ML100550537

Developmental Revision B - Technical Specifications Bases B 3.5 - Emergency Core Cooling Systems

ML100550537
Person / Time
Site:	Watts Bar
Issue date:	02/02/2010
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
References
Download: ML100550537 (34)

Text

Accumulators B 3.5.1 (continued)

Watts Bar - Unit 2 B 3.5-1 (developmental)

A B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.1 Accumulators BASES BACKGROUND The functions of the ECCS accumulators are to supply water to the reactor vessel during the blowdown phase of a loss of coolant accident (LOCA), to provide inventory to help accomplish the refill phase that follows thereafter, and to provide Reactor Coolant System (RCS) makeup for a small break LOCA.

The blowdown phase of a large break LOCA is the initial period of the transient during which the RCS departs from equilibrium conditions, and heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. The blowdown phase of the transient ends when the RCS pressure falls to a value approaching that of the containment atmosphere.

In the refill phase of a LOCA, which immediately follows the blowdown phase, reactor coolant inventory has vacated the core through steam flashing and ejection out through the break. The core is essentially in adiabatic heatup. The balance of accumulator inventory is then available to help fill voids in the lower plenum and reactor vessel downcomer so as to establish a recovery level at the bottom of the core and ongoing reflood of the core with the addition of safety injection (SI) water.

The accumulators are pressure vessels partially filled with borated water and pressurized with nitrogen gas. The accumulators are passive components, since no operator or control actions are required in order for them to perform their function. Internal accumulator tank pressure is sufficient to discharge the accumulator contents to the RCS, if RCS pressure decreases below the accumulator pressure.

Each accumulator is piped into an RCS cold leg via an accumulator line and is isolated from the RCS by a motor operated isolation valve and two check valves in series. The motor operated isolation valves are interlocked by P-11 with the pressurizer pressure measurement channels to ensure that the valves will automatically open as RCS pressure increases to above the permissive circuit P-11 setpoint.

Accumulators B 3.5.1 BASES (continued)

Watts Bar - Unit 2 B 3.5-2 (developmental)

B BACKGROUND (continued)

This interlock also prevents inadvertent closure of the valves during normal operation prior to an accident. Although not required for accident mitigation, the valves will automatically open as a result of an SI signal.

These features ensure that the valves meet the requirements of the Institute of Electrical and Electronic Engineers (IEEE) Standard 279-1971 (Ref. 1) for "operating bypasses" and that the accumulators will be available for injection without reliance on operator action.

The accumulator size, water volume, and nitrogen cover pressure are selected so that three of the four accumulators are sufficient to partially cover the core before significant clad melting or zirconium water reaction can occur following a LOCA. The need to ensure that three accumulators are adequate for this function is consistent with the LOCA assumption that the entire contents of one accumulator will be lost via the RCS pipe break during the blowdown phase of the LOCA.

APPLICABLE SAFETY ANALYSES The accumulators are assumed OPERABLE in both the large and small break LOCA analyses at full power (Ref. 2). These are the Design Basis Accidents (DBAs) that establish the acceptance limits for the accumulators. Reference to the analyses for these DBAs is used to assess changes in the accumulators as they relate to the acceptance limits.

In performing the LOCA calculations, conservative assumptions are made concerning the availability of ECCS flow. In the early stages of a LOCA, with or without a loss of offsite power, the accumulators provide the sole source of makeup water to the RCS. The assumption of loss of offsite power is also considered to determine if it yields limiting results. The loss of offsite power assumption imposes a delay wherein the ECCS pumps cannot deliver flow until the emergency diesel generators start, come to rated speed, and go through their timed loading sequence. In cold leg break scenarios, the entire contents of one accumulator are assumed to be lost through the break.

The limiting large break LOCA is a split break in the cold leg. During this event, the accumulators discharge to the RCS as soon as RCS pressure decreases to below accumulator pressure.

Accumulators B 3.5.1 BASES (continued)

Watts Bar - Unit 2 B 3.5-3 (developmental)

B APPLICABLE SAFETY ANALYSES (continued)

As a conservative estimate, no credit is taken for ECCS pump flow until an effective delay has elapsed. This delay accounts for the diesels starting and the pumps being loaded and delivering full flow. The delay time is conservatively set to account for SI signal generation. During this time, the accumulators are analyzed as providing the sole source of emergency core cooling. No operator action is assumed during the injection phase of a large break LOCA.

The worst case small break LOCA analyses also assume a time delay before pumped flow reaches the core. For the larger range of small breaks, the rate of blowdown is such that the increase in fuel clad temperature is terminated solely by the accumulators, with pumped flow then providing continued cooling. As break size decreases, the accumulators and centrifugal charging pumps both play a part in terminating the rise in clad temperature. As break size continues to decrease, the role of the accumulators continues to decrease until they are not required and the centrifugal charging pumps become solely responsible for terminating the temperature increase.

This LCO helps to ensure that the following acceptance criteria established for the ECCS by 10 CFR 50.46, Paragraph b (Ref. 3) will be met following a LOCA:

a.

Maximum fuel element cladding temperature is 2200°F;

b.

Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation;

c.

Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react; and

d.

Core is maintained in a coolable geometry.

Since the accumulators discharge during the blowdown phase of a LOCA, they do not contribute to the long term cooling requirements of 10 CFR 50.46.

Accumulators B 3.5.1 BASES (continued)

Watts Bar - Unit 2 B 3.5-4 (developmental)

B APPLICABLE SAFETY ANALYSES (continued)

For the small break LOCA analysis, a nominal contained accumulator water volume of 7855 gallons is used, while a range of 7518-8191 gallons was used for the large break LOCA analysis. The contained water volume is the same as the deliverable volume for the accumulators, since the accumulators are emptied, once discharged. To allow for instrument inaccuracy, values of 7630 gallons and 8000 gallons are specified.

The minimum boron concentration setpoint is used in the post LOCA boron concentration calculation. The calculation is performed to assure reactor subcriticality in a post LOCA environment. Of particular interest is the large break LOCA, since no credit is taken for control rod assembly insertion. A reduction in the accumulator minimum boron concentration would produce a subsequent reduction in the available containment sump concentration for post LOCA shutdown and an increase in the maximum sump pH. The maximum boron concentration is used in determining the cold leg to hot leg recirculation injection switchover time and minimum sump pH.

The small break LOCA analysis is performed at the minimum nitrogen cover pressure, since sensitivity analyses have demonstrated that higher nitrogen cover pressure results in a computed peak clad temperature benefit. The maximum nitrogen cover pressure analysis limit of 690 psig prevents accumulator relief valve actuation, and ultimately preserves accumulator integrity. The LOCA analyses support a range of 585 psig to 690 psig. To account for the accumulator tank design pressure rating, and to allow for instrument accuracy values of 610 psig and 660 psig are specified for the pressure indicator in the main control room.

