ML20093B083

Proposed TS-371 Bases Sections 3.5.A & 3.5.B Re Core Spray & Rhrs & 3.5.C Re RHR Svc Water & Emergency Equipment Cooling Water Sys

ML20093B083
Person / Time
Site:	Browns Ferry
Issue date:	10/02/1995
From:	TENNESSEE VALLEY AUTHORITY
To:
Shared Package
ML20093B048	List: ML20093B045 ML20093B083
References
NUDOCS 9510110219
Download: ML20093B083 (43)

Text

-. _ . . . . . -- . _ . - . - _ .

ENCLOSURE 1 TENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT (BFN)

UNITS 1, 2, AND 3 REVISION TO TECHNICAL SPECIFICATION (TS) BASES (TS-3 71)

DESCRIPTION AND REASON FOR THE CHANGES ,

I. DESCRIPTION OF THE CHANGES TVA is revising Units 1, 2, and 3 TS Bases Sections 3.5.A and 3.5.B, " Core Spray System (CSS) and Residual Heat Removal System (RHRS)," and 3.5.C, "RHR Service Water and Emergency Equipment Cooling Water Systems (EECWS)." This revision will clarify the existing note in TS 3.5.B.11 for the RHR system cross-connect capability and the proposed ,

note being added to TS 3.5.C.3 by TS-361 (submitted on June 2, 1995) for the standby coolant supply capability.

Additionally, a statement regarding the Low Pressure Coolant Injection (LPCI) subsystem cross-tie valve is being moved from Units 1, 2, and 3 TS Bases Section 3.5.C to TS Bases Section 3.5.B.

The specific changes are described below.

1. Unit 1 Bases Section 3.5.A and 3.5.B, page 3.5/4.5-27.

Add the following prior to the last paragraph:

Since the RHR system cross-connect capability provides added long term redundancy to the other emergency and containment cooling systems, a 5-hour time to establish flow path availability is allowed. This time limit does not reduce the other requirements associated with RHR system pump operability.

2. Unit 2 Bases Section 3.5.A and 3.5.B, page 3.5/4.5-25.

Add the following prior to the last paragraph:

Since the RHR system cross-connect capability provides added long term redundancy to the other emergency and containment cooling systems, a 5-hour time to establish flow path availability is allowed. This time limit does not reduce the '

I other requirements associated with RHR system pump operability.

l l

l 1

9510110219 951002 PDR ADOCK 05000259 P PDR

I

3. Unit 3 Bases Section 3.5.A and 3.5.B, page 3.5/4.5-28.

Add the following prior to the last paragraph:

Since the RHR system cross-connect capability provides added long term redundancy to the other emergency and containment cooling systems, a 5-hour time to establish flow path availability is allowed. This time limit does not reduce the other requirements associated with RHR system pump operability.

4. Unit 1 Bases Section 3.5.C, page 3.5/4.5-29.

Add the following prior to the second paragraph:

Since the standby coolant supply capability provides added long term redundancy to the other emergency and containment cooling systems, a 5-hour time to establish flow path availability is allowed. This time limit does not reduce the other requirements associated with RHRSW/EECW system pump operability.

5. Unit 2 Bases Section 3.5.C, page 3.5/4.5-27.

Add the following prior to the second paragraph:

Since the standby coolant supply capability provides added long term redundancy to the other emergency and containment cooling systems, a 5-hour time to establish flow path availability is allowed. This time limit does not reduce the other requirements associated with RHRSW/EECW j system pump operability. I

6. Unit 3 Bases Section 3.5.C, page 3.5/4.5-30.

Add the following prior to the second paragraph:

Since the standby coolant supply capability provides added long ters cedundancy to the other emergency and containmen:: cooling systems, a 5-hour time to establish flow path availability is allowed. This time limit does not reduce the other requirements associated with RHRSW/EECW system pump operability.

7. Unit 1 - Move the following sentence from Bases Section 3.5.C, page 3.5/4.5-29, second paragraph to El-2

I l

l Bases Section 3.5.A and 3.5.B, page 3.5/4.5-27, following paragraph 5:

Verification that the LPCI subsystem cross-tie j valve is closed and power to its operator is i disconnected ensures that each LPCI subsystem j remains independent and a failure of the flow  :

path in one subsystem will not affect the flow l path of the other LPCI subsystem. J 8 '. Unit 2 - Move the following sentence from Bases Section 3.5.C, page 3.5/4.5-27, second paragraph to Bases Section 3.5.A and 3.5.B, page 3.5/4.5-25, i l

following paragraph 5:

Verification that the LPCI subsystem cross-tie valve is closed and power to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI subsystem.

9. Unit 3 - Move the following sentence from Bases Section 3.5.C, page 3.5/4.5-30, second paragraph to Bases Section 3.5.A and 3.5.B, page 3.5/4.5-28, following paragraph 5:

Verification that the LPCI subsystem cross-tie valve is closed and power to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI subsystem.

II. REASON FOR THE CHANGES TVA is providing clarification in the TS Bases for notes (existing and proposed) associated with the RHR system cross-connect capability and the standby coolant supply capability. The notes state that the specified capability (cross-connect or standby coolant) is not considered inoperable if the capability can be restored to service within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The note associated with RHR system cross-connect capability is contained in TS 3.5.B.11. The note associated with standby coolant supply capability is being added to TS 3.5.C.3 by TS-361.

The clarification to the TS Bases states that this allowed inoperability time does not reduce the other existing TS requirements for the RHR system or RHRSW/EECW system pump operability. T,1ese notes were not intended to supersede other existing operability requirements; therefore, this addition to the Bases is not significant.

El-3

The statement regarding the LPCI subsystem cross-tie valve  !

was added as part of TS-256 (Unit 1 Amendment 169, Unit 2 '

l Amendment 169, and Unit 3 Amendment 140). This statement was added to support TS 4.5.B.1.g that was also added in  ;

TS-256. However, the TS Bases for Section 3.5.C was l revised instead of the appropriate TS Bases for Section 3.5.B.

l l

+

t El-4 i-

~ - - ' 4 - -

-'"-T - ew  %.- -

l ENCLOSURE 2 TENNESSEE VALLEY AUTHORITY BROWNS FERRY NUCLEAR PLANT (BFN) l UNITS 1, 2, AND 3 REVISION TO TECHNICAL SPECIFICATION (TS) BASES (TS-371)

MARKED PAGES 1

I. AFFECTED PAGE LIST Unit 1 Unit 2 Unit 3 3.5/4.5-27 3.5/4.5-25 3.5/4.5-28 3.5/4.5-29 3.5/4.5-27 3.5/4.5-30 II. MARKED PAGES See attached.

