintained safely in MODE 3 for an extended period of time.

The OPERABILITY of the remote shutdown control and instrumentation functions ensures there is sufficient information available on selected unit parameters to maintain the unit in MODE 3 should the control room become inaccessible.

The Remote Shutdown System is required to provide equipment at appropriate locations outside the control room with a capability to maintain the unit in a safe condition in MODE 3.

The criteria governing the requirements of the Remote Reference 1.

design and specific system Shutdown System are located in The Remote Shutdown System satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

North Anna Units 1 and 2 B 3.3.4-1 Revisi on 0

Remote Shutdown System B 3.3.4 BASES LCO The Remote Shutdown System LCO provides the OPERABILITY requirements of the instrumentation and controls necessary to maintain the unit in MODE 3 from a location other than the control room. The instrumentation and controls required are listed in Table B 3.3.4-1.

The controls, instrumentation, and transfer switches are required for:

Core reactivity control (long term);

"- RCS pressure control;

"- Decay heat removal via the AFW System and the SG PORVs; and

"* RCS inventory control via charging flow.

A Function of a Remote Shutdown System is OPERABLE if all instrument and control channels needed to support the Remote Shutdown System Function are OPERABLE.

In some cases, Table B 3.3.4-1 may indicate that the required information or control capability is available from several alternate sources. In these cases, the Function is OPERABLE as long as one channel of any of the alternate information or control sources is OPERABLE.

The remote shutdown instrument and control circuits covered by this LCO do not need to be energized to be considered OPERABLE. This LCO is intended to ensure the instruments and control circuits will be OPERABLE if unit conditions require that the Remote Shutdown System be placed in operation.

APPLICABILITY The Remote Shutdown System LCO is applicable in MODES 1, 2, and 3. This is required so that the unit can be maintained in MODE 3 for an extended period of time from a location other than the control room.

This LCO is not applicable in MODE 4, 5, or 6.

In these MODES, the facility is already subcritical and in a condition of reduced RCS energy. Under these conditions, considerable time is available to restore necessary instrument control functions if control room instruments or controls become unavailable.

North Anna Units 1 and 2 Revision 0 B 3.3.4-2

Remote Shutdown System B 3.3.4 BASES ACTIONS A Remote Shutdown System function is inoperable when the function is not accomplished by at least one designed Remote Shutdown System channel that satisfies the OPERABILITY criteria for the channel's Function. These criteria are outlined in the LCO section of the Bases.

A Note has been added to the ACTIONS to clarify the application of Completion Time rules. Separate Condition entry is allowed for each Function. The Completion Time(s) of the inoperable channel(s)/train(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function.

A.1 Condition A addresses the situation where one or more required Functions of the Remote Shutdown System are inoperable. This includes the control and transfer switches for any required function.

The Required Action is to restore the required Function to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.

B.1 and B.2 If the Required Action and associated Completion Time of Condition A is not met, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.3.4.1 REQUIREMENTS Performance of the CHANNEL CHECK once every 31 days ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the two instrument channels could be an indication of (continued)

North Anna Units 1 and 2 B 3.3.4-3 Revision 0

Remote Shutdown System B 3.3.4 BASES SURVEILLANCE SR 3.3.4.1 (continued)

REQUIREMENTS excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the unit staff, based on a combination of the channel instrument uncertainties, including indication and readability. If the channels are within the criteria, it is an indication that the channels are OPERABLE.

If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

As specified in the Surveillance, a CHANNEL CHECK is only required for those channels which are normally energized.

The Frequency of 31 days is based upon operating experience which demonstrates that channel failure is rare. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the LCO required channels.

SR 3.3.4.2 SR 3.3.4.2 verifies each required Remote Shutdown System control circuit and transfer switch performs the intended function. This verification is performed from the remote shutdown panel and locally, as appropriate. Operation of the equipment from the remote shutdown panel is not necessary.

The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the unit can be maintained in MODE 3 from the remote shutdown panel and the local control stations. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

(However, this Surveillance is not required to be performed only during a unit outage.)

Operating experience demonstrates that remote shutdown control channels usually pass the Surveillance test when performed at the 18 month Frequency.

North Anna Units 1 and 2 B 3.3.4-4 Revision 0

Remote Shutdown System B 3.3.4 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.3.4.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies that the channel responds to a measured parameter within the necessary range and accuracy.

Whenever a sensing element is replaced, the next required CHANNEL CALIBRATION of the resistance temperature detector (RTD) sensors is accomplished by an inplace cross calibration that compares the other sensing elements with the recently installed sensing element.

The Frequency of 18 months is based upon operating experience and consistency with the refueling cycle.

REFERENCES

1. UFSAR, Chapter 3.

North Anna Units 1 and 2 Revision 0 B 3.3.4-5

Remote Shutdown System B 3.3.4 Table B 3.3.4-1 (page 1 of 1)

Remote Shutdown System Instrumentation and Controls FUNCTION/INSTRUMENT REQUIRED OR CONTROL PARAMETER NUMBER OF FUNCTIONS

1. Reactivity Control

a. Boric Acid Pump controls

2. Reactor Coolant System (RCS)

Pressure Control

a. Pressurizer Pressure indications 1

b. Pressurizer Heater controls 1

3.

Decay Heat Removal via Steam Generators (SGs)

a. RCS Tavg Temperature indication 1 loop

b.

AFW Pump and Valve controls 1

c.

SG Pressure indication 1

d.

SG Level (Wide Range) indication 1

e.

SG Power Operated Relief Valve controls 1

f. AFW Discharge Header Pressure indication 1

g.

Emergency Condensate Storage Tank Level indication 1

4. RCS Inventory Control

a. Pressurizer Level indication 1

b. Charging Pump controls 1

c. Charging Flow control 1

North Anna Units 1 and 2 Revi si on 0 B 3.3.4-6

LOP EDG Start Instrumentation B 3.3.5 B 3.3 INSTRUMENTATION B 3.3.5 Loss of Power (LOP)

Emergency Diesel Generator (EDG)

Start Instrumentation BASES BACKGROUND The EDGs provide a source of emergency power when offsite power is either unavailable or is insufficiently stable to allow safe unit operation. Undervoltage protection will generate an LOP start if a loss of voltage or degraded voltage condition occurs on the emergency buses. There are two required LOP start signals for each 4.16 kV emergency bus.

Undervoltage relays are provided on each 4160 V Class 1E bus for detecting a loss of bus voltage or a sustained degraded voltage condition. The relays are combined in a two-out-of-three logic to generate a LOP signal. A loss of voltage start of the EDG is initiated when the voltage is less than 74% of rated voltage and lasts for approximately 2 seconds. A degraded voltage start of the EDG is produced when the voltage is less than 90% of rated voltage sustained for approximately 56 seconds. The time delay for the degraded voltage start signal is reduced to approximately 7.5 seconds with the presence of a Safety Injection signal for the H and J bus on this unit.

One 4160 VAC bus from the other unit is needed to support operation of each required Service Water (SW) pump, Main Control Room/Emergency Switchgear Room (MCR/ESGR)

Emergency Ventilation System (EVS) fan, Auxiliary Building central exhaust fan, and Component Cooling Water (CC) pump.

SW, MCR/ESGR EVS, Auxiliary Building central exhaust system, and CC are shared systems.

The Allowable Value in conjunction with the trip setpoint and LCO establishes the threshold for Engineered Safety Features Actuation System (ESFAS) action to prevent exceeding acceptable limits such that the consequences of Design Basis Accidents (DBAs) will be acceptable. The Allowable Value is considered a limiting value such that a channel is OPERABLE if the setpoint is found not to exceed the Allowable Value during the CHANNEL CALIBRATION.

Note that, although a channel is OPERABLE under these circumstances, the setpoint must be left adjusted to within the established calibration tolerance band of the setpoint (continued)

North Anna Units 1 and 2 B 3.3.5-1 Revision 0

LOP EDG Start Instrumentation B 3.3.5 BASES BACKGROUND in accordance with uncertainty assumptions stated in the (continued) referenced setpoint methodology, (as-left-criteria) and confirmed to be operating with the statistical allowances of the uncertainty terms assigned.

Allowable Values and LOP EDG Start Instrumentation Setpoints The trip setpoints are summarized in Reference 3.

The selection of the Allowable Values is such that adequate protection is provided when all sensor and processing time delays are taken into account.

Setpoints adjusted consistent with the requirement of the Allowable Value ensure that the consequences of accidents will be acceptable, providing the unit is operated from within the LCOs at the onset of the accident and that the equipment functions as designed.

Allowable Values are specified for each Function in SR 3.3.5.2. Nominal trip setpoints are also specified in the unit specific setpoint calculations and listed in the Technical Requirements Manual (TRM)

(Ref. 2). The trip setpoints are selected to ensure that the setpoint measured by the surveillance procedure does not exceed the Allowable Value if the relay is performing as required. If the measured setpoint does not exceed the Allowable Value, the relay is considered OPERABLE.

Operation with a trip setpoint less conservative than the nominal trip setpoint, but within the Allowable Value, is acceptable provided that operation and testing is consistent with the assumptions of the unit specific setpoint calculation (Ref.

3).

APPLICABLE The LOP EDG start instrumentation is required for the SAFETY ANALYSES Engineered Safety Features (ESF) Systems to function in any accident with a loss of offsite power. Its design basis is that of the ESFAS.

Accident analyses credit the loading of the EDG based on the loss of offsite power during a loss of coolant accident (LOCA).

The actual EDG start has historically been associated with the ESFAS actuation. The EDG loading has been included in the delay time associated with each safety system component requiring EDG supplied power following a loss of offsite power. The analyses assume a non-mechanistic (continued)

North Anna Units 1 and 2 Revision 0 B 3.3.5-2

LOP EDG Start Instrumentation B 3.3.5 BASES APPLICABLE EDG loading, which does not explicitly account for each SAFETY ANALYSES individual component of loss of power detection and (continued) subsequent actions.

The required channels of LOP EDG start instrumentation, in conjunction with the ESF systems powered from the EDGs, provide unit protection in the event of any of the analyzed accidents discussed in Reference 5, in which a loss of offsite power is assumed.

The delay times assumed in the safety analysis for the ESF equipment include the 10 second EDG start delay, and the appropriate sequencing delay, if applicable. The response times for ESFAS actuated equipment in LCO 3.3.2, "Engineered Safety Feature Actuation System (ESFAS)

Instrumentation,"

include the appropriate EDG loading and sequencing delay if applicable.

The LOP EDG start instrumentation channels satisfy Criterion 3 of 10 CFR 50.36(c)(2)(ii).

LCO The LCO for LOP EDG start instrumentation requires that three channels per bus of both the loss of voltage and degraded voltage Functions shall be OPERABLE. in MODES 1, 2, 3, and 4 when the LOP EDG start instrumentation supports safety systems associated with the ESFAS. This is associated with the requirement of LCO 3.3.5.a for this unit's H and J buses. LCO 3.3.5.b specifies that for a required H and/or J bus on the other unit that is needed to support a required shared component for this unit, the LOP EDG start instrumentation for the required bus must be OPERABLE.

The other unit's required H and/or J bus are required to be OPERABLE to support the SW, MCR/ESGR EVS, Auxiliary Building central exhaust, and CC functions needed for this unit.

These Functions share components, pumps, or fans, which are electrically powered from both units. A channel is OPERABLE with a trip setpoint value outside its calibration tolerance band provided the trip setpoint "as-found" value does not exceed its associated Allowable Value and provided the trip setpoint "as-left" value is adjusted to a value within the "as-left" calibration tolerance band of the trip setpoint. A trip setpoint may be set more conservative than the trip setpoint specified in the TRM (Ref. 2) as necessary in response to unit conditions. In MODES 5 or 6, the three channels must be OPERABLE whenever the associated EDG is required to be OPERABLE to ensure that the automatic start of (continued)

North Anna Units 1 and 2 B 3.3.5-3 Revi sion 0

LOP EDG Start Instrumentation B 3.3.5 LCO (continued) the EDG is available when needed. Loss of the LOP EDG Start Instrumentation Function could result in the delay of safety systems initiation when required. This could lead to unacceptable consequences during accidents. During the loss of offsite power the EDG powers the motor driven auxiliary feedwater pumps. Failure of these pumps to start would leave only one turbine driven pump, as well as an increased potential for a loss of decay heat removal through the secondary system.

APPLICABILITY The LOP EDG Start Instrumentation Functions are required in MODES 1, 2, 3, and 4 because ESF Functions are designed to provide protection in these MODES. Actuation in MODE 5 or 6 is required whenever the required EDG must be OPERABLE so that it can perform its function on a LOP or degraded power to the emergency bus.

ACTIONS In the event a channel's trip setpoint is found nonconservative with respect to the Allowable Value, or the channel is found inoperable, then the function that channel provides must be declared inoperable and the LCO Condition entered for the particular protection function affected.

Because the required channels are specified on a per bus basis, the Condition may be entered separately for each bus as appropriate.

A Note has been added in the ACTIONS to clarify the application of Completion Time rules. The Conditions of this Specification may be entered independently for each Function listed in the LCO and for each emergency bus. The Completion Time(s) of the inoperable channel(s) of a Function will be tracked separately for each Function starting from the time the Condition was entered for that Function for the associated emergency bus.

A.1 Condition A applies to the LOP EDG start Function with one loss of voltage or degraded voltage channel per bus inoperable.

If one channel is inoperable, Required Action A.1 requires that channel to be placed in trip within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . A plant-specific risk assessment, consistent with Reference 4, (continued)

North Anna Units I and 2 BASES B 3.3.5-4 Revi si on 0

LOP EDG Start Instrumentation B 3.3.5 BASES ACTIONS A.1 (continued) was performed to justify the 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time. With a channel in trip, the LOP EDG start instrumentation channels are configured to provide a one-out-of-two logic to initiate a trip of the incoming offsite power.

A Note is added to allow bypassing an inoperable channel for up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for surveillance testing of other channels. A plant-specific risk assessment, consistent with Reference 4, was performed to justify the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months time limit. This allowance is made where bypassing the channel does not cause an actuation and where normally, excluding required testing, two other channels are monitoring that parameter.

The specified Completion Time and time allowed for bypassing one channel are reasonable considering the Function remains fully OPERABLE on every bus and the low probability of an event occurring during these intervals.

B.1 Condition B applies when more than one loss of voltage or more than one degraded voltage channel on an emergency bus is inoperable.

Required Action B.1 requires restoring all but one channel to OPERABLE status. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time should allow ample time to repair most failures and takes into account the low probability of an event requiring an LOP start occurring during this interval.

C.1 Condition C applies to each of the LOP EDG start Functions when the Required Action and associated Completion Time for Condition A or B are not met.

In these circumstances the Conditions specified in LCO 3.8.1, "AC Sources-Operating," or LCO 3.8.2, "AC Sources-Shutdown," for the EDG made inoperable by failure of the LOP EDG start instrumentation are required to be entered immediately. The actions of those LCOs provide for adequate compensatory actions to assure unit safety.

North Anna Units 1 and 2 B 3.3.5-5 Revision 0

LOP EDG Start Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.1 REQUIREMENTS SR 3.3.5.1 is the performance of a TADOT for channels required by LCO 3.3.5.a and LCO 3.3.5.b. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable TADOT of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at an 18 month frequency with applicable extensions. This test is performed every 92 days.

The test checks trip devices that provide actuation signals directly, bypassing the analog process control equipment.

The SR is modified by a Note that excludes verification of setpoints from the TADOT. Since this SR applies to the loss of voltage and degraded voltage relays for the 4160 VAC emergency buses, setpoint verification requires elaborate bench calibration and is accomplished during the CHANNEL CALIBRATION.

Each train or logic channel shall be functionally tested up to and including input coil continuity testing of the ESF slave relay. The Frequency is based on the known reliability of the relays and controls and the multichannel redundancy available, and has been shown to be acceptable through operating experience.

SR 3.3.5.2 SR 3.3.5.2 is the performance of a CHANNEL CALIBRATION for channels required by LCO 3.3.5.a and LCO 3.3.5.b.

The setpoints, as well as the response to a loss of voltage and a degraded voltage test, shall include a single point verification that the trip occurs within the required time delay, as shown in Reference 1.

A CHANNEL CALIBRATION is performed every 18 months, or approximately at every refueling. CHANNEL CALIBRATION is a complete check of the instrument loop, including the sensor.

The test verifies that the channel responds to a measured parameter within the necessary range and accuracy. The verification of degraded voltage with a SI signal is not required by LCO 3.3.5.b.

(continued)

North Anna Units 1 and 2 B 3.3.5-6 Revision 0

LOP EDG Start Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.2 (continued)

REQUIREMENTS The Frequency of 18 months is based on operating experience and consistency with the typical industry refueling cycle and is justified by the assumption of an 18 month calibration interval in the determination of the magnitude of equipment drift in the setpoint analysis.

SR 3.3.5.3 This SR ensures the individual channel ESF RESPONSE TIMES are less than or equal to the maximum values assumed in the accident analysis for channels required by LCO 3.3.5.a and LCO 3.3.5.b. Response Time testing acceptance criteria are included in the TRM (Ref. 2).

Individual component response times are not modeled in the analyses. The analyses model the overall or total elapsed time, from the point at which the parameter exceeds the trip setpoint value at the sensor, to the point at which the equipment in both trains reaches the required functional state (e.g., pumps at rated discharge pressure, valves in full open or closed position).

For channels that include dynamic transfer functions (e.g.,

lag, lead/lag, rate/lag, etc.), the response time test may be performed with the transfer functions set to one with the resulting measured response time compared to the appropriate TRM response time. Alternately, the response time test can be performed with the time constants set to their nominal value provided the required response time is analytically calculated assuming the time constants are set at their nominal values. The response time may be measured by a series of overlapping tests such that the entire response time is measured.

Response time may be verified by actual response time test in any series of sequential, overlapping or total channel measurements, or by the summation of allocated sensor, signal processing and actuation logic response times with actual response time tests on the remainder of the channel.

ESF RESPONSE TIME tests are conducted on an 18 month STAGGERED TEST BASIS. Testing of the final actuation devices, which make up the bulk of the response time, is included in the testing of each channel. The final actuation device in one train is tested with each channel.

Therefore, (continued)

North Anna Units 1 and 2 Revi si on 0 B 3.3.5-7

LOP EDG Start Instrumentation B 3.3.5 BASES SURVEILLANCE SR 3.3.5.3 (continued)

REQUI REMENTS staggered testing results in response time verification of these devices every 18 months. The 18 month Frequency is consistent with the typical refueling cycle and is based on unit operating experience, which shows that random failures of instrumentation components causing serious response time degradation, but not channel failure, are infrequent occurrences.

REFERENCES

1. UFSAR, Section 8.3.

2. Technical Requirements Manual.

3. RTS/ESFAS Setpoint Methodology Study (Technical Report EE-0116).

4. WCAP 14333-P-A, Rev.

1, October 1998.

5. UFSAR, Chapter 15.

North Anna Units 1 and 2 Revision 0 B 3.3.5-8

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB)

Limits BASES BACKGROUND These Bases address requirements for maintaining RCS pressure, temperature, and flow rate within limits assumed in the safety analyses. The safety analyses (Ref.

1) of normal operating conditions and anticipated operational occurrences assume initial conditions within the normal steady state envelope. The limits placed on RCS pressure, temperature, and flow rate ensure that the minimum departure from nucleate boiling ratio (DNBR) will be met for each of the transients analyzed.

The RCS pressure limit is consistent with operation within the nominal operational envelope. Pressurizer pressure indications are compared to the limit. A lower pressure will cause the reactor core to approach DNB limits.

The RCS coolant average temperature limit is consistent with full power operation within the nominal operational envelope. RCS loop average temperature is compared to the limit. A higher average temperature will cause the core to approach DNB limits.

The RCS flow rate normally remains constant during an operational fuel cycle with all pumps running. The minimum RCS flow limit corresponds to that assumed for DNB analyses.

Flow rate indications are averaged to come up with a value for comparison to the limit. A lower RCS flow will cause the core to approach DNB limits.

Operation for significant periods of time outside these DNB limits increases the likelihood of a fuel cladding failure in a DNB limited event.

APPLICABLE The requirements of this LCO represent the initial SAFETY ANALYSES conditions for DNB limited transients analyzed in the unit safety analyses (Ref. 1). The safety analyses have shown that transients initiated from the limits of this LCO will result in meeting the DNBR criterion. The limits on the DNB related parameters assure that each of the parameters are maintained within the normal steady state envelope of (continued)

North Anna Units 1 and 2 Revision 0 B 3.4. 1-1

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO operation assumed in the transient and accident analysis.

The limits have been analytically demonstrated to be adequate to maintain a minimum DNBR greater than the design limit throughout each analyzed transient including allowances for measurement uncertainties. Changes to the unit that could impact these parameters must be assessed for their impact on the DNBR criteria. The transients analyzed for include loss of coolant flow events and dropped or stuck rod events. A key assumption for the analysis of these events is that the core power distribution is within the limits of LCO 3.1.6, "Control Bank Insertion Limits"; LCO 3.2.3, "AXIAL FLUX DIFFERENCE (AFD)"; and LCO 3.2.4, "QUADRANT POWER TILT RATIO (QPTR)."

The pressurizer pressure limit and RCS average temperature limit specified in the COLR equal the analytical limits because of the application of statistical combination of uncertainty.

The RCS DNB parameters satisfy Criterion 2 of 10 CFR 50.36(c) (2) (ii).

This LCO specifies limits on the monitored process variables-pressurizer pressure, RCS average temperature, and RCS total flow rate-to ensure the core operates within the limits assumed in the safety analyses. These variables are contained in the COLR to provide operating and analysis flexibility from cycle to cycle. However, the minimum RCS flow, usually based on the maximum analyzed steam generator tube plugging, is retained in the LCO. Operating within these limits will result in meeting the DNBR criterion in the event of a DNB limited transient.

The numerical values for pressure, temperature, and flow rate-specified in the COLR are given for the measurement location have been adjusted for instrument error.

APPLICABILITY In MODE 1, the limits on pressurizer pressure, RCS coolant average temperature, and RCS flow rate must be maintained during steady state operation in order to ensure DNBR criteria will be met in the event of an unplanned loss of forced coolant flow or other DNB limited transient. The (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.1-2

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES APPLICABILITY design basis events that are sensitive to DNB in other MODES (continued)

(MODE 2 through 5) have sufficient margin to DNB, and therefore, there is no reason to restrict DNB in these MODES.

A Note has been added to indicate the limit on pressurizer pressure is not applicable during short term operational transients such as a THERMAL POWER ramp increase > 5% RTP per minute or a THERMAL POWER step increase > 10% RTP. These conditions represent short term perturbations where actions to control pressure variations might be counterproductive.

Also, since they represent transients initiated from power levels < 100% RTP, an increased DNBR margin exists to offset the temporary pressure variations.

The DNBR limit is provided in SL 2.1.1, "Reactor Core SLs."

The conditions which define the DNBR limit are less restrictive than the limits of this LCO, but violation of a Safety Limit (SL) merits a stricter, more severe Required Action. Should a violation of this LCO occur, the operator must check whether or not an SL may have been exceeded.

ACTIONS A.1 RCS pressure and RCS average temperature are controllable and measurable parameters. With one or both of these parameters not within LCO limits, action must be taken to restore parameter(s).

RCS total flow rate is not a controllable parameter and is not expected to vary during steady state operation. If the indicated RCS total flow rate is below the LCO limit, power must be reduced, as required by Required Action B.1, to restore DNB margin and eliminate the potential for violation of the accident analysis bounds.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for restoration of the parameters provides sufficient time to adjust unit parameters, to determine the cause for the off normal condition, and to restore the readings within limits, and is based on unit operating experience.

North Anna Units 1 and 2 Revision 0 B 3.4.1-3

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES ACTIONS B.1 (continued)

If Required Action A.1 is not met within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . In MODE 2, the reduced power condition eliminates the potential for violation of the accident analysis bounds. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable to reach the required unit conditions in an orderly manner.

SURVEILLANCE SR 3.4.1.1 REQUIREMENTS Since Required Action A.1 allows a Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore parameters that are not within limits, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Surveillance Frequency for pressurizer pressure is sufficient to ensure the pressure can be restored to a normal operation, steady state condition following load changes and other expected transient operations.-The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.

SR 3.4.1.2 Since Required Action A.1 allows a Completion Time of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months to restore parameters that are not within limits, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Surveillance Frequency for RCS average temperature is sufficient to ensure the temperature can be restored to a normal operation, steady state condition following load changes and other expected transient operations. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval has been shown by operating practice to be sufficient to regularly assess for potential degradation and to verify operation is within safety analysis assumptions.

SR 3.4.1.3 The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Surveillance Frequency for RCS total flow rate is performed using the installed flow instrumentation. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval has been shown by operating practice to be sufficient to regularly assess potential degradation and to verify operation within safety analysis assumptions.

North Anna Units 1 and 2 Revision 0 B 3.4.1-4

RCS Pressure, Temperature, and Flow DNB Limits B 3.4.1 BASES SURVEILLANCE REQUIREMENTS (continued)

REFERENCES SR 3.4.1.4 Measurement of RCS total flow rate by performance of a precision calorimetric heat balance once every 18 months allows the installed RCS flow instrumentation to be calibrated and verifies the actual RCS flow rate is greater than or equal to the minimum required RCS flow rate.

The Frequency of 18 months reflects the importance of verifying flow after a refueling outage when the core has been altered, which may have caused an alteration of flow resistance.

This SR is modified by a Note that allows entry into MODE 1, without having performed the SR, and placement of the unit in the best condition for performing the SR. The Note states that the SR is not required to be performed until 30 days after Ž 90% RTP. The 30 day period after reaching 90% RTP is reasonable to establish stable operating conditions, install the test equipment, perform the test, and analyze the results. The Surveillance shall be performed within 30 days after reaching 90% RTP.

1. UFSAR, Chapter 15.

North Anna Units 1 and 2 Revi sion 0 B 3.4.1-5

Intentionally Blank

RCS Minimum Temperature for Criticality B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 RCS Minimum Temperature for Criticality BASES BACKGROUND This LCO is based upon meeting several major considerations before the reactor can be made critical and while the reactor is critical.

The first consideration is moderator temperature coefficient (MTC),

LCO 3.1.3, "Moderator Temperature Coefficient (MTC)."

In the transient and accident analyses, the MTC is assumed to be in a range from slightly positive to negative and the operating temperature is assumed to be within the nominal operating envelope while the reactor is critical. The LCO on minimum temperature for criticality helps ensure the unit is operated consistent with these assumptions.

The second consideration is the protective instrumentation.

Because certain protective instrumentation (e.g., excore neutron detectors) can be affected by moderator temperature, a temperature value within the nominal operating envelope is chosen to ensure proper indication and response while the reactor is critical.

The third consideration is the pressurizer operating characteristics. The transient and accident analyses assume that the pressurizer is within its normal startup and operating range (i.e., saturated conditions and steam bubble present).

It is also assumed that the RCS temperature is within its normal expected range for startup and power operation. Since the density of the water, and hence the response of the pressurizer to transients, depends upon the initial temperature of the moderator, a minimum value for moderator temperature within the nominal operating envelope is chosen.

The fourth consideration is that the reactor vessel is above its minimum nil ductility reference temperature when the reactor is critical.