The effects on containment mass and energy releases from the accumulators are accounted for in the appropriate analyses (Refs. 2 and 4).

The accumulators satisfy Criterion 3 of the NRC Policy Statement.

LCO The LCO establishes the minimum conditions required to ensure that the accumulators are available to accomplish their core cooling safety function following a LOCA. Four accumulators are required to ensure that 100% of the contents of three of the accumulators will reach the core during a LOCA. This is consistent with the assumption that the contents of one accumulator spill through the break. If less than three accumulators are injected during the blowdown phase of a LOCA, the ECCS acceptance criteria of 10 CFR 50.46 (Ref. 3) could be violated.

Accumulators B 3.5.1 BASES (continued)

Watts Bar - Unit 2 B 3.5-5 (developmental)

A LCO (continued)

For an accumulator to be considered OPERABLE, the isolation valve must be fully open, power removed above 1000 psig, and the limits established in the SRs for contained volume, boron concentration, and nitrogen cover pressure must be met.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with RCS pressure > 1000 psig, the accumulator OPERABILITY requirements are based on full power operation. Although cooling requirements decrease as power decreases, the accumulators are still required to provide core cooling as long as elevated RCS pressures and temperatures exist.

This LCO is only applicable at pressures > 1000 psig. At pressures 1000 psig, the rate of RCS blowdown is such that the ECCS pumps can provide adequate injection to ensure that peak clad temperature remains below the 10 CFR 50.46 (Ref. 3) limit of 2200°F.

In MODE 3, with RCS pressure 1000 psig, and in MODES 4, 5, and 6, the accumulator motor operated isolation valves are closed to isolate the accumulators from the RCS. This allows RCS cooldown and depressurization without discharging the accumulators into the RCS or requiring depressurization of the accumulators.

ACTIONS A.1 If the boron concentration of one accumulator is not within limits, it must be returned to within the limits within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. In this Condition, ability to maintain subcriticality or minimum boron precipitation time may be reduced. The boron in the accumulators contributes to the assumption that the combined ECCS water in the partially recovered core during the early reflooding phase of a large break LOCA is sufficient to keep that portion of the core subcritical. One accumulator below the minimum boron concentration limit, however, will have no effect on available ECCS water and an insignificant effect on core subcriticality during reflood.

Boiling of ECCS water in the core during reflood concentrates boron in the saturated liquid that remains in the core. In addition, current analysis techniques demonstrate that the accumulators do not discharge following a large main steam line break for the majority of plants. Even if they do discharge, their impact is minor and not a design limiting event. Thus, 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> is allowed to return the boron concentration to within limits.

Accumulators B 3.5.1 BASES (continued)

Watts Bar - Unit 2 B 3.5-6 (developmental)

B ACTIONS (continued)

B.1 If one accumulator is inoperable for a reason other than boron concentration, the accumulator must be returned to OPERABLE status within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In this Condition, the required contents of three accumulators cannot be assumed to reach the core during a LOCA. Due to the severity of the consequences should a LOCA occur in these conditions, the 24-hour Completion Time to open the valve, remove power to the valve, or restore the proper water volume or nitrogen cover pressure ensures that prompt action will be taken to return the inoperable accumulator to OPERABLE status. The Completion Time minimizes the potential for exposure of the plant to a LOCA under these conditions. The 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> allowed to restore an inoperable accumulator to OPERABLE status is justified in WCAP-15049-A, Rev. 1 (Ref. 6).

C.1 and C.2 If the accumulator cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and pressurizer pressure reduced to 1000 psig within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

D.1 If more than one accumulator is inoperable, the plant is in a condition outside the accident analyses; therefore, LCO 3.0.3 must be entered immediately.

SURVEILLANCE REQUIREMENTS SR 3.5.1.1 Each accumulator valve should be verified to be fully open every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. This verification ensures that the accumulators are available for injection and ensures timely discovery if a valve should be less than fully open. If an isolation valve is not fully open, the rate of injection to the RCS would be reduced. Although a motor operated valve position should not change with power removed, a closed valve could result in not meeting accident analyses assumptions. This Frequency is considered reasonable in view of other administrative controls that ensure a mispositioned isolation valve is unlikely.

Accumulators B 3.5.1 BASES (continued)

Watts Bar - Unit 2 B 3.5-7 (developmental)

B SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.1.2 and SR 3.5.1.3 Every 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />, borated water volume and nitrogen cover pressure are verified for each accumulator (Refer to the note below.). This Frequency is sufficient to ensure adequate injection during a LOCA. Because of the static design of the accumulator, a 12-hour Frequency usually allows the operator to identify changes before limits are reached. Operating experience has shown this Frequency to be appropriate for early detection and correction of off normal trends.

Note: In the discussion contained in the Applicable Safety Analyses of this Bases section, the borated water volume and nitrogen cover pressure specified for SR 3.5.1.2 and SR 3.5.1.3 account for instrument accuracy.

SR 3.5.1.4 The boron concentration should be verified to be within required limits for each accumulator every 31 days since the static design of the accumulators limits the ways in which the concentration can be changed.

The 31-day Frequency is adequate to identify changes that could occur from mechanisms such as stratification or inleakage. Sampling the affected accumulator within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> after a 75 gallons (1% volume) increase will identify whether inleakage has caused a reduction in boron concentration to below the required limit. This is consistent with the recommendation of NUREG-1366 (Ref. 5).

SR 3.5.1.5 Verification every 31 days that power is removed from each accumulator isolation valve operator when the pressurizer pressure is 1000 psig ensures that an active failure could not result in the undetected closure of an accumulator motor operated isolation valve. If this were to occur, only two accumulators would be available for injection given a single failure coincident with a LOCA. Since power is removed under administrative control, the 31-day Frequency will provide adequate assurance that power is removed.

This SR allows power to be supplied to the motor operated isolation valves when pressurizer pressure is < 1000 psig, thus allowing operational flexibility by avoiding unnecessary delays to manipulate the breakers during plant startups or shutdowns. Even with power supplied to the valves, inadvertent closure is prevented by the RCS pressure interlock associated with the valves.

Accumulators B 3.5.1 BASES Watts Bar - Unit 2 B 3.5-8 (developmental)

B SURVEILLANCE REQUIREMENTS SR 3.5.1.5 (continued)

Should closure of a valve occur in spite of the interlock, the SI signal provided to the valves would open a closed valve in the event of a LOCA.

This design feature still exists, but is no longer required for accident mitigation.

REFERENCES

1.