~ . - - - - - - - - - - - - - -

1

1

^f5 3 "ius(Cened) Al10 021989 f ' 1.Should one'.1tHR pump (containment cooling mode) .become inoperable, a l

' complement of three full capacity containment heat removal systems is still available. Any two of the remaining pumps / heat exchanger combinations would provide more than adequate containment cooling for any

- aabnormal-or postaccident situation. Because of the availability of 1

-equipment in excess of normal redundancy requirements, a 30-day repair l l l

period is justified.

)

l i Should two RER pumps (containment cooling mode) become inoperable, a full

] heat resoval system is still available. The remaining pump / heat j exchanger combinations would provide adequate containment cooling for any J

abnormal postaccident situation. Because of the availability of a full

complement of heat removal equipment, a 7-day repair period is justified.

4

! Obsern tion of the stated requirements for the containment cooling mode assures that the suppression pool and the drywell vill be sufficiently cooled, following a loss-of-coolant accident, to prevent primary

' containment overpressurization. The containment cooling function of the 4

j

'IERS is permitted only after the core has reflooded to the two-thirds core height level. This prevents inadvertently diverting water needed j for core flooding to the less urgent task of containment cooling. The f two-thirds core height level interlock may be manually bypassed by a 1

keylock switch. .

Since the RHRS is filled with low quality water during power operation, l it'is-planned that the system be filled with domineralized (condensate) j water before using the shutdown cooling function of the RER System. j Since it is desirable to have the RERS in service if a " pipe-break" type 1

of > accident should occur, it is permitted to be out of operation for only l

a restricted amount of time and when the system pressure is low. At

least one-half of the containment cooling function must remain CPERABLE

during this time period. Requiring two OPERABLE CSS pumps during

! cooldown allows for flushing the RERS even if the shutdown were caused by

, inability to meet the CSS specifications (3.5.A) on a number of OPERABLE j

Pumps.

g When the reactor vessel pressure is atmospheric, the limiting conditions pge for operation are less restrictive. At atmospheric pressure, the minimum PAC.C requirement is for one supply of makeup water to the core. Requiring two '

3,gN5M 'OPERAM2 RER pumps and one CSS pump provides redundancy to ensure makeup water availability.

I Should one RER pump or associated heat exchanger located on the unit  ;

) Meer :croen-connection -espability for in the adjacent unit become inoperable, an equal long-term fluid makeup to the reactor and for cooling of

A the containment remains OPERABLE. Because of the availability of an l equal makeup and cooling capability, a 30-day repair period is justified. l l

i I

t j

1 5

( BFN 3.5/4.5-27 1

? Unit 1 AMENDMENT NO.16 9 l:

l l I

, . _ _ ...a i

'^ ' ' * * " -e ,, ,,, ,. , . , _ . . _ ,

~ . . . . ... . - .

'3.5

B&3E1 (Cont'd)

MY05~m

.The RER Service Water System was designed as a shared system for three i units. The specification, as vricten, is conservative when consider-

}

ation is given to particular pumps being out of service and to possible a valving-arrangements. If unusual operating conditions arise such that more pumps are out of service than allowed by this specification, a

special case request may be made to the NRC to allow continued operation 5

MSN if the actual system cooling requirements can be assured.

i' 3 Should one of the two RERSW pumps normally or alternately assigned to l the RER heat ==h==er header supplying the standby coolant supply l

. connection become inoperable, an equal capability for long-term fluid makeup to the unit reactor and for cooling of the unit containment

' remains OPERABLE. Because of the availability of an equal makeup and

]j cooling capability, a 30-day repair period is justified. Should the i capability to provide standby coolant supply be lost, a 10-day repair i Etime is justified based on_the low probability for ever needing the on "

s_tandby coo _lant suppi g Verification that the LPCI subsystem cross-tie %C,C (valveisclosedandpowertoitsoperatorisdisconnectedensuresthat sach LPCI subsystem remains independent and a failure of the flow path k,f/y.

3 f.27 i 'in one subsystem will not affect the flow path of the other LPCI j (subsystem.f 2 With only one unit fueled, four RHRSW pumps are required to be OPERABLE 3

for indefinite operation to meet the requirements of $pecification i 3.5.B.1 (RHR system). If only three RHRSW pumps are OPERABLE, a 30-day l LCO exists because of the requirement of Specification 3.5.B.5 (RBR j system).

l .3.5.D Eauinment Area coolcrt l

There is an equipment area cooler for each RRR pump and an equipment i

area cooler for each set (two pumps, either the A and C or B and D j pumps) of core spray pumps. The equipment area coolers take auction l

near the cooling air discharge of'the motor of the pump (s) served and discharge air near the cooling air suction of the motor of the pues(s) served. This ensures that cool air is supplied for cooling the pur.p motors.

l The equipment area coolers also remove the pump, and equipment waste j heat from the basement rooms housing the engineered safeguard

equipment. The various conditions under which the operation of the i equipment air coolers is required have been identified by evaluating the

! normal and abnormal operating transients and accidents over the full l range of planned operations. The surveillance and testing of the ,

equipment area coolers in each of their various modes is accomplished during the testing of the equipment served by these coolers. This testing is adequate to assure the OPERABILITY of the equipment area

coolers.

l

. REFERENCES

1. Residual Heat Removal System (BFN TSAR Secti'on 4.8)

2. Core Standby Cooling System (BFN FSAR subsection 6.7)

N BFN 3.5/4.5-29 AMENOMENT NG.176 Unit 1 i

i

1 3.5 BASES'(Cent'd) E 02 M j Should one RER pump (containment cooling mode) become inoperable, a j complement of three full capacity containment heat removal systems is still available. Any two of the remaining pumps / heat exchanger

' combinations would provide more than adequate containment cooling for any j abnormal or postaccident situation. Because of the availability of l

equipment in excess of normal redundancy requirements, a 30-day repair

! period is justified. .