APPLICABLE Although the RCS minimum temperature for criticality is not SAFETY ANALYSES itself an initial condition assumed in Design Basis Accidents (DBAs),

the closely aligned temperature for hot zero power (HZP) is a process variable that is an initial (continued)

North Anna Units 1 and 2 B 3.4.2-1 Revision 0

RCS Minimum Temperature for Criticality B 3.4.2 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO condition of DBAs, such as the rod cluster control assembly (RCCA) withdrawal from subcritical, RCCA ejection, boron dilution at startup, feedwater malfunction, main steam system depressurization, and main steam line break accidents performed at zero power that either assumes the failure of, or presents a challenge to, the integrity of a fission product barrier.

All low power safety analyses assume initial RCS loop temperatures Ž the HZP temperature of 5470F. The minimum temperature for criticality limitation provides a small band, 60F, for critical operation below HZP. This band allows critical operation below HZP during unit startup and does not adversely affect any safety analyses since the MTC is not significantly affected by the small temperature difference between HZP and the minimum temperature for criticality.

The RCS minimum temperature for criticality satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

Compliance with the LCO ensures that the reactor will not be made or maintained critical (keff Ž 1.0) at a temperature less than a small band below the HZP temperature, which is assumed in the safety analysis. Failure to meet the requirements of this LCO may produce initial conditions inconsistent with the initial conditions assumed in the safety analysis.

APPLICABILITY In MODE 1 and MODE 2 with keff Ž 1.0, LCO 3.4.2 is applicable since the reactor can only be critical (keff Ž 1.0) in these MODES.

The special test exception of LCO 3.1.9, "MODE 2 PHYSICS TESTS Exceptions," permits PHYSICS TESTS to be performed at

5% RTP with RCS loop average temperatures slightly lower than normally allowed so that fundamental nuclear characteristics of the core can be verified. In order for nuclear characteristics to be accurately measured, it may be necessary to operate outside the normal restrictions of this LCO. For example, to measure the MTC at beginning of cycle, it is necessary to allow RCS loop average temperatures to fall below Tno load, which may cause RCS loop average temperatures to fall below the temperature limit of this LCO.

North Anna Units 1 and 2 Revision 0 B 3.4.2-2

RCS Minimum Temperature for Criticality B 3.4.2 BASES ACTIONS A.1 If the parameters that are outside the limit cannot be restored, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 2 with keff < 1.0 within 30 minutes. Rapid reactor shutdown can be readily and practically achieved within a 30 minute period. The allowed time is reasonable, based on operating experience, to reach MODE 2 with keff

< 1.0 in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS RCS loop average temperature is required to be verified at or above 5417F every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The SR to verify RCS loop average temperatures every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months takes into account indications and alarms that are continuously available to the operator in the control room and is consistent with other routine Surveillances which are typically performed once per shift.

In addition, operators are trained to be sensitive to RCS temperature during approach to criticality and will ensure that the minimum temperature for criticality is met as criticality is approached.

REFERENCES None.

North Anna Units 1 and 2 Revision 0 B 3.4.2-3

Intentionally Blank

RCS P/T Limits B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

This LCO contains P/T limit curves for heatup, cooldown, inservice leak and hydrostatic (ISLH) testing, and data for the maximum rate of change of reactor coolant temperature.

Each P/T limit curve defines an acceptable region for normal operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region.

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB).

The vessel is the component most subject to brittle failure, and the LCO limits apply mainly to the vessel. The limits do not apply to the pressurizer, which has different design characteristics and operating functions.

10 CFR 50, Appendix G (Ref.

1), requires the establishment of P/T limits for specific material fracture toughness requirements of the RCPB materials. Reference 1 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME)

Code,Section III, Appendix G (Ref. 2).

The neutron embrittlement effect on the material toughness is reflected by increasing the nil ductility reference temperature (RTNDT) as exposure to neutron fluence increases.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.4.3-1

RCS P/T Limits B 3.4.3 BASES BACKGROUND (continued)

The actual shift in the RTNDT of the vessel material is established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3) and Appendix H of 10 CFR 50 (Ref.

4). The operating P/T limit curves are adjusted, as necessary, based on the evaluation findings and the recommendations of Regulatory Guide 1.99 (Ref.

5).

The P/T limit curves are calculated using the most limiting value of RTNDT corresponding to the limiting beltline region material for the reactor vessel.

The heatup curve represents a different set of restrictions than the cooldown curve because the directions of the thermal gradients through the vessel wall are reversed. The thermal gradient reversal alters the location of the tensile stress between the outer and inner walls.

The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components. The ASME Code,Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

APPLICABLE SAFETY ANALYSES The P/T limits are not derived from Design Basis Accident (DBA) analyses. They are prescribed during normal operation to avoid encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, an unanalyzed condition. Although the P/T limits are not derived from any DBA, the P/T limits are acceptance limits since they preclude operation in an unanalyzed condition.

RCS P/T limits satisfy Criterion 2 of 10 CFR 50.36(c) (2)(ii).

North Anna Units 1 and 2 Revision 0 B 3.4.3-2

RCS P/T Limits B 3.4.3 BASES LCO The two elements of this LCO are:

a. The limit curves for heatup, cooldown, and ISLH testing; and

b. Limits on the rate of change of temperature.

The LCO limits apply to all components of the RCS, except the pressurizer. These limits define allowable operating regions and permit a large number of operating cycles while providing a wide margin to nonductile failure.

The limits for the rate of change of temperature control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and ISLH testing P/T limit curves. Thus, the LCO for the rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the P/T limit curves.

The reactor vessel beltline is the most limiting region of the reactor vessel for the determination of P/T limit curves. The P/T curves include a correction for the difference between the pressure at the point of measurement (hot leg or pressurizer) and the reactor vessel beltline.

The P/T limits do not include instrument uncertainties since these uncertainties are insignificant when compared to the margin included in the Reference 1 methods.

Violating the LCO limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCPB components. The consequences depend on several factors, as follow:

a. The severity of the departure from the allowable operating P/T regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

North Anna Units 1 and 2 B 3.4.3-3 Revision 0

RCS P/T Limits B 3.4.3 BASES APPLICABILITY ACTIONS The RCS P/T limits LCO provides a definition of acceptable operation for prevention of nonductile failure in accordance with 10 CFR 50, Appendix G (Ref.

1). Although the P/T limits were developed to provide guidance for operation during heatup or cooldown (MODES 3, 4, and 5) or ISLH testing, their Applicability is at all times in keeping with the concern for nonductile failure. The limits do not apply to the pressurizer.

During MODES 1 and 2, other Technical Specifications provide limits for operation that can be more restrictive than or can supplement these P/T limits. LCO 3.4.1, "RCS Pressure, Temperature, and Flow Departure from Nucleate Boiling (DNB)

Limits"; LCO 3.4.2, "RCS Minimum Temperature for Criticality"; and Safety Limit 2.1, "Safety Limits," also provide operational restrictions for pressure and temperature and maximum pressure. Furthermore, MODES 1 and 2 are above the temperature range of concern for nonductile failure, and stress analyses have been performed for normal maneuvering profiles, such as power ascension or descent.

A.1 and A.2 Operation outside the P/T limits during MODE 1, 2, 3, or 4 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed before continuing operation. Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.

ASME Code,Section XI, Appendix E (Ref.

6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

(continued)

North Anna Units 1 and 2 Revi si on 0 B 3.4.3-4

RCS P/T Limits B 3.4.3 BASES ACTIONS A.1 and A.2 (continued)

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable to accomplish the evaluation. The evaluation for a mild violation is possible within this time, but more severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed before continuing to operate.

Condition A is modified by a Note requiring Required Action A.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

B.1 and B.2 If a Required Action and associated Completion Time of Condition A are not met, the unit must be placed in a lower MODE because either the RCS remained in an unacceptable P/T region for an extended period of increased stress or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. In reduced pressure and temperature conditions, the possibility of propagation with undetected flaws is decreased.

If the required restoration activity cannot be accomplished within 30 minutes, Required Action B,1 and Required Action B.2 must be implemented to reduce pressure and temperature.

If the required evaluation for continued operation cannot be accomplished within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or the results are indeterminate or unfavorable, action must proceed to reduce pressure and temperature as specified in Required Action B.1 and Required Action B.2. A favorable evaluation must be completed and documented before returning to operating pressure and temperature conditions.

Pressure and temperature are reduced by bringing the unit to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 with RCS pressure

< 500 psig within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months .

(continued)

North Anna Units 1 and 2 Revision 0 B 3.4.3-5

RCS P/T Limits B 3.4.3 BASES ACTIONS B.1 and B.2 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1 and C.2 Actions must be initiated immediately to correct operation outside of the P/T limits at times other than when in MODE 1, 2, 3, or 4, so that the RCPB is returned to a condition that has been verified by stress analysis.

The immediate Completion Time reflects the urgency of initiating action to restore the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify that the RCPB integrity remains acceptable and must be completed prior to entry into MODE 4.

Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, or inspection of the components.

ASME Code,Section XI, Appendix E (Ref. 6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

Condition C is modified by a Note requiring Required Action C.2 to be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action C.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

North Anna Units 1 and 2 Revi si on 0 B 3.4.3-6

RCS P/T Limits B 3.4.3 BASES SURVEILLANCE SR 3.4.3.1 REQUIREMENTS Verification that operation is within limits is required every 30 minutes when RCS pressure and temperature conditions are undergoing planned changes. This Frequency is considered reasonable in view of the control room indication available to monitor RCS status. Also, since temperature rate of change limits are specified in hourly increments, 30 minutes permits assessment and correction for minor deviations within a reasonable time.

Surveillance for heatup, cooldown, or ISLH testing may be discontinued when the definition given in the relevant unit procedure for ending the activity is satisfied.

This SR is modified by a Note that only requires this SR to be performed during system heatup, cooldown, and ISLH testing. No SR is given for criticality operations because LCO 3.4.2 contains a more restrictive requirement.

REFERENCES

1. 10 CFR 50, Appendix G.

2.

ASME, Boiler and Pressure Vessel Code,Section III, Appendix G.

3. ASTM E 185.

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

6.

ASME, Boiler and Pressure Vessel Code,Section XI, Appendix E.

North Anna Units 1 and 2 Revision 0

.B 3.4.3-7

Intentionally Blank

RCS Loops-MODES 1 and 2 B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 RCS Loops-MODES 1 and 2 BASES BACKGROUND The primary function of the RCS is removal of the heat generated in the fuel due to the fission process, and transfer of this heat, via the steam generators (SGs), to the secondary plant.

The setondary functions of the RCS include:

a. Moderating the neutron energy level to the thermal state, to increase the probability of fission;

b. Improving the neutron economy by acting as a reflector;

c. Carrying the soluble neutron poison, boric acid;

d. Providing a second barrier against fission product release to the environment; and

e. Removing the heat generated in the fuel due to fission product decay following a unit shutdown.

The reactor coolant is circulated through three loops connected in parallel to the reactor vessel, each containing an SG, a reactor coolant pump (RCP),

and appropriate flow and temperature instrumentation for both control and protection.

The reactor vessel contains the clad fuel. The SGs provide the heat sink to the isolated secondary coolant. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage. This forced circulation of the reactor coolant ensures mixing of the coolant for proper boration and chemistry control.

APPLICABLE Safety analyses contain various assumptions for the design SAFETY ANALYSES bases accident initial conditions including RCS pressure, RCS temperature, reactor power level, core parameters, and safety system setpoints. The important aspect for this LCO is the reactor coolant forced flow rate, which is represented by the number of RCS loops in service.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.4.4-1

RCS Loops-MODES 1 and 2 B 3.4.4

.BASES APPLICABLE SAFETY ANALYSES (continued)

Both transient and steady state analyses have been performed to establish the effect of flow on the departure from nucleate boiling (DNB).

The transient and accident analyses for the unit have been performed assuming three RCS loops are in operation. The majority of the unit safety analyses are based on initial conditions at high core power or zero power.

The accident analyses that are most important to RCP operation are the complete loss of forced reactor flow, single reactor coolant pump locked rotor, partial loss of forced reactor flow, and rod withdrawal events (Ref.

1).

The DNB analyses assume normal three loop operation.

Uncertainties in key unit operating parameters, nuclear and thermal parameters, and fuel fabrication parameters are considered statistically such that there is at least a 95 percent probability that DNB will not occur for the limiting power rod. Key unit parameter uncertainties are used to determine the unit departure from nucleate boiling ratio (DNBR) uncertainty. This DNBR uncertainty, combined with the DNBR limit, establishes a design DNBR value which must be met in unit safety analyses and is used to determine the pressure and temperature Safety Limit (SL).

Since the parameter uncertainties are considered in determining the design DNBR value, the unit safety analyses are performed using values of input parameters without uncertainties. Therefore, nominal operating values for reactor coolant flow are used in the accident analyses.

The unit is designed to operate with all RCS loops in operation to maintain DNBR above the limit during all normal operations and anticipated transients. By ensuring heat transfer in the nucleate boiling region, adequate heat transfer is provided between the fuel cladding and the reactor coolant.

RCS Loops-MODES 1 and 2 satisfy Criterion 2 of 10 CFR 50.36(c) (2) (ii).

LCO The purpose of this LCO is to require an adequate forced flow rate for core heat removal. Flow is represented by the number of RCPs in operation for removal of heat by the SGs. To meet safety analysis acceptance criteria for DNBR, three pumps are required at rated power.

An OPERABLE RCS loop consists of an OPERABLE RCP in operation providing forced flow for heat transport and an OPERABLE SG in accordance with the Steam Generator Surveillance Program.

North Anna Units 1 and 2 Revision 0 B 3.4.4-2

RCS Loops-MODES 1 and 2 B 3.4.4 BASES APPLICABILITY In MODES 1 and 2, the reactor is critical and thus has the potential to produce maximum THERMAL POWER.

Thus, to ensure that the assumptions of the accident analyses remain valid, all RCS loops are required to be OPERABLE and in operation in these MODES to prevent DNB and core damage.

The decay heat production rate is much lower than the full power heat rate. As such, the forced circulation flow and heat sink requirements are reduced for lower, noncritical MODES as indicated by the LCOs for MODES 3, 4, and 5.

Operation in other MODES is covered by:

LCO LCO LCO LCO LCO 3.4.5, 3.4.6, 3.4.7, 3.4.8, 3.9.5, LCO 3.9.6, "RCS Loops-MODE 3";

"RCS Loops-MODE 4";

"RCS Loops-MODE 5, Loops Filled";

"RCS Loops-MODE 5, Loops Not Filled";

"Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

A. 1 If the requirements of the LCO are not met, the Required Action is to reduce power and bring the unit to MODE 3. This lowers power level and thus reduces the core heat removal needs and minimizes the possibility of violating DNBR limits.

The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging safety systems.

SURVEILLANCE REQUIREMENTS SR 3.4.4.1 This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that each RCS loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal while maintaining the margin to the DNBR limit. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance.

North Anna Units 1 and 2 ACTIONS Revision 0 B 3.4.4-3

RCS Loops-MODES 1 and 2 B 3.4.4 BASES REFERENCES

1. UFSAR, Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.4.4-4

RCS Loops-MODE 3 B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.5 RCS Loops-MODE 3 BASES BACKGROUND In MODE 3, the primary function of the reactor coolant is removal of decay heat and transfer of this heat, via the steam generator (SG),

to the secondary plant fluid. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.

The reactor coolant is circulated through three RCS loops, connected in parallel to the reactor vessel, each containing an SG, a reactor coolant pump (RCP),

and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication. The reactor vessel contains the clad fuel. The SGs provide the heat sink. The RCPs circulate the water through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and prevent fuel damage.

In MODE 3, RCPs are used to provide forced circulation for heat removal during heatup and cooldown. The MODE 3 decay heat removal requirements are low enough that a single RCS loop with one RCP running is sufficient to remove core decay heat. However, two RCS loops are required to be OPERABLE to ensure redundant capability for decay heat removal.

APPLICABLE SAFETY ANALYSES Whenever the reactor trip breakers (RTBs) are in the closed position and the control rod drive mechanisms (CRDMs) are energized, an inadvertent rod withdrawal from subcritical, resulting in a power excursion, is possible. Such a transient could be caused by a malfunction of the rod control system.

Therefore, in MODE 3 with RTBs in the closed position and Rod Control System capable of rod withdrawal, accidental control rod withdrawal from subcritical is postulated and requires at least one RCS loop to be OPERABLE and in operation to ensure that the accident analyses limits are met.

Failure to provide decay heat removal may result in challenges to a fission product barrier. The RCS loops are part of the primary success path that functions or actuates (continued)

North Anna Units 1 and 2 B 3.4.5-1 Revision 0

RCS Loops-MODE 3 B 3.4.5 BASES APPLICABLE to prevent or mitigate a Design Basis Accident or transient SAFETY ANALYSES that either assumes the failure of, or presents a challenge (continued) to, the integrity of a fission product barrier.

RCS Loops-MODE 3 satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO The purpose of this LCO is to require that at least two RCS loops be OPERABLE and one of those loops be in operation. One RCS loop in operation is necessary to ensure removal of decay heat from the core and homogenous boron concentration throughout the RCS. An additional RCS loop is required to be OPERABLE to ensure redundant capability for decay heat removal.

The Note permits all RCPs to be removed from operation for

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. The purpose of the Note is to permit pump swap operations and tests that are designed to validate various accident analyses values. One of these tests is validation of the pump coastdown curve used as input to a number of accident analyses including a loss of flow accident. This test is generally performed in MODE 3 during the initial startup testing program, and as such should only be performed once. If, however, changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values of the coastdown curve may be revalidated by conducting the test again. Another test that may be performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow.

The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits the stopping of the pumps in order to perform this test and validate the assumed analysis values.

As with the validation of the pump coastdown curve, this test should be performed only once unless the flow characteristics of the RCS are changed. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months time period specified is adequate to perform the pump swap or the desired tests, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.4.5-2

RCS Loops-MODE 3 B 3.4.5 BASES LCO (continued)

Utilization of the Note is permitted provided the following conditions are met, along with any other conditions imposed by initial startup test procedures:

a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to ensure the SDM of LCO 3.1.1, thereby maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure the SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and

b. Core outlet temperature is maintained at least 10OF below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

An OPERABLE RCS loop consists of one OPERABLE RCP and one OPERABLE SG in accordance with the Steam Generator Tube Surveillance Program, which has the minimum water level specified in SR 3.4.5.2. An RCP is OPERABLE if it is capable of being powered and is able to provide forced flow if required.

APPLICABILITY In MODE 3, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing.

Operation in other MODES is covered by:

LCO LCO LCO LCO LCO 3.4.4, 3.4.6, 3.4.7, 3.4.8, 3.9.5, LCO 3.9.6, "RCS Loops-MODES 1 and 2";

"RCS Loops-MODE 4";

"RCS Loops-MODE 5, Loops Filled";

"RCS Loops-MODE 5, Loops Not Filled";

"Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

North Anna Units I and 2 Revision 0 B 3.4.5-3

RCS Loops-MODE 3 B 3.4.5 BASES ACTIONS A.1 If one required RCS loop is inoperable, redundancy for heat removal is lost. The Required Action is restoration of the required RCS loop to OPERABLE status within the Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . This time allowance is a justified period to be without the redundant, nonoperating loop because a single loop in operation has a heat transfer capability greater than that needed to remove the decay heat produced in the reactor core and because of the low probability of a failure in the remaining loop occurring during this period.

B.1 If restoration is not possible within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the unit must be brought to MODE 4. In MODE 4, the unit may be placed on the Residual Heat Removal System. The additional Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is compatible with required operations to achieve cooldown and depressurization from the existing unit conditions in an orderly manner and without challenging unit systems.

C.1, C.2, and C.3 If two required RCS loops are inoperable or a required RCS loop is not in operation, except as during conditions permitted by the Note in the LCO section, place the Rod Control System in a condition incapable of rod withdrawal (e.g., all CRDMs must be de-energized by opening the RTBs or de-energizing the MG sets). All operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended, and action to restore one of the RCS loops to OPERABLE status and operation must be initiated. Boron dilution requires forced circulation for proper mixing, and opening the RTBs or de-energizing the MG sets removes the possibility of an inadvertent rod withdrawal. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for heat removal.

The action to restore must be continued until one loop is restored to OPERABLE status and operation.

North Anna Units 1 and 2 Revision 0 B 3.4.5-4

RCS Loops-MODE 3 B 3.4.5 BASES SURVEILLANCE SR 3.4.5.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that the required loops are in operation. Verification includes flow rate, temperature, and pump status monitoring, which help ensure that forced flow is providing heat removal.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS loop performance.

SR 3.4.5.2 SR 3.4.5.2 requires verification of SG OPERABILITY.

SG OPERABILITY is verified by ensuring that the secondary side narrow range water level is Ž 17% for required RCS loops. If the SG secondary side narrow range water level is < 17%, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink for removal of the decay heat. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications available in the control room to alert the operator to a loss of SG level.

SR 3.4.5.3 Verification that the required RCP is OPERABLE ensures that safety analyses limits are met. The requirement also ensures that an additional RCP can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power availability to the required RCP.

This SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a required pump is not in operation.

REFERENCES None.

North Anna Units 1 and 2 Revision 0 B 3.4.5-5

Intentionally Blank

RCS Loops-MODE 4 B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Loops-MODE 4 BASES BACKGROUND In MODE 4, the primary function of the reactor coolant is the removal of decay heat and the transfer of this heat to either the steam generator (SG) secondary side coolant or the component cooling water via the residual heat removal (RHR) heat exchangers. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.

The reactor coolant is circulated through three RCS loops connected in parallel to the reactor vessel, each loop containing an SG, a reactor coolant pump (RCP),

and appropriate flow, pressure, level, and temperature instrumentation for control, protection, and indication. The RCPs circulate the coolant through the reactor vessel and SGs at a sufficient rate to ensure proper heat transfer and to prevent boric acid stratification.

In MODE 4, either RCPs or RHR loops can be used to provide forced circulation. The intent of this LCO is to provide forced flow from at least one RCP or one RHR loop for decay heat removal and transport. The flow provided by one RCP loop or RHR loop is adequate for decay heat removal. The other intent of this LCO is to require that two paths be OPERABLE to provide redundancy for decay heat removal.

APPLICABLE In MODE 4, RCS circulation is considered in the SAFETY ANALYSES determination of the time available for mitigation of the accidental boron dilution event. The RCS and RHR loops provide this circulation.

RCS Loops-MODE 4 satisfies Criterion 4 of 10 CFR 50.36(c) (2) (ii).

LCO The purpose of this LCO is to require that at least two loops be OPERABLE in MODE 4 and that one of these loops be in operation. The LCO allows the two loops that are required to be OPERABLE to consist of any combination of RCS loops and RHR loops. Any one loop in operation provides enough flow to (continued)

North Anna Units 1 and 2 B 3.4.6-1 Revision 0

RCS Loops-MODE 4 B 3.4.6 BASES LCO remove the decay heat from the core with forced circulation.

(continued)

An additional loop is required to be OPERABLE to provide redundancy for heat removal.

Note 1 permits all RCPs or RHR pumps to be removed from operation for

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. The purpose of the Note is to permit pump swap operations and tests that are designed to validate various accident analyses values. One of the tests which may be performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow. The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits the stopping of the pumps in order to perform this test and validate the assumed analysis values. If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values may be revalidated by conducting the test again. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months time period is adequate to perform the pump swap or test, and operating experience has shown that boron stratification is not a problem during this short period with no forced flow.

Utilization of Note 1 is permitted provided the following conditions are met along with any other conditions imposed by initial startup test procedures:

a.

No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to meet the SDM of LCO 3.1.1, therefore maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure the SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and

b. Core outlet temperature is maintained at least 10OF below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

Note 2 requires that the secondary side water temperature of each SG be

50°F above each of the RCS cold leg temperatures before the start of an RCP with any RCS cold leg temperature (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.6-2

RCS Loops-MODE 4 B 3.4.6 BASES LCO (continued)

APPLICABILITY

2350F (Unit 1),

270°F (Unit 2). This restraint is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.

An OPERABLE RCS loop is comprised of an OPERABLE RCP and an OPERABLE SG in accordance with the Steam Generator Tube Surveillance Program, which has the minimum water level specified in SR 3.4.6.2.

Similarly for the RHR System, an OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger. RCPs and RHR pumps are OPERABLE if they are capable of being powered and are able to provide forced flow if required.

In MODE 4, this LCO ensures forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of either RCS or RHR provides sufficient circulation for these purposes. However, two loops consisting of any combination of RCS and RHR loops are required to be OPERABLE to provide redundancy for heat removal.

Operation in other MODES is covered by:

LCO LCO LCO LCO LCO 3.4.4, 3.4.5, 3.4.7, 3.4.8, 3.9.5, LCO 3.9.6, "RCS Loops-MODES 1 and 2";

"RCS Loops-MODE 3";

"RCS Loops-MODE 5, Loops Filled";

"RCS Loops-MODE 5, Loops Not Filled";

"Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

A.1 If one required loop is inoperable, redundancy for heat removal is lost. Action must be initiated to restore a second RCS or RHR loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

North Anna Units 1 and 2 ACTIONS Revision 0 B 3.4.6-3

RCS Loops-MODE 4 B 3.4.6 BASES ACTIONS A.2 (conti nued)

If restoration is not accomplished and an RHR loop is

OPERABLE, the unit must be brought to MODE 5 within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Bringing the unit to MODE 5 is a conservative action with regard to decay heat removal. With only one RHR loop OPERABLE, redundancy for decay heat removal is lost and, in the event of a loss of the remaining RHR loop, it would be safer to initiate that loss from MODE 5 rather than MODE 4. The Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable time, based on operating experience, to reach MODE 5 from MODE 4 in an orderly manner and without challenging unit systems.

This Required Action is modified by a Note which indicates that the unit must be placed in MODE 5 only if an RHR loop is OPERABLE. With no RHR loop OPERABLE, the unit is in a condition with only limited cooldown capabilities.

Therefore, the actions are to be concentrated on the restoration of an RHR loop, rather than a cooldown of extended duration.

B.1 and B.2 If two required loops are inoperable or a required loop is not in operation, except during conditions permitted by Note 1 in the LCO section, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RCS or RHR loop to OPERABLE status and operation must be initiated.

The required margin to criticality must not be reduced in this type of operation. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation. With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Times reflect the importance of maintaining operation for decay heat removal.

The action to restore must be continued until one loop is restored to OPERABLE status and operation.

Revision 0 North Anna Units 1 and 2 B 3.4.6-4

RCS Loops-MODE 4 B 3.4.6 BASES SURVEILLANCE SR 3.4.6.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that the required RCS or RHR loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RCS and RHR loop performance.

SR 3.4:6.2 SR 3.4.6.2 requires verification of SG OPERABILITY.

SG OPERABILITY is verified by ensuring that the secondary side narrow range water level is Ž 17%.

If the SG secondary side narrow range water level is < 17%, the tubes may become uncovered and the associated loop may not be capable of providing the heat sink necessary for removal of decay heat.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications available in the control room to alert the operator to the loss of SG level.

SR 3.4.6.3 Verification that the required pump is OPERABLE ensures that an additional RCS or RHR pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required pump.