IEEE Standard 279-1971, "Criteria for Protection Systems for Nuclear Power Generating Stations."

2.

Watts Bar FSAR, Section 6.3, "Emergency Core Cooling System."

3.

Title 10, Code of Federal Regulations, Part 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Power Plants."

4.

Watts Bar FSAR, Section 15.0, "Accident Analysis."

5.

NUREG-1366, Improvements to Technical Specifications Surveillance Requirements, December 1992.

6.

WCAP-15049-A, Rev. 1, April, 1999.

ECCS - Operating B 3.5.2 (continued)

Watts Bar - Unit 2 B 3.5-9 (developmental)

A B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.2 ECCS - Operating BASES BACKGROUND The function of the ECCS is to provide core cooling and negative reactivity to ensure that the reactor core is protected after any of the following accidents:

a.

Loss of coolant accident (LOCA), coolant leakage greater than the capability of the normal charging system;

b.

Rod ejection accident;

c.

Loss of secondary coolant accident, including uncontrolled steam release or loss of feedwater; and

d.

Steam generator tube rupture (SGTR).

The addition of negative reactivity is designed primarily for the loss of secondary coolant accident where primary cooldown could add enough positive reactivity to achieve criticality and return to significant power.

There are three phases of ECCS operation: injection, cold leg recirculation, and hot leg recirculation. In the injection phase, water is taken from the refueling water storage tank (RWST) and injected into the Reactor Coolant System (RCS) through the cold legs. When sufficient water is removed from the RWST to ensure that enough boron has been added to maintain the reactor subcritical and the containment sumps have enough water to supply the required net positive suction head to the ECCS pumps, suction is switched to the containment sump for cold leg recirculation. Approximately 3.0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> after event initiation, the ECCS flow is shifted to the hot leg recirculation phase to provide a backflush, which would reduce the boiling in the top of the core and any resulting boron precipitation.

The ECCS consists of three separate subsystems: centrifugal charging (high head), safety injection (SI) (intermediate head), and residual heat removal (RHR) (low head). Each subsystem consists of two redundant, 100% capacity trains. The ECCS accumulators and the RWST are also part of the ECCS, but are not considered part of an ECCS flow path as described by this LCO.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-10 (developmental)

A BACKGROUND (continued)

The ECCS flow paths consist of piping, valves, heat exchangers, and pumps such that water from the RWST can be injected into the RCS following the accidents described in this LCO. The major components of each subsystem are the centrifugal charging pumps, the RHR pumps, heat exchangers, and the SI pumps. Each of the three subsystems consists of two 100% capacity trains that are interconnected and redundant such that either train is capable of supplying 100% of the flow required to mitigate the accident consequences. This interconnecting and redundant subsystem design provides the operators with the ability to utilize components from opposite trains to achieve the required 100% flow to the core.

During the injection phase of LOCA recovery, a suction header supplies water from the RWST to the ECCS pumps. Separate piping supplies each subsystem and each train within the subsystem. The discharge from the SI and RHR pumps divides and feeds an injection line to each of the RCS cold legs. Throttle valves and piping hydraulic design are set to balance the flow to the RCS and prevent pump runout. This balance ensures sufficient flow to the core to meet the analysis assumptions following a LOCA in one of the RCS cold legs.

For LOCAs that are too small to depressurize the RCS below the shutoff head of the SI pumps, the centrifugal charging pumps supply water until the RCS pressure decreases below the SI pump shutoff head. During this period, the steam generators are used to provide part of the core cooling function.

During the recirculation phase of LOCA recovery, RHR pump suction is transferred to the containment sump. The RHR pumps then supply the other ECCS pumps. Initially, recirculation is through the same paths as the injection phase. Subsequently, recirculation provides injection to the hot and cold legs simultaneously.

The centrifugal charging subsystem of the ECCS also functions to supply borated water to the reactor core following increased heat removal events, such as a main steam line break (MSLB). The limiting design conditions occur when the negative moderator temperature coefficient is highly negative, such as at the end of each cycle.

During low temperature conditions in the RCS, limitations are placed on the maximum number of ECCS pumps that may be OPERABLE. Refer to the Bases for LCO 3.4.12, "Cold Overpressure Mitigation System (COMS)," for the basis of these requirements.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-11 (developmental)

A BACKGROUND (continued)

The ECCS subsystems are actuated upon receipt of an SI signal. The actuation of safeguard loads is accomplished in a programmed time sequence for a loss of offsite power. If offsite power is available, the safeguard loads start immediately. If offsite power is not available, the Engineered Safety Feature (ESF) buses shed normal operating loads and are connected to the emergency diesel generators (EDGs). Safeguard loads are then actuated in the programmed time sequence. The time delay associated with diesel starting, sequenced loading, and pump starting determines the time required before pumped flow is available to the core following a LOCA.

The active ECCS components, along with the passive accumulators and the RWST covered in LCO 3.5.1, "Accumulators," and LCO 3.5.4, "Refueling Water Storage Tank (RWST)," provide the cooling water necessary to meet GDC 35 (Ref. 1).

APPLICABLE SAFETY ANALYSES The LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46, Paragraph b (Ref. 2), will be met following a LOCA:

a.

Maximum fuel element cladding temperature is 2200°F;

b.

Maximum cladding oxidation is 0.17 times the total cladding thickness before oxidation;

c.

Maximum hydrogen generation from a zirconium water reaction is 0.01 times the hypothetical amount generated if all of the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d.

Core is maintained in a coolable geometry; and

e.

Adequate long term core cooling capability is maintained.

The LCO also limits the potential for a post trip return to power following an MSLB event and ensures that containment temperature limits are met.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-12 (developmental)

A APPLICABLE SAFETY ANALYSES (continued)

Each ECCS subsystem is taken credit for in a large break LOCA event at full power (Refs. 3 and 4). This event establishes the requirement for runout flow for the ECCS pumps, as well as the maximum response time for their actuation. The centrifugal charging pumps and SI pumps are credited in a small break LOCA event. This event establishes the flow and discharge head at the design point for the centrifugal charging pumps. The SGTR and MSLB events also credit the centrifugal charging pumps. The OPERABILITY requirements for the ECCS are based on the following LOCA analysis assumptions:

a.

A large break LOCA event, with or without loss of offsite power and with a single failure disabling one ECCS train (in the containment pressure analysis, both EDG trains are conservatively assumed to operate due to requirements for modeling full active containment heat removal system operation); and

b.

A small break LOCA event, with a loss of offsite power and a single failure disabling one ECCS train.