Should two RER pumps (containment cooling mode).become inoperable, a full heat removal system is still available. The remaining pump / heat l

sachanger' combinations would provide adequate containment cooling for any l

abnormal postaccident situation. Because of the availability of a full

complement of heat removal equipment, a 7-day repair period is justified.

Observation of the stated requirements'for the containment cooling mode assures that the supprettsion pool and the drywell will be sufficiently cooled, following a loss-of-coolant accident, to prevent primary 1

containment overpressurization. The containment cooling function of the I RERS is permitted only after the core has reflooded to the two-thirds core height level. This prevents inadvertently diverting water need3d

' for core flooding to the less urgent task of containment cooling. The two-thirds core height level interlock may be manually bypassed by a i keylock switch.

's Since the RERS is filled with low quality water during power operation, it is planned that the system be filled with domineralized (condensate)

L water before using the shutdown cooling function of the RER System.

' Since it is desirable to have the RHRS in service if a " pipe-break" type of accident should occur, it is permitted to be out of operation for only a restricted amount of time and when the system pressure is low. At i

least one-half of the containment cooling function must remain OPERABLE during this time period. Requiring two OPERABLE CSS pumps during cooldown allows for flushing the RERS even if the shutdown were caused by

inability to meet the CSS specifications (3.5.A) on a number of OPERABLE pumps.

i When the reactor vessel pressure is atmospheric, the limiting conditions

1,W# for operation are less restrictive. At atmospheric pressure, the minimum W" requirement is for one supply of makeup water to the core. Requiring two k, Tr'A M OPERABt.E RER pumps and one CSS pump provides redundancy to ensure makeup i Q /d+ 4W water availability.

- hould one RHR pump or associated heat exchanger located on the unit cross-connection in the adjacent unit become inoperable, an equal fe capability for long-term fluid makeup to the reactor and for cooling of i

~

-A the containment remains OPERABLE. Because of the availability of an equal makeup and cooling capability, a 30-day repair period is justified.

i t

BFN 3.5/4.5-25 AMEN 0 MENT NO.16 9 d Unit 2 r

i O6. t . A .

_v - - T ,r- w -

l 3.5 BASES (Cont'd)

I The RiiR Service Water System was designed as a shared system for three units. The specification, as written, is conservative when consider-j ation is given to particular pumps being out of service and to possible valving arrangements. If unusual operating conditions arise such that l

i more pumps are out of service than allowed by this specification, a '

special case request may be made to the NRC to allow continued operation if the actual system cooling requirements can be assured.

E Should one of the two RHRSW pumps normally or alternately assigned to the RHR heat exchanger header supplying the standby coolant supply connection become inoperable, an equal capability for long-term fluid i

. makeup to the unit reactor and for cooling of the unit containment remains OPERABLE.

Because of the availability of an equal makeup and cooling capability, a 30-day repair period is justified. Should the capability to provide standby coolant supply be lost, a 10-day repair fMove time is justified based on the low probability for ever needing the PAcr standby coolant supply j Verification that the LPCI subsysH E cross-tiel'rc Walve is closed and power to its operator is disconnected ensures that g/gg4 '

each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI u subsystem. f i

With only one unit fueled, four RHRSW pumps are required to be OPERABLE j

for indefinite operation to meet the requirements of Specification j 3.5.B.1 (RHR system). If only three RHRSW pumps are OPERABLE, a 30-day LCO exists because of the requirement of Specification 3.5.B.5 (RHR system).

3.5.D Eauia==nt Area Coolers There is an equipment area cooler for each RER pump and an equipment area cooler for each set (two pumps, either the A and C or B and D pumps) of core spray pumps. The equipment area coolers take auction oneer the cooling air discharge of the motor of the pump (s) served and

-discharge air near the cooling air suction of the motor of the pump (s)

. served. This ensures that cool air it supplied for cooling the pump motors.

The equipment area coolers also remove the pump, and equipment waste heat from the basement rooms housing the engineered safeguard (

equipment. The various conditions under which the operation of the equipment air coolers is required have been identified by evaluating the nors.nl and abnormal operating transients and accidents over the full range of planned operations. The surveillance and testing of the equipment area coolers in each of their various modes is accomplished ,

during the testing of the equipment served by these coolers. This testing is adequate to assure the OPERABILITY of the equipment area coolers.

REFERENCES

1. Residual Heat Removal System (BPN FSAR Section 4.8)

2. Core Standby Cooling System (BFN FSAR Section 6) 3yy 3.5/4.5-27 A33[)ggy g. 2 2 9 Unit 2

f 3.5 BAAEA (C:nt'd) @Qg

! 18hould one RER ptany (containment cooling mode) become inoperable, a complement of three full capacity containment heat removal systems is still available. Any two of the remaining ptanps/ heat exchanger J

! combinations would provide more than adequate containment cooling for 4

say abnormal or postaccident situation. Because of the availability of

{ equipment in excess of normal redundancy requirements, a 30-day repair f period is justified.

t j Should two RER pumps (containment cooling mode) become inoperable, a 1 full heat removal system is still available. The remainina ptaip/ heat l j exchanger combinations would provide adequate containment ecoling for 1 any abnormal postaccident situation. Because of the availability of a i full complement of heat removal equipment, a 7-day repair period is ,

j justified.

Observation of the stated requirements for the containment cooling mode assures that the suppression pool and the drywell will be sufficiently i cooled, following a loss-of-coolant accident, to prevent primary j containment overpressurization. The containment cooling function of j the RERS is permitted only after the core has reflooded to the j two-thirds core height level. This prevents inadvertently diverting

water needed for core flooding to the less urgent task of containment

' cooling. The two-thirds core height level interlock may be manually i bypassed by a keylock switch.

l Since the RERS is filled with low quality water during power operation, i it is planned that the system be filled with domineralized (condensate) water before using the shutdown cooling function of the RER System.

! Since it is desirable to have the RERS in service if a " pipe-break" j type of accident should-occur, it is permitted to be out of operation

! for only a restricted amount of time and when the system pressure is

! ' low. At least one-half of the containment cooling function must remain i 0FWWAnf2 during this time period. Requiring two OPERAnf2 CSS pumps

! during cooldown allows for f1=hing the RERS even if the shutdown were caused by inability to meet the CSS specifications (3.5.A) on a amaber l of '0FERABLE pumps.

l gy When the reactor vessel pressure is atmospheric, the limiting i

1

, ,, ,_ cdWm M nm&n an Ma mMnM. M am@nh pressure, the minimum requirement is for one supply of makeup water to vAce 3gp,5 So the core. Requiring two OPERABLE RHR pumps and one CSS ptanp provides redundancy to ensure makeup water availability.

j  %

j. Should one RHR pump or associated heat exchanger located on the unit M" cross-connection in the adjacent unit become inoperable, an equal A capability for long-term fluid makeup to the reactor and for cooling of ,

the containment remains OPERABLE. Because of the availability of an l equal makeup and cooling capability, a 30-day repair period is

justified.