The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

This SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a required pump is not in operation.

REFERENCES None.

North Anna Units 1 and 2 Revision 0 B 3.4.6-5

Intentionally Blank

RCS Loops-MODE 5, Loops Filled B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 RCS Loops-MODE 5, Loops Filled BASES BACKGROUND In MODE 5 with the RCS loops filled, the primary function of the reactor coolant is the removal of decay heat and transfer this heat either to the steam generator (SG) secondary side coolant via natural circulation (Ref. 1) or the component cooling water via the residual heat removal (RHR) heat exchangers. While the principal means for decay heat removal is via the RHR System, the SGs via natural circulation (Ref. 1) are specified as a backup means for redundancy.

Even though the SGs cannot produce steam in this MODE, they are capable of being a heat sink due to their large contained volume of secondary water. As long as the SG secondary side water is at a lower temperature than the reactor coolant, heat transfer will occur. The rate of heat transfer is directly proportional to the temperature difference. The secondary function of the reactor coolant is to act as a carrier for soluble neutron poison, boric acid.

In MODE 5 with RCS loops filled, the reactor coolant is circulated by means of two RHR loops connected to the RCS, each loop containing an RHR heat exchanger, an RHR pump, and appropriate flow and temperature instrumentation for control, protection, and indication. One RHR pump circulates the water through the RCS at a sufficient rate to prevent boric acid stratification.

The number of loops in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RHR loop for decay heat removal and transport. The flow provided by one RHR loop is adequate for decay heat removal.

The other intent of this LCO is to require that a second path be available to provide redundancy for heat removal.

The LCO provides for redundant paths of decay heat removal capability. The first path can be an RHR loop that must be OPERABLE and in operation. The second path can be another OPERABLE RHR loop or maintaining a SG with secondary side water level of at least 17% using narrow range instrumentation to provide an alternate method for decay heat removal via natural circulation (Ref. 1).

North Anna Units 1 and 2 B 3.4.7-1 Revi si on 0

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES APPLICABLE In MODE 5, RCS circulation is considered in the SAFETY ANALYSES determination of the time available for mitigation of the accidental boron dilution event. The RHR loops provide this circulation.

RCS Loops-MODE 5 (Loops Filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO The purpose of this LCO is to require that at least one of the RHR loops be OPERABLE and in operation with an additional RHR loop OPERABLE or a SG with secondary side water level

Ž 17% using narrow range instrumentation and the associated loop isolation valves open. One RHR loop provides sufficient forced circulation to perform the safety functions of the reactor coolant under these conditions. An additional RHR loop is required to be OPERABLE to provide redundancy for heat removal.

However, if the standby RHR loop is not

OPERABLE, an acceptable alternate method is a SG with its secondary side water level Ž 17% using narrow range instrumentation. Should the operating RHR loop fail, the SG could be used to remove the decay heat via natural circulation.

Note 1 permits all RHR pumps to be removed from operation

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months per 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period. The purpose of the Note is to permit pump swap operations and tests designed to validate various accident analyses values. One of the tests performed during the startup testing program is the validation of rod drop times during cold conditions, both with and without flow. The no flow test may be performed in MODE 3, 4, or 5 and requires that the pumps be stopped for a short period of time. The Note permits stopping of the pumps in order to perform this test and validate the assumed analysis values.

If changes are made to the RCS that would cause a change to the flow characteristics of the RCS, the input values must be revalidated by conducting the test again. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months time period is adequate to perform the pump swap or test, and operating experience has shown that boron stratification is not likely during this short period with no forced flow.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.4.7-2

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES LCO Utilization of Note 1 is permitted provided the following (continued) conditions are met, along with any other conditions imposed by initial startup test procedures:

a. No operations are permitted that would dilute the RCS boron concentration with coolant at boron concentrations less than required to meet the SDM of LCO 3.1.1, therefore maintaining the margin to criticality. Boron reduction with coolant at boron concentrations less than required to assure the SDM is maintained is prohibited because a uniform concentration distribution throughout the RCS cannot be ensured when in natural circulation; and

b. Core outlet temperature is maintained at least 10OF below saturation temperature, so that no vapor bubble may form and possibly cause a natural circulation flow obstruction.

Note 2 allows one RHR loop to be inoperable for a period of up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , provided that the other RHR loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when such testing is safe and possible.

Note 3 requires that the secondary side water temperature of each SG be

50°F above each of the RCS cold leg temperatures before the start of a reactor coolant pump (RCP) with an RCS cold leg temperature 5 2350F (Unit 1),

270°F (Unit 2). This restriction is to prevent a low temperature overpressure event due to a thermal transient when an RCP is started.

Note 4 provides for an orderly transition from MODE 5 to MODE 4 during a planned heatup by permitting removal of RHR loops from operation when at least one RCS loop is in operation. This Note provides for the transition to MODE 4 where an RCS loop is permitted to be in operation and replaces the RCS circulation function provided by the RHR loops with circulation provided by an RCP.

RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required. An OPERABLE SG can perform as a heat sink via natural circulation when it has an adequate water level and is OPERABLE in accordance with the Steam Generator Tube Surveillance Program.

North Anna Units 1 and 2 B 3.4.7-3 Revision 0

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES APPLICABILITY In MODE 5 with the unisolated portion of the RCS loops filled, this LCO requires forced circulation of the reactor coolant to remove decay heat from the core and to provide proper boron mixing. One loop of RHR provides sufficient circulation for these purposes. However, one additional RHR loop is required to be OPERABLE, or the secondary side water level of at least one SG is required to be Ž 17% with the associated loop isolation valves open.

Operation in other MODES is covered by:

LCO LCO LCO LCO LCO 3.4.4, 3.4.5, 3.4.6, 3.4.8, 3.9.5, LCO 3.9.6, "RCS Loops-MODES 1 and 2";

"RCS Loops-MODE 3";

"RCS Loops-MODE 4";

"RCS Loops-MODE 5, Loops Not Filled";

"Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

If all RCS loops are isolated, an SG cannot be used for decay heat removal and RCS water inventory is substantially reduced. In this circumstance, LCO 3.4.8 applies.

ACTIONS A.1. A.2, B.1, and B.2 If one RHR loop is OPERABLE and the required SG has secondary side water level < 17%, redundancy for heat removal is lost.

Action must be initiated immediately to restore a second RHR loop to OPERABLE status or to restore the required SG secondary side water level. Either Required Action will restore redundant heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

C.1 and C.2 If a required RHR loop is not in operation, except during conditions permitted by Note 1 and Note 4, or if no required RHR loop is OPERABLE, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action to restore one RHR loop to OPERABLE status and operation must be initiated. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.7-4

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES ACTIONS C.1 and C.2 (continued)

LCO 3.1.1 is required to assure continued safe operation.

With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Times reflect the importance of maintaining operation for heat removal.

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that the required loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RHR loop performance.

SR 3.4.7.2 Verifying that at least one SG is OPERABLE by ensuring its secondary side narrow range water level is Ž 17% ensures an alternate decay heat removal method via natural circulation in the event that the second RHR loop is not OPERABLE.

If both RHR loops are OPERABLE, this Surveillance is not needed. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered adequate in view of other indications available in the control room to alert the operator to the loss of SG level.

SR 3.4.7.3 Verification that the required RHR pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation. Verification is performed by verifying proper breaker alignment and power available to the required RHR pump. If secondary side water level is Ž 17% in at least one SG, this Surveillance is not needed. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

This SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a required pump is not in operation.

North Anna Units 1 and 2 Revision 0 B 3.4.7-5

RCS Loops-MODE 5, Loops Filled B 3.4.7 BASES REFERENCES

1. NRC Information Notice 95-35, Degraded Ability of Steam Generators to Remove Decay Heat by Natural Circulation.

North Anna Units 1 and 2 Revision 0 B 3.4.7-6

RCS Loops-MODE 5, Loops Not Filled B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.8 RCS Loops-MODE 5, Loops Not Filled BASES BACKGROUND In MODE 5 with the RCS loops not filled, the primary function of the reactor coolant is the removal of decay heat generated in the fuel, and the transfer of this heat to the component cooling water via the residual heat removal (RHR) heat exchangers. The steam generators (SGs) are not available as a heat sink when the loops are not filled. The secondary function of the reactor coolant is to act as a carrier for the soluble neutron poison, boric acid.

In MODE 5 with loops not filled, only RHR pumps can be used for coolant circulation. The number of pumps in operation can vary to suit the operational needs. The intent of this LCO is to provide forced flow from at least one RHR pump for decay heat removal and transport and to require that two paths be available to provide redundancy for heat removal.

APPLICABLE In MODE 5, RCS circulation is considered in the SAFETY ANALYSES determination of the time available for mitigation of the accidental boron dilution event. The RHR loops provide this circulation. The flow provided by one RHR loop is adequate for heat removal and for boron mixing.

RCS loops in MODE 5 (loops not filled) satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

LCO The purpose of this LCO is to require that at least two RHR loops be OPERABLE and one of these loops be in operation. An OPERABLE loop is one that has the capability of transferring heat from the reactor coolant at a controlled rate. Heat cannot be removed via the RHR System unless forced flow is used. A minimum of one running RHR pump meets the LCO requirement for one loop in operation. An additional RHR loop is required to be OPERABLE to provide redundancy for heat removal.

Note 1 permits all RHR pumps to be removed from operation for

15 minutes when switching from one loop to another. The circumstances for stopping both RHR pumps are to be limited to situations when the outage time is short and core outlet (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.8-1

RCS Loops-MODE 5, Loops Not Filled B 3.4.8 BASES LCO (continued) temperature is maintained > 10'F below saturation temperature. The Note prohibits boron dilution with coolant at boron concentrations less than required to assure the SDM of LCO 3.1.1 is maintained or draining operations when RHR forced flow is stopped.

Note 2 allows one RHR loop to be inoperable for a period of

2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , provided that the other loop is OPERABLE and in operation. This permits periodic surveillance tests to be performed on the inoperable loop during the only time when these tests are safe and possible.

An OPERABLE RHR loop is comprised of an OPERABLE RHR pump capable of providing forced flow to an OPERABLE RHR heat exchanger.

RHR pumps are OPERABLE if they are capable of being powered and are able to provide flow if required.

APPLICABILITY In MODE 5 with the unisolated portion of the loops not filled, this LCO requires core heat removal and coolant circulation by the RHR System.

Operation in other MODES is covered by:

LCO LCO LCO LCO LCO 3.4.4, 3.4.5, 3.4.6, 3.4.7, 3.9.5, LCO 3.9.6, "RCS Loops-MODES 1 and 2";

"RCS Loops-MODE 3";

"RCS Loops-MODE 4";

"RCS Loops-MODE 5, Loops Filled";

"Residual Heat Removal (RHR) and Coolant Circulation-High Water Level" (MODE 6); and "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level" (MODE 6).

If all RCS loops are isolated, the RCS water inventory is substantially reduced. In this circumstance, LCO 3.4.8 applies whether or not the isolated loops are filled.

A. 1 If one required RHR loop is inoperable, redundancy for RHR is lost. Action must be initiated to restore a second loop to OPERABLE status. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

Revision 0 North Anna Units 1 and 2 ACTIONS B 3.4.8-2

RCS Loops-MODE 5, Loops Not Filled B 3.4.8 BASES ACTIONS B.1 and B.2 (continued)

If no required loop is OPERABLE or the required loop is not in operation, except during conditions permitted by Note 1, all operations involving introduction of coolant into the RCS with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 must be suspended and action must be initiated immediately to restore an RHR loop to OPERABLE status and operation. The required margin to criticality must not be reduced in this type of operation. Suspending the introduction of coolant into the RCS of coolant with boron concentration less than required to meet the minimum SDM of LCO 3.1.1 is required to assure continued safe operation.

With coolant added without forced circulation, unmixed coolant could be introduced to the core, however coolant added with boron concentration meeting the minimum SDM maintains acceptable margin to subcritical operations. The immediate Completion Time reflects the importance of maintaining operation for heat removal.

The action to restore must continue until one loop is restored to OPERABLE status and operation.

SURVEILLANCE SR 3.4.8.1 REQUIREMENTS This SR requires verification every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that the required loop is in operation. Verification includes flow rate, temperature, or pump status monitoring, which help ensure that forced flow is providing heat removal.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient considering other indications and alarms available to the operator in the control room to monitor RHR loop performance.

SR 3.4.8.2 Verification that the required pump is OPERABLE ensures that an additional pump can be placed in operation, if needed, to maintain decay heat removal and reactor coolant circulation.

Verification is performed by verifying proper breaker alignment and power available to the required pump. The Frequency of 7 days is considered reasonable in view of other administrative controls available and has been shown to be acceptable by operating experience.

This SR is modified by a Note that states the SR is not required to be performed until 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after a required pump is not in operation.

North Anna Units 1 and 2 Revision 0 B 3.4.8-3

RCS Loops-MODE 5, Loops Not Filled B 3.4.8 BASES REFERENCES None.

Revision 0 North Anna Units 1 and 2 B 3.4.8-4

Pressurizer B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 Pressurizer BASES BACKGROUND The pressurizer provides a point in the RCS where liquid and vapor are maintained in equilibrium under saturated conditions for pressure control purposes to prevent bulk boiling in the remainder of the RCS. Key functions include maintaining required primary system pressure during steady state operation, and limiting the pressure changes caused by reactor coolant thermal expansion and contraction during normal load transients.

The pressure control components addressed by this LCO include the pressurizer water level, the required heaters, and their controls and emergency power supplies. Pressurizer safety valves and pressurizer power operated relief valves are addressed by LCO 3.4.10, "Pressurizer Safety Valves,"

and LCO 3.4.11, "Pressurizer Power Operated Relief Valves (PORVs)," respectively.

The intent of the LCO is to ensure that a steam bubble exists in the pressurizer prior to power operation to minimize the consequences of potential overpressure transients. The presence of a steam bubble is consistent with analytical assumptions. Relatively small amounts of noncondensible gases can inhibit the condensation heat transfer between the pressurizer spray and the steam, and diminish the spray effectiveness for pressure control.

Electrical immersion heaters, located in the lower section of the pressurizer vessel, keep the water in the pressurizer at saturation temperature and maintain a constant operating pressure. There are 5 groups of pressurizer heaters. Groups 1, 2, 4, and 5 are backup heaters. Group 3 consists of proportional heaters. Groups 1 and 4 are powered from the emergency busses and are governed by this Specification. A minimum required available capacity of pressurizer heaters ensures that the RCS pressure can be maintained. The capability to maintain and control system pressure is important for maintaining subcooled conditions in the RCS and ensuring the capability to remove core decay heat by either forced or natural circulation of reactor coolant.

Unless adequate heater capacity is available, the hot, high pressure condition cannot be maintained indefinitely and (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.9-1

Pressurizer B 3.4.9 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES LCO still provide the required subcooling margin in the primary system. Inability to control the system pressure and maintain subcooling under conditions of natural circulation flow in the primary system could lead to a loss of single phase natural circulation and decreased capability to remove core decay heat.

In MODES 1, 2, and 3, the LCO requirement for a steam bubble is reflected implicitly in the accident analyses. Safety analyses performed for lower MODES are not limiting. All analyses performed from a critical reactor condition assume the existence of a steam bubble and saturated conditions in the pressurizer. In making this assumption, the analyses neglect the small fraction of noncondensible gases normally present.

Safety analyses presented in the UFSAR (Ref. 1) do not take credit for pressurizer heater operation unless their operation would increase the severity of the event; however, an implicit initial condition assumption of the safety analyses is that the pressure control system is maintaining RCS pressure in the normal operating range.

The maximum pressurizer water level limit, which ensures that a steam bubble exists in the pressurizer, satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii). Although the heaters are not specifically used in accident analysis, the need to maintain subcooling in the long term during loss of offsite power, as indicated in NUREG-0737 (Ref. 2),

is the reason for providing an LCO.

The LCO requirement for the pressurizer to be OPERABLE with a water volume

1240 cubic feet, which is equivalent to

93%, ensures that a steam bubble exists. Limiting the LCO maximum operating water level preserves the steam space for pressure control. The LCO has been established to ensure the capability to establish and maintain pressure control for steady state operation and to minimize the consequences of potential overpressure transients. Requiring the presence of a steam bubble is also consistent with analytical assumptions.

The LCO requires two groups of OPERABLE pressurizer heaters, each with a capacity Ž 125 kW, capable of being powered from an emergency bus. The two heater groups are designated as (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.9-2

Pressurizer B 3.4.9 BASES LCO (continued)

APPLICABILITY ACTIONS Group 1 and Group 4. The minimum heater capacity required is sufficient to maintain the RCS near normal operating pressure when accounting for heat losses through the pressurizer insulation. By maintaining the pressure near the operating conditions, a wide margin to subcooling can be obtained in the loops. The exact design value of 125 kW is derived from the use of seven heaters rated at 17.9 kW each.

The amount needed to maintain pressure is dependent on the heat losses.

The need for pressure control is most pertinent when core heat can cause the greatest effect on RCS temperature, resulting in the greatest effect on pressurizer level and RCS pressure control. Thus, applicability has been designated for MODES 1 and 2. The applicability is also provided for MODE 3. The purpose is to prevent solid water RCS operation during heatup and cooldown to avoid rapid pressure rises caused by normal operational perturbation, such as reactor coolant pump startup.

In MODES 1, 2, and 3, there is need to maintain the availability of pressurizer heaters, capable of being powered from an emergency bus. In the event of a loss of offsite power, the initial conditions of these MODES give the greatest demand for maintaining the RCS in a hot pressurized condition with loop subcooling for an extended period. For MODE 4, 5, or 6, the need for pressurizer heaters supplied from an emergency bus to maintain pressure control is reduced because core heat is reduced, and has a correspondingly lower effect on pressurizer level and RCS pressure control. In addition, other mechanisms, such as the Residual Heat Removal (RHR)

System and the Power Operated Relief Valves (PORVs) are available to control RCS temperature and pressure should normal offsite power be lost.

A.1, A.2, A.3 and A.4 Pressurizer water level control malfunctions or other unit evolutions may result in a pressurizer water level above the nominal upper limit, even with the unit at steady state conditions. Normally the unit will trip in this event since the upper limit of this LCO is the same as the Pressurizer Water Level-High Trip.

(continued)

North Anna Units 1 and 2 B 3.4.9-3 Revision 0

Pressuri zer B 3.4.9 BASES ACTIONS A.1, A.2, A.3 and A.4 (continued)

If the pressurizer water level is not within the limit, action must be taken to bring the unit to a MODE in which the LCO does not apply. To achieve this status, within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months the unit must be brought to MODE 3, with all rods fully inserted and incapable of withdrawal. Additionally, the unit must be brought to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This takes the unit out of the applicable MODES.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly. manner and without challenging unit systems.

B.1 If one required group of pressurizer heaters is inoperable, restoration is required within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is reasonable considering the anticipation that a demand caused by loss of offsite power would be unlikely in this period. Pressure control may be maintained during this time using the remaining heaters.

C.1 and C.2 If one group of pressurizer heaters are inoperable and cannot be restored in the allowed Completion Time of Required Action B.1, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.9.1 REQUIREMENTS This SR requires that during steady state operation, pressurizer level is maintained below the nominal upper limit to provide a minimum space for a steam bubble. The Surveillance is performed by observing the indicated level.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months corresponds to verifying the parameter each shift. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval has been shown by operating practice to be sufficient to regularly assess level for any deviation and verify that operation is within (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.9-4

Pressurizer B 3.4.9 BASES SURVEILLANCE REQUIREMENTS SR 3.4.9.1 (continued) the safety analyses assumption of ensuring that a steam bubble exists in the pressurizer. Alarms are also available for early detection of abnormal level indications.

SR 3.4.9.2 The SR is satisfied when the power supplies are demonstrated to be capable of producing the minimum power and the associated pressurizer heaters are verified to be at their required rating. This may be done by testing the power supply output and by performing an electrical check on heater element continuity and resistance. The Frequency of 18 months is considered adequate to detect heater degradation and has been shown by operating experience to be acceptable.

REFERENCES

1. UFSAR, Chapter 15.

2. NUREG-0737, November 1980.

North Anna Units 1 and 2 B 3.4.9-5 Revision 0

Intentionally Blank

Pressurizer Safety Valves B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.10 Pressurizer Safety Valves BASES BACKGROUND The pressurizer safety valves provide, in conjunction with the Reactor Protection System, overpressure protection for the RCS. The pressurizer safety valves are totally enclosed pop type, spring loaded, self actuated valves with backpressure compensation. The safety valves are designed to prevent the system pressure from exceeding the system Safety Limit (SL),

2735 psig, which is 110% of the design pressure.

Because the safety valves are totally enclosed and self actuating, they are considered independent components. The relief capacity for each valve, 380,000 lb/hr, is based on postulated overpressure transient conditions resulting from a complete loss of steam flow to the turbine, a locked reactor coolant pump rotor, and reactivity insertion due to control rod withdrawal.

The complete loss of steam flow is typically the limiting event. The limiting event results in the maximum surge rate into the pressurizer, which specifies the minimum relief capacity for the safety valves. The discharge flow from the pressurizer safety valves is directed to the pressurizer relief tank. This discharge flow is indicated by an increase in temperature downstream of the pressurizer safety valves, increase in the pressurizer relief tank temperature or level, or by the acoustic monitors located on the relief line.

Overpressure protection is required in MODES 1, 2, 3, 4, and 5; however, in MODE 4, with one or more RCS cold leg temperatures

235°F (Unit 1), 270'F (Unit 2), and MODE 5 and MODE 6 with the reactor vessel head on, overpressure protection is provided by operating procedures and by meeting the requirements of LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)

System."

The safety valve pressure tolerance limit is expressed as an average value. The as-found error, expressed as a positive or negative percentage of each tested safety valve, is summed and divided by the number of valves tested. This average as-found value is compared to the acceptable range of +2% to -3%.

In addition, no single valve is allowed to be outside of +/-3%. The lift setting is for the ambient conditions associated with MODES 1, 2, and 3. This requires (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.10-1

Pressurizer Safety Valves B 3.4.10 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES either that the valves be set hot or that a correlation between hot and cold settings be established.

The pressurizer safety valves are part of the primary success path and mitigate the effects of postulated accidents. OPERABILITY of the safety valves ensures that the RCS pressure will be limited to 110% of design pressure. The consequences of exceeding the American Society of Mechanical Engineers (ASME) pressure limit (Ref. 1) could include damage to RCS components, increased leakage, or a requirement to perform additional stress analyses prior to resumption of reactor operation.

All accident and safety analyses in the UFSAR (Ref.

2) that require safety valve actuation assume operation of three pressurizer safety valves to limit increases in RCS pressure. The overpressure protection analysis (Ref. 3) is also based on operation of three safety valves. Accidents that could result in overpressurization if not properly terminated include:

a. Uncontrolled rod withdrawal from full power;

b. Loss of reactor coolant flow;

c. Loss of external electrical load;

d. Loss of normal feedwater;

e. Loss of all AC power to station auxiliaries;

f. Locked rotor; and

g. Uncontrolled rod withdrawal from subcritical.

Description of the analyses of the above transients are contained in Reference 2. Safety valve actuation is required in events a, c, f and g (above) to limit the pressure increase. Compliance with this LCO is consistent with the design bases and accident analyses assumptions.

Pressurizer safety valves satisfy Criterion 3 of 10 CFR 50.36(c) (2)(ii).

Revision 0 North Anna Units 1 and 2 B 3.4.10-2

Pressurizer Safety Valves B 3.4.10 BASES LCO The three pressurizer safety valves are set to open at the RCS design pressure (2485 psig), and within the ASME specified tolerance, to avoid exceeding the maximum design pressure SL, to maintain accident analyses assumptions, and to comply with ASME requirements. The safety valve pressure tolerance limit is expressed as an average value. The as found error, expressed as a positive or negative percentage of each tested safety valve, is summed and divided by the number of valves tested. This average as-found value is compared to the acceptable range of +2% to -3%.

In addition, no single valve is allowed to be outside of +/-3%. The limit protected by this Specification is the reactor coolant pressure boundary (RCPB)

SL of 110% of design pressure.

Inoperability of one or more valves could result in exceeding the SL if a transient were to occur. The consequences of exceeding the ASME pressure limit could include damage to one or more RCS components, increased leakage, or additional stress analysis being required prior to resumption of reactor operation.

APPLICABILITY In MODES 1, 2, and 3, and portions of MODE 4 above the LTOP arming temperature, OPERABILITY of three valves is required because the combined capacity is required to keep reactor coolant pressure below 110% of its design value during certain accidents. MODE 3 and portions of MODE 4 are conservatively included, although the listed accidents may not require the safety valves for protection.

The LCO is not applicable in MODE 4 when any RCS cold leg temperatures are - 2350F (Unit 1),

270°F (Unit 2) or in MODE 5 because LTOP is provided. Overpressure protection is not required in MODE 6 with reactor vessel head detensioned.

The Note allows entry into MODES 3 and 4 with the lift settings outside the LCO limits. This permits testing and examination of the safety valves at high pressure and temperature near their normal operating range, but only after the valves have had a preliminary cold setting. The cold setting gives assurance that the valves are OPERABLE near their design condition. This method of testing is not currently used at North Anna, but it is an accepted method.

Only one valve at a time may be removed from service for testing. The 54 hour6.25e-4 days 0.015 hours 8.928571e-5 weeks 2.0547e-5 months exception is based on 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months outage time for each of the three valves. The 18 hour2.083333e-4 days 0.005 hours 2.97619e-5 weeks 6.849e-6 months period is derived from industry experience that hot testing can be performed in this timeframe.

Revision 0 North Anna Units 1 and 2 B 3.4.10-3

Pressurizer Safety Valves B 3.4.10 BASES ACTIONS A.1 With one pressurizer safety valve inoperable, restoration must take place within 15 minutes. The Completion Time of 15 minutes reflects the importance of maintaining the RCS Overpressure Protection System. An inoperable safety valve coincident with an RCS overpressure event could challenge the integrity of the pressure boundary.

B.1 and B.2 If the Required Action of A.1 cannot be met within the required Completion Time or if two or more pressurizer safety valves are inoperable, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 with any RCS cold leg temperatures

235°F (Unit 1), 270'F (Unit 2) within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. With any RCS cold leg temperatures at or below 2350F (Unit 1), 270°F (Unit 2), overpressure protection is provided by the LTOP System. The change from MODE 1, 2, or 3 to MODE 4 reduces the RCS energy (core power and pressure), lowers the potential for large pressurizer insurges, and thereby removes the need for overpressure protection by three pressurizer safety valves.

SURVEILLANCE SR 3.4.10.1 REQUIREMENTS SRs are specified in the Inservice Testing Program.

Pressurizer safety valves are to be tested in accordance with the requirements of the ASME Code (Ref. 4),

which provides the activities and Frequencies necessary to satisfy the SRs.

No additional requirements are specified.

The pressurizer safety valve setpoint given in the LCO is for OPERABILITY; however, the valves are reset to +/-1% during the Surveillance to allow for drift.

REFERENCES

1.

ASME, Boiler and Pressure Vessel Code,Section III.

2.

UFSAR, Chapter 15.

3.

WCAP-7769, Rev. 1, June 1972.