During the blowdown stage of a LOCA, the RCS depressurizes as primary coolant is ejected through the break into the containment. The nuclear reaction is terminated either by moderator voiding during large breaks or control rod insertion for small breaks. Following depressurization, emergency cooling water is injected into the cold legs, flows into the downcomer, fills the lower plenum, and refloods the core.

The effects on containment mass and energy releases are accounted for in appropriate analyses (Refs. 3 and 4). The LCO ensures that an ECCS train will deliver sufficient water to match boil off rates soon enough to minimize the consequences of the core being uncovered following a large LOCA. It also ensures that the centrifugal charging and SI pumps will deliver sufficient water and boron during a small LOCA to maintain core subcriticality. For smaller LOCAs, the centrifugal charging pump delivers sufficient fluid to maintain RCS inventory. For a small break LOCA, the steam generators continue to serve as the heat sink, providing part of the required core cooling.

The ECCS trains satisfy Criterion 3 of the NRC Policy Statement.

LCO In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-13 (developmental)

A LCO (continued)

In MODES 1, 2, and 3, two independent (and redundant) ECCS trains are required to ensure that sufficient ECCS flow is available, assuming a single failure affecting either train. Additionally, individual components within the ECCS trains may be called upon to mitigate the consequences of other transients and accidents.

In MODES 1, 2, and 3, an ECCS train consists of a centrifugal charging subsystem, an SI subsystem, and an RHR subsystem. Each train includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST upon an SI signal and automatically transferring suction to the containment sump.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via the ECCS pumps and their respective supply headers to each of the four cold leg injection nozzles. In the long term, this flow path may be switched to take its supply from the containment sump and to supply its flow to the RCS hot and cold legs.

The flow path for each train must maintain its designed independence to ensure that no single failure can disable both ECCS trains.

As indicated in Note 1, the SI flow paths may be isolated for 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in MODE 3, under controlled conditions, to perform pressure isolation valve testing per SR 3.4.14.1. The flow path is readily restorable from the control room. As indicated in Note 2, operation in MODE 3 with safety injection pumps and charging pumps made incapable of injecting in order to facilitate entry into or exit from the Applicability of LCO 3.4.12, Cold Overpressure Mitigation System (COMS) is necessary with a COMS arming temperature at or near the MODE 3 boundary temperature of 350°F. LCO 3.4.12 requires that certain pumps be rendered incapable of injecting at and below the COMS arming temperature. When this temperature is at or near the MODE 3 boundary temperature, time is needed to make pumps incapable of injecting prior to entering the COMS Applicability, and provide time to restore the inoperable pumps to OPERABLE status on exiting the COMS Applicability.

APPLICABILITY In MODES 1, 2, and 3, the ECCS OPERABILITY requirements for the limiting Design Basis Accident, a large break LOCA, are based on full power operation. Although reduced power would not require the same level of performance, the accident analysis does not provide for reduced cooling requirements in the lower MODES. The centrifugal charging pump performance is based on a small break LOCA, which establishes the pump performance curve and has less dependence on power. The

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-14 (developmental)

A APPLICABILITY (continued)

SI pump performance requirements are based on a small break LOCA.

MODE 2 and MODE 3 requirements are bounded by the MODE 1 analysis.

This LCO is only applicable in MODE 3 and above. Below MODE 3, the SI signal setpoint is manually bypassed by operator control, and system functional requirements are relaxed as described in LCO 3.5.3, "ECCS - Shutdown."

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -

MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."

ACTIONS A.1 With one or more trains inoperable and at least 100% of the ECCS flow equivalent to a single OPERABLE ECCS train available, the inoperable components must be returned to OPERABLE status within 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />. The 72-hour Completion Time is based on an NRC reliability evaluation (Ref. 5) and is a reasonable time for repair of many ECCS components.

An ECCS train is inoperable if it is not capable of delivering design flow to the RCS. Individual components are inoperable if they are not capable of performing their design function or supporting systems are not available.

The LCO requires the OPERABILITY of a number of independent subsystems. Due to the redundancy of trains and the diversity of subsystems, the inoperability of one component in a train does not render the ECCS incapable of performing its function. Neither does the inoperability of two different components, each in a different train, necessarily result in a loss of function for the ECCS. The intent of this Condition is to maintain a combination of equipment such that 100% of the ECCS flow equivalent to a single OPERABLE ECCS train remains available. This allows increased flexibility in plant operations under circumstances when components in opposite trains are inoperable.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-15 (developmental)

A ACTIONS A.1 (continued)

An event accompanied by a loss of offsite power and the failure of an EDG can disable one ECCS train until power is restored. A reliability analysis (Ref. 5) has shown that the impact of having one full ECCS train inoperable is sufficiently small to justify continued operation for 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

Reference 6 describes situations in which one component, such as an RHR crossover valve, can disable both ECCS trains. With one or more component(s) inoperable such that 100% of the flow equivalent to a single OPERABLE ECCS train is not available, the facility is in a condition outside the accident analysis. Therefore, LCO 3.0.3 must be immediately entered.

B.1 and B.2 If the inoperable trains cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3.5.2.1 Verification of proper valve position ensures that the flow path from the ECCS pumps to the RCS is maintained. Misalignment of these valves could render both ECCS trains inoperable. Securing these valves in position by removal of power or by key locking the control in the correct position ensures that they cannot change position as a result of an active failure or be inadvertently misaligned. These valves are of the type, described in Reference 6, that can disable the function of both ECCS trains and invalidate the accident analyses. A 12-hour Frequency is considered reasonable in view of other administrative controls that will ensure a mispositioned valve is unlikely.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-16 (developmental)

A SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.2.2 Verifying the correct alignment for manual, power operated, and automatic valves in the ECCS flow paths provides assurance that the proper flow paths exist for ECCS operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these were verified to be in the correct position prior to locking, sealing, or securing. A valve that receives an actuation signal is allowed to be in a non-accident position provided the valve will automatically reposition within the proper stroke time. This Surveillance does not require any testing or valve manipulation. Rather, it involves verification that those valves capable of being mis-positioned are in the correct position. The 31-day Frequency is appropriate because the valves are operated under administrative control, and an improper valve position would only affect a single train. This Frequency has been shown to be acceptable through operating experience.

SR 3.5.2.3 With the exception of the operating centrifugal charging pump, the ECCS pumps are normally in a standby, non-operating mode. As such, flow path piping has the potential to develop voids and pockets of entrained gases. Maintaining the piping from the ECCS pumps to the RCS full of water by venting the ECCS pump casings and accessible suction and discharge piping high points ensures that the system will perform properly, injecting its full capacity into the RCS upon demand.* This will also prevent water hammer, pump cavitation, and pumping of non-condensible gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an SI signal or during shutdown cooling. The 31-day Frequency takes into consideration the gradual nature of gas accumulation in the ECCS piping and the procedural controls governing system operation.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-17 (developmental)

A SURVEILLANCE REQUIREMENTS SR 3.5.2.3 (continued)

• For the accessible locations, UT may be substituted to demonstrate the piping is full of water. An accessible ECCS high point is defined as one that:

1) Has a vent connection installed.