F l BFN 3.5/4.5-28

! unit 3 AMENDMENT N0.14 0 g .

l l

l 3.5 BASES (Cont'd) DEC 0 71994 The RHR Service Water System was designed as a shared system for three units. The specification, as written, is conservative when consider-ation is given to particular pumps being out of service and to possible valving arrangements. If unusual operating conditions arise such that more pumps are out of service than allowed by this specification, a

" " . special case request may be made to the NRC to allow continued operation if the actual system cooling requirements can be assured.

B Should one of the two RHRSW pumps normally or alternately assigned to the RHR heat exchanger header supplying the standby coolant supply connection become inoperable, an equal capability for long-term fluid

' makeup to the unit reactor and for cooling of the unit containment /b V6 To remains OPERABLE.

Because of the availability of an equal makeup and N6 cooling capability, a 30-day repair period is justified. Should the 3,5/'/S-26 capability to provide standby coolant supply be lost, a 10-day repair time is justified based on_the low probability _for ever needing the standbycoolantsupplygVerificationthattheLPCIsubsystemcross-tie niilve is cI6sedWGower to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI Qubsyst y With only one unit fueled, four RHRSW pumps are required to be OPERABLE for indefinite operation to meet the requirements of Specification 3.5.B.1 (RHR system). If only three RHRSW pumps are OPERABLE, a 30-day LCO exists because of the requirement of Specification 3.5.B.5 (RHR system).

3.5.D Eauinment Area Coolers There is an equipment area cooler for each RHR pump and an equipment area cooler for each set (two pumps, either the A and C or B and D pumps) of core spray pumps. The equipment area coolers take suction near the cooling air discharge of the motor of the pump (s) served and discharge air near the cooling air suctica of the motor of the punp(s) served. This ensures that cool air is supplied for cooling the pump motors.

The equipment area coolers also remove the pump, and equipment waste heat from the basement rooms housing the engineered safeguard ffI equipment. The various conditions under which the operation of the equipment air coolers is required have been identified by evaluating the l normal and abnormal operating transients and accidents over the f ull range of planned operations. The surveillance and testing of the equipment area coolers in each of their various modes is accomplished during the testing of the equipment served by these coolers. This testing is adequate to assure the OPERABILITY of the equipment area coolers. ,

I' s

REFERENCES

1. Residual Heat Removal System (BFN FSAR Section 4.8)

2. Core Standby Cooling System (BFW FSAR Section 6) l BFN 3.5/4.5-30 AMENDMENT NO.18 6 Unit 3 .

INSERT A

.Since the RHR system cross-connect capability provides added long y term' redundancy to the other emergency and containment cooling I systems, a 5-hour time to establish flow path availability is  !

allowed. This time limit does not reduce the other requirements associated with RHR system pump operability.

1 l

)

I INSERT B I i

Since the standby coolant supply capability provides added long term redundancy to the other emergency and containment cooling systems, a 5-hour time to establish flow path availability is allowed. This time limit does not reduce the other requirements associated with RHRSW/EECW system pump operability.

I I

l

. l l

ENCLOSURE 3 TENNESSEE VALLEY AUTHORITY l BROWNS FERRY NUCLEAR PLANT (BFN) l

s. UNIT 8 1, 2, AND 3 REVISION TO TECHNICAL SPECIFICATION (TS) BASES (TS-371) l REVISED PAGES  !

I. AFFECTED PAGE LIST l Unit 1 Unit 2 Unit 3 3.5/4.5-27 3.5/4.5-25 3.5/4.5-28 3.5/4.5-28 3.5/4.5-26 3.5/4.5-29 3.5/4.5-29 3.5/4.5-27 3.5/4.5-30 3.5/4.5-30 3.5/4.5-28 3.5/4.5-31 1 3.5/4.5-31 3.5/4.5-29 3.5/4.5-32 3.5/4.5-32 3.5/4.5-30 3.5/4.5-33 3.5/4.5-33 3.5/4.5-31 3.5/4.5-34 3.5/4.5-34 3.5/4.5-32 3.5/4.5-35 3.5/4.5-35 3.5/4.5-33 3.5/4.5-36 3.5/4.5-36 3.5/4.5-34 3.5/4.5-37 l

II. REVISED PAGES  :

See attached.

l 1

l l

l I

l 1

l l

l l

l I

4 j .,

3.5 BAlfJ. (Cont'd). -

Should one RHR pump (containment cooling mode) become inoperable', a j complement of three full capacity containment heat removal systems is  !

i still available. 'Any two of the remaining pumps / heat exchanger 1 i

combinations would provide more than adequate containment cooling for any abnormal or postaccident situation. Because of the availability )

of equipment in excess of normal redundancy requirements, a 30-day I repair period is justified. l

] l Should two RHR pumps (containment cooling mode) become inoperable, a

full heat removal system is still available. The remaining pump / heat exchanger combinations would provide adequate containment cooling for any abnormal postaccident situation. Because of the availability of a full complement of heat removal equipment, a 7-day repair period is justified. l Observation of the stated requirements for the containment cooling j mode assures that the suppression pool and the drywell will be l

sufficiently cooled, following a loss-of-coolant. accident, to prevent i primary containment overpressurization. The containment cooling j function of the RHRS is permitted only after the core has reflooded to j the two-thirds core height level. This prevents inadvertently i diverting water needed for core flooding to the less urgent task of I

! containment cooling. The two-thirds core height level interlock may l be manually bypassed by a keylock switch. l i l Since the RHRS is filled with low quality water during power j operation, it is planned that the system be filled with demineralized j (condensate) water before using the shutdown cooling function of the

! RHR System. Since it is desirable to have the RHRS in service if a j " pipe-break" type of accident should occur, it is permitted to be out

~

of operation for only a restricted amount of time and when the system pressure is low. At least one-half of the containment cooling function must remain OPERABLE during this time period. Requiring two OPERABLE CSS pumps during cooldown allows for flushing the RHRS even l

if the shutdown were caused by inability to meet the CSS i specifications (3.5.A) on a number of OPERABLE pumps.

l When the reactor vessel pressure is atmospheric, the limiting 3 conditions for operation are less restrictive. At atmospheric

! pressure, the minimum requirement is for one supply of makeup water to j

, the core. Requiring two OPERABLE RHR pumps and one CSS pump provides l redundancy to ensure makeup water availability.