Revision 0 North Anna Units 1 and 2 B 3.4.10-4

Pressurizer Safety Valves B 3.4.10 BASES REFERENCES (continued)

4. ASME Code for Operation and Maintenance of Nuclear Power Plants.

North Anna Units 1 and 2 Revision 0 B 3.4.10-5

Intentionally Blank

Pressurizer PORVs B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 Pressurizer Power Operated Relief Valves (PORVs)

BASES BACKGROUND The pressurizer is equipped with two types of devices for pressure relief: pressurizer safety valves and PORVs.

The PORVs are air or nitrogen operated valves that are controlled to open at a set pressure when the pressurizer pressure increases and close when the pressurizer pressure decreases. The PORVs may also be manually operated from the control room.

Block valves, which are normally open, are located between the pressurizer and the PORVs. The block valves are used to isolate the PORVs in case of excessive leakage or a stuck open PORV.

Block valve closure is accomplished manually using controls in the control room. A stuck open PORV is, in effect, a small break loss of coolant accident (LOCA).

As such, block valve closure terminates the RCS depressurization and coolant inventory loss.

The PORVs and their associated block valves may be used by unit operators to depressurize the RCS to recover from certain transients if normal pressurizer spray is not available. Additionally, the series arrangement of the PORVs and their block valves permit performance of surveillances on the valves during power operation.

The PORVs may also be used for feed and bleed core cooling in the case of multiple equipment failure events that are not within the design basis, such as a total loss of feedwater.

The PORVs, their block valves, and their controls are powered from the emergency buses that normally receive power from offsite power sources, but are also capable of being powered from emergency power sources in the event of a loss of offsite power. The PORVs are air operated valves and normally are provided motive force by the Instrument Air System. A backup, nitrogen supply for the PORVs is also available. Two PORVs and their associated block valves are powered from two separate safety trains (Ref. 1).

The unit has two PORVs, each having a relief capacity of 210,000 lb/hr at 2335 psig. The functional design of the PORVs is based on maintaining pressure below the Pressurizer (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.11-1

Pressurizer PORVs B 3.4.11 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES LCO Pressure-High reactor trip setpoint following a step reduction of 50% of full load with steam dump. In addition, the PORVs minimize challenges to the pressurizer safety valves and also may be used for low temperature overpressure protection (LTOP).

See LCO 3.4.12, "Low Temperature Overpressure Protection (LTOP)

System."

Unit operators employ the PORVs to depressurize the RCS in response to certain unit transients if normal pressurizer spray is not available. For the Steam Generator Tube Rupture (SGTR) event, the safety analysis assumes that manual operator actions are required to mitigate.the event. A loss of offsite power is assumed to accompany the event, and thus, normal pressurizer spray is unavailable to reduce RCS pressure. The PORVs are assumed to be used for RCS depressurization, which is one of the steps performed to equalize the primary and secondary pressures in order to terminate the primary to secondary break flow and the radioactive releases from the affected steam generator.

The PORVs are also modeled in safety analyses for events that result in increasing RCS pressure for which departure from nucleate boiling ratio (DNBR) criteria are critical (Ref. 2).

By assuming PORV actuation, the primary pressure remains below the high pressurizer pressure trip setpoint; thus, the DNBR calculation is more conservative. As such, this actuation is not required to mitigate these events, and PORV automatic operation is, therefore, not an assumed safety function.

Pressurizer PORVs satisfy Criterion 3 of 10 CFR 50.36(c) (2)(ii).

The LCO requires the PORVs and their associated block valves to be OPERABLE for manual operation to mitigate the effects associated with an SGTR.

By maintaining two PORVs and their associated block valves OPERABLE, the single failure criterion is satisfied. An OPERABLE block valve may be either open and energized with the capability to be closed, or closed and energized with the capability to be opened, since the required safety function is accomplished by manual operation. Although typically open to allow PORV operation, the block valves may be OPERABLE when closed to isolate the flow path of an inoperable PORV (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.11-2

Pressurizer PORVs B 3.4.11 BASES LCO (continued)

APPLICABILITY ACTIONS that is capable of being manually cycled (e.g., as in the case of excessive PORV leakage). Similarly, isolation of an OPERABLE PORV does not render that PORV or block valve inoperable provided the relief function remains available with manual action.

An OPERABLE PORV is required to be capable of manually opening and closing, and not experiencing excessive seat leakage. Excessive seat leakage, although not associated with a specific acceptance criteria, exists when conditions dictate closure of the block valve to limit leakage to within LCO 3.4.13, "RCS Operational Leakage."

Satisfying the LCO helps minimize challenges to fission product barriers.

In MODES 1, 2, and 3, the PORVs and their associated block valves are required to be OPERABLE to limit the potential for a small break LOCA through the flow path and for manual operation to mitigate the effects associated with an SGTR.

The PORVs are also required to be OPERABLE in MODES 1, 2, and 3 for manual actuation to mitigate an SGTR event.

Imbalances in the energy output of the core and heat removal by the secondary system can cause the RCS pressure to increase to the PORV opening setpoint. The most rapid increases will occur at the higher operating power and pressure conditions of MODES 1 and 2.

Pressure increases are less prominent in MODE 3 because the core input energy is reduced, but the RCS pressure is high.

Therefore, the LCO is applicable in MODES 1, 2, and 3. The LCO is not applicable in MODES 4, 5, and 6 with the reactor vessel head in place when both pressure and core energy are decreased and the pressure surges become much less significant. LCO 3.4.12 addresses the PORV requirements in these MODES.

Note 1 has been added to clarify that all pressurizer PORVs are treated as separate entities, each with separate Completion Times (i.e., the Completion Time is on a component basis).

North Anna Units 1 and 2 Revision 0 B 3.4.11-3

Pressurizer PORVs B 3.4.11 BASES ACTIONS A.1 (continued)

The PORVs are provided normal motive force by the Instrument Air system and have a backup nitrogen supply. If the backup nitrogen supply is inoperable, the PORVs are still capable of being manually cycled provided the Instrument Air system is available. The Instrument Air system is highly reliable and the likelihood of its being unavailable during a demand for PORV actuation is low enough to justify a 14 day Completion Time for return of the backup nitrogen supply to OPERABLE status.

B.1 PORVs may be inoperable and capable of being manually cycled (e.g., excessive seat leakage).

In this Condition, either the PORVs must be restored or the flow path isolated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The associated block valve is required to be closed, but power must be maintained to the associated block valve, since removal of power would render the block valve inoperable. This permits operation of the unit until the next refueling outage (MODE 6) so that maintenance can be performed on the PORVs to eliminate the problem condition.

Quick access to the PORV for pressure control can be made when power remains on the closed block valve. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is based on unit operating experience that has shown that minor problems can be corrected or closure accomplished in this time period.

C.1, C.2, and C.3 If one PORV is inoperable and not capable of being manually cycled, it must be either restored, or isolated by closing the associated block valve and removing the power to the associated block valve. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on challenges to the PORVs during this time period, and provides the operator adequate time to correct the situation. If the inoperable valve cannot be restored to being capable of being manually cycled (permitting entry into Condition B), or OPERABLE status, it must be isolated within the specified time. Because there is one PORV that remains OPERABLE, an additional 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is provided to restore the inoperable PORV to OPERABLE status.

If the PORV cannot be restored within this additional time, the unit must be brought to a MODE in which the LCO does not apply, as required by Condition E.

Revision 0 North Anna Units 1 and 2 B 3.4.11-4

Pressurizer PORVs B 3.4.11 BASES ACTIONS D.1 and D.2 (continued)

If one block valve is inoperable, then it is necessary to either restore the block valve to OPERABLE status within the Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or place the associated PORV in manual control.

The prime importance for the capability to close the block valve is to isolate a stuck open PORV.

Therefore, if the block valve cannot be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months , the Required Action is to place the PORV in manual control to preclude its automatic opening for an overpressure event and to avoid the potential for a stuck open PORV at a time that the block valve is inoperable. The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable, based on the small potential for challenges to the system during this time period, and provides the operator time to correct the situation. Because at least one PORV remains OPERABLE, the operator is permitted a Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to restore the inoperable block valve to OPERABLE status. The time allowed to restore the block valve is based upon the Completion Time for restoring an inoperable PORV in Condition C, since the PORVs may not be capable of mitigating an event if the inoperable block valve is not full open. If the block valve is restored within the Completion Time of 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months , the PORV may be restored to automatic operation. If it cannot be restored within this additional time, the unit must be brought to a MODE in which the LCO does not apply, as required by Condition E.

The Required Actions D.1 and D.2 are modified by a Note stating that the Required Actions do not apply if the sole reason for the block valve being declared inoperable is as a result of power being removed to comply with another Required Action. In this event, the Required Actions for inoperable PORV(s)

(which require the block valve power to be removed once it is closed) are adequate to address the condition. While it may be desirable to also place the PORV(s) in manual control, this may not be possible for all causes of Condition C entry with PORV(s) inoperable and not capable of being manually cycled (e.g., as a result of failed control power fuse(s) or control switch malfunction(s).)

E.1 and E.2 If the Required Action of Condition A, B, C, or D is not met, then the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.11-5

Pressurizer PORVs B 3.4.11 BASES ACTIONS E.1 and E.2 (continued) 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, automatic PORV OPERABILITY is required. See LCO 3.4.12.

F.1 and F.2 If more than one PORV is inoperable and not capable of being manually cycled, then the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, automatic PORV OPERABILITY is required. See LCO 3.4.12.

G.1 If two block valves are inoperable, it is necessary to restore at least one block valve within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . The Completion Time is reasonable, based on the small potential for challenges to the system during this time and provide the operator time to correct the situation.

The Required Action G.1 is modified by a Note stating that the Required Action does not apply if the sole reason for the block valve being declared inoperable is as a result of power being removed to comply with another Required Action.

In this event, the Required Action for inoperable PORV (which requires the block valve power to be removed once it is closed) is adequate to address the condition. While it may be desirable to also place the PORV in manual control, this may not be possible for all causes of Condition C entry with PORV inoperable and not capable of being manually cycled (e.g.,

as a result of failed control power fuse(s) or control switch malfunction(s)).

H.1 and H.2 If the Required Actions of Condition G are not met, then the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at (continued)

North Anna Units 1 and 2 Revision 0.

B 3.4.11-6

Pressurizer PORVs B 3.4.11 BASES ACTIONS H.1 and H.2 (continued) least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 4, automatic PORV OPERABILITY is required. See LCO 3.4.12.

SURVEILLANCE SR 3.4.11.1 REQUIREMENTS SR 3.4.11.1 requires verification that the pressure in the PORV backup nitrogen system is sufficient to provide motive force for the PORVs to cope with a steam generator tube rupture coincident with loss of the containment Instrument Air system. The Frequency of 7 days is based on operating experience.

SR 3.4.11.2 Block valve cycling verifies that the valve(s) can be opened and closed if needed. The basis for the Frequency of 92 days is the ASME Code (Ref.

3).

This SR is modified by two Notes. Note 1 modifies this SR by stating that it is not required to be performed with the block valve closed, in accordance with the Required Actions of this LCO. Opening the block valve in this condition increases the risk of an unisolable leak from the RCS since the PORV is already inoperable.

Note 2 modifies this SR to allow entry into and operation in MODE 3 prior to performing the SR. This allows the test to be performed in MODE 3 under operating temperature and pressure conditions, prior to entering MODE 1 or 2.

SR 3.4.11.3 SR 3.4.11.3 requires a complete cycle of each PORV.

Operating a PORV through one complete cycle ensures that the PORV can be manually actuated for mitigation of an SGTR. This testing is performed in MODES 3 or 4 to prevent possible RCS pressure transients with the reactor critical. The Frequency of 18 months is based on a typical refueling cycle and industry accepted practice.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.4.11-7

Pressurizer PORVs B 3.4.11 BASES SURVEILLANCE REQUIREMENTS SR 3.4.11.3 (continued)

The Note modifies this SR to allow entry into and operation in MODE 3 prior to performing the SR. This allows the test to be performed in MODE 3 under operating temperature and pressure conditions, prior to entering MODE 1 or 2.

SR 3.4.11.4 Operating the solenoid control valves and check valves on the accumulators ensures the PORV control system actuates properly when called upon. The Frequency of 18 months is based on a typical refueling cycle and the Frequency of the other Surveillances used to demonstrate PORV OPERABILITY.

REFERENCES

1. Regulatory Guide 1.32, February 1977.

2.

UFSAR, Section 15.4.

3.

ASME Code for Operation and Maintenance of Nuclear Power Plants.

North Anna Units 1 and 2 Revision 0 B 3.4.11-8

LTOP System B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Low Temperature Overpressure Protection (LTOP)

System BASES BACKGROUND The LTOP System controls RCS pressure at low temperatures so the integrity of the reactor coolant pressure boundary (RCPB) is not compromised by violating the LTOP System design basis pressure and temperature (P/T) limit curve (i.e., 110% of the isothermal P/T limit curve determined to satisfy the requirements of 10 CFR 50, Appendix G, Ref. 1).

The reactor vessel is the limiting RCPB component for demonstrating such protection. This' specification provides the maximum allowable actuation logic setpoints for the power operated relief valves (PORVs) and LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," provides the maximum RCS pressure for the existing RCS cold leg temperature during cooldown, shutdown, and heatup to meet the Reference I requirements during the LTOP MODES.

The reactor vessel material is less tough at low temperatures than at normal operating temperature. As the vessel neutron exposure accumulates, the material toughness decreases and becomes less resistant to pressure stress at low temperatures (Ref. 2).

RCS pressure, therefore, is maintained low at low temperatures and is increased only as temperature is increased.

The potential for vessel overpressurization is most acute when the RCS is water solid, occurring only while shutdown; a pressure fluctuation can occur more quickly than an operator can react to relieve the condition. Exceeding the RCS P/T limits by a significant amount could cause brittle cracking of the reactor vessel. LCO 3.4.3, "RCS Pressure and Temperature (P/T) Limits," requires administrative control of RCS pressure and temperature during heatup and cooldown to prevent exceeding the P/T limits.

This LCO provides RCS overpressure protection by limiting coolant input capability and having adequate pressure relief capacity. Limiting coolant input capability requires all but one low head safety injection (LHSI) pump and one charging pump incapable of injection into the RCS and isolating the accumulators when accumulator pressure is greater than the PORV lift setting. The pressure relief capacity requires either two redundant RCS PORVs or a depressurized RCS and an (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.12-1

LTOP System B 3.4.12 BASES BACKGROUND RCS vent of sufficient size. One RCS PORV or the open RCS (continued) vent is the overpressure protection device that acts to terminate an increasing pressure event.

With limited coolant input capability, the ability to provide core coolant addition is restricted. The LCO does not require the makeup control system deactivated or the safety injection (SI) actuation circuits blocked. Due to the lower pressures in the LTOP MODES and the expected core decay heat levels, the makeup system can provide adequate flow via the makeup control valve. If conditions require the use of more than one LHSI and charging pump for makeup in the event of loss of inventory, then pumps can be made available through manual actions.

The LTOP System for pressure relief consists of two PORVs with reduced lift settings, or a depressurized RCS and an RCS vent of sufficient size. Two RCS PORVs are required for redundancy. One RCS PORV has adequate relieving capability to keep from overpressurization for the required coolant input capability.

PORV Requirements As designed for the LTOP System, each PORV is signaled to open if the RCS pressure exceeds a limit determined by the LTOP actuation logic. The LTOP actuation logic monitors both RCS temperature and RCS pressure and determines when a condition is not acceptable. The wide range RCS temperature indications are auctioneered to select the lowest temperature signal.

The lowest temperature signal is passed to a comparator circuit which determines the pressure limit for that temperature. The pressure limit is then compared with the indicated RCS pressure from a wide range pressure channel.

If the indicated pressure meets or exceeds the calculated value, the PORVs are signaled to open.

The PORV setpoints are staggered so only one valve opens to stop a low temperature overpressure transient. If the opening of the first valve does not prevent a further increase in pressure, a second valve will open at its higher pressure setpoint to stop the transient. Having the setpoints of both valves within the limits in the LCO ensures that the LTOP System design basis P/T limit curve will not be exceeded in any analyzed event.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.4.12-2

LTOP System B 3.4.12 BASES BACKGROUND PORV Requirements (continued)

When a PORV is opened in an increasing pressure transient, the release of coolant will cause the pressure increase to slow and reverse. As the PORV releases coolant, the RCS pressure decreases until a reset pressure is reached and the valve is signaled to close. The pressure continues to decrease below the reset pressure as the valve closes.

RCS Vent Requirements Once the RCS is depressurized, a vent exposed to the containment atmosphere will maintain the RCS within the LTOP design basis P/T limit curve in an RCS overpressure transient, if the relieving requirements of the transient do not exceed the capabilities of the vent. Thus, the vent path must be capable of relieving the flow resulting from the limiting LTOP mass or heat input transient, and maintaining pressure below the LTOP System design basis P/T limit curve.

The required vent capacity may be provided by one or more vent paths.

For an RCS vent to meet the flow capacity requirement, it requires removing a pressurizer safety valve, blocking open a PORV and its block valve, or similarly establishing a vent by opening an RCS vent valve. The vent path(s) must be above the level of reactor coolant, so as not to drain the RCS when open.

APPLICABLE SAFETY ANALYSES Safety analyses (Ref. 3) demonstrate that the reactor vessel is adequately protected against exceeding the LTOP System design basis P/T limit curve (i.e., 110% of the isothermal P/T limit curve determined to satisfy the requirements of 10 CFR 50, Appendix G, Ref. 1). In MODES 1, 2, and 3, and in MODE 4 with RCS cold leg temperature exceeding 2350F (Unit 1), 270°F (Unit 2), the pressurizer safety valves will prevent RCS pressure from exceeding the Reference 1 limits.

At 2350F (Unit 1),

270°F (Unit 2) and below, overpressure prevention falls to two OPERABLE RCS PORVs or to a depressurized RCS and a sufficient sized RCS vent. Each of these means has a limited overpressure relief capability.

The RCS cold leg temperature below which LTOP protection must be provided increases as the reactor vessel material toughness decreases due to neutron embrittlement. Each time the P/T curves are revised, the LTOP System must be (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.12-3

LTOP System B 3.4.12 BASES APPLICABLE re-evaluated to ensure its functional requirements can still SAFETY ANALYSES be met using the PORV method or the depressurized and vented (continued)

RCS condition.

The LCO contains the acceptance limits that define the LTOP requirements. Any change to the RCS must be evaluated against the Reference 3 analyses to determine the impact of the change on the LTOP acceptance limits.

Transients that are capable of overpressurizing the RCS are categorized as either mass or heat input transients, examples of which follow:

Mass Input Type Transients

a. Inadvertent safety injection; or

b. Charging/letdown flow mismatch.

Heat Input Type Transients

a. Reactor coolant pump (RCP) startup with temperature asymmetry between the RCS and steam generators.

The following are required during the LTOP MODES to ensure that mass and heat input transients do not occur, which either of the LTOP overpressure protection means cannot handle:

a. Rendering all but one LHSI pump and one charging pump incapable of injection;

b. Deactivating the accumulator discharge isolation valves in their closed positions when accumulator pressure is greater than the PORV lift setting; and

c. Disallowing start of an RCP if secondary temperature is more than 50°F above primary temperature in any one loop.

LCO 3.4.6, "RCS Loops-MODE 4," and LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," provide this protection.

The Reference 3 analyses demonstrate that either one PORV or the depressurized RCS and RCS vent can maintain RCS pressure below limits when only one LHSI pump and one charging pump are actuated. Thus, the LCO allows only one LHSI pump and one charging pump OPERABLE during the LTOP MODES.

The (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.12-4

LTOP System B 3.4.12 BASES APPLICABLE Heat Input Type Transients (continued)

SAFETY ANALYSES Reference 3 analyses do not explicitly model actuation of the LHSI pump, since the RCS pressurization resulting from inadvertent safety injection by a single charging pump against a water-solid RCS would not be made more severe by such actuation. Since the LTOP analyses assume that the accumulators do not cause a mass addition transient, when RCS temperature is low, the LCO also requires the accumulators to be isolated when accumulator pressure is greater than the PORV lift setting. The isolated accumulators must have their discharge valves closed and the valve power supply breakers fixed i~n their open positions.

Fracture mechanics analyses established the temperature of LTOP Applicability at 2350F (Unit 1),

270°F (Unit 2).

The consequences of a small break loss of coolant accident (LOCA) in LTOP MODE 4 conform to 10 CFR 50.46 (Ref. 4),

requirements by having a maximum of one LHSI pump and one charging pump OPERABLE.

PORV Performance The fracture mechanics analyses show that the vessel is protected when the PORVs are set to open at or below the limits shown in the LCO. The setpoints are derived by analyses that model the performance of the LTOP System, assuming the limiting LTOP transient of one charging pump injecting into the RCS.

These analyses consider pressure overshoot beyond the PORV opening and closing, resulting from signal processing and valve stroke times. The PORV setpoints at or below the derived limit ensure the RCS pressure at the reactor vessel beltline will not exceed the LTOP design P/T limit curve.

The PORV setpoints are evaluated when the P/T limits are modified. The P/T limits are periodically modified as the reactor vessel material toughness decreases due to neutron embrittlement caused by neutron irradiation. Revised limits are determined using neutron fluence projections and the results of examinations of the reactor vessel material irradiation surveillance specimens. The Bases for LCO 3.4.3 discuss these examinations.

The PORVs are considered active components. Thus, the failure of one PORV is assumed to represent the worst case, single active failure.

North Anna Units 1 and 2 Revision 0 B 3.4.12-5

LTOP System B 3.4.12 BASES APPLICABLE RCS Vent Performance SAFETY ANALYSES (continued)

With the RCS depressurized, analyses show a vent size of 2.07 square inches is capable of mitigating the allowed LTOP overpressure transient. (A vent size of 2.07 square inches is the equivalent relief capacity of one PORV.) The capacity of a vent this size is greater than the flow of the limiting transient for the LTOP configuration, one LHSI pump and one charging pump OPERABLE, maintaining RCS pressure less than the LTOP design basis P/T limit curve.

The RCS vent size is re-evaluated for compliance each time the P/T limit curves are revised based on the results of the vessel material surveillance.

The RCS vent is passive and is not subject to active failure.

The LTOP System satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

LCO This LCO requires that the LTOP System is OPERABLE. The LTOP System is OPERABLE when the minimum coolant input and pressure relief capabilities are OPERABLE. Violation of this LCO could lead to the loss of low temperature overpressure mitigation and violation of the LTOP System design basis P/T limit curve (i.e., 110% of the isothermal P/T limit curve determined to satisfy the requirements of 10 CFR 50, Appendix G, Ref. 1) as a result of an operational transient.

To limit the coolant input capability, the LCO requires a maximum of one LHSI pump and one charging pump capable of injecting into the RCS and all accumulator discharge isolation valves closed with power removed from the isolation valve operator, when accumulator pressure is greater than the PORV lift setting.

The LCO is modified by two Notes. Note 1 allows two charging pumps to be made capable of injection for

1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months during pump swap operations. One hour provides sufficient time to safely complete the actual transfer and to complete the administrative controls and Surveillance requirements associated with the swap. The intent is to minimize the actual time that more than one charging pump is physically capable of injection.

(conti nued)

Revision 0 North Anna Units 1 and 2 B 3.4.12-6

LTOP System B 3.4.12 BASES LCO (continued)

Note 2 states that accumulator isolation is only required when the accumulator pressure is more than the PORV lift setting. This Note permits the accumulator discharge isolation valves to be open if the accumulator cannot challenge the LTOP limits.

The elements of the LCO that provide low temperature overpressure mitigation through pressure relief are:

a. Two OPERABLE PORVs; or A PORV is OPERABLE for LTOP when its block valve is open, its lift setpoint is set to the limits provided in the LCO and testing proves its ability to open at this setpoint, and backup nitrogen motive power is available to the PORVs and their control circuits.

b. A depressurized RCS and an RCS vent.

An RCS vent is OPERABLE when open with an area of

Ž 2.07 square inches.

Each of these methods of overpressure prevention is capable of mitigating the limiting LTOP transient.

APPLICABILITY This LCO is applicable in MODE 4 when any RCS cold leg temperature is

2350F (Unit 1),

270OF (Unit 2), in MODE 5, and in MODE 6 when the reactor vessel head is on. The pressurizer safety valves provide overpressure protection that meets the Reference 1 P/T limits above 2357F (Unit 1),

2707F (Unit 2). When the reactor vessel head is off, overpressurization cannot occur.

LCO 3.4.3 provides the operational P/T limits for all MODES.

LCO 3.4.10, "Pressurizer Safety Valves," requires the OPERABILITY of the pressurizer safety valves that provide overpressure protection during MODES 1, 2, and 3, and MODE 4 above 2351F (Unit 1), 270°F (Unit 2).

Low temperature overpressure prevention is most critical during shutdown when the RCS is water solid, and a mass or heat input transient can cause a very rapid increase in RCS pressure when little or no time allows operator action to mitigate the event.

North Anna Units 1 and 2 Revision 0 B 3.4.12-7

LTOP System B 3.4.12 BASES ACTIONS A.1 and B.1 With more than one LHSI pump and one charging pump capable of injecting into the RCS, RCS overpressurization is possible.

To immediately initiate action to restore restricted coolant input capability to the RCS reflects the urgency of removing the RCS from this condition.

C.1, C.2, D.1, and D.2 An unisolated accumulator requires isolation immediately.

Power available to an accumulator isolation valve operator must be removed in one hour. These ACTIONS are modified by a Note which states the Condition only applies if the accumulator pressure is more than the PORV lift setting.

If isolation is needed and cannot be accomplished, Required Action D.1 and Required Action D.2 provide two options, either of which must be performed in the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . By increasing the RCS temperature to > 2350F (Unit 1), 270'F (Unit 2), the LCO is no longer Applicable. Depressurizing the accumulators below the PORV lift setting also exits the Condition.

The Completion Times are based on operating experience that these activities can be accomplished in these time periods and on engineering judgement indicating that an event requiring LTOP is not likely in the allowed times.

E.1 In MODE 4 when any RCS cold leg temperature is

235°F (Unit 1), 270°F (Unit 2), with one RCS PORV inoperable, the RCS PORV must be restored to OPERABLE status within a Completion Time of 7 days. Two PORVs are required to provide low temperature overpressure mitigation while withstanding a single failure of an active component.

The Completion Time considers the facts that only one of the PORVs is required to mitigate an overpressure transient and that the likelihood of an active failure of the remaining valve path during this time period is very low.

Revision 0 North Anna Units 1 and 2 B 3.4.12-8

LTOP System B 3.4.12 BASES ACTIONS F.1 (conti nued)

The consequences of operational events that will overpressurize the RCS are more severe at lower temperature (Ref. 5). Thus, with one of the two RCS PORVs inoperable in MODE 5 or in MODE 6 with the head on, the Completion Time to restore two valves to OPERABLE status is 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months .

The Completion Time represents a reasonable time to investigate and repair PORV failures without exposure to a lengthy period with only one OPERABLE RCS PORV to protect against overpressure events.

G.1 The RCS must be depressurized and a vent must be established within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months when:

a. Both required RCS PORVs are inoperable; or

b. A Required Action and associated Completion Time of Condition A, B, D, E, or F is not met; or

c. The LTOP System is inoperable for any reason other than Condition A, B, C, D, E, or F.