2) The high point can be vented with the dose received remaining within ALARA expectations. ALARA for venting ECCS high point vents is considered to not be within ALARA expectations when the planned, intended collective dose for the activity is unjustifiably higher than industry norm, or the licensees past experience, for this (or similar) work activity.

3) The high point can be vented with industrial safety expectations remaining within the industry norm.

SR 3.5.2.4 Periodic surveillance testing of ECCS pumps to detect gross degradation caused by impeller structural damage or other hydraulic component problems is required by the American Society of Mechanical Engineers (ASME) OM Code. This type of testing may be accomplished by measuring the pump developed head at only one point of the pump characteristic curve. This verifies both that the measured performance is within an acceptable tolerance of the original pumps baseline performance and that the performance at the test flow is greater than or equal to the performance assumed in the plant safety analysis. SRs are specified in the Inservice Testing Program, which encompasses the ASME OM Code. The ASME OM Code provides the activities and Frequencies necessary to satisfy the requirements.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-18 (developmental)

A SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.2.5 and 3.5.2.6 These Surveillances demonstrate that each automatic ECCS valve actuates to the required position on an actual or simulated SI signal and that each ECCS pump starts on receipt of an actual or simulated SI signal. This Surveillance is not required for valves that are locked, sealed, or otherwise secured in the required position under administrative control. The 18-month Frequency is based on the need to perform these Surveillances under the conditions that apply during a plant outage and the potential for unplanned plant transients if the Surveillances were performed with the reactor at power. The 18-month Frequency is also acceptable based on consideration of the design reliability (and confirming operating experience) of the equipment. The actuation logic is tested as part of ESF Actuation System testing, and equipment performance is monitored as part of the Inservice Testing Program.

SR 3.5.2.7 Realignment of valves in the flow path on an SI signal is necessary for proper ECCS performance. These valves are secured in a throttled position for restricted flow to a ruptured cold leg, ensuring that the other cold legs receive at least the required minimum flow. The 18-month Frequency is based on the same reasons as those stated in SR 3.5.2.5 and SR 3.5.2.6.

SR 3.5.2.8 Periodic inspections of the containment sump suction inlet ensure that it is unrestricted and stays in proper operating condition. The advanced sump strainer design installed at WBN incorporates both the trash rack function and the screen function. Inspection of the advanced strainer constitutes fulfillment of the trash rack/screen inspection. The 18-month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage, on the need to have access to the location, and because of the potential for an unplanned transient if the Surveillance were performed with the reactor at power. This Frequency has been found to be sufficient to detect abnormal degradation and is confirmed by operating experience.

ECCS - Operating B 3.5.2 BASES (continued)

Watts Bar - Unit 2 B 3.5-19 (developmental)

A REFERENCES

1.

Title 10, Code of Federal Regulations, Part 50, Appendix A, General Design Criterion 35, "Emergency Core Cooling System."

2.

Title 10, Code of Federal Regulations, Part 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Plant."

3.

Watts Bar FSAR, Section 6.3, "Emergency Core Cooling System."

4.

FSAR Bar FSAR, Section 15.0, "Accident Analysis."

5.

NRC Memorandum to V. Stello, Jr., from R. L. Baer, "Recommended Interim Revisions to LCOs for ECCS Components," December 1, 1975.

6.

IE Information Notice No. 87-01, "RHR Valve Misalignment Causes Degradation of ECCS in PWRs," January 6, 1987.

ECCS - Shutdown B 3.5.3 (continued)

Watts Bar - Unit 2 B 3.5-20 (developmental)

A B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.3 ECCS - Shutdown BASES BACKGROUND The Background section for Bases 3.5.2, "ECCS - Operating," is applicable to these Bases, with the following modifications.

In MODE 4, the required ECCS train consists of two separate subsystems: the high head centrifugal charging subsystem for injection and recirculation and the low head residual heat removal (RHR) subsystem for recirculation.

The ECCS flow paths consist of 1) piping, valves, heat exchangers, and pumps such that water from the refueling water storage tank (RWST) can be injected via the charging pump into the Reactor Coolant System (RCS) following the accidents described in Bases 3.5.2; and 2) piping, valves, heat exchangers, and pumps such that water from the containment sump can be recirculated to the RCS from the RHR and charging subsystems.

APPLICABLE SAFETY ANALYSES The Applicable Safety Analyses section of Bases 3.5.2 also applies to this Bases section with the following modifications.

Due to the stable conditions associated with operation in MODE 4 and the reduced probability of occurrence of a Design Basis Accident (DBA), the ECCS operational requirements are reduced. It is understood in these reductions that certain automatic safety injection (SI) actuation is not available. In this MODE, sufficient time exists for manual actuation of the required ECCS to mitigate the consequences of a DBA.

Only one train of ECCS is required for MODE 4. This requirement dictates that single failures are not considered during this MODE of operation. The ECCS trains satisfy Criterion 3 of the NRC Policy Statement.

ECCS - Shutdown B 3.5.3 BASES (continued)

(continued)

Watts Bar - Unit 2 B 3.5-21 (developmental)

A LCO In MODE 4, one of the two independent (and redundant) ECCS trains is required to be OPERABLE to ensure that sufficient ECCS flow is available to the core following a DBA.

In MODE 4, an ECCS train consists of a centrifugal charging subsystem and an RHR subsystem. Each centrifugal charging subsystem includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the RWST and transferring suction to the discharge of the RHR subsystem. Each RHR subsystem includes the piping, instruments, and controls to ensure an OPERABLE flow path capable of taking suction from the containment sump and recirculating to the RCS.

During an event requiring ECCS actuation, a flow path is required to provide an abundant supply of water from the RWST to the RCS via a charging pump and its respective supply header. In the long term, the flow path may be switched to take its supply from the containment sump and provide recirculation flow to the RCS.

APPLICABILITY In MODES 1, 2, and 3, the OPERABILITY requirements for the ECCS are covered by LCO 3.5.2.

In MODE 4, one OPERABLE ECCS train is acceptable without single failure consideration, on the basis of the stable reactivity of the reactor and the limited core cooling requirements.

In MODES 5 and 6, plant conditions are such that the probability of an event requiring ECCS injection is extremely low. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, "RCS Loops -

MODE 5, Loops Filled," and LCO 3.4.8, "RCS Loops - MODE 5, Loops Not Filled." MODE 6 core cooling requirements are addressed by LCO 3.9.5, "Residual Heat Removal (RHR) and Coolant Circulation - High Water Level," and LCO 3.9.6, "Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level."