3 Verification that the LPCI subsystem cross-tie valve is closed and power to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem

, will not affect the flow path of the other LPCI subsystem.

Since the RHR system cross-connect capability provides added long term redundancy to the other emergency and containment cooling systems, a BFN 3.5/4.5-27 Unit 1 i

4 3.5 BASES (Cont'd). . .

1 5-hour time to establish flow path availability is allowed. This time i limit does not reduce the other requirements associated with RHR I system pump operability.

]' Should one RHR pump or associated heat exchanger located on the unit cross-connection in the adjacent unit become inoperable, an equal capability'for long-term fluid makeup to the reactor and for cooling i of the containment remains OPERABLE. Because of the availability of an equal makeup and cooling capability, a 30-day repair period is justified.

i The suppression chamber can be drained when the reactor vessel pressure is atmospheric, irradiated fuel is in the reactor vessel, and work is not in progress which has the' potential to drain the vessel.

By requiring the fuel pool gate to be open with the vessel head removed, the combined water inventory in the fuel pool, the reactor

cavity, and the separator / dryer pool, between the fuel pool low level alarm and the reactor vessel flange, is about 65,800 cubic feet (492,000 gallons). This will provide adequate low-pressure cooling in j lieu of CSS and RHR (LPCI and containment cooling mode) as currently required in Specifications 3.5.A.4 and 3.5.B.9. The additional requirements for providing standby coolant supply available will

ensure a redundant supply of coolant supply. Control rod drive

, maintenance may continue during this period provided no more than one drive is removed at a time unless blind flanges are installed during j the period of time CRDs are not in place.

Should the capability for providing flow through the cross-connect

lines be lost, a 10-day repair time is allowed before shutdown is required. This repair time is justified based on the very small probability for ever needing RHR pumps and heat exchangers to supply

an adjacent unit.

i REFERENCES

1. Residual Heat Removal System (BFNP FSAR subsection 4.8) l 2. Core Standby Cooling Systems (BFNP FSAR Section 6) 3.5.C. RHR Service Water System and Emergency Eauioment Coolina Water System (EECWS)

< The EECW has two completely redundant and independent headers (north j and south) in a loop arrangement inside and outside the Reactor Building. Four RHRSW pumps, two per header, (A3, B3, C3 and D3) are

! dedicated to automatically supplying the EECW system needs. Four l additional pumps (A1, B1, C1 and D1) can serve as RHRSW system pumps or be manually valved into the EECW system headers and serve as backup for the RHRSW pumps deciated to supplying the EECW system. Those

! components requiring EECW, except the control air compressors which BFN 3.5/4.5-28 Unit 1 l

+

- r ., w - . _. ,, ~ - - - 3 ,m n 7~ ~ e-_7,.

4 9

f 3.5 BASES (Cont'd). . .

are not safety related, are able to be fed from both headers thus

assuring continuity of operation if either header becomes inoperable.

4 The control air compressors only use the EECW north header as an emergency backup supply.

There are four RHR heat exchanger headers (A, B, C, & D) with one RHR

heat exchanger from each unit on each header. There are two RHRSW 4

pumps on each header; one normally assigned to each header (A2, B2, C2, or D2) and one on alternate assignment (A1, B1, C1, or D1). One RHR heat exchanger header can adequately deliver the flow supplied by 4 both RHRSW pumps to any two of the three RHR heat exchangers on the header. One RHRSW pump can supply the full flow requirement of one RHR heat exchanger. Two RHR heat exchangers can more than adequately

handle the cooling requirements of one unit in any abnormal or j postaccident situation.

i The RHR Service Water System was designed as a shared system for three j units. The specification, as written, is conservative when consider-

]

ation is given to particular pumps being out of service and to a possible valving arrangements. If unusual operating conditions arise i such that more pumps are out of service than allowed by this i specification, a special case request may be made to the NRC to allow i continued operation if the actual system cooling requirements can be i assured.  ;

4 Since the standby coolant supply capability provides added long term l redundancy to the other emergency and containment cooling systems, a j 5-hour time to establish flow path availability is allowed. This time i limit does not reduce the other requirements associated with l RHRSW/EECW system operability.

Should one of the two RHRSW pumps normally or alternately assigned to

' the RHR heat exchanger header supplying the standby coolant supply l

. connection become inoperable, an equal capability for long-term fluid i makeup to the unit reactor and for cooling of the unit containment remains OPERABLE. Because of the availability of an equal makeup and cooling capability, a 30-day repair period is justified. Should the capability to provide standby coolant supply be lost, a 10-day repair

! time is justified based on the low probability for ever needing the j standby coolant supply.

With only one unit fueled, four RHRSW pumps are required to be OPERABLE for indefinite operation to meet the requirements of Specification 3.5.B.1 (RHR system). If only three RHRSW pumps are OPERABLE, a 30-day LCO exists because of the requirement of i Specification 3.5.B.5 (RHR system).

3.5.D Eauipment Area Coolers l There is an equipment area cooler for each RHR pump and an equipment area cooler for each set (two pumps, either the A and C or B and D pumps) of core spray pumps. The equipment area coolers take auction l

i- BrN 3.5/4.5-29 Unit 1 i

1 l .

i 3.5 BASES.(Cont'd). . -

near the cooling air discharge of the motor of the pump (s) serve'd and j discharge air near the cooling air suction of the motor of the pump (s) i served. This ensures that cool air is supplied for cooling the pump motors.

{

The equipment area coolers also remove the pump, and equipment waste heat from the basement rooms housing the engineered safeguard equipment. The various conditions under which the operation of the

equipment air coolers is required have been identified by evaluating j the normal and abnormal operating transients and accidents over the

full range of planned operations. The surveillance and testing of the 3

equipment area coolers in each of their various modes is accomplished during the testing of the equipment served by these coolers. This i testine, is adequate to assure the OPERABILITY of the equipment area Coolers.