The vent must be sized Ž 2.07 square inches to ensure that the flow capacity is greater than that required for the worst case mass input transient reasonable during the applicable MODES. This action is needed to protect the RCPB from a low temperature overpressure event and a possible brittle failure of the reactor vessel.

The Completion Time considers the time required to place the unit in this Condition and the relatively low probability of an overpressure event during this time period due to increased operator awareness of administrative control requirements.

SURVEILLANCE SR 3.4.12.1, SR 3.4.12.2, and SR 3.4.12.3 REQUIREMENTS To minimize the potential for a low temperature overpressure event by limiting the mass input capability, a maximum of one LHSI pump and a maximum of one charging pump are verified (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.12-9

LTOP System B 3.4.12 BASES SURVEILLANCE SR 3.4.12.1. SR 3.4.12.2, and SR 3.4.12.3 (continued)

REQUIREMENTS incapable of injecting into the RCS and the accumulator discharge isolation valves are verified closed with power removed from the isolation valve operator.

SR 3.4.12.3 is modified by a Note stating that the verification is only required when accumulator pressure is greater than the PORV lift setting. With accumulator pressure less than the PORV lift setting, the accumulator cannot challenge the LTOP limits and the isolation valves are allowed to be open.

The LHSI pumps and charging pumps are rendered incapable of injecting into the RCS through removing the power from the pumps by racking the breakers out under administrative control.

An alternate method of LTOP control may be employed using at least two independent means to prevent a pump start such that a single failure or single action will not result in an injection into the RCS. This may be accomplished through the pump control switch being placed in pull to lock and at least one valve in the discharge flow path being closed.

The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is sufficient, considering other indications and alarms available to the operator in the control room, to verify the required status of the equipment.

SR 3.4.12.4 The RCS vent of Ž 2.07 square inches is proven OPERABLE by verifying its open condition either:

a. Once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months for a valve that is not locked.

b. Once every 31 days for a valve that is locked, sealed, or secured in position. A removed pressurizer safety valve or blocked open PORV with its block valve disabled in the open position fits this category.

The passive vent arrangement must only be open to be OPERABLE. This Surveillance is required to be performed if the vent is being used to satisfy the pressure relief requirements of the LCO 3.4.12b.

Revision 0 North Anna Units 1 and 2 B 3.4.12-10

LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.12.5 The PORV block valve must be verified open every 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months to provide the flow path for each required PORV to perform its function when actuated. The valve may be remotely verified open in the main control room. In addition, the PORV keyswitch must be verified to be in the proper position to provide the appropriated trip setpoints to the PORV actuation logic. This Surveillance is performed if the PORV is used to satisfy the LCO.

The block valve is a remotely controlled, motor operated valve. The power to the valve operator is not required removed, and the manual operator is not required locked in the inactive position. Thus, the block valve can be closed in the event the PORV develops excessive leakage or does not close (sticks open) after relieving an overpressure situation.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is considered adequate in view of other administrative controls available to the operator in the control room, such as valve position indication and alarms, that verify that the PORV block valve remains open and the keyswitch in the proper position.

SR 3.4.12.6 SR 3.4.12.6 requires verification that the pressure in the PORV backup nitrogen system is sufficient to provide motive force for the PORVs to cope with an overpressure event. The Frequency of 7 days is based on operating experience.

SR 3.4.12.7 Performance of a COT is required within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing RCS temperature to

2351F (Unit 1), 270°F (Unit 2) and every 31 days on each required PORV to verify and, as necessary, adjust its lift setpoint. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. The COT will (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.12-11

LTOP System B 3.4.12 BASES SURVEILLANCE REQUIREMENTS SR 3.4.12.7 (continued) verify the setpoint is within the allowed maximum limits in this specification. PORV actuation could depressurize the RCS and is not required.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency considers the unlikelihood of a low temperature overpressure event during this time.

A Note has been added indicating that this SR is required to be met 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after decreasing RCS cold leg temperature to

235 0F (Unit 1),

270°F (Unit 2). The COT cannot be performed until in the LTOP MODES when the PORV lift setpoint can be reduced to the LTOP setting. The test must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering the LTOP MODES.

SR 3.4.12.8 Performance of a CHANNEL CALIBRATION on each required PORV actuation channel is required every 18 months to adjust the whole channel so that it responds and the valve opens within the required range and accuracy to known input.

REFERENCES

1. 10 CFR 50, Appendix G.

2. Generic Letter 88-11.

3. UFSAR, Section 5.2.2.2.

4. 10 CFR 50, Section 50.46.

5. Generic Letter 90-06.

Revision 0 North Anna Units 1 and 2 B 3.4.12-12

RCS Operational LEAKAGE B 3.4.13 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.13 RCS Operational LEAKAGE BASES BACKGROUND Components that contain or transport the coolant to or from the reactor core make up the RCS. Component joints are made by welding, bolting, rolling, or pressure loading, and valves isolate connecting systems from the RCS.

During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration.

The purpose of the RCS Operational LEAKAGE LCO is to limit system operation in the presence of LEAKAGE from these sources to amounts that do not compromise safety. This LCO specifies the types and amounts of LEAKAGE.

General Design Criteria 3 (Ref. 1), requires means for detecting and, to the extent practical, identifying the source of reactor coolant LEAKAGE.

Regulatory Guide 1.45 (Ref.

2) describes acceptable methods for selecting leakage detection systems.

The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring reactor coolant LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE is necessary to provide quantitative information to the operators, allowing them to take corrective action should a leak occur that is detrimental to the safety of the facility and the public.

A limited amount of leakage inside containment is expected from auxiliary systems that cannot be made 100% leaktight.

Leakage from these systems should be detected, located, and isolated from the containment atmosphere, if possible, to not interfere with RCS leakage detection.

This LCO deals with protection of the reactor coolant pressure boundary (RCPB) from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded.

The consequences of violating this LCO include the possibility of a loss of coolant accident (LOCA).

North Anna Units 1 and 2 Revi si on 0 B 3.4.13-1

RCS Operational LEAKAGE B 3.4.13 BASES APPLICABLE Except for primary to secondary LEAKAGE, the safety analyses SAFETY ANALYSES do not address operational LEAKAGE.

However, other operational LEAKAGE is related to the safety analyses for LOCA; the amount of leakage can affect the probability of such an event. The safety analysis for an event resulting in steam discharge to the atmosphere assumes a 1 gpm primary to secondary LEAKAGE as the initial condition.

Primary to secondary LEAKAGE is a factor in the dose releases outside containment resulting from a steam line break (SLB) accident. To a lesser extent, other accidents or transients involve secondary steam release to the atmosphere, such as a steam generator tube rupture (SGTR).

The leakage contaminates the secondary fluid.

The UFSAR (Ref.

3) analysis for SGTR assumes the contaminated secondary fluid is only briefly released via safety valves and the majority is steamed to the condenser if offsite power is available. The 1 gpm primary to secondary LEAKAGE is relatively inconsequential in this case. If offsite power is not available, releases continue through the unaffected steam generators until the Residual Heat Removal System is placed in service. In this case, the 1 gpm primary to secondary LEAKAGE is more significant.

The SLB is more limiting for site radiation releases. The safety analysis for the SLB accident assumes primary to secondary LEAKAGE as an initial condition. The dose consequences resulting from the SLB accident are well within the limits defined in the staff approved licensing basis.

The RCS operational LEAKAGE satisfies Criterion 2 of 10 CFR 50.36(c)(2)(ii).

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE No pressure boundary LEAKAGE is allowed, being indicative of material deterioration.

LEAKAGE of this type is unacceptable as the leak itself could cause further deterioration, resulting in higher LEAKAGE.

Violation of this LCO could result in continued degradation of the RCPB.

LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

Revision 0 North Anna Units 1 and 2 B 3.4.13-2

RCS Operational LEAKAGE B 3.4.13 BASES LCO

b. Unidentified LEAKAGE (continued)

One gallon per minute (gpm) of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the containment air monitoring and containment sump level monitoring equipment can detect within a reasonable time period. Violation of this LCO could result in continued degradation of the RCPB, if the LEAKAGE is from the pressure boundary.

c. Identified LEAKAGE Up to 10 gpm of identified LEAKAGE is considered allowable because LEAKAGE is from known sources that do not interfere with detection of unidentified LEAKAGE and is well within the capability of the RCS Makeup System.

Identified LEAKAGE includes LEAKAGE to the containment from specifically known and located sources, but does not include pressure boundary LEAKAGE or controlled reactor coolant pump (RCP) seal leakoff (a normal function not considered LEAKAGE).

Violation of this LCO could result in continued degradation of a component or system.

d. Primary to Secondary LEAKAGE through All Steam Generators (SGs)

Total primary to secondary LEAKAGE amounting to 1 gpm through all SGs produces acceptable offsite doses in the SLB accident analysis. Violation of this LCO could exceed the offsite dose limits for this accident. Primary to secondary LEAKAGE must be included in the total allowable limit for identified LEAKAGE.

e. Primary to Secondary LEAKAGE through Any One SG The 500 gallons per day limit on one SG is based on the assumption that a single crack leaking this amount would not propagate to a SGTR under the stress conditions of a LOCA or a main steam line rupture. If leaked through many cracks, the cracks are very small, and the above assumption is conservative.

Revision 0 North Anna Units 1 and 2 B 3.4.13-3

RCS Operational LEAKAGE B 3.4.13 BASES APPLICABILITY In MODES 1, 2, 3, and 4, the potential for RCPB LEAKAGE is greatest when the RCS is pressurized.

In MODES 5 and 6, LEAKAGE limits are not required because the reactor coolant pressure is far lower, resulting in lower stresses and reduced potentials for LEAKAGE.

LCO 3.4.14, "RCS Pressure Isolation Valve (PIV)

Leakage,"

measures leakage through each individual PIV and can impact this LCO.

Of the two PIVs in series in each isolated line, leakage measured through one PIV does not result in RCS LEAKAGE when the other is leak tight. If both valves leak and result in a loss of mass from the RCS, the loss must be included in the allowable identified LEAKAGE.

ACTIONS A.1 Unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE in excess of the LCO limits must be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . This Completion Time allows time to verify leakage rates and either identify unidentified LEAKAGE or reduce LEAKAGE to within limits before the reactor must be shut down. This action is necessary to prevent further deterioration of the RCPB.

B.1 and B.2 If any pressure boundary LEAKAGE exists, or if unidentified LEAKAGE, identified LEAKAGE, or primary to secondary LEAKAGE cannot be reduced to within limits within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months , the reactor must be brought to lower pressure conditions to reduce the severity of the LEAKAGE and its potential consequences. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

The reactor must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This action reduces the LEAKAGE and also reduces the factors that tend to degrade the pressure boundary.

The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems. In MODE 5, the pressure stresses acting on the RCPB are much lower, and further deterioration is much less likely.

Revision 0 North Anna Units 1 and 2 B 3.4.13-4

RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE SR 3.4.13.1 REQU IREMENTS Verifying RCS LEAKAGE to be within the LCO limits ensures the integrity of the RCPB is maintained. Pressure boundary LEAKAGE would at first appear as unidentified LEAKAGE and can only be positively identified by inspection. It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE. Unidentified LEAKAGE and identified LEAKAGE are determined by performance of an RCS water inventory balance. Primary to secondary LEAKAGE is also measured by performance of an RCS water inventory balance in conjunction with effluent monitoring within the secondary steam and feedwater systems.

The RCS water inventory balance must be met with the reactor at steady state operating conditions (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows).

Therefore, a Note is added allowing that this SR is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishing steady state operation. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance provides sufficient time to collect and process all necessary data after stable plant conditions are established.

Steady state operation is required to perform a proper inventory balance since calculations during maneuvering are not useful. For RCS operational LEAKAGE determination by water inventory balance, steady state is defined as stable RCS pressure, temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flows.

An early warning of pressure boundary LEAKAGE or unidentified LEAKAGE is provided by the automatic systems that monitor the containment atmosphere radioactivity and the containment sump level.

It should be noted that LEAKAGE past seals and gaskets is not pressure boundary LEAKAGE.

These leakage detection systems are specified in LCO 3.4.15, "RCS Leakage Detection Instrumentation."

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Frequency is a reasonable interval to trend LEAKAGE and recognizes the importance of early leakage detection in the prevention of accidents.

North Anna Units 1 and 2 Revision 0 B 3.4.13-5

RCS Operational LEAKAGE B 3.4.13 BASES SURVEILLANCE SR 3.4.13.2 REQUIREMENTS (continued)

This SR provides the means necessary to determine SG OPERABILITY in an operational MODE.

The requirement to demonstrate SG tube integrity in accordance with the Steam Generator Tube Surveillance Program emphasizes the importance of SG tube integrity, even though this Surveillance cannot be performed at normal operating conditions.

REFERENCES

1. UFSAR, Section 3.1.26.

2. Regulatory Guide 1.45, May 1973.

3.

UFSAR, Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.4.13-6

RCS PIV Leakage B 3.4.14 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.14 RCS Pressure Isolation Valve (PIV)

Leakage BASES BACKGROUND 10 CFR 50.2, 10 CFR 50.55a(c), and General Design Criteria 55 (Refs. 1, 2, and 3), define RCS PIVs as any two normally closed valves in series within the reactor coolant pressure boundary (RCPB),

which separate the high pressure RCS from an attached low pressure system. The 1975 Reactor Safety Study, WASH-1400, (Ref. 4) identified intersystem LOCAs as a significant contributor to the risk of core melt.

The study considered designs containing two in-series check valves and two check valves in series with an MOV which isolate the high pressure RCS from the low pressure safety injection system. The scenario considered is a failure of the two check valves leading to overpressurization and rupture of the low pressure injection piping which results in a LOCA that bypasses containment. A letter was issued (Ref. 5) by the NRC requiring plants to describe the PIV configuration of the plant. On April 20, 1981, the NRC issued an Order modifying the North Anna Unit 1 Technical Specifications to include testing requirements on PIVs and to specify the PIVs to be tested. The original North Anna 2 Technical Specifications, dated August 21, 1980, included a list of PIVs required to be tested and described the required testing. The valves required to be leak tested by this Specification are listed in Tables B 3.4.14-1 (Unit 1) and B 3.4.14-2 (Unit 2).

During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration. The RCS PIV Leakage LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety.

The PIV leakage limit applies to each individual valve to which the LCO applies. Leakage through both series PIVs in a line must be included as part of the identified LEAKAGE, governed by LCO 3.4.13, "RCS Operational LEAKAGE." This is true during operation only when the loss of RCS mass through two series valves is determined by a water inventory balance (SR 3.4.13.1). A known component of the identified LEAKAGE before operation begins is the least of the two individual leak rates determined for leaking series PIVs during the (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.14-1

RCS PIV Leakage B 3.4.14 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES required surveillance testing; leakage measured through one PIV in a line is not RCS operational LEAKAGE if the other is leaktight.

Although this specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components.

Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident, that could degrade the ability for low pressure injection.

Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.

Reference 4 identified potential intersystem LOCAs as a significant contributor to the risk of core melt. The dominant accident sequence in the intersystem LOCA category is the failure of the low pressure portion of the ECCS low pressure injection system outside of containment.

The accident is the result of a postulated failure of the PIVs, which are part of the RCPB, and the subsequent pressurization of the ECCS low pressure injection system downstream of the PIVs from the RCS. Because the low pressure portion of the system is not designed for RCS pressure, overpressurization failure of the low pressure line would result in a LOCA outside containment and subsequent risk of core melt.

RCS PIV leakage satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

LCO The RCS PIVs required to be leak tested are listed in Tables B 3.4.14-1 (Unit 1) and B 3.4.14-2 (Unit 2).

RCS PIV leakage is identified LEAKAGE into closed systems connected to the RCS. Isolation valve leakage is usually on the order of drops per minute. Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.4.14-2

RCS PIV Leakage B 3.4.14 BASES LCO (continued)

APPLICABILITY ACTIONS The LCO PIV leakage limit is 0.5 gpm per nominal inch of valve size with a maximum limit of 5 gpm. The previous criterion of 1 gpm for all valve sizes imposed an unjustified penalty on the larger valves without providing information on potential valve degradation and resulted in higher personnel radiation exposures. A study concluded a leakage rate limit based on valve size was superior to a single allowable value.

Reference 6 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential) in those types of valves in which the higher service pressure will tend to diminish the overall leakage channel opening. In such cases, the observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one half power.

In MODES 1, 2, 3, and 4, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized.

In MODE 4, any valves in the RHR flow path that are required to be tested are not required to meet the requirements of this LCO when in, or during the transition to or from, the RHR mode of operation.

In MODES 5 and 6, leakage limits are not provided because the lower reactor coolant pressure results in a reduced potential for leakage and for a LOCA outside the containment.

The Actions are modified by two Notes. Note 1 provides clarification that each flow path allows separate entry into a Condition. This is allowed based upon the functional independence of the flow path. Note 2 requires an evaluation of affected systems if a PIV is inoperable. The leakage may have affected system operability, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function.

Revision 0 North Anna Units 1 and 2 B 3.4.14-3

RCS PIV Leakage B 3.4.14 BASES ACTIONS A.1 (continued)

Required Action A.1 requires that RCS PIV leakage be restored to within limit within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Four hours provides time to reduce leakage in excess of the allowable limit. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time allows the actions and restricts the operation with leaking isolation valves.

B.1 and B.2 If leakage cannot be reduced the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This Action may reduce the leakage and also reduces the potential for a LOCA outside the containment. The allowed Completion Times are reasonable based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.14.1 REQUIREMENTS Performance of leakage testing on the affected RCS PIV or isolation valve used to satisfy Required Action A.1 is required to verify that leakage is below the specified limit and to identify each leaking valve. The leakage limit of 0.5 gpm per inch of nominal valve diameter up to 5 gpm maximum applies to each valve. Leakage testing requires a stable pressure condition. Leakage may be measured indirectly (as from the performance of pressure indicators) to satisfy ALARA requirements if supported by calculations verifying that the method is capable of demonstrating valve compliance with the leakage criteria.

For the two PIVs in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.

Testing is to be performed every 18 months, a typical refueling cycle, if the unit does not go into MODE 5 for at least 7 days. The 18 month Frequency is consistent with 10 CFR 50.55a(g) (Ref. 7) as contained in the Inservice (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.14-4

RCS PIV Leakage B 3.4.14 BASES SURVEILLANCE SR 3.4.14.1 (continued)

REQUIREMENTS Testing Program, is within frequency allowed by the American Society of Mechanical Engineers (ASME)

Code (Ref. 6), and is based on the need to perform such surveillances under the conditions that apply during an outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

In addition, testing must be performed once after the valve has been opened by flow or exercised to ensure tight reseating. PIVs disturbed in the performance of this Surveillance should also be tested unless documentation shows that an infinite testing loop cannot practically be avoided. Testing must be performed within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after the valve has been reseated. Within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is a reasonable and practical time limit for performing this test after opening or reseating a valve.

The leakage limit is to be met at the RCS pressure associated with MODES 1 and 2. This permits leakage testing at high differential pressures with stable conditions not possible in the MODES with lower pressures. If testing cannot be performed at these pressures, testing can be performed at lower pressures and scaled to operating pressure.

Entry into MODES 3 and 4 is allowed if needed to establish the necessary differential pressures and stable conditions to allow for performance of this Surveillance. The Note that allows this provision is complementary to the Frequency of prior to entry into MODE 2 whenever the unit has been in MODE 5 for 7 days or more, if leakage testing has not been performed in the previous 9 months.

In addition, this Surveillance is not required to be performed on any RCS PIVs in the RHR System flow path when the RHR System is aligned to the RCS in the shutdown cooling mode of operation. PIVs contained in the RHR shutdown cooling flow path that are required to be tested must be leakage rate tested after RHR is secured and stable unit conditions and the necessary differential pressures are established.

REFERENCES

1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).

3.

UFSAR, Section 3.1.48.1.

North Anna Units 1 and 2 Revision 0 B 3.4.14-5

RCS PIV Leakage B 3.4.14 BASES REFERENCES

4. WASH-1400 (NUREG-75/014),

Appendix V, October 1975.

(continued)

5. Letter from D. G. Eisenhut, NRC, to all LWR licensees, LWR Primary Coolant System Pressure Isolation Valves, February 23, 1980.

6. ASME Code for Operation and Maintenance of Nuclear Power Plants.

7.

10 CFR 50.55a(g).

Revision 0 North Anna Units 1 and 2 B 3.4.14-6

RCS PIV Leakage B 3.4.14 Table B 3.4.14-1 (page 1 of 1)

Unit 1 RCS PIVS Required To Be Tested FUNCTION 1-SI-83 Low Head Safety Injection to Cold Legs-Loop 1 1-SI-195 Low Head Safety Injection to Cold Legs-Loop 1 1-SI-86 Low Head Safety Injection to Cold Legs-Loop 2 1-SI-197 Low Head Safety Injection to Cold Legs-Loop 2 1-SI-89 Low Head Safety Injection to Cold Legs-Loop 3 I-SI-199 Low Head Safety Injection to Cold Legs-Loop 3 North Anna Units 1 and 2 VALVE Revision 0 B 3.4.14-7

RCS PIV Leakage B 3.4.14 Table B 3.4.14-2 (page 1 of 1)

Unit 2 RCS PIVS Required To Be Tested Function 2-SI-85 2-SI-93 2-SI-107 2-SI-119 MOV-2836 MOV-2869A, MOV-2867C, 2-SI-91 2-SI-99 2-SI-105 2-SI-126 2-SI-128 2-SI-151 2-SI-153 2-SI-168 2-SI-170 2-SI-185 2-SI-187 MOV-2700 MOV-2701 MOV-2720A, MOV-2890A, B

D B

B, C, & D High head safety injection to cold legs and hot legs High head safety injection to cold legs and hot legs High head safety injection to cold legs and hot legs High head safety injection to cold legs and hot legs High head safety injection off charging header High head safety injection off charging header Boron injection tank outlet valves Low head safety injection to cold legs Low head safety injection to cold legs Low head safety injection to cold legs Low head safety injection to hot legs Low head safety injection to hot legs Accumulator discharge check valves Accumulator discharge check valves Accumulator discharge check valves Accumulator discharge check valves Accumulator discharge check valves Accumulator discharge check valves RHR system isolation valves RHR system isolation valves RHR system isolation valves Low head safety injection to cold legs and hot legs Revision 0 North Anna Units 1 and 2 Valve B 3.4.14-8

RCS Leakage Detection Instrumentation B 3.4.15 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.15 RCS Leakage Detection Instrumentation BASES BACKGROUND

UFSAR, Chapter 3 (Ref. 1) requires compliance with Regulatory Guide 1.45. Regulatory Guide 1.45 (Ref. 2) describes acceptable methods for selecting RCS leakage detection systems.

Leakage detection systems must have the capability to detect significant reactor coolant pressure boundary (RCPB) degradation as soon after occurrence as practical to minimize the potential for propagation to a gross failure.

Thus, an early indication or warning signal is necessary to permit proper evaluation of all unidentified LEAKAGE.

Industry practice has shown that water flow changes of 0.5 to 1.0 gpm can be readily detected in contained volumes by monitoring changes in water level, in flow rate, or in the operating frequency of a pump. The containment sump used to collect unidentified LEAKAGE includes two sump level monitors that provide level indication and a discharge flow totalizer. The discharge flow totalizer can be either a mechanical flow totalizer or a calculated value. This is acceptable for detecting increases in unidentified LEAKAGE.

The reactor coolant contains radioactivity that, when released to the containment, can be detected by radiation monitoring instrumentation. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects.

Instrument sensitivities in accordance with Regulatory Guide 1.45 (Ref. 2) particulate and for gaseous monitoring are practical for these leakage detection systems.

Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid responses to RCS LEAKAGE.

One Containment Air Recirculation Fan (CARF) provides enough air flow for the operation of the radiation detectors.

Air temperature and pressure monitoring methods may also be used to infer unidentified LEAKAGE to the containment.

Containment temperature and pressure fluctuate slightly (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.15-1

RCS Leakage Detection Instrumentation B 3.4.15 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES during unit operation, but a rise above the normally indicated range of values may indicate RCS leakage into the containment. The relevance of temperature and pressure measurements are affected by containment free volume and, for temperature, detector location. Alarm signals from these instruments can be valuable in recognizing rapid and sizable leakage to the containment. Temperature and pressure monitors are not required by this LCO.

The need to evaluate the severity of an alarm or an indication is important to the operators, and the ability to compare and verify with indications from other systems is necessary. Multiple instrument locations are utilized, if needed, to ensure that the transport delay time of the leakage from its source to an instrument location yields an acceptable overall response time.

The safety significance of RCS LEAKAGE varies widely depending on its source, rate, and duration. Therefore, detecting and monitoring RCS LEAKAGE into the containment area is necessary. Quickly separating the identified LEAKAGE from the unidentified LEAKAGE provides quantitative information to the operators, allowing them to take corrective action should a leakage occur detrimental to the safety of the unit and the public.

RCS leakage detection instrumentation satisfies Criterion 1 of 10 CFR 50.36(c)(2)(ii).

One method of protecting against large RCS leakage derives from the ability of instruments to rapidly detect extremely small leaks. This LCO requires instruments of diverse monitoring principles to be OPERABLE to provide a high degree of confidence that extremely small leaks are detected in time to allow actions to place the unit in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.

The LCO is satisfied when monitors of diverse measurement means are available. Thus, the containment sump monitor, in combination with a gaseous or particulate radioactivity monitor, provides an acceptable minimum.

North Anna Units 1 and 2 LCO Revision 0 B 3.4.15-2

RCS Leakage Detection Instrumentation B 3.4.15 BASES APPLICABILITY Because of elevated RCS temperature and pressure in MODES 1, 2, 3, and 4, RCS leakage detection instrumentation is required to be OPERABLE.

In MODE 5 or 6, the temperature is to be

200OF and pressure is maintained low or at atmospheric pressure. Since the temperatures and pressures are far lower than those for MODES 1, 2, 3, and 4, the likelihood of leakage and crack propagation are much smaller. Therefore, the requirements of this LCO are not applicable in MODES 5 and 6.

ACTIONS A.1 and A.2 With the required containment sump monitor inoperable, no other form of sampling can provide the equivalent information; however, the containment atmosphere radioactivity monitor will provide indications of changes in leakage. Together with the atmosphere monitor, the periodic surveillance for RCS water inventory balance, SR 3.4.13.1, must be performed at an increased frequency of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to provide information that is adequate to detect leakage. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishing steady state operation (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flow). The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance provides sufficient time to collect and process all necessary data after stable unit conditions are established.

Restoration of the required sump monitor to OPERABLE status within a Completion Time of 30 days is required to regain the function after the monitor's failure. This time is acceptable, considering the Frequency and adequacy of the RCS water inventory balance required by Required Action A.1.

B.1.1, B.1.2, and B.2 With both gaseous and particulate containment atmosphere radioactivity monitoring instrumentation channels inoperable, alternative action is required. Either grab samples of the containment atmosphere must be taken and analyzed or water inventory balances, in accordance with SR 3.4.13.1, must be performed to provide alternate periodic information.