ECCS - Shutdown B 3.5.3 BASES (continued)

(continued)

Watts Bar - Unit 2 B 3.5-22 (developmental)

B ACTIONS A Note prohibits the application of LCO 3.0.4.b to an inoperable ECCS high head subsystem when entering MODE 4. There is an increased risk associated with entering MODE 4 from MODE 5 with an inoperable ECCS high head subsystem and the provisions of LCO 3.0.4.b, which allow entry into a MODE or other specified condition in the Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, should not be applied in this circumstance.

A.1 With no ECCS RHR subsystem OPERABLE, the plant is not prepared to respond to a loss of coolant accident. The Completion Time of immediately to initiate actions that would restore at least one ECCS RHR subsystem to OPERABLE status ensures that prompt action is taken to restore the required recirculation cooling capacity. Normally, in MODE 4, reactor decay heat is removed from the RCS by an RHR loop. If no RHR loop is OPERABLE for this function, reactor decay heat must be removed by some alternate method, such as use of the steam generators. The alternate means of heat removal must continue until the inoperable RHR loop components can be restored to operation so that decay heat removal is continuous.

With both RHR pumps and heat exchangers inoperable for decay heat removal, it would be unwise to require the plant to go to MODE 5, where the only available heat removal system is the RHR. Therefore, the appropriate action is to initiate measures to restore one ECCS RHR subsystem and to continue the actions until the subsystem is restored to OPERABLE status.

The Note allows the required ECCS RHR subsystem to be inoperable due to surveillance testing of RCS Pressure Isolation Valve leakage (2FCV-74-2 and 2FCV-74-8). This allows testing while the RCS pressure is high enough to obtain valid leakage data and following valve closure for the RHR decay heat removal path. The condition requiring alternate heat removal methods ensures that the RCS heatup rate can be controlled to prevent Mode 3 entry and thereby ensure that the reduced ECCS operational requirements are maintained. The condition requiring manual realignment capability from the main control room ensures that in the unlikely event of a Design Basis Accident during the 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> of Surveillance testing, the RHR subsystem can be placed in ECCS recirculation mode when required to mitigate the event.

ECCS - Shutdown B 3.5.3 BASES Watts Bar - Unit 2 B 3.5-23 (developmental)

A ACTIONS (continued)

B.1 With no ECCS centrifugal charging subsystem OPERABLE, due to the inoperability of the centrifugal charging pump or flow path from the RWST, the plant is not prepared to provide high pressure response to Design Basis Events requiring SI. The 1-hour Completion Time to restore at least one ECCS centrifugal charging subsystem to OPERABLE status ensures that prompt action is taken to provide the required cooling capacity or to initiate actions to place the plant in MODE 5, where an ECCS train is not required.

C.1 When the Required Actions of Condition B cannot be completed within the required Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status the plant must be brought to MODE 5 within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The allowed Completion Time is reasonable, based on operating experience, to reach the required plant condition in an orderly manner and without challenging plant systems or operators.

SURVEILLANCE REQUIREMENTS SR 3.5.3.1 The applicable Surveillance descriptions from Bases 3.5.2 apply. This SR is modified by a Note that allows an RHR train to be considered OPERABLE during alignment and operation for decay heat removal, if capable of being manually realigned (remote or local) to the ECCS mode of operation and not otherwise inoperable. This allows operation in the RHR mode during MODE 4, if necessary.

REFERENCES The applicable references from Bases 3.5.2 apply.

RWST B 3.5.4 (continued)

Watts Bar - Unit 2 B 3.5-24 (developmental)

A B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.4 Refueling Water Storage Tank (RWST)

BASES BACKGROUND The RWST supplies borated water to the Chemical and Volume Control System (CVCS) during abnormal operating conditions, to the refueling pool during refueling, and to the ECCS and the Containment Spray System during accident conditions.

The RWST supplies both trains of the ECCS and the Containment Spray System through a common supply header during the injection phase of a loss of coolant accident (LOCA) recovery. Motor operated isolation valves are provided to isolate the RWST from the ECCS once the system has been transferred to the recirculation mode. The recirculation mode is entered when pump suction is transferred to the containment sump following receipt of the RWST-Low coincident with Containment Sump Level-High signal. Use of a single RWST to supply both trains of the ECCS and Containment Spray System is acceptable since the RWST is a passive component, and passive failures are not required to be assumed to occur coincidentally with Design Basis Events until after transfer to the recirculation mode.

The switchover from normal operation to the injection phase of ECCS operation requires changing centrifugal charging pump suction from the CVCS volume control tank (VCT) to the RWST through the use of isolation valves. Each set of isolation valves is interlocked so that the VCT isolation valves will begin to close once the RWST isolation valves are fully open. Since the VCT is under pressure, the preferred pump suction will be from the VCT until the tank is isolated. This will result in a delay in obtaining the RWST borated water. The effects of this delay are discussed in the Applicable Safety Analyses section of these Bases.

During normal operation in MODES 1, 2, and 3, the safety injection (SI) and residual heat removal (RHR) pumps are aligned to take suction from the RWST.

The ECCS and Containment Spray System pumps are provided with recirculation lines that ensure each pump can maintain minimum flow requirements when operating at or near shutoff head conditions.

RWST B 3.5.4 BASES (continued)

Watts Bar - Unit 2 B 3.5-25 (developmental)

A BACKGROUND (continued)

When the suction for the ECCS and Containment Spray System pumps is transferred to the containment sump, the RWST flow paths must be isolated to prevent a release of the containment sump contents to the RWST, which could result in a release of contaminants to the atmosphere and the eventual loss of suction head for the ECCS pumps.

This LCO ensures that:

a.

The RWST contains sufficient borated water to support the ECCS during the injection phase;

b.

Sufficient water volume exists in the containment sump to support continued operation of the ECCS and Containment Spray System pumps at the time of transfer to the recirculation mode of cooling; and

c.

The reactor remains subcritical following a LOCA.

Insufficient water in the RWST could result in insufficient cooling capacity when the transfer to the recirculation mode occurs. Improper boron concentrations could result in a reduction of SDM or excessive boric acid precipitation in the core following the LOCA, as well as excessive caustic stress corrosion of mechanical components and systems inside the containment.