REFERENCES

1. Residual Heat Removal System (BFN FSAR Section 4.8)

2. Core Standby Cooling System (BFN FSAR subsection 6.7) 3.5.E. High Pressure Coolant Inlection System (HPCIS)

The HPCIS is provided to assure that the reactor core is adequately cooled to limit fuel clad temperature in the event of a small break in j the nuclear system and loss of coolant which does not result in rapid i

depressurization of the reactor vessel. The HPCI system permits the reactor to be shut down while maintaining sufficient reactor vessel water level inventory until the vessel is depressurized. The HPCIS

continues to operate until reactor vessel pressure is below the l pressure at which LPCI operation or Core Spray system operation i maintains core cooling. The capacity of the system is selected to ,

provide the required core cooling. The HPCI pump is designed to pump 5000 gpm at reactor pressures between 1120 and 150 psig. The HPCIS is 1 not required to be OPERABLE below 150 psig since this is well within  ;

the range of the low pressure cooling systems and below the pressure )

of any events for which HPCI is required to provide core cooling.  !

i l The minimum required NPSH for HPCI is 21 feet. There is adequate I elevation head between the suppression pool and the HPCI pump, such l l that the required NPSH is available with a suppression pool I temperature up to 140*F with no containment back pressure.

The HPCIS is not designed to operate at full capacity until reactor pressure exceeds 150 psig and the steam supply to the HPCI turbine is autor.atically isolated before reactor pressure decreases below 100 psig. The ADS, CSS, and RHRS (LPCI) must be OPERABLE when starting up from a COLD CONDITION. Steam pressure is sufficient at 150 psig to run the HPCI turbine for OPERABILITY testing yet, still below the shutoff head of the CSS and RHRS pumps so they will inject water into 1 i

BFN 3.5/4.5-30 l a

Unit 1 I

. . - ,, - . . , .e - - - - -

i

^

f- 3.5 BASES (Cont'd). - -

l

} the vessel if required. The ADS provides additional backup to reduce pressure to the range where the CSS and RHRS will inject into the l Vessel if necessary. Considering the low reactor pressure, the j redundancy and availability of CSS, RHRS, and ADS during startup from

, a COLD CONDITION, twelve hours is allowed as a reasonable time to i demonstrate HPCI OPERABILITY once sufficient steam pressure becomes

! available. The alternative to demonstrate HPCI OPERABILITY PRIOR TO

STARTUP using auxiliary steam is provided for plant operating i flexibility.

I j With the HPCIS inoperable, a seven-day period to return the system to service is justified based on the availability of the ADS, CSS, RHRS

, (LPCI) and the RCICS. The availability of these redundant and j diversified systems provides adequate assurance of core cooling while i HPCIS is out of service.

I The surveillance requirements, which are based on industry codes and

standards, provide adequate assurance that the HPCIS will be OPERABLE

[ when required.

3.5.F Reactor Core Isolation Coolina System (RCICS) t l The RCICS functions to provide makeup water to the reactor vessel l during shutdown and isolation from the main heat sink to supplement or

j. replace the normal makeup sources. The RCICS provides its design flow

] between 150 psig and 1120 psig reactor pressure. Below 150 psig,

RCICS is not required to be OPERABLE since this pressure is

substantially below that for any events in which RCICS is needed to maintain sufficient coolant to the reactor vessel. RCICS will

! continue to operate below 150 psig at reduced flow until it

automatically isolates at greater than or equal to 50 psig reactor steam pressure. 150 psig is also below the shutoff head of the CSS and RHRS, thus, considerable overlap exists with the cooling systems i that provide core cooling at low reactor pressure. The minimum

!~

required NPSH for RCIC is 20 feet. There is adequate elevation head between the suppression pool and the RCIC pump, such that the required NPSH is available with a suppression pool temperature up to 140*F with

! no containment back pressure.

1 The ADS, CSS, and RHRS (LPCI) must be OPERABLE when starting up from a i COLD CONDITION. Steam pressure is sufficient at 150 psig to run the i RCIC turbine for OPERABILITY testing, yet still below the shutoff head I

of the CSS and RHRS pumps so they will inject water into the vessel if required. Considering the low reactor pressure and the availability of the low pressure coolant systema during startup from a COLD CONDITION, twelve hours is allowed as a reasonable time to demonstrate i

RCIC OPERABILITY once sufficient steam pressure becomes available.

The alternative to demonstrate RCIC OPERABILITY PRIOR TO STARTUP using l auxiliary steam is provided for plant operating flexibility.

i BFN 3.5/4.5-31 l Unit 1 f

., _ , _ . - . - , , _ . . , . ,.._r... ,._._ _ , , _

3.5 BASES (Cont'd), ', .

2 With the RCICS inoperable, a seven-day period to return the syst'm e to service is justified based on the availability of the HPCIS to cool

the core and upon consideration that the average risk associated with  !

j failure of the RCICS to cool the core when required is not increased.

I The surveillance requirements, which are based on industry codes and standards, provide adequate assurance that the RCICS will be OPERABLE

when required. J l

3.5.C Automatic Depressurization System (ADS) j The ADS consists of six of the thirteen relief valves. It is designed I to provide depressurization of the reactor coolant system during a l small break loss of coolant accident (LOCA) if HPCI fails or is unable I to maintain the required water level in the reactor vessel. ADS I operation reduces the reactor vessel pressure to within the operating pressure range of the low pressure emergency core cooling systems t (core spray and LPCI) so that they can operate to protect the fuel

, barrier. Specification 3.5.G applies only to the automatic feature of i the pressure relief system.

! l i Specification 3.6.D specifies the requirements for the pressure relief

! function of the valves. It is possible for any number of the valves assigned to the ADS to be incapable of performing their ADS functions because of instrumentation failures, yet be fully capable of t performing their pressure relief function.

I i l The emergency core cooling system LOCA analyses for small line breaks I

! assumed that four of the six ADS valves were OPERABLE. By requiring i six valves to be OPERABLE, additional conservatism is provided to j account for the possibility of a single failure in the ADS system, j Reactor operation with one of the six ADS valves inoperable is allowed

to continue for fourteen days provided the HPCI, core spray, and LPCI ,

systems are OPERABLE. Operation with more than one ADS valve '

inoperable is not acceptable.