(continued)

Revi si on 0 North Anna Units 1 and 2 B 3.4.15-3

RCS Leakage Detection Instrumentation B 3.4.15 BASES ACTIONS B.1.1, B.1.2, and B.2 (continued)

With a sample obtained and analyzed or water inventory balance performed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , the reactor may be operated for up to 30 days to allow restoration of the required containment atmosphere radioactivity monitors.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months interval provides periodic information that is adequate to detect leakage. A Note is added allowing that SR 3.4.13.1 is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after establishing steady state operation (stable temperature, power level, pressurizer and makeup tank levels, makeup and letdown, and RCP seal injection and return flow). The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance provides sufficient time to collect and process all necessary data after stable unit conditions are established. The 30 day Completion Time recognizes at least one other form of leakage detection is available.

C.1 and C.2 If a Required Action of Condition A or B cannot be met, the unit must be brought to a MODE in which the requirement does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1 With all required monitors inoperable, no required automatic means of monitoring leakage are available, and immediate unit shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.4.15.1 REQU IREMENTS SR 3.4.15.1 requires the performance of a CHANNEL CHECK of the required containment atmosphere radioactivity monitor.

The check gives reasonable confidence that the channel is operating properly. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is based on instrument reliability and is reasonable for detecting off normal conditions.

Revision 0 North Anna Units 1 and 2 B 3.4.15-4

RCS Leakage Detection Instrumentation B 3.4.15 BASES SURVEILLANCE SR 3.4.15.2 REQUIREMENTS SR 3.4.15.2 requires the performance of a COT every 92 days on the required containment atmosphere radioactivity monitor. The test ensures that the monitor can perform its function in the desired manner. The test verifies the alarm setpoint and relative accuracy of the instrument string. The Frequency is based on the staff recommendation for increasing the availability of radiation monitors according to NUREG-1366 (Ref.

3).

SR 3.4.15.3 and SR 3.4.15.4 These SRs require the performance of a CHANNEL CALIBRATION for each of the RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrument string, including the instruments located inside containment. The containment sump level indication is provided by either of two level monitors, and discharge flow indication is provided by a discharge flow totalizer. The frequency of 18 months is a typical refueling cycle and considers channel reliability. Again, operating experience has proven that this Frequency is acceptable.

REFERENCES

1. UFSAR, Chapter 3.

2. Regulatory Guide 1.45, dated May, 1973.

3. NUREG-1366, dated December, 1992.

Revision 0 North Anna Units 1 and 2 B 3.4.15-5

Intentional ly Blank

RCS Specific Activity B 3.4.16 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.16 RCS Specific Activity BASES BACKGROUND APPLICABLE SAFETY ANALYSES The maximum dose to the whole body and the thyroid that an individual at the site boundary can receive for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months during an accident is specified in 10 CFR 100 (Ref.

1).

The limits on specific activity ensure that the doses are held to a small fraction of the 10 CFR 100 limits during analyzed transients and accidents.

The RCS specific activity LCO limits the allowable concentration level of radionuclides in the reactor coolant.

The LCO limits are established to minimize the offsite radioactivity dose consequences in the event of a steam generator tube rupture (SGTR) accident.

The LCO contains specific activity limits for both DOSE EQUIVALENT 1-131 and gross specific activity. The allowable levels are intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months dose at the site boundary to a small fraction of the 10 CFR 100 dose guideline limits. The limits in the LCO are standardized, based on parametric evaluations of offsite radioactivity dose consequences for typical site locations.

The parametric evaluations showed the potential offsite dose levels for a SGTR accident were an appropriately small fraction of the 10 CFR 100 dose guideline limits. Each evaluation assumes a broad range of site applicable atmospheric dispersion factors in a parametric evaluation.

The LCO limits on the specific activity of the reactor coolant ensures that the resulting 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months doses at the site boundary will not exceed a small fraction of the 10 CFR 100 dose guideline limits following a SGTR accident. The SGTR safety analysis (Ref. 2) assumes the specific activity of the reactor coolant at the LCO limit and an existing reactor coolant steam generator (SG) tube leakage rate of 1 gpm. The safety analysis assumes the specific activity of the secondary coolant at its limit of 0.1 gCi/gm DOSE EQUIVALENT 1-131 from LCO 3.7.7, "Secondary Specific Activity."

(continued)

North Anna Units 1 and 2 Revi si on 0 B 3.4.16-1

RCS Specific Activity B 3.4.16 BASES APPLICABLE The analysis for the SGTR accident establishes the SAFETY ANALYSES acceptance limits for RCS specific activity. Reference to (continued) this analysis is used to assess changes to the unit that could affect RCS specific activity, as they relate to the acceptance limits.

The analysis is for two cases of reactor coolant specific activity. One case assumes specific activity at 1.0 gCi/gm DOSE EQUIVALENT 1-131 with a concurrent large iodine spike that increases the 1-131 release rate to the reactor coolant by a factor of 500 immediately after the accident. The second case assumes the initial reactor coolant iodine activity at 60.0 pCi/gm DOSE EQUIVALENT 1-131 due to a pre-accident iodine spike caused by an RCS transient. In both cases, the noble gas activity in the reactor coolant assumes 1% failed fuel, which closely equals the LCO limit of 100/E gCi/gm for gross specific activity.

The radiologically limiting SGTR analysis also assumes a loss of offsite power at the same time as the SGTR event. The SGTR causes a reduction in reactor coolant inventory. The reduction initiates a reactor trip from a low pressurizer pressure signal or an RCS overtemperature AT signal.

The coincident loss of offsite power causes the steam dump valves to close to protect the condenser. The rise in pressure in the ruptured SG discharges radioactively contaminated steam to the atmosphere through the SG power operated relief valves and the main steam safety valves. The unaffected SGs remove core decay heat by venting steam to the atmosphere until the cooldown ends.

The safety analysis shows the radiological consequences of an SGTR accident are within a small fraction of the Reference 1 dose guideline limits. Operation with iodine specific activity levels greater than the LCO limit is permissible, if the activity levels do not exceed the limits shown in Figure 3.4.16-1, in the applicable specification, for more than 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months .

The remainder of the above LCO limit permissible iodine levels shown in Figure 3.4.16-1 are acceptable because of the low probability of a SGTR accident occurring during the established 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months time limit. The occurrence of an SGTR accident at these permissible levels could increase the site boundary dose levels, but still be within 10 CFR 100 dose guideline limits.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.4.16-2

RCS Specific Activity B 3.4.16 BASES APPLICABLE The limits on RCS specific activity are also used for SAFETY ANALYSES establishing standardization in radiation shielding and (continued) plant personnel radiation protection practices.

RCS specific activity satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

LCO The specific iodine activity is limited to 1.0 gCi/gm DOSE EQUIVALENT 1-131, and the gross specific activity in the reactor coolant is limited to the number of gCi/gm equal to 100 divided by E (average disintegration energy of the sum of the average beta and gamma energies of the coolant nuclides). The limit on DOSE EQUIVALENT 1-131 ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid dose to an individual at the site boundary during the Design Basis Accident (DBA) will be a small fraction of the allowed thyroid dose. The limit on gross specific activity ensures the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months whole body dose to an individual at the site boundary during the DBA will be a small fraction of the allowed whole body dose.

The SGTR accident analysis (Ref. 2) shows that the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months site boundary dose levels are within acceptable limits.

Violation of the LCO may result in reactor coolant radioactivity levels that could, in the event of an SGTR, lead to site boundary doses that exceed the 10 CFR 100 dose guideline limits.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS average temperature

Ž 500F, operation within the LCO limits for DOSE EQUIVALENT 1-131 and gross specific activity are necessary to contain the potential consequences of an SGTR to within the acceptable site boundary dose values.

For operation in MODE 3 with RCS average temperature < 5000F, and in MODES 4 and 5, the release of radioactivity in the event of a SGTR is unlikely since the saturation pressure of the reactor coolant is below the lift pressure settings of the main steam safety valves and SG power operated relief valves.

Revision 0 North Anna Units 1 and 2 B 3.4.16-3

RCS Specific Activity B 3.4.16 BASES ACTIONS A.1 and A.2 With the DOSE EQUIVALENT 1-131 greater than the LCO limit, samples at intervals of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months must be taken to demonstrate that the limits of Figure 3.4.16-1 are not exceeded.

The Completion Time of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is required to obtain and analyze a sample. Sampling is done to continue to provide a trend.

The DOSE EQUIVALENT 1-131 must be restored to within limits within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is required, if the limit violation resulted from normal iodine spiking.

B.1 With the gross specific activity in excess of the allowed limit, the unit must be placed in a MODE in which the requirement does not apply.

The change within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months to MODE 3 and RCS average temperature < 500°F lowers the saturation pressure of the reactor coolant below the setpoints of the main steam safety valves and prevents venting the SG to the environment in an SGTR event. The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 below 500'F from full power conditions in an orderly manner and without challenging unit systems.

C.'

If a Required Action and the associated Completion Time of Condition A is not met or if the DOSE EQUIVALENT 1-131 is in the unacceptable region of Figure 3.4.16-1, the reactor must be brought to MODE 3 with RCS average temperature < 500°F within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months . The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, to reach MODE 3 below 5007F from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.16.1 REQUIREMENTS SR 3.4.16.1 requires performing a gamma isotopic analysis as a measure of the gross specific activity of the reactor coolant at least once every 7 days. While basically a quantitative measure of radionuclides with half lives longer than 15 minutes, excluding iodines, this measurement is the (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.16-4

RCS Specific Activity B 3.4.16 BASES SURVEILLANCE SR 3.4.16.1 (continued)

REQUIREMENTS sum of the degassed gamma activities and the gaseous gamma activities in the sample taken. This Surveillance provides an indication of any increase in gross specific activity.

Trending the results of this Surveillance allows proper remedial action to be taken before reaching the LCO limit under normal operating conditions. The Surveillance is applicable in MODES 1 and 2, and in MODE 3 with Tavg at least 5000F. The 7 day Frequency considers the unlikelihood of a gross fuel failure during the time.

SR 3.4.16.2 This Surveillance is performed in MODE 1 only to ensure iodine remains within limit during normal operation and following fast power changes when fuel failure is more apt to occur. The 14 day Frequency is adequate to trend changes in the iodine activity level, considering gross activity is monitored every 7 days. The Frequency, between 2 and 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a power change Ž 15% RTP within a 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months period, is established because the iodine levels peak during this time following fuel failure; samples at other times would provide inaccurate results.

SR 3.4.16.3 A radiochemical analysis for E determination is required every 184 days (6 months) with the unit operating in MODE 1 equilibrium conditions. The E determination directly relates to the LCO and is required to verify unit operation within the specified gross activity LCO limit. The analysis for E is a measurement of the average energies per disintegration for isotopes with half lives longer than 15 minutes, excluding iodines. The Frequency of 184 days recognizes E does not change rapidly.

This SR has been modified by a Note that indicates sampling is required to be performed within 31 days after a minimum of 2 effective full power days and 20 days of MODE 1 operation have elapsed since the reactor was last subcritical for at least 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . This ensures that the radioactive materials are at equilibrium so the analysis for E is representative and not skewed by a crud burst or other similar abnormal event.

North Anna Units 1 and 2 Revision 0 B 3.4.16-5

RCS Specific Activity B 3.4.16 BASE REFERENCES

1. 10 CFR 100.11.

2. UFSAR, Section 15.4.3.

Revision 0 North Anna Units 1 and 2 S

B 3.4.16-6

RCS Loop Isolation Valves B 3.4.17 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.17 RCS Loop Isolation Valves BASES BACKGROUND APPLICABLE SAFETY ANALYSES LCO The reactor coolant loops are equipped with loop isolation valves that permit any loop to be isolated from the reactor vessel. One valve is installed on each hot leg and one on each cold leg. The loop isolation valves are used to perform maintenance on an isolated loop. Power operation with a loop isolated is not permitted.

To ensure that inadvertent closure of a loop isolation valve does not occur, the valves must be open with power to the valve operators removed in MODES 1, 2, 3 and 4. If the valves are closed, a set of administrative controls and equipment interlocks must be satisfied prior to opening the isolation valves as described in LCO 3.4.18, "RCS Isolated Loop Startup."

The safety analyses performed for the reactor at power assume that all reactor coolant loops are initially in operation and the loop isolation valves are open. This LCO places controls on the loop isolation valves to ensure that the valves are not inadvertently closed in MODES 1, 2, 3 and 4. The inadvertent closure of a loop isolation valve when the Reactor Coolant Pumps (RCPs) are operating will result in a partial loss of forced reactor coolant flow (Ref. 1).

If the reactor is at power at the time of the event, the effect of the partial loss of forced coolant flow is a rapid increase in the coolant temperature which could result in DNB with subsequent fuel damage if the reactor is not tripped by the Low Flow reactor trip. If the reactor is shutdown and an RCS loop is in operation removing decay heat, closure of the loop isolation valve associated with the operating loop could also result in increasing coolant temperature and the possibility of fuel damage.

RCS Loop Isolation Valves satisfy Criterion 2 of 10 CFR 50.36(c) (2) (ii).

This LCO ensures that the loop isolation valves are open and power to the valve operators is removed. Loop isolation valves are used for performing maintenance in MODES 5 and 6.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.4.17-1

RCS Loop Isolation Valves B 3.4.17 BASES LCO The safety analyses assume that the loop isolation valves (continued) are open in any RCS loops required to be OPERABLE by LCO 3.4.4, "RCS Loops-MODES 1 and 2," LCO 3.4.5, "RCS Loops-MODE 3," or LCO 3.4.6, "RCS Loops-MODE 4."

APPLICABILITY In MODES 1 through 4, this LCO ensures that the loop isolation valves are open and power to the valve operators is removed. The safety analyses assume that the loop isolation valves are open in any RCS loops required to be OPERABLE.

In MODES 5 and 6, the loop isolation valves may be closed.

Controlled startup of an isolated loop is governed by the requirements of LCO 3.4.18, "RCS Isolated Loop Startup."

ACTIONS The Actions have been provided with a Note to clarify that all RCS loop isolation valves for this LCO are treated as separate entities, each with separate Completion Times, i.e., the Completion Time is on a component basis.

A.1 If power is inadvertently restored to one or more loop isolation valve operators, the potential exists for accidental isolation of a loop. The loop isolation valves have motor operators. Therefore, these valves will maintain their last position when power is removed from the valve operator. With power applied to the valve operators, only the interlocks prevent the valve from being operated.

Although operating procedures and interlocks make the occurrence of this event unlikely, the prudent action is to remove power from the loop isolation valve operators. The Completion Time of 30 minutes to remove power from the loop isolation valve operators is sufficient considering the complexity of the task.

B.1, B.2. and B.3 Should a loop isolation valve be closed in MODES 1 through 4, the affected loop isolation valve(s) must remain closed and the unit placed in MODE 5. Once in MODE 5, the isolated loop may be started in a controlled manner in accordance with LCO 3.4.18, "RCS Isolated Loop Startup."

Opening the closed isolation valve in MODES 1 through 4 could result in colder water or water at a lower boron concentration being mixed with the operating RCS loops (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.17-2

RCS Loop Isolation Valves B 3.4.17 BASES ACTIONS B.1, B.2, and B.3 (continued) resulting in positive reactivity insertion. The Completion Time of Required Action B.1 allows time for borating the operating loops to a shutdown boration level such that the unit can be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.17.1 REQUIREMENTS The Surveillance is performed to ensure that the RCS loop isolation valves are open prior to removing power from the isolation valve operator. There is no remote position indication available after power is removed from the valve operators. The valves will maintain their last position when power is removed for the valve operator.

SR 3.4.17.2 The primary function of this Surveillance is to ensure that power is removed from the valve operators, since SR 3.4.4.1 of LCO 3.4.4, "RCS Loops-MODES 1 and 2," ensures that the loop isolation valves are open by verifying every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months that all loops are operating and circulating reactor coolant. The Frequency of 31 days ensures that the required flow will remain available, is based on engineering judgment, and has proven to be acceptable. Operating experience has shown that the failure rate is so low that the 31 day Frequency is justified.

REFERENCES

1. UFSAR, Section 15.2.6.

Revision 0 North Anna Units 1 and 2 B 3.4.17-3

Intentionally Blank

RCS Isolated Loop Startup B 3.4.18 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.18 RCS Isolated Loop Startup BASES BACKGROUND The RCS may be operated with loops isolated in MODES 5 and 6 in order to perform maintenance. While operating with a loop isolated, there is potential for inadvertently opening the isolation valves in the isolated loop. In this event, any coolant in the isolated loop would begin to mix with the coolant in the operating loops. This situation has the potential of causing a positive reactivity addition with a corresponding reduction of SDM if:

a. The temperature in the isolated loop is lower than the temperature in the operating Residual Heat Removal (RHR) or RCS loops (cold water incident); or

b. The boron concentration in the isolated loop is lower than the boron concentration required to meet the SDM of LCO 3.1.1 or the boron concentration of LCO 3.9.1 (boron dilution incident).

If the loop is drained of coolant, startup of an isolated loop will cause coolant to flow from the RCS into the isolated portion of the loop with the potential to lower the RCS water level and cause a loss of suction to the RHR System pumps.

As discussed in the UFSAR (Ref.

1), the startup of a filled, isolated loop is done in a controlled manner that virtually eliminates any sudden reactivity addition from cold water or boron dilution because:

a. This LCO and unit operating procedures require that the boron concentration-in the isolated loop be equal to or greater than the boron concentration required to meet the SDM of LCO 3.1.1 or the boron concentration of LCO 3.9.1 prior to opening the isolation valves, thus eliminating the potential for introducing coolant from the isolated loop that could dilute the boron concentration in the operating loops below the required limit.

b. The cold leg loop isolation valve cannot be opened unless the loop has been operated with the hot leg isolation valve open and recirculation flow of Ž 125 gpm for (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.18-1

RCS Isolated Loop Startup B 3.4.18 BASES BACKGROUND

b. (continued)

> 90 minutes. This ensures that the temperatures of both the hot leg and cold leg of the isolated loop are within 20°F of the operating loops and the boron concentration of the isolated loop is greater than or equal to the boron concentration required to meet the SDM of LCO 3.1.1 or the boron concentration of LCO 3.9.1. Compliance with the recirculation requirement is ensured by operating procedures and automatic interlocks.

c. Other automatic interlocks prevent opening the hot leg loop isolation valve unless the cold leg loop isolation valve is fully closed.

The startup of an initially drained, isolated loop is performed in a controlled manner to ensure that sufficient water is available in the RCS to support RHR operation. In this case, the automatic interlocks are defeated and the isolated loop is filled under administrative control.

APPLICABLE During startup of a filled isolated loop, the cold leg loop SAFETY ANALYSES isolation valve interlocks and operating procedures prevent opening the valve until the isolated loop and active RCS volume temperatures are equalized and the boron concentration is within limit. This ensures that any undesirable reactivity effect from the isolated loop does not occur.

An evaluation of the effects of opening the loop isolation valves with the boron concentration or temperature requirements of the filled, isolated portion not met is described in Reference 1. Failure to follow the requirements in the LCO could result in the RCS boron concentration or coolant temperature being reduced with a corresponding reduction in SDM.

The evaluation concluded that adequate time is available for an operator to identify and respond to such an event prior to reactor criticality.

The initial RCS volume requirements ensure that the operation of the RHR System is not impaired during the filling of an isolated loop from the RCS should the isolation valves on three drained, isolated loops be inadvertently opened.

RCS isolated loop startup satisfies Criterion 2 of 10 CFR 50.36(c) (2) (ii).

Revision 0 North Anna Units 1 and 2 B 3.4.18-2

RCS Isolated Loop Startup B 3.4.18 BASES LCO Loop isolation valves are used for performing maintenance when the unit is in MODE 5 or 6. This LCO governs the return to operation of an isolated loop (i.e., the hot and cold leg loop isolation valves are initially closed) and ensures that the loop isolation valves remain closed unless acceptable conditions for opening the valves are established.

There are two methods for returning an isolated loop to operation. The first method is used when the isolated loop is filled with water. When using the filled loop method, the hot leg isolation valve (e.g., the inlet valve to the isolated portion of the loop) is opened first. As described in LCO 3.4.18.a, the water in the isolated loop must be borated to at least the boron concentration needed to provide the required shutdown margin prior to opening the hot leg isolation valve. This ensures that the RCS boron concentration is not reduced below that required to maintain the required shutdown margin. The water in the isolated loop is then mixed with the water in the RCS by establishing flow through the recirculation line (which bypasses the cold leg isolation valve). After the flow through the recirculation line has thoroughly mixed the water in the isolated loop with the water in the RCS and it is verified that the isolated loop temperature is no more than 20°F below the temperature of the RCS (to avoid reactivity additions due to reduced RCS temperature), the cold leg isolation valve may be opened.

The second method for returning an isolated loop to operation is described in LCO 3.4.18.b and is used when the isolated loop is drained of water. In the drained loop method, the water in the RCS is used to fill the isolated portion of the loop. The LCO also requires that the pressurizer water level be established sufficiently high prior to and during the opening of the isolation valves to ensure that the inadvertent opening of all three sets of loop isolation valves on three drained and isolated loops would not result in loss of net positive suction head for the Residual Heat Removal system.

The LCO is modified by a Note which allows Reactor Coolant Pump (RCP) seal injection to be initiated to a RCP in a drained, isolated loop. This is to support vacuum assisted backfill of the loop. In this method, a vacuum is drawn on the isolated loop prior to opening the cold leg isolation valve in order to minimize the amount of trapped air in the loop and to minimize the need to run the RCP in the isolated loop to clear out air pockets. In order to draw a vacuum on (continued)

North Anna Units 1 and 2 Revision 0 B 3.4.18-3

RCS Isolated Loop Startup B 3.4.18 BASES LCO (continued)

APPLICABILITY the isolated loop, the RCP seals must be filled with water.

The boron concentration of the water used for seal injection must meet the same requirements as the reactor coolant system and the loop must be drained prior to starting seal injection in order to be sure that no water at a boron concentration less than required remains in the isolated loop.

The LCO is modified by a Note which allows a hot or cold leg isolation valve to be closed for up to two hours without considering the loop isolated and meeting the LCO requirements when opening the closed valve. This allows for necessary maintenance and testing on the valves and the valve operators. If the closed valve is not reopened with two hours, it is necessary to close both isolation valves on the affected loop and follow the requirements of the LCO when reopening the isolation valves. This is required because there is a possibility that the water in the isolated loop has become diluted or cooled to the point that reintroduction of the water into to the reactor vessel could result in a significant reactivity change.

In MODES 5 and 6, RCS loops may be isolated to perform maintenance. When a filled, isolated loop is to be put in operation, the isolated loop boron concentration and temperature must be controlled prior to opening the loop isolation valves in order to avoid the potential for positive reactivity addition. When an initially drained, isolated loop is to be put into operation, sufficient RCS inventory must be available to ensure that RCS water level continues to support RHR operation. The LCO water level requirement is sufficient to ensure that RCS water level does not drop below that required for RHR operation. In MODES 1, 2, 3 and 4, the loop isolation valves are required to be open with power to the valve operators removed by LCO 3.4.17, "RCS Loop Isolation Valves."

ACTIONS A.1, B.1, and C.1 Required Actions A.1, B.1, and C.1 apply when the requirements of LCO 3.4.18.a are not met and a loop isolation valve has been opened. Therefore, the Actions require immediate closure of isolation valves to preclude a boron dilution event or a cold water event or RCS water level falling below that required for RHR operation.

North Anna Units 1 and 2 Revision 0 B 3.4.18-4

RCS Isolated Loop Startup B 3.4.18 BASES ACTIONS D.1, D.2, E.1 and E.2 (continued)

Required Actions D.1, D.2, E.1 and E.2 apply when the requirements of LCO 3.4.18.b are not met and an initially drained, isolated loop is filled from the active RCS volume by opening a loop isolation valve. If the RCS water level requirement is not met, there is the possibility of insufficient net positive suction head to support the RHR pumps.

If the RCP seal injection boron concentration requirements are not met, there is the possibility of diluting the reactor coolant boron concentration below that which is required. In both cases, the isolation valve(s) are to be closed and the requirements of the LCO must be met prior to opening the isolation valves. If both isolation valves on the loop are not fully opened within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , the lack of flow through the closed valve(s) could result in the boron concentration of the previously isolated portion of the loop being significantly different from the remainder of the RCS. The boron concentration in the isolated loop must be verified to be within limit or the isolation valve(s) are to be closed and the requirements of the LCO must be met prior to opening the isolation valves.

F.1 If power is restored to one or more closed loop isolation valve operators without the initial conditions in LCO 3.4.18.a.1 or LCO 3.4.18.b.1 being met, the potential exists for accidental startup of an isolated loop and possible reduction in shutdown margin. The loop isolation valves have motor operators. Therefore, these valves will maintain their last position when power is removed from the valve operator.

With power applied to the valve operators, only the interlocks prevent the valve from being operated. Although operating procedures and interlocks make the occurrence of this event unlikely, the prudent action is to remove power from the loop isolation valve operators. The Completion Time of 30 minutes to remove power from the loop isolation valve operators is sufficient considering the complexity of the task.

SURVEILLANCE SR 3.4.18.1 REQU IREMENTS This Surveillance is performed to ensure that the temperature differential between a filled, isolated loop and the operating loops is

200F. The loop stop valve interlocks (continued)

Revi si on 0 North Anna Units 1 and 2 B 3.4.18-5

RCS Isolated Loop Startup B 3.4.18 BASES SURVEILLANCE SR 3.4.18.1 (continued)

REQUIREMENTS ensure that the temperature of the isolated loop is equalized with the temperature of the operating loops by requiring that the isolated loop is operated for at least 90 minutes with a recirculation flow of Ž 125 gpm. The safety analysis neglects the uncertainty associated with measuring recirculation flow due to the insignificant effect on the analysis. Performing the Surveillance 30 minutes prior to opening the cold leg isolation valve in the isolated loop provides reasonable assurance, based on engineering judgment, that the temperature differential will stay within limits until the cold leg isolation valve is opened. This Frequency has been shown to be acceptable through operating experience.

The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting a filled, isolated loop.

SR 3.4.18.2 To ensure that the boron concentration of a filled, isolated loop is greater than or equal to the boron concentration required to meet the SDM of LCO 3.1.1 or the boron concentration of LCO 3.9.1, a Surveillance is performed 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to opening either the hot or cold leg isolation valve. Performing the Surveillance 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to opening either the hot or cold leg isolation valve provides reasonable assurance the boron concentration difference will stay within acceptable limits until the loop is unisolated.

This Frequency is a reasonable amount of time given that the isolated loop boron concentration changes slowly and the time required to request and have analyzed a boron concentration measurement prior to opening the isolation valve.

The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting a filled, isolated loop.

North Anna Units 1 and 2 Revi sion 0 B 3.4.18-6

RCS Isolated Loop Startup B 3.4.18 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.18.3 This Surveillance is performed to ensure that a filled, isolated loop is recirculated, with the hot leg isolation valve open, for at least 90 minutes at a flow rate of at least 125 gpm. This will ensure that the boron concentration and temperature of the isolated loop is similar to those of the operating loops. The Frequency of within 30 minutes prior to opening the cold leg isolation valve in a filled, isolated loop is considered a reasonable time to prepare for the opening of the cold leg isolation valve. The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting a filled, isolated loop.