APPLICABLE SAFETY ANALYSES During accident conditions, the RWST provides a source of borated water to the ECCS and Containment Spray System pumps. As such, it provides containment cooling and depressurization, core cooling, and replacement inventory and is a source of negative reactivity for reactor shutdown (Ref. 1). The design basis transients and applicable safety analyses concerning each of these systems are discussed in the Applicable Safety Analyses section of B 3.5.2, ECCS - Operating; B 3.5.3, ECCS -

Shutdown; and B 3.6.6, Containment Spray System. These analyses are used to assess changes to the RWST in order to evaluate their effects in relation to the acceptance limits in the analyses.

RWST B 3.5.4 BASES (continued)

Watts Bar - Unit 2 B 3.5-26 (developmental)

A APPLICABLE SAFETY ANALYSES (continued)

The RWST must also meet volume, boron concentration, and temperature requirements for non-LOCA events. The volume is not an explicit assumption in non-LOCA events since the required volume is a small fraction of the available volume. The deliverable volume limit is set by the LOCA and containment analyses. For the RWST, the deliverable volume is different from the total volume contained since, due to the design of the tank, more water can be contained than can be delivered.

The minimum boron concentration is an explicit assumption in the main steam line break (MSLB) analysis to ensure the required shutdown capability. The maximum boron concentration is an explicit assumption in the inadvertent ECCS actuation analysis, although it is typically a non-limiting event and the results are very insensitive to boron concentrations. The maximum temperature ensures that the amount of cooling provided from the RWST during the heatup phase of a feedline break is consistent with safety analysis assumptions; the minimum is an assumption in both the MSLB and inadvertent ECCS actuation analyses, although the inadvertent ECCS actuation event is typically non-limiting.

The MSLB analysis has considered a delay associated with the interlock between the VCT and RWST isolation valves, and the results show that the departure from nucleate boiling design basis is met. The delay has been established as 27 seconds, with offsite power available, or 37 seconds without offsite power.

For a large break LOCA Analysis, the minimum water volume limit of 370,000 gallons and the minimum boron concentration limit are used to compute the post LOCA sump boron concentration necessary to assure subcriticality. This minimum value was chosen to be consistent with the minimum value specified for Unit 1. The large break LOCA is the limiting case since the safety analysis assumes least negative reactivity insertion.

The upper limit on boron concentration of 3300 ppm is used to determine the maximum allowable time to switch to hot leg recirculation following a LOCA. The purpose of switching from cold leg to hot leg injection is to avoid boron precipitation in the core following the accident.

RWST B 3.5.4 BASES (continued)

Watts Bar - Unit 2 B 3.5-27 (developmental)

A APPLICABLE SAFETY ANALYSES (continued)

In the ECCS analysis, the containment spray temperature is assumed to be equal to the RWST lower temperature limit of 60°F. If the lower temperature limit is violated, the containment spray further reduces containment pressure, which decreases the rate at which steam can be vented out the break and increases peak clad temperature. The acceptable temperature range of 60°F to 105°F is assumed in the large break LOCA analysis, and the small break analysis value bounds the upper temperature limit of 105°F. The upper temperature limit of 105°F is also used in the containment OPERABILITY analysis. Exceeding the upper temperature limit will result in a higher peak clad temperature, because there is less heat transfer from the core to the injected water following a LOCA and higher containment pressures due to reduced containment spray cooling capacity. For the containment response following an MSLB, the lower limit on boron concentration and the upper limit on RWST water temperature are used to maximize the total energy release to containment.

The RWST satisfies Criterion 3 of the NRC Policy Statement.

LCO The RWST ensures that an adequate supply of borated water is available to cool and depressurize the containment in the event of a Design Basis Accident (DBA), to cool and cover the core in the event of a LOCA, to maintain the reactor subcritical following a DBA, and to ensure adequate level in the containment sump to support ECCS and Containment Spray System pump operation in the recirculation mode.

To be considered OPERABLE, the RWST must meet the water volume, boron concentration, and temperature limits established in the SRs.

RWST B 3.5.4 BASES (continued)

(continued)

Watts Bar - Unit 2 B 3.5-28 (developmental)

A APPLICABILITY In MODES 1, 2, 3, and 4, RWST OPERABILITY requirements are dictated by ECCS and Containment Spray System OPERABILITY requirements. Since both the ECCS and the Containment Spray System must be OPERABLE in MODES 1, 2, 3, and 4, the RWST must also be OPERABLE to support their operation. Core cooling requirements in MODE 5 are addressed by LCO 3.4.7, RCS Loops - MODE 5, Loops Filled, and LCO 3.4.8, RCS Loops - MODE 5, Loops Not Filled.

MODE 6 core cooling requirements are addressed by LCO 3.9.5, Residual Heat Removal (RHR) and Coolant Circulation - High Water Level, and LCO 3.9.6, Residual Heat Removal (RHR) and Coolant Circulation - Low Water Level.

ACTIONS A.1 With RWST boron concentration or borated water temperature not within limits, they must be returned to within limits within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. Under these conditions neither the ECCS nor the Containment Spray System can perform its design function. Therefore, prompt action must be taken to restore the tank to OPERABLE condition. The 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> limit to restore the RWST temperature or boron concentration to within limits was developed considering the time required to change either the boron concentration or temperature and the fact that the contents of the tank are still available for injection.

B.1 With the RWST inoperable for reasons other than Condition A (e.g., water volume), it must be restored to OPERABLE status within 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.

In this Condition, neither the ECCS nor the Containment Spray System can perform its design function. Therefore, prompt action must be taken to restore the tank to OPERABLE status or to place the plant in a MODE in which the RWST is not required. The short time limit of 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> to restore the RWST to OPERABLE status is based on this condition simultaneously affecting redundant trains.

RWST B 3.5.4 BASES (continued)

Watts Bar - Unit 2 B 3.5-29 (developmental)

B ACTIONS (continued)

C.1 and C.2 If the RWST cannot be returned to OPERABLE status within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 5 within 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3.5.4.1 The RWST borated water temperature should be verified every 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to be within the limits assumed in the accident analyses band. The specified temperature range is 60°F and 105°F and does not account for instrument error. The 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> Frequency is sufficient to identify a temperature change that would approach either limit and has been shown to be acceptable through operating experience.

The SR is modified by a Note that eliminates the requirement to perform this Surveillance when ambient air temperatures are within the operating limits of the RWST. With ambient air temperatures within the band, the RWST temperature should not exceed the limits.

SR 3.5.4.2 The required minimum RWST water level is 370,000 gallons (value does not account for instrument error). Verification every 7 days of the presence of this water volume ensures that a sufficient initial supply of water is available for injection and to support continued ECCS and Containment Spray System pump operation on recirculation. Since the RWST volume is normally stable and is protected by an alarm, a 7 day Frequency is appropriate and has been shown to be acceptable through operating experience.