With one ADS valve known to be incapable of automatic operation, five valves remain OPERABLE to perform the ADS function. This condition is within the analyses for a small break LOCA and the peak clad i temperature is well below the 10 CFR 50.46 limit. Analysis has shown that four valves are capable of depressurizing the reactor rapidly

enough to maintain peak clad temperature within acceptable limits.  ;

H. Maintenance of Filled Discharme Pine

, If the discharge piping of the core spray, LPCI, HPCIS, and RCICS are not filled, a water hammer can develop in this piping when the pump i

and/or pumps are started. To minimize damage to the discharge piping

and to ensure added margin in the operation of these systems, this i- Technical Specification requires the discharge lines to be filled

whenever the system is in an OPERABLE condition. If a discharge pipe l-j BEN 3.5/4.5-32 l Unit 1 i l.

i: __

l

. 3.5 BASES (Cont'd),

is not filled, the pumps that supply that line must be assumed to be inoperable for Technical Specification purposes. I i

! The core spray and RHR system discharge piping high point vent is visually checked for water flow once a month and prior to testing to ensure that the lines are filled. The visual checking will avoid starting the core spray or RHR system with a discharge line not a

filled. In addition to the visual observation and to ensure a filled j

discharge line other than prior to testing, a pressure suppression  ;

4 chamber head tank is located approximately 20 feet above the discharge line high point to supply makeup water for these systems. The l condensate head tank located approximately 100 feet above the discharge high point serves as a backup charging system when the pressure suppression chamber head tank is not in service. System discharge pressure indicators are used to determine the water level above the discharge line high point. The indicators will reflect approximately 30 psig for a water level at the high point and 45 psig for a water level.in the pressure suppression chamber head tank and

are monitored daily to ensure that the discharge lines are filled.

When in their normal standby condition, the suction for the HPCI and RCIC pumps are aligned to the condensate storage tank, which is physically at a higher elevation than the HPCIS and RCICS piping.

4 This assures that the HPCI and RCIC discharge piping remains filled, i i Further assurance is provided by observing water flow from these systems' high points monthly.

3.5.I. Average Planar Linear Heat Generation Rate (APLHGR)

This specification assures that the peak cladding temperature

following the postulated design basis loss-of-coolant accident will

' not exceed the limit specified in the 10 CFR 50, Appendix K.

peak cladding temperature following a postulated loss-of-coolant d

s ident is primarily a function of the average heat generation rate

of all the rods of a fuel assembly at any axial location and is only l dependent secondarily on the rod-to-rod power distribution within an assembly. Since expected local variations in power distribution within a fuel assembly affect the calculated peak clad temperature by less than i 20*F relative to the peak temperature for a typical fuel design, the limit on the average linear heat generation rate is sufficient to assure that calculated temperatures are within the 10 CFR 50 Appendix K limit.

] 3.5.J. Linear Heat Generation Rate (LHGR)

This specification assures that the linear heat generation rate in any rod is less than the design linear heat generation if fuel pellet densification is postulated.

J 4

4 s BFN 3.5/4.5-33 l Unit 1 1

I i

l l

3.5 BASES (Cont'd). . .

The LHGR shall be checked daily during reactor operation at 1 25 percent power to determine if fuel burnup, or control rod movement has caused changes in power distribution. For LHGR to be a limiting value below 25 percent of rated thermal power, the largest total peaking would have to be greater than approximately 9.7 which is precluded by a considerable margin when employing any permissible control rod pattern.

j 3.5.K. Minimum Critical Power Ratio (MCPR)

At core thermal power levels less than or equal to 25 percent, the

. reactor will be operating at minimum recirculation pump speed and the moderator void content will be very small. For all designated control rod patterns which may be employed at this point, operating plant experience and thermal hydraulic analysis indicated that the resulting L MCPR value is in excess of requirements by a considerable margin.

With this low void content, any inadvertent core flow increase would only place operation in a more conservative mode relative to MCPR.

The daily requirement for calculating MCPR above 25 percent rated thermal power is sufficient since power distribution shifts are very slow when there have not been significant power or control rod changes. The requirement for calculating MCPR when a limiting control rod pattern is approached ensures that MCPR will be known following a change in power or power shape (regardless of magnitude) that could place operation at a thermal limit.

3.5.L. APRM Setooints The fuel cladding integrity safety limits of Section 2.1 were based on a total peaking factor within design limits (FRP/CNFLPD 1 1.0). The i APRM instruments must be adjusted to ensure that the core thermal limits are not exceeded in a degraded situation when entry conditions are less conservative than design assumptions.

3.5.M. Core Thermal-Hydraulic Stability  !

1 The minimum margin to the onset of thermal-hydraulic instability occurs in Region I of Figure 3.5.M-1. A manually initiated scram upon l I

entry into this region is sufficient to preclude core oscillations which could challenge the MCPR safety limit.

Because the probability of thermal-hydraulic oscillations is lower and ,

the margin to the MCPR safety limit is greater in Region II than in Region I of Figure 3.5.M-1, an immediate scram upon entry into the region is not necessary. However, in order to minimize the probability of core instability following entry into Region II, the operator will take immediate action to exit the region. Although formal surveillances are not performed while exiting Region II l (delaying exit for surveillances is undesirable), an immediate manual i scram will be initiated if evidence of thermal-hydraulic instability is observed.

BFN 3.5/4.5-34 l Unit 1 I

l l

l

. 1 i  !

3.5 BASES (Cont'd). -

Clear indications of thermal-hydraulic instability are APRM oscillations which exceed 10 percent peak-to-peak or LPRM oscillations '

which exceed 30 percent peak-to-peak (approximately equivalent to APRM oscillations of 10 percent during regional oscillations). Periodic l LPRM upscale or downscale alarms may also be indicators of thermal hydraulic instability and will be immediately investigated.

Periodic upscale'or downscale LPRM alarms will occur before regional oscillations are large enough to threaten the MCPR safety limit.

Therefore, the criteria for initiating a manual scram described in the preceding paragraph are sufficient to ensure that the MCPR safety limit will not be violated in the event that core oscillations initiate while exiting Region II.

Normal operation of the reactor is restricted to thermal power and core flow conditions (i.e., outside Regions I and II) where j thermal-hydraulic instabilities are very unlikely to occur.

3.5.N. References i

1. " Fuel Densification Effects on General Electric Boiling Water Reactor Fuel," Supplements 6, 7, and 8, NEIM-10735, August 1973.