SR 3.4.18.4 This Surveillance is performed to ensure that an isolated loop is drained before opening an isolation valve to fill the isolated portion of the RCS from the RCS active volume or before initiating seal injection to the RCP in the isolated loop. This verification is performed to prevent unsampled water in a partially filled, isolated loop from mixing with the water in the RCS and potentially causing reactivity changes due to differences in boron concentration. The Frequency of within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months prior to filling an initially drained loop from the active RCS volume or within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months of initiating seal injection to the RCP in the isolated loop is considered a reasonable time to prepare for the opening of the isolation valve. The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting an initially drained, isolated loop.

SR 3.4.18.5 This Surveillance verifies that the boron concentration of the water used for seal injection to the RCP in the isolated loop is borated to the same requirement as the RCS. This will prevent the water used for seal injection from diluting the water in the RCS. The LCO is modified by two Notes. Note 1 states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting an initially drained, isolated loop. Note 2 states that the Surveillance is only required to be met when using blended flow as the source for RCP seal injection. The other sources (continued)

Revision 0 North Anna Units 1 and 2 B 3.4.18-7

RCS Isolated Loop Startup B 3.4.18 BASES SURVEILLANCE SR 3.4.18.5 (continued)

REQUIREMENTS for seal injection are required to be borated to at least the required boron concentration and are periodically verified by other specifications. The Frequency of within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to initiating seal injection flow and once per hour during filling of an initially drained loop from the active RCS volume is considered a reasonable time to monitor the seal injection boron concentration.

SR 3.4.18.6 This Surveillance verifies that there is sufficient water in the RCS when filling an initially drained, isolated portion of the RCS.

The volume of water required is sufficient to continue to support RHR operation in the event of the inadvertent opening of the isolation valves on three isolated and drained loops. The required level of 32%

incorporates inaccuracies due to use of instruments calibrated at cold conditions. If instruments calibrated at hot conditions are used, an indicated level of 39% is required due to the increased instrument uncertainty. The Frequency of every 15 minutes during filling of a drained, isolated loop ensures that the operators are aware of the water level during the filling operation. The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting a drained, isolated loop.

SR 3.4.18.7 This Surveillance is performed to ensure that the boron concentration of an isolated loop satisfies the boron concentration requirements of the RCS prior to completely opening the cold leg isolation valve or opening the hot leg isolation valve. The Surveillance is modified by a Note which states that the Surveillance is only required to be met when utilizing the requirements of the LCO applicable to starting an initially drained, isolated loop. The Frequency of within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months prior to fully opening the cold leg isolation valve or opening the hot leg isolation valve is considered a reasonable time to prepare for the opening of the isolation valves.

REFERENCES

1. UFSAR, Section 15.2.6.

Revision 0 North Anna Units 1 and 2 B 3.4.18-8

RCS Loops-Test Exceptions B 3.4.19 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.19 RCS Loops-Test Exceptions BASES BACKGROUND The primary purpose of this test exception is to provide an exception to LCO 3.4.4, "RCS Loops-MODES 1 and 2," to permit reactor criticality under no forced flow conditions during certain PHYSICS TESTS (natural circulation demonstration, station blackout, and loss of offsite power) to be performed while at low THERMAL POWER levels.Section XI of 10 CFR 50, Appendix B (Ref.

1), requires that a test program be established to ensure that structures, systems, and components will perform satisfactorily in service. All functions necessary to ensure that the specified design conditions are not exceeded during normal operation and anticipated operational occurrences must be tested. This testing is an integral part of the design, construction, and operation of the power plant as specified in General Design Criteria 1, "Quality Standards and Records" (Ref. 2).

The key objectives of a test program are to provide assurance that the facility has been adequately designed to validate the analytical models used in the design and analysis, to verify the assumptions used to predict unit response, to provide assurance that installation of equipment at the unit has been accomplished in accordance with the design, and to verify that the operating and emergency procedures are adequate. Testing is performed prior to initial criticality, during startup, and following low power operations.

The tests will include verifying the ability to establish and maintain natural circulation following a unit trip, performing natural circulation cooldown on emergency power, and during the cooldown, showing that adequate boron mixing occurs and that pressure can be controlled using auxiliary spray and pressurizer heaters powered from the emergency power sources.

APPLICABLE The tests described above require operating the unit without SAFETY ANALYSES forced convection flow and as such are not bounded by any safety analyses. However, operating experience has demonstrated this exception to be safe under the present applicability.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.4.19-1

RCS Loops-Test Exceptions B 3.4.19 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO As described in LCO 3.0.7, compliance with Test Exception LCOs is optional, and therefore no criteria of 10 CFR 50.36(c)(2)(ii) apply. Test Exception LCOs provide flexibility to perform certain operations by appropriately modifying requirements of other LCOs. A discussion of the criteria satisfied for the other LCOs is provided in their respective Bases.

This LCO provides an exemption to the requirements of LCO 3.4.4.

The LCO is provided to allow for the performance of PHYSICS TESTS in MODE 2 (after a refueling), where the core cooling requirements are significantly different than after the core has been operating. Without the LCO, unit operations would be heldbound to the normal operating LCOs for reactor coolant loops and circulation (MODES 1 and 2), and the appropriate tests could not be performed.

In MODE 2, where core power level is considerably lower and the associated PHYSICS TESTS must be performed, operation is allowed under no flow conditions provided THERMAL POWER is

P-7 and the reactor trip setpoints of the OPERABLE power level channels are set

25% RTP. This ensures, if some problem caused the unit to enter MODE 1 and start increasing unit power, the Reactor Trip System (RTS) would automatically shut it down before power became too high, and thereby prevent violation of fuel design limits.

The exemption is allowed even though there are no bounding safety analyses. However, these tests are performed under close supervision during the test program and provide valuable information on the unit's capability to cool down without offsite power available to the reactor coolant pumps.

APPLICABILITY This LCO is applicable when performing low power PHYSICS TESTS without any forced convection flow. This testing is performed to establish that heat input from nuclear heat does not exceed the natural circulation heat removal capabilities. Therefore, no safety or fuel design limits will be violated as a result of the associated tests.

Revision 0 North Anna Units 1 and 2 B 3.4.19-2

RCS Loops-Test Exceptions B 3.4.19 BASES ACTIONS A.1 When THERMAL POWER is Ž the P-7 interlock setpoint 10%, the only acceptable action is to ensure the reactor trip breakers (RTBs) are opened immediately in accordance with Required Action A.1 to prevent operation of the fuel beyond its design limits. Opening the RTBs will shut down the reactor and prevent operation of the fuel outside of its design limits.

SURVEILLANCE SR 3.4.19.1 REQUIREMENTS Verification that the power level is < the P-7 interlock setpoint (10%)

will ensure that the fuel design criteria are not violated during the performance of the PHYSICS TESTS.

The Frequency of once per hour is adequate to ensure that the power level does not exceed the limit. Unit operations are conducted slowly during the performance of PHYSICS TESTS and monitoring the power level once per hour is sufficient to ensure that the power level does not exceed the limit.

SR 3.4.19.2 The power range and intermediate range neutron detectors, P-1O, and P-13 interlock setpoint must be verified to be OPERABLE and adjusted to the proper value. The Low Power Reactor Trips Block, P-7 interlock, is actuated from either the Power Range Neutron Flux, P-1O, or the Turbine Impulse Chamber Pressure, P-13 interlock. The P-7 interlock is a logic Function with train, not channel identity. A COT is performed prior to initiation of the PHYSICS TESTS. A successful test of the required contact(s) of a channel relay may be performed by the verification of the change of state of a single contact of the relay. This clarifies what is an acceptable CHANNEL OPERATIONAL TEST of a relay. This is acceptable because all of the other required contacts of the relay are verified by other Technical Specifications and non-Technical Specifications tests at least once per refueling interval with applicable extensions. This will ensure that the RTS is properly aligned to provide the required degree of core protection during the performance of the PHYSICS TESTS. The SR 3.3.1.8 Frequency is sufficient for the power range and intermediate range neutron detectors to ensure that the instrumentation is OPERABLE before initiating PHYSICS TESTS.

Revision 0 North Anna Units 1 and 2 B 3.4.19-3

RCS Loops-Test Exceptions B 3.4.19 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.4.19.3 The Low Power Reactor Trips Block, P-7 interlock, must be verified to be OPERABLE in MODE 1 by LCO 3.3.1, "Reactor Trip System Instrumentation." The P-7 interlock is actuated from either the Power Range Neutron Flux, P-1O, or the Turbine Impulse Chamber Pressure, P-13 interlock. The P-7 interlock is a logic Function. An ACTUATION LOGIC TEST is performed to verify OPERABILITY of the P-7 interlock prior to initiation of startup and PHYSICS TESTS. This will ensure that the RTS is properly functioning to provide the required degree of core protection during the performance of the PHYSICS TESTS.

REFERENCES

1. 10 CFR 50, Appendix B, Section XI.

2.

UFSAR, Section 3.1.1.

Revision 0 North Anna Units 1 and 2 B 3.4.19-4

Accumulators B 3.5.1 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.1 Accumulators BASES BACKGROUND The functions of the ECCS accumulators are to supply water to the reactor vessel during the blowdown phase of a loss of coolant accident (LOCA),

to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA.

The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.

In the refill phase of a large break LOCA, which immediately follows the blowdown phase, reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heatup. The balance of accumulator inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection (SI) water.

The accumulators are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The accumulators are passive components, since no operator or control actions are required in order for them to perform their function. Internal accumulator tank pressure is sufficient to discharge the accumulator contents to the RCS, if RCS pressure decreases below the accumulator pressure.

Each accumulator is piped into an RCS cold leg via an accumulator line and is isolated from the RCS by a motor operated isolation valve and two check valves in series.

The accumulator size, water volume, and nitrogen cover pressure are selected so that two of the three accumulators are sufficient to partially cover the core before significant clad melting or zirconium water reaction can (continued)

North Anna Units 1 and 2 Revision 0 B 3.5.1-1

Accumulators B 3.5.1 BASES BACKGROUND (continued)

APPLICABLE SAFETY ANALYSES occur following a large break LOCA. The need to ensure that two accumulators are adequate for this function is consistent with the large break LOCA assumption that the entire contents of one accumulator will be lost via the RCS pipe break during the blowdown phase of the large break LOCA The accumulators are assumed OPERABLE in both the large and small break LOCA analyses at full power (Ref.

1). These are the Design Basis Accidents (DBAs) that establish the acceptance limits for the accumulators. Reference to the analyses for these DBAs is used to assess changes in the accumulators as they relate to the acceptance limits.

In performing the LOCA calculations, conservative assumptions are made concerning the availability of ECCS flow. In the early stages of a large break LOCA, with or without a loss of offsite power, the accumulators provide the sole source of makeup water to the RCS. The assumption of loss of offsite power is required by regulations and conservatively imposes a delay wherein the ECCS pumps cannot deliver flow until the emergency diesel generators start, come.to rated speed, and energize their respective buses. In cold leg large break scenarios, the entire contents of one accumulator are assumed to be lost through the break.

The limiting large break LOCA is a double ended guillotine break at the discharge of the reactor coolant pump. During this event, the accumulators discharge to the RCS as soon as RCS pressure decreases to below accumulator pressure.

As a conservative estimate, no credit is taken for ECCS pump flow until an effective delay has elapsed. This delay accounts for the diesels starting and the pumps being loaded and delivering full flow. The delay time is conservatively set with an additional 2 seconds to account for SI signal generation. During this time, the accumulators are analyzed as providing the sole source of emergency core cooling. No operator action is assumed during the blowdown stage of a large break LOCA.

The worst case small break LOCA analyses also assume a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the accumulators, with pumped flow then providing continued cooling. As break size decreases, the accumulators and High (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.1-2

Accumulators B 3.5.1 BASES APPLICABLE Head Safety Injection (HHSI) pumps both play a part in SAFETY ANALYSES terminating the rise in clad temperature. As break size (continued) continues to decrease, the role of the accumulators continues to decrease until they are not required and the HHSI pumps become solely responsible for terminating the temperature increase.

This LCO helps to ensure that the following acceptance criteria established for the ECCS by 10 CFR 50.46 (Ref. 2) will be met following a LOCA:

a. Maximum fuel element cladding temperature is

22000 F;

b. Maximum cladding oxidation is

0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is ! 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and

d. Core is maintained in a coolable geometry.

Since the accumulators discharge during the blowdown phase of a LBLOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.

For both the large and small break LOCA analyses, a nominal contained accumulator water volume is used. For small breaks, the accumulator water volume only affects the mass flow rate of water into the RCS since the tanks do not empty for most break sizes analyzed. The assumed water volume has an insignificant effect upon the peak clad temperature.

For large breaks, an increase in water volume can be either a peak clad temperature penalty or benefit, depending on downcomer filling and subsequent spill through the break during the core reflooding portion of the transient. The safety analysis supports operation with a contained water volume of between 7580 gallons and 7756 gallons per accumulator.

The minimum boron concentration setpoint is used in the post LOCA boron concentration calculation. The calculation is performed to assure reactor subcriticality in a post LOCA (continued)

North Anna Units 1 and 2 Revi si on 0 B 3.5.1-3

Accumulators B 3.5.1 BASES APPLICABLE environment. Of particular interest is the large break LOCA, SAFETY ANALYSES since no credit is taken for control rod assembly insertion.

(continued)

A reduction in the accumulator minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown and an increase in the maximum sump pH. The maximum boron concentration is used in determining the cold leg to hot leg recirculation injection switchover time and minimum sump pH.

The large and small break LOCA peak clad temperature analyses are performed at the minimum nitrogen cover pressure, since sensitivity analyses have demonstrated that higher nitrogen cover pressure results in a computed peak clad temperature benefit. The maximum nitrogen cover pressure limit prevents accumulator relief valve actuation, and ultimately preserves accumulator integrity.

The effects on containment mass and energy releases from the accumulators are accounted for in the appropriate analyses (Ref.

1). The large break LOCA containment analyses assume that the accumulator nitrogen is discharged into the containment, which affects transient subatmospheric pressure.

The accumulators satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO The LCO establishes the minimum conditions required to ensure that the accumulators are available to accomplish their core cooling safety function following a LOCA. Three accumulators are required to ensure that 100% of the contents of two of the accumulators will reach the core during a large break LOCA. This is consistent with the assumption that the contents of one accumulator spill through the break. If less than two accumulators are injected during the blowdown phase of a large break LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 2) could be violated.

For an accumulator to be considered OPERABLE, the isolation valve must be fully open, power removed above 2000 psig, and the limits established in the SRs for contained volume, boron concentration, and nitrogen cover pressure must be met.

Revision 0 North Anna Units 1 and 2 B 3.5.1-4

Accumulators B 3.5.1 BASES APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure

> 1000 psig, the accumulator OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.

This LCO is only applicable at pressures > 1000 psig. At pressures

1000 psig, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 2) limit of 22000F.

In MODE 3, with RCS pressure

1000 psig, and in MODES 4, 5, and 6, the accumulator motor operated isolation valves are closed to isolate the accumulators from the RCS. This allows RCS cooldown and depressurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators.

ACTIONS A.1 If the boron concentration of one accumulator is not within limits, it must be returned to within the limits within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . In this Condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical.

One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS water and an insignificant effect on core subcriticality during reflood. Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, the accumulators do not discharge following a large main steam line break. Thus, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to return the boron concentration to within limits.

B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this Condition, the required contents of two accumulators cannot be assumed to (continued)

North Anna Units 1 and 2 Revision 0 B 3.5.1-5

Accumul ators B 3.5.1 BASES ACTIONS B.1 (continued) reach the core during a large break LOCA. Due to the severity of the consequences should a large break LOCA occur in these conditions, the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time minimizes the time the unit is exposed to a LOCA under these conditions.

C.1 and C.2 If the accumulator cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and RCS pressure reduced to

1000 psig within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

D.1 If more than one accumulator is inoperable, the unit is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE SR 3.5.1.1 REQUIREMENTS Each accumulator isolation valve should be verified to be fully open every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This verification ensures that the accumulators are available for injection and ensures timely discovery if a valve should be less than fully open.

If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in not meeting accident analyses assumptions. This Frequency is considered reasonable in view of other administrative controls that ensure a mispositioned isolation valve is unlikely.

Revision 0 North Anna Units 1 and 2 B 3.5.1-6

Accumulators B 3.5.1 BASES SURVEILLANCE SR 3.5.1.2 and SR 3.5.1.3 REQUIREMENTS (continued)

Every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , borated water volume and nitrogen cover pressure are verified for each accumulator. This Frequency is sufficient to ensure adequate injection during a LOCA.

Because of the static design of the accumulator, a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency usually allows the operator to identify changes before limits are reached. Operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends.

SR 3.5.1.4 The boron concentration should be verified to be within required limits for each accumulator every 31 days since the static design of the accumulators limits the ways in which the concentration can be changed. A Note states that for Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the accumulator boron concentration acceptance criteria shall be Ž 2200 ppm and

2400 ppm. The 31 day Frequency is adequate to identify changes that could occur from mechanisms such as stratification or inleakage. Sampling the affected accumulator within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months after a 50% increase of indicated level will identify whether inleakage has caused a reduction in boron concentration to below the required limit. It is not necessary to verify boron concentration if the added water inventory is from the refueling water storage tank (RWST),

because the water contained in the RWST is within the accumulator boron concentration requirements. This is consistent with the recommendation of NUREG-1366 (Ref. 3).

Although the run of piping between the two accumulator discharge check valves is credited in demonstrating compliance with Technical Specification 3.5.1 minimum accumulator volume requirement, the minimum boron concentration requirement does not apply to this run of piping. Applicable accident analyses have explicitly considered in-leakage from the RCS, and the resulting reduction in boron concentration in this run of piping, which is not sampled.

SR 3.5.1.5 Verification every 31 days that power is removed from each accumulator isolation valve operator when the RCS pressure is Ž 2000 psig ensures that an active failure could not (continued)

North Anna Units 1 and 2 Revision 0 B 3.5.1-7

Accumulators B 3.5.1 BASES SURVEILLANCE REQUIREMENTS SR 3.5.1.5 (continued) result in the closure of an accumulator motor operated isolation valve. If this were to occur, only one accumulator would be available for injection given a single failure coincident with a LOCA. Since power is removed under administrative control, the 31 day Frequency will provide adequate assurance that power is removed.

This SR allows power to be supplied to the motor operated isolation valves when RCS pressure is < 2000 psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during unit startups or shutdowns.

REFERENCES

1. UFSAR, Chapter 6 and Chapter 15.

2.

10 CFR 50.46.

3. NUREG-1366, February 1990.

Revision 0 North Anna Units 1 and 2 B 3.5.1-8

ECCS-Operating B 3.5.2 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 ECCS-Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a. Loss of coolant accident (LOCA),

coolant leakage greater than the capability of the normal charging system;

b. Rupture of a control rod drive mechanism-control rod assembly ejection accident;

c. Loss of secondary coolant accident, including uncontrolled steam release or loss of feedwater; and

d. Steam generator tube rupture (SGTR).

The addition of negative reactivity is designed primarily for the MSLB where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are three phases of ECCS operation: injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for cold leg recirculation.

Within approximately 5 hours5.787037e-5 days 0.00139 hours 8.267196e-6 weeks 1.9025e-6 months , the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush, which would reduce the boiling in the top of the core and any resulting boron precipitation.

The ECCS consists of two separate subsystems: High Head Safety Injection (HHSI) and Low Head Safety Injection (LHSI).

Each subsystem consists of two redundant, 100%

capacity trains. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this LCO.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.5.2-1

ECCS-Operating B 3.5.2 BASES BACKGROUND (continued)

The ECCS flow paths consist of piping, valves, and pumps such that water from the RWST can be injected into the RCS following the accidents described in this LCO. The major components of each subsystem are the HHSI pumps and the LHSI pumps. Each of the two subsystems consists of two 100%

capacity trains that are interconnected and redundant such that either train is capable of supplying 100% of the flow required to mitigate the accident consequences. This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from opposite trains to achieve the required 100% flow to the core.

During the injection phase of LOCA recovery, a suction header supplies water from the RWST to the ECCS pumps. Water from the supply header enters the LHSI pumps through parallel, normally open, motor operated valves. Water to the HHSI pumps is supplied via parallel motor operated valves to ensure that at least one valve opens on receipt of a safety injection actuation signal. The supply header then branches to the three HHSI pumps through normally open, motor operated valves. The discharge from the HHSI pumps combines prior to entering the boron injection tank (BIT) and then divides again into three supply lines, each of which feeds the injection line to one RCS cold leg. The discharge from the LHSI pumps combine and then divide into three supply lines, each of which feeds the injection line to one RCS cold leg. Control valves in the HHSI lines are set to balance the flow to the RCS. This balance ensures sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the RCS cold legs and preclude pump runout.

For LOCAs that are too small to depressurize the RCS below the shutoff head of the LHSI pumps, the HHSI pumps supply water until the RCS pressure decreases below the LHSI pump shutoff head. During this period, the steam generators are used to provide part of the core cooling function.

During the recirculation phase of LOCA recovery, LHSI pump suction is transferred to the containment sump. The LHSI pumps then supply the HHSI pumps. Initially, recirculation is through the same paths as the injection phase.

Subsequently, recirculation alternates injection between the hot and cold legs.

(continued)

North Anna Units 1 and 2 Revi si on 0 B 3.5.2-2

ECCS-Operating B 3.5.2 BASES BACKGROUND The HHSI subsystem of the ECCS also functions to supply (continued) borated water to the reactor core following increased heat removal events, such as an MSLB. The limiting design conditions occur when the negative moderator temperature coefficient is highly negative, such as at the end of each cycle.

HHSI pumps A and B are capable of being automatically started and are powered from separate emergency buses. HHSI pump C can only be manually started, but can be powered from either of the emergency buses that HHSI pumps A and B are powered from. An interlock prevents HHSI pump C from being powered from both emergency buses simultaneously. For HHSI pump C to be OPERABLE, it must be running since it does not start automatically. In the event of a Safety Injection signal coincident with a loss of offsite power, interlocks prevent automatic operation of two HHSI pumps on the same emergency bus to prevent overloading the emergency diesel generators.

HHSI pump C is normally either running, or available but not running. HHSI pump C is normally running if either HHSI pump A or B is inoperable or both are otherwise preferred to not be in operation. HHSI pump C is normally available but not running when either HHSI pump A or B is running.

The ECCS subsystems are actuated upon receipt of an SI signal. The actuation of safeguard loads is accomplished in a programmed time sequence. If offsite power is available, the safeguard loads start immediately in the programmed sequence. If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs).

Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting and pump starting determines the time required before pumped flow is available to the core following a LOCA.

The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1, "Accumulators," and LCO 3.5.4, "Refueling Water Storage Tank (RWST),"

provide the cooling water necessary to meet Reference 1.

North Anna Units 1 and 2 Revision 0 B 3.5.2-3

ECCS-Operating B 3.5.2 BASES APPLICABLE The LCO helps to ensure that the following acceptance SAFETY ANALYSES criteria for the ECCS, established by 10 CFR 50.46 (Ref. 2),

will be met following a LOCA:

a. Maximum fuel element cladding temperature is

22007F;

b. Maximum cladding oxidation is

0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from a zirconium water reaction is

0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. Core is maintained in a coolable geometry; and

e. Adequate long term core cooling capability is maintained.

The LCO also limits the magnitude of post trip return to power following an MSLB event and ensures that containment temperature limits are met.

Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Refs. 3 and 4). This event establishes the maximum flow requirement for the ECCS pumps. The HHSI pumps are credited in a small break LOCA event. This event relies upon the flow and discharge head of the HHSI pumps.

The SGTR and MSLB events also credit the HHSI pumps. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:

a. A large break LOCA event, with loss of offsite power and a single failure disabling one LHSI pump (both EDG trains are assumed to operate due to requirements for modeling full active containment heat removal system operation);

and

b. A small break LOCA event, with a loss of offsite power and a single failure disabling one Emergency Diesel Generator.

During the blowdown stage of a large break LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.2-4

ECCS-Operating B 3.5.2 BASES APPLICABLE or control rod insertion for small breaks. Following SAFETY ANALYSES depressurization, emergency cooling water is injected into (continued) the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.

The effects on containment mass and energy releases are accounted for in appropriate analysis (Ref. 3).

The LCO ensures that an ECCS train will deliver sufficient water to match boiloff rates soon enough to minimize the consequences of the core being uncovered following a large LOCA.

It also ensures that the HHSI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For smaller LOCAs, the HHSI pump delivers sufficient fluid to maintain RCS inventory. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.

The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train.

Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.

In MODES 1, 2, and 3, an ECCS train consists of an HHSI subsystem and a LHSI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and automatically transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the three cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs.

The flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.5.2-5

ECCS-Operating B 3.5.2 BASES LCO (continued)

APPLICABILITY As indicated in the Note, the SI flow paths may be isolated for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 3.4.14.1.

The flow path is readily restorable from the control room.

In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES.

MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.

This LCO is only applicable in MODE 3 and above. Below MODE 3, the SI signal setpoint has already been manually bypassed by operator control, and system functional requirements are relaxed as described in LCO 3.5.3, "ECCS-Shutdown."

In MODES 5 and 6, unit conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled,"

and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

A.1 With one or more trains inoperable and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is based on an NRC reliability evaluation (Ref. 5) and is a reasonable time for repair of many ECCS components.

An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available.

(continued)

Revision 0 North Anna Units 1 and 2 ACTIONS B 3.5.2-6

ECCS-Operating B 3.5.2 BASES ACTIONS A.1 (continued)

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one active component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS (e.g.,

an inoperable HHSI pump in one train, and an inoperable LHSI pump in the other). This allows increased flexibility in unit operations under circumstances when components in opposite trains are inoperable.

An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref.

5) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

B.1 and B.2 If the inoperable trains cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and MODE 4 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

C.1 Condition A is applicable with one or more trains inoperable. The allowed Completion Time is based on the assumption that at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train is available. With less than 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the facility is in a condition outside of the accident analyses. Therefore, LCO 3.0.3 must be entered immediately.

North Anna Units 1 and 2 Revision 0 B 3.5.2-7

ECCS-Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.1 REQUIREMENTS Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained.

Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removal of power or by key locking the control in the correct position ensures that they cannot change position as a result of an active failure or be inadvertently misaligned. These valves are of the type that can disable the function of both ECCS trains and invalidate the accident analyses. A 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is considered reasonable in view of other administrative controls that will ensure a mispositioned valve is unlikely.

SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths will exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a nonaccident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mispositioned are in the correct position. The 31 day Frequency is appropriate because the valves are operated under administrative control, and an improper valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.3 With the exception of the operating charging pump, the ECCS pumps are normally in a standby nonoperating mode. As such, some flow path piping has the potential to develop pockets of entrained gases. Plant operating experience and analysis has shown that after proper system filling (following maintenance or refueling outages), some entrained noncondensable gases remain. These gases will form small voids, which remain stable in the system in both normal and transient operation. Mechanisms postulated to increase the (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.2-8

ECCS-Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.3 (continued)

REQUIREMENTS void size are gradual in nature, and the system is operated in accordance with procedures to preclude growth in these voids.