RWST B 3.5.4 BASES Watts Bar - Unit 2 B 3.5-30 (developmental)

B SURVEILLANCE REQUIREMENTS (continued)

SR 3.5.4.3 The boron concentration of the RWST should be verified every 7 days to be within the required limits. This SR ensures that the reactor will remain subcritical following a LOCA. Further, it assures that the resulting sump pH will be maintained in an acceptable range so that boron precipitation in the core will not occur and the effect of chloride and caustic stress corrosion on mechanical systems and components will be minimized. Since the RWST volume is normally stable, a 7 day sampling Frequency to verify boron concentration is appropriate and has been shown to be acceptable through operating experience.

REFERENCES

1.

Watts Bar FSAR, Section 6.3, Emergency Core Cooling System, and Section 15.0, Accident Analysis.

Seal Injection Flow B 3.5.5 (continued)

Watts Bar - Unit 2 B 3.5-31 (developmental)

A B 3.5 EMERGENCY CORE COOLING SYSTEMS (ECCS)

B 3.5.5 Seal Injection Flow BASES BACKGROUND The function of the seal injection throttle valves during an accident is similar to the function of the ECCS throttle valves in that each restricts flow from the charging pump header to the Reactor Coolant System (RCS).

The restriction on reactor coolant pump (RCP) seal injection flow limits the amount of ECCS flow that would be diverted from the injection path following an accident. This limit is based on safety analysis assumptions that are required because RCP seal injection flow is not isolated during SI.

APPLICABLE SAFETY ANALYSES All ECCS subsystems are taken credit for in the large break loss of coolant accident (LOCA) at full power (Ref. 1). The LOCA analysis establishes the minimum flow for the ECCS pumps. The centrifugal charging pumps are also credited in the small break LOCA analysis. This analysis establishes the flow and discharge head at the design point for the centrifugal charging pumps. The steam generator tube rupture and main steam line break event analyses also credit the centrifugal charging pumps, but are not limiting in their design. Reference to these analyses is made in assessing changes to the Seal Injection System for evaluation of their effects in relation to the acceptance limits in these analyses.

This LCO ensures that seal injection flow of 40 gpm, with charging pump discharge header pressure 2430 psig and pressurizer level control valve full open, will be sufficient for RCP seal integrity but limited so that the ECCS trains will be capable of delivering sufficient water to match boiloff rates soon enough to minimize uncovering of the core following a large LOCA. It also ensures that the centrifugal charging pumps will deliver sufficient water for a small LOCA and sufficient boron to maintain the core subcritical. For smaller LOCAs, the charging pumps alone deliver sufficient fluid to overcome the loss and maintain RCS inventory.

Seal injection flow satisfies Criterion 2 of the NRC Policy Statement.

Seal Injection Flow B 3.5.5 BASES (continued)

(continued)

Watts Bar - Unit 2 B 3.5-32 (developmental)

A LCO The intent of the LCO limit on seal injection flow is to make sure that flow through the RCP seal water injection line is low enough to ensure that sufficient centrifugal charging pump injection flow is directed to the RCS via the injection points (Ref. 2).

The LCO is not strictly a flow limit, but rather a flow limit based on a flow line resistance. In order to establish the proper flow line resistance, a pressure and flow must be known. The flow line resistance is determined by assuming that the RCS pressure is at normal operating pressure and that the charging pump discharge pressure is greater than or equal to the value specified in this LCO. The charging pump discharge header pressure remains essentially constant through all the applicable MODES of this LCO. A reduction in RCS pressure would result in more flow being diverted to the RCP seal injection line than at normal operating pressure.

The valve settings established at the prescribed charging pump discharge header pressure result in a conservative valve position should RCS pressure decrease. The additional modifier of this LCO, the pressurizer level control valve being full open, is required since the valve is designed to fail open for the accident condition. With the discharge pressure and control valve position as specified by the LCO, a flow limit is established.

It is this flow limit that is used in the accident analyses.

The limit on seal injection flow, combined with the charging pump discharge header pressure limit and an open wide condition of the pressurizer level control valve, must be met to render the ECCS OPERABLE. If these conditions are not met, the ECCS flow will not be as assumed in the accident analyses.

APPLICABILITY In MODES 1, 2, and 3, the seal injection flow limit is dictated by ECCS flow requirements, which are specified for MODES 1, 2, 3, and 4. The seal injection flow limit is not applicable for MODE 4 and lower, however, because high seal injection flow is less critical as a result of the lower initial RCS pressure and decay heat removal requirements in these MODES. Therefore, RCP seal injection flow must be limited in MODES 1, 2, and 3 to ensure adequate ECCS performance.

Seal Injection Flow B 3.5.5 BASES (continued)

(continued)

Watts Bar - Unit 2 B 3.5-33 (developmental)

B ACTIONS A.1 With the seal injection flow exceeding its limit, the amount of charging flow available to the RCS may be reduced. Under this Condition, action must be taken to restore the flow to below its limit. The operator has 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from the time the flow is known to be above the limit to correctly position the manual valves and thus be in compliance with the accident analysis. The Completion Time minimizes the potential exposure of the plant to a LOCA with insufficient injection flow and provides a reasonable time to restore seal injection flow within limit. This time is conservative with respect to the Completion Times of other ECCS LCOs; it is based on operating experience and is sufficient for taking corrective actions by operations personnel.

B.1 and B.2 When the Required Actions cannot be completed within the required Completion Time, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> and to MODE 4 within 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br />. The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE REQUIREMENTS SR 3.5.5.1 Verification every 31 days that the manual seal injection throttle valves are adjusted to give a flow within the limit listed below ensures that proper manual seal injection throttle valve position, and hence, proper seal injection flow, is maintained:

40 gpm with charging pump discharge header pressure 2430 psig and the pressurizer level control valve full open (values do not account for instrument error).

The Frequency of 31 days is based on engineering judgment and is consistent with other ECCS valve Surveillance Frequencies. The Frequency has proven to be acceptable through operating experience.

Seal Injection Flow B 3.5.5 BASES Watts Bar - Unit 2 B 3.5-34 (developmental)

B SURVEILLANCE REQUIREMENTS SR 3.5.5.1 (continued)

As noted, the Surveillance is not required to be performed until 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> after the RCS pressure has stabilized within a +/- 20 psig range of normal operating pressure. The RCS pressure requirement is specified since this configuration will produce the required pressure conditions necessary to assure that the manual valves are set correctly. The exception is limited to 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> to ensure that the Surveillance is timely.

REFERENCES

1.

Watts Bar FSAR, Section 6.3, "Emergency Core Cooling System,"

and Section 15.0, "Accident Analysis."

2.

Title 10, Code of Federal Regulations, Part 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light-Water Nuclear Plants," 1974.