To provide additional assurances that the system will function, a verification is performed every 92 days that the system is sufficiently full of water. The system is sufficiently full of water when the voids and pockets of entrained gases in the ECCS piping are small enough in size and number so as to not interfere with the proper operation of the ECCS. Verification that the.ECCS piping is sufficiently full of water can be performed by venting the necessary high point ECCS vents outside containment, using NDE, or using other Engineering-justified means. Maintaining the piping from the ECCS pumps to the RCS sufficiently full of water ensures that the system will perform properly, injecting its full capacity into the RCS upon demand. This will also prevent water hammer, pump cavitation, and pumping of excess noncondensable gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling. The 92 day frequency takes into consideration the gradual nature of the postulated void generation mechanism.

SR 3.5.2.4 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the ASME Code.

This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pump baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the safety analysis. SRs are specified in the Inservice Testing Program, which encompasses the ASME Code.

The ASME Code provides the activities and Frequencies necessary to satisfy the requirements.

SR 3.5.2.5 and SR 3.5.2.6 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump capable of (continued)

North Anna Units 1 and 2 Revision 0 B 3.5.2-9

ECCS-Operating B 3.5.2 BASES SURVEILLANCE SR 3.5.2.5 and SR 3.5.2.6 (continued)

REQUIREMENTS starting automatically starts on receipt of an actual or simulated SI signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative controls. The 18 month Frequency is based on the need to perform these Surveillances under the conditions that apply during a unit outage and the potential for unplanned unit transients if the Surveillances were performed with the reactor at power.

The 18 month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of ESF Actuation System testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.7 Proper throttle valve position is necessary for proper ECCS performance and to prevent pump runout and subsequent component damage. The Surveillance verifies each listed ECCS throttle valve is secured in the correct position. The 18 month Frequency is based on the same reasons as those stated in SR 3.5.2.5 and SR 3.5.2.6.

SR 3.5.2.8 Periodic inspections of the containment sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a unit outage and on the need to have access to the location. This Frequency has been found to be sufficient to detect abnormal degradation and is confirmed by operating experience.

REFERENCES

1. UFSAR, Section 3.1.31.

2.

10 CFR 50.46.

3. UFSAR, Section 15.4.1.

4.

UFSAR, Section 6.2 and Chapter 15.

North Anna Units 1 and 2 Revision 0 B 3.5.2-10

ECCS-Operati ng B 3.5.2 BASES REFERENCES

5.

NRC Memorandum to V. Stello, Jr., from R.L. Baer, (continued)

"Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

North Anna Units 1 and 2 Revision 0 B 3.5.2-11

Intentionally Blank

ECCS-Shutdown B 3.5.3 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 ECCS-Shutdown BASES BACKGROUND APPLICABLE SAFETY ANALYSES The Background section for Bases 3.5.2, "ECCS-Operating," is applicable to these Bases, with the following modifications.

In MODE 4, the required ECCS train consists of two separate subsystems: High Head Safety Injection (HHSI) and Low Head Safety Injection (LHSI).

The ECCS flow paths consist of piping, valves and pumps such that water from the refueling water storage tank (RWST) can be injected into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2.

The Applicable Safety Analyses section of Bases 3.5.2 also applies to this Bases section.

Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA),

the ECCS operational requirements are reduced. It is understood in these reductions that certain automatic safety injection (SI) actuation is not available.

In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA. The safety analysis assumes that flow from one HHSI pump is manually initiated 10 minutes after the DBA.

Only one train of ECCS is required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation.

The ECCS trains satisfy Criterion 3 of 10 CFR 50.36(c) (2) (ii).

LCO In MODE 4, one of the two independent (and redundant) ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.

In MODE 4, an ECCS train consists of an HHSI subsystem and an LHSI subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of (continued)

North Anna Units 1 and 2 Revision 0 B 3.5.3-1

ECCS-Shutdown B 3.5.3 BASES LCO taking suction from the RWST and transferring suction to the (continued) containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the three cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to deliver its flow to the RCS hot or cold legs.

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for ECCS are covered by LCO 3.5.2.

In MODE 4 with RCS temperature below 3500F, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.

In MODES 5 and 6, unit conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled,"

and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

ACTIONS A.1 With no ECCS train OPERABLE, due to the inoperability of the ECCS flow path, the unit is not prepared to respond to Design Basis Events requiring SI. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to restore at least one ECCS train to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the unit in MODE 5, where an ECCS train is not required.

B.1 When the Required Actions of Condition A cannot be completed within the required Completion Time, the unit should be placed in MODE 5. Twenty-four hours is a reasonable time, based on operating experience, to reach MODE 5 in an orderly manner and without challenging unit systems or operators.

Revision 0 North Anna Units 1 and 2 B 3.5.3-2

ECCS-Shutdown B 3.5.3 BASES SURVEILLANCE SR 3.5.3.1 REQU IREMENTS The applicable Surveillance descriptions from Bases 3.5.2 apply.

REFERENCES The applicable references from Bases 3.5.2 apply.

North Anna Units 1 and 2 Revision 0 B 3.5.3-3

Intentionally Blank

RWST B 3.5.4 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.4 Refueling Water Storage Tank (RWST)

BASES BACKGROUND The RWST supplies borated water to the Chemical and Volume Control System (CVCS) during abnormal operating conditions, to the refueling pool during refueling, and to the ECCS and the Quench Spray System during accident conditions.

The RWST supplies water to the ECCS pumps through a common supply header. Water from the supply header enters the low head safety injection (LHSI) pumps through parallel, normally open, motor operated valves. Water to the High Head Safety Injection (HHSI) pumps is supplied via parallel motor operated valves to ensure that at least one opens on receipt of a safety injection actuation signal. The supply header then branches to the three HHSI pumps. The RWST supplies water to the Quench Spray pumps via separate, redundant lines. A motor operated isolation valve is provided in each header to isolate the RWST from the ECCS once the system has been transferred to the recirculation mode. The recirculation mode is entered when pump suction is transferred to the containment sump either manually or automatically following receipt of the RWST-Low Low level signal.

Use of a single RWST to supply both trains of the ECCS and*Quench Spray System is acceptable since the RWST is a passive component used for a short period of time following an accident, and passive failures are not required to be assumed to occur during the time the RWST is needed following Design Basis Events.

The switchover from normal operation to the injection phase of ECCS operation requires changing HHSI pump suction from the CVCS volume control tank (VCT) to the RWST through the use of isolation valves.

During normal operation, the LHSI pumps are aligned to take suction from the RWST.

The ECCS pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at or near shutoff head conditions.

(continued)

North Anna Units 1 and 2 Revision 0 B 3.5.4-1

RWST B 3.5.4 BASES BACKGROUND (continued)

When the suction for the ECCS pumps is transferred to the containment sump, the recirculation lines are isolated to prevent a release of the containment sump contents to the RWST, which could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ECCS pumps.

This LCO ensures that:

a. The RWST contains sufficient borated water to support the ECCS during the injection phase and Quench Spray System;

b. Sufficient water volume exists in the containment sump to support continued operation of the ECCS and Recirculation Spray System pumps following transfer to the recirculation mode of cooling; and

c. The reactor remains subcritical following a loss of coolant accident (LOCA).

Insufficient water volume in the RWST could result in insufficient cooling capacity when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following the LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside the containment.

APPLICABLE SAFETY ANALYSES During accident conditions, the RWST provides a source of borated water to the ECCS and Quench Spray System pumps. As such, it provides containment cooling and depressurization, core cooling, and replacement inventory to the RCS and is a source of negative reactivity for reactor shutdown (Ref. 1).

The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of B 3.5.2, "ECCS-Operating"; B 3.5.3, "ECCS-Shutdown"; and B 3.6.6, "Quench Spray System." These analyses are used to assess changes to the RWST in order to evaluate their effects in relation to the acceptance limits in the analyses.

The RWST must also meet volume, boron concentration, and temperature requirements for certain non-LOCA events. The volume is not an explicit assumption in non-LOCA events since the required volume is a small fraction of the (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.4-2

RWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued) available volume. The deliverable volume limit is assumed by the Large Break LOCA containment analyses. For the RWST, the deliverable volume is different from the total volume contained. Because of the design of the tank, more water can be contained than can be delivered. The upper RWST volume limit is assumed for pH control after a LBLOCA. The minimum boron concentration is an explicit assumption in the main steam line break (MSLB) analysis to ensure the required shutdown capability. The importance of its value is small because of the boron injection tank (BIT) with a high boron concentration. The maximum boron concentration is an explicit assumption in the inadvertent ECCS actuation analysis, although it is typically a nonlimiting event and the results are very insensitive to boron concentrations.

The maximum RWST temperature ensures that the amount of containment cooling provided from the RWST during containment pressurization events is consistent with safety analysis assumptions. The minimum RWST temperature is an assumption in the inadvertent Quench Spray actuation analyses.

For a large break LOCA analysis, the minimum water volume limit of 466,200 gallons and the lower boron concentration limit of 2600 ppm are used to compute the post LOCA sump boron concentration necessary to assure subcriticality. For Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the minimum RWST boron concentration acceptance criteria shall be Ž 2300 ppm. The large break LOCA is the limiting case since the safety analysis assumes that all control rods are out of the core.

The upper limit on boron concentration of 2800 ppm is used to determine the maximum allowable time to switch to hot leg recirculation following a LOCA. For Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the maximum RWST boron concentration acceptance criteria shall be

2400 ppm. The purpose of switching from cold leg to hot leg injection is to avoid boron precipitation in the core following the accident.

In the ECCS analysis, the quench spray temperature is bounded by the RWST lower temperature limit of 40'F. If the lower temperature limit is violated, the quench spray further reduces containment pressure, which decreases the rate at which steam can be vented out the break and increases peak clad temperature. The upper temperature limit of 50'F is bounded by the values used in the small break LOCA analysis (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.4-3

RWST B 3.5.4 BASES APPLICABLE SAFETY ANALYSES (continued)

LCO and containment OPERABILITY analysis. Exceeding this temperature will result in a higher peak clad temperature, because there is less heat transfer from the core to the injected water for the small break LOCA and higher containment pressures due to reduced quench spray cooling capacity. For the containment response following an MSLB, the lower limit on boron concentration and the upper limit on RWST water temperature are used to maximize the total energy release to containment.

The RWST satisfies Criterion 3 of 10 CFR 50.36(c)(2)(ii).

The RWST ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA),

to cool and cover the core in the event of a LOCA, to maintain the reactor subcritical following a DBA, and to ensure adequate level in the containment sump to support ECCS and Recirculation Spray System pump operation in the recirculation mode.

To be considered OPERABLE, the RWST must meet the water volume, boron concentration, and temperature limits established in the SRs.

APPLICABILITY In MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are dictated by ECCS and Quench Spray System OPERABILITY requirements. Since both the ECCS and the Quench Spray System must be OPERABLE in MODES 1, 2, 3, and 4, the RWST must also be OPERABLE to support their operation. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops-MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops-MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation-High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation-Low Water Level."

ACTIONS A.1 With RWST boron concentration or borated water temperature not within limits, they must be returned to within limits within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months . Under these conditions neither the ECCS nor the Quench Spray System can perform its design function.

Therefore, prompt action must be taken to restore the tank to (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.4-4

RWST B 3.5.4 BASES ACTIONS A.1 (continued)

OPERABLE condition. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months limit to restore the RWST temperature or boron concentration to within limits was developed considering the time required to change either the boron concentration or temperature and the fact that the contents of the tank are still available for injection.

B.1 With the RWST inoperable for reasons other than Condition A (e.g., water volume),

it must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In this Condition, neither the ECCS nor the Quench Spray System can perform its design function. Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the unit in a MODE in which the RWST is not required. The short time limit of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to restore the RWST to OPERABLE status is based on this condition simultaneously affecting redundant trains.

C.1 and C.2 If the RWST cannot be returned to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months and to MODE 5 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.5.4.1 REQUIREMENTS The RWST borated water temperature should be verified every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to be within the limits assumed in the accident analyses band. This Frequency is sufficient to identify a temperature change that would approach either limit and has been shown to be acceptable through operating experience.

SR 3.5.4.2 The RWST water volume should be verified every 7 days to be above the required minimum level in order to ensure that a sufficient initial supply is available for injection and to (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.4-5

RWST B 3.5.4 BASES SURVEILLANCE SR 3.5.4.2 (continued)

REQUI REMENTS support continued ECCS and Recirculation Spray System pump operation on recirculation. Since the RWST volume is normally stable and is protected by an alarm, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.

SR 3.5.4.3 The boron concentration of the RWST should be verified every 7 days to be within the required limits. A Note states that for Unit 2, until the first entry into MODE 4 following the Unit 2 Fall 2002 refueling outage, the RWST boron concentration acceptance criteria shall be Ž 2300 ppm and

2400 ppm. This SR ensures that the reactor will remain subcritical following a LOCA. Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized. Since the RWST volume is normally stable, a 7 day sampling Frequency to verify boron concentration is appropriate and has been shown to be acceptable through operating experience.

REFERENCES

1. UFSAR, Chapter 6 and Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.5.4-6

Seal Injection Flow B 3.5.5 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.5 Seal Injection Flow BASES BACKGROUND APPLICABLE SAFETY ANALYSES The function of the seal injection throttle valves during an accident is similar to the function of the ECCS throttle valves in that each restricts flow from the High Head Safety Injection (HHSI) pump header to the Reactor Coolant System (RCS).

The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow'that would be diverted from the injection path following an accident and precludes HHSI pump runout due to excessive seal injection flow. This limit is based on safety analysis assumptions that are required because RCP seal injection flow is not isolated during safety injection (SI).

All ECCS subsystems are assumed to be OPERABLE in the large break loss of coolant accident (LOCA) at full power (Ref.

1). The LOCA analysis establishes the minimum flow for the HHSI pumps. The HHSI pumps are also credited in the small break LOCA analysis. This analysis establishes the flow and discharge head requirements at the design point for the HHSI pumps. The steam generator tube rupture and main steam line break event analyses also credit the HHSI pumps, but are not limiting in their design. Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.

This LCO ensures that seal injection flow of

30 gpm, with RCS pressure Ž 2215 psig and

2255 psig and seal injection (air operated) hand control valve full open, will be limited in such a manner that the ECCS trains will be capable of delivering sufficient water to provide adequate core cooling following a large LOCA, and protect against HHSI pump runout. The analysis conservatively neglects the contribution from seal injection to the RCS. This conservatism bounds the minor effect of instrument uncertainty, so instrument uncertainties have not been included in the derivation of the flow (30 gpm) and RCS pressure (Ž 2215 psig and

2255 psig) setpoints. The flow limit also ensures that the HHSI pumps will deliver (continued)

North Anna Units 1 and 2 Revisi on 0 B 3.5.5-1

Seal Injection Flow B 3.5.5 BASES APPLICABLE sufficient water for a small LOCA and sufficient boron to SAFETY ANALYSES maintain the core subcritical. For smaller LOCAs, the HHSI (continued) pumps alone deliver sufficient fluid to overcome the loss and maintain RCS inventory.

Seal injection flow satisfies Criterion 2 of 10 CFR 50.36(c) (2)(ii).

LCO The intent of the LCO limit on seal injection flow is to make sure that flow through the RCP seal water injection line is low enough to ensure that sufficient HHSI pump injection flow is directed to the RCS via the injection points and to prevent pump runout.

The LCO is not strictly a flow limit, but rather a flow limit based on a flow line resistance. In order to establish the proper flow line resistance, a pressure and flow must be known. The flow line resistance is determined by assuming that the RCS pressure is at normal operating pressure as specified in this LCO. The HHSI pump discharge header pressure remains essentially constant through all the applicable MODES of this LCO. A reduction in RCS pressure would result in more flow being diverted to the RCP seal injection line than at normal operating pressure. The valve settings established at the prescribed RCS pressure result in a conservative valve position should RCS pressure decrease. The additional modifier of this LCO, the seal injection (air operated) hand control valve being full open, is required since the valve is designed to fail open for the accident condition. With the discharge pressure and control valve position as specified by the LCO, a flow path resistance limit is established. It is this resistance limit that is used in the accident analyses.

The limit on seal injection flow, combined with the RCS pressure limit and an open wide condition of the seal injection hand control valve, must be met to render the ECCS OPERABLE.

If these conditions are not met, the ECCS flow to the core could be less than that assumed in the accident analyses.

APPLICABILITY In MODES 1, 2, and 3, the seal injection flow limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4. The seal injection flow limit is not applicable for MODE 4 and lower, however, because high seal (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.5-2

Seal Injection Flow B 3.5.5 BASES APPLICABILITY injection flow is less critical as a result of the lower (continued) initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.

ACTIONS A.1 With the seal injection flow exceeding its limit, the amount of charging flow available to the RCS may be reduced or, following a LOCA, pump runout could occur. Under this Condition, action must be taken to restore the flow to below its limit. The operator has 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months from the time the flow is known to be above the limit to correctly position the manual valves and thus be in compliance with the accident analysis.

The Completion Time minimizes the potential exposure of the unit to a LOCA with insufficient injection flow and provides a reasonable time to restore seal injection flow within limits. This time is conservative with respect to the Completion Times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.

B.1 and B.2 When the Required Actions cannot be completed within the required Completion Time, a controlled shutdown must be initiated. The Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for reaching MODE 3 from MODE 1 is a reasonable time for a controlled shutdown, based on operating experience and normal cooldown rates, and does not challenge unit safety systems or operators. Continuing the unit shutdown begun in Required Action B.1, an additional 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is a reasonable time, based on operating experience and normal cooldown rates, to reach MODE 4, where this LCO is no longer applicable.

SURVEILLANCE SR 3.5.5.1 REQUIREMENTS Verification every 31 days that the manual seal injection throttle valves are adjusted to give a flow within the limit ensures that proper manual seal injection throttle valve position, and hence, proper seal injection flow, is maintained. The Frequency of 31 days is based on engineering (continued)

Revision 0 North Anna Units 1 and 2 B 3.5.5-3

Seal Injection Flow B 3.5.5 BASES SURVEILLANCE REQUIREMENTS REFERENCES SR 3.5.5.1 (continued) judgment and is consistent with other ECCS valve Surveillance Frequencies. The Frequency has proven to be acceptable through operating experience.

As noted, the Surveillance is not required to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the RCS pressure has stabilized within a

+/- 20 psi range of normal operating pressure. The RCS pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual valves are set correctly. The exception is limited to 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to ensure that the Surveillance is timely.

1. UFSAR, Chapter 6 and Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.5.5-4

BIT B 3.5.6 B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.6 Boron Injection Tank (BIT)

BASES BACKGROUND The BIT is the primary means of quickly introducing negative reactivity into the Reactor Coolant System (RCS) on a safety injection (SI) signal.

The main flow the discharge through lines parallel that operated from elements have these valves, path through the Boron Injection Tank is from of the High Head Safety Injection (HHSI) pumps equipped with a flow element and two valves in open on an SI signal.' The valves can be the main control board. The valves and flow main control board indications. Downstream of the flow enters the BIT (Ref. 1).

The BIT is a stainless steel clad tank containing concentrated boric acid. Two trains of strip heaters are mounted on the tank to keep the temperature of the boric acid solution above the precipitation point. The strip heaters are controlled by temperature elements located near the bottom of the BIT. The temperature elements also activate High and Low temperature alarms in the Control Room. In addition to the strip heaters on the BIT, there is a recirculation system with a heat tracing system, including the piping section between the motor operated isolation valves, which further ensures that the boric acid stays in solution. The entire contents of the BIT are injected when required; thus, the contained and deliverable volumes are the same.

During normal operation, a boric acid transfer pump provides recirculation between the boric acid tank and the BIT. On receipt of an SI signal, the recirculation line valves close. Flow to the BIT is then supplied from the HHSI pumps.

The solution of the BIT is injected into the RCS through the RCS cold legs.

APPLICABLE During a main steam line break (MSLB) or loss of coolant SAFETY ANALYSES accident (LOCA),

the BIT provides an immediate source of concentrated boric acid that quickly introduces negative reactivity into the RCS.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.5.6-1

BIT B 3.5.6 BASES APPLICABLE The contents of the BIT are not credited for core cooling or SAFETY ANALYSES immediate boration in the LOCA analysis, but are for post (continued)

LOCA recovery. The BIT maximum boron concentration of 15,750 ppm is used to determine the minimum time for hot leg recirculation switchover. The minimum boron concentration of 12,950 ppm is used to determine the minimum mixed mean sump boron concentration for post LOCA shutdown requirements.

For the MSLB, the BIT is the primary mechanism for injecting boron into the core to counteract the positive increases in reactivity caused by an RCS cooldown. The MSLB core response analysis conservatively assumes a 0 ppm minimum boron concentration of the BIT, which also affects the departure from nucleate boiling design analysis. The MSLB containment response analysis conservatively assumes a 2000 ppm minimum boron concentration of the BIT. Reference to the LOCA and MSLB analyses is used to assess changes to the BIT to evaluate their effect on the acceptance limits contained in these analyses.

The minimum temperature limit of 1150F for the BIT ensures that the solution does not reach the boric acid precipitation point. The temperature of the solution is monitored and alarmed on the main control board.

The BIT boron concentration limits are established to ensure that the core remains subcritical during post LOCA recovery.

The BIT will counteract any positive increases in reactivity caused by an RCS cooldown.

The BIT water volume of 900 gallons is used to ensure that the appropriate quantity of highly borated water with sufficient negative reactivity is injected into the RCS to shut down the core following an MSLB, to determine the hot leg recirculation switchover time, and to safeguard against boron precipitation.

The BIT satisfies Criteria 2 and 3 of 10 CFR 50.36(c) (2)(ii).

LCO This LCO establishes the minimum requirements for contained volume, boron concentration, and temperature of the BIT inventory. This ensures that an adequate supply of borated water is available in the event of a LOCA or MSLB to maintain the reactor subcritical following these accidents.

(continued)

Revision 0 North Anna Units 1 and 2 B 3.5.6-2

BIT B 3.5.6 BASES LCO To be considered OPERABLE, the limits established in the SR (continued) for water volume, boron concentration, and temperature must be met.

APPLICABILITY In MODES 1, 2, and 3, the BIT OPERABILITY requirements are consistent with those of LCO 3.5.2, "ECCS-Operating."

In MODES 4, 5, and 6, the respective accidents are less severe, so the BIT is not required in these lower MODES.

ACTIONS A.1 If the required volume is not present in the BIT, both the hot leg recirculation switchover time analysis and the boron precipitation analysis may not be correct. Under these conditions, prompt action must be taken to restore the volume to above its required limit to declare the tank OPERABLE, or the unit must be placed in a MODE in which the BIT is not required.

The BIT boron concentration is considered in the hot leg recirculation switchover time analysis, the boron precipitation analysis, and may effect the reactivity analysis for an MSLB.

If the concentration were not within the required limits, these analyses could not be relied on.

Under these conditions, prompt action must be taken to restore the concentration to within its required limits, or the unit must be placed in a MODE in which the BIT is not required.

The BIT temperature limit is established to ensure that the solution does not reach the boric acid crystallization point. If the temperature of the solution drops below the minimum, prompt action must be taken to raise the temperature and declare the tank OPERABLE, or the unit must be placed in a MODE in which the BIT is not required.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time to restore the BIT to OPERABLE status is consistent with other Completion Times established for loss of a safety function and ensures that the unit will not operate for long periods outside of the safety analyses.

Revision 0 North Anna Units 1 and 2 B 3.5.6-3

BIT B 3.5.6 BASES ACTIONS B.1, B.2, and B.3 (conti nued)

When Required Action A.1 cannot be completed within the required Completion Time, a controlled shutdown should be initiated. Six hours is a reasonable time, based on operating experience, to reach MODE 3 from full power conditions and to be borated to the required SDM without challenging unit systems or operators. Borating to the required SDM assures that the unit is in a safe condition, without need for any additional boration.

After determining that the BIT is inoperable and the Required Actions of B.1 and B.2 have been.completed, the tank must be returned to OPERABLE status within 7 days.

These actions ensure that the unit will not be operated with an inoperable BIT for a lengthy period of time. It should be noted, however, that changes to applicable MODES cannot be made until the BIT is restored to OPERABLE status, except as provided by LCO 3.0.4.

C.1 Even though the RCS has been borated to a safe and stable condition as a result of Required Action B.2, either the BIT must be restored to OPERABLE status (Required Action C.1) or the unit must be placed in a condition in which the BIT is not required (MODE 4). The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time to reach MODE 4 is reasonable, based on operating experience and normal cooldown rates, and does not challenge unit safety systems or operators.

SURVEILLANCE SR 3.5.6.1 REQUIREMENTS Verification every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months that the BIT water temperature is at or above the specified minimum temperature is frequent enough to identify a temperature change that would approach the acceptable limit. The solution temperature is also monitored by an alarm that provides further assurance of protection against low temperature. This Frequency has been shown to be acceptable through operating experience.

Revision 0 North Anna Units 1 and 2 B 3.5.6-4

BIT B 3.5.6 BASES SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.6.2 Verification every 7 days that the BIT contained volume is above the required limit is frequent enough to assure that this volume will be available for quick injection into the RCS.

The 900 gallon limit corresponds to the BIT being completely full. Methods of verifying that the BIT is completely full include venting from the high point vent, and recirculation flow with the Boric Acid Storage Tanks. If the volume is too low, the BIT would not provide enough borated water to ensure subcriticality during recirculation or to provide additional core shutdown margin following an MSLB.

Since the BIT volume is normally stable, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.

SR 3.5.6.3 Verification every 7 days that the boron concentration of the BIT is within the required band ensures that the reactor remains subcritical following a LOCA; it limits return to power following an MSLB, and maintains the resulting sump pH in an acceptable range so that boron precipitation will not occur in the core. In addition, the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized.

The BIT is in a recirculation loop that provides continuous circulation of the boric acid solution through the BIT and the boric acid tank (BAT).

There are a number of points along the recirculation loop where local samples can be taken. The actual location used to take a sample of the solution is specified in the unit Surveillance procedures. Sampling from the BAT to verify the concentration of the BIT is not recommended, since this sample may not be homogenous and the boron concentration of the two tanks may differ.

The sample should be taken from the BIT or from a point in the flow path of the BIT recirculation loop.

REFERENCES

1. UFSAR, Chapter 6 and Chapter 15.

Revision 0 North Anna Units 1 and 2 B 3.5.6-5

Intentionally Blank

v t e Letter Sequence Other
TAC:MB0799, Nis Power Range Channel Daily SR TS Change to Address LOW Power Decalibration, Revise Containment Requirements During Handling Irradiated Fuel and Core Alterations (Approved, Closed) TAC:MB0800, Nis Power Range Channel Daily SR TS Change to Address LOW Power Decalibration, Revise Containment Requirements During Handling Irradiated Fuel and Core Alterations (Approved, Closed)
Initiation Request, Request, Request, Request Acceptance... Administration Questions Answers Results Approval Other: ML020650715, ML020840253, ML021220053, ML021220061, ML021220067, ML021220088, ML021220108, ML021220166, ML021220192, ML021220214, ML021220221, ML021220224, ML021220254, ML021550518
MONTHYEAR2002-02-20 [Table View]

ML021220254

Text

Navigation menu

Search