2. Supplement 1 to Technical Report on Densification of General Electric Reactor Fuelc, December 14, 1974 (USA Regulatory Staff).

3. Communication: V. A. Moore to I. S. Mitchell, " Modified GE Model for Fuel Densification," Docket 50-321, March 27, 1974.

4. Generic Reload Fuel Application, Licensing Topical Report, NEDE-24011-P-A and Addenda.

5. Letter from R. H. Buchholz (GE) to P. S. Check (NRC), " Response to NRC Request For Information On ODYN Computer Model," September 5, 1980.

4.5 Core and Containment Coolina Systems Surveillance Frecuencies The testing interval for the core and containment cooling systems is based on industry practice, quantitative reliability analysis, judgment and practicality. The core cooling systems have not been designed to be fully testable during operation. For example, in the case of the HPCI, automatic initiation during power operation would result in pumping cold water into the reactor vessel which is not j desirable. Complete ADS testing during power operation causes an 1 undesirable loss-of-coolant inventory. To increase the availability i of the core and containment cooling system, the components which make I up the system, i.e., instrumentation, pumps, valves, etc., are tested frequently. The pumps and motor operated injection valves are also  !

tested in accordance with Specification 1.0.MM to assure their  ;

OPERABILITY. A simulated automatic actuation test once each cycle '

BFN 3.5/4.5-35 l Unit 1 l

l l

_ ~__ _ . _ . _ _. ._

Ac5 Core and containment Coolina Systems surveillance Freauencies -

(Continued) -

combined with testing of the pumps and injection valves in accordance with Specification 1.0.MM is deemed to be adequate testing of these

systems. Monthly alignment checks of valves that are not locked or sealed in position which affect the ability of the systems to perform their intended safety function are also verified to be in the proper position. Valves which automatically reposition themselves on an initiation signal are permitted to be in a position other than normal to facilitate other operational modes of the system.

When components and subsystems are out-of-service, overall core and containment cooling reliability is maintained by OPERABILITY of the remaining redundant equipment.

1 Whenever a CSCS system or loop la made inoperable, the other CSCS

systems or loops that are required to be OPERABLE shall be considered OPERABLE if they are within the required surveillance testing frequency and there is no reason to suspect they are inoperable. If the function, system, or loop under test or calibration is found inoperable or exceeds the trip level setting, the LCO and the required surveillance testing for the system or loop shall apply.

Averare Planar LHGR. LHGR. and MCPR The APLHGR, LHGR, and MCPR shall be checked daily to determine if fuel burnup, or control rod movement has caused changes in power

! distribution. Since changes due to burnup are slow, and only a few control rods are moved daily, a daily check of power distribution is adequate.

i BFN 3.5/4.5-36 l Unit 1

i I

l

~

• i 3.5 BASES (Cont'd), ,

Should one RHR pump (containment cooling mode) become inoperable ~, a cc plement of three full capacity containment heat removal systems is

stsil available. Any two of the remaining pumps / heat exchanger combinations would provide more than adequate containment cooling for l any abnormal or postaccident situation. Because of the availability i of equipment in excess of normal redundancy requirements, a 30-day i repair period is justified. )

, Should two RHR pumps (containment cooling mode) become inoperable, a full heat removal system is still available. The remaining pump / heat exchanger combinations would provide adequate containment cooling for i any abnormal postaccident situation. Because of the availability of a

- full complement of heat removal equipment, a 7-day repair period is justified.

! Observation of the stated requirements for the containment cooling mode assures that the suppression pool and the drywell will be i sufficiently cooled, following a loss-of-coolant accident, to prevent primary containment overpressurization. The containment cooling function of the RHRS is permitted only after the core has reflooded te the two-thirds core height level. This prevents inadvertently i I

j diverting voter needed for core flooding to the less urgent task of

containment cooling. The two-thirds core height level daterlock may i be manually bypassed by a keylock switch.

Since the RHRS is filled with low quality water.during power l operation, it is planned that the system be filled with demineralized (condensate) water before using the shutdown cooling function of the RHR System. Since it is desirable to have the RHRS in service if a

" pipe-break" type of accident should occur, it is permitted to be out of operation for only a restricted amount of time and when the system pressure is low.' At least one-half of the containment cooling function must remain OPERABLE iuring this time period. Requiring two OPERABLE CSS pumps during cc' own allows for flushing the RHRS even if the shutdown were caused by inability to meet the CSS specifications (3.5.A) on a number of OPERABLE pumps.

When the reactor vessel pressure is atmospheric, the limiting conditions for operation are less restrictive. At atmospheric pressure, the minimum requirement is for one supply of makeup water to the core. Requiring two OPERABLE RHR pumps and one CSS pump provides redundancy to ensure makeup water availability.

Verification that the LPCI subsystem cross-tie valve is closed and power to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI subsystem.

Since the RHR system cross-connect capability provides added long term redundane/ to the other emergency and containment cooling systems, a BFN 3.5/4.5-25 Unit 2

. - - . . . - - - . - - . . ~ . - . - . .-. _ . .- -.

3.5 Bases (Cont'd); $,

5-hour time to establish flow path availability is allowed. This time l limit does not reduce the other requirements associated with RHR i system pump operability.

Should one RHR pump or associated heat exchanger located on the unit cross-connection in the adjacent unit become inoperable, an equal capability for long-term fluid makeup to the reactor and for cooling i of the containment remains OPERABLE. Because of the availability of an equal makeup and cooling capability, a 30-day repair period is justified.

The suppression chamber can be drained when the reactor vessel pressure is atmospheric, irradiated fuel is in the reactor vessel, and work is not in progress which has the potential to drain the vessel. t By requiring the fuel pool gate to be open with the vessel head I removed, the combined water inventory in the fuel pool, the reactor cavity, and the separator / dryer pool, between the fuel pool low level  :

alarm and the reactor vessel flange, is about 65,800 cubic feet (492,000 gallons). This will provide adequate low-pressure cooling in )

lieu of CSS and RHR (LPCI and containment cooling mode) as currently required in Specifications 3.5.A.4 and 3.5.B.9. The additional requirements for providing standby coolant supply available will ensure a redundant supply of coolant supply. Control rod drive maintenance may continue during this period provided no more than one drive is removed at a time unless blind flanges are installed during the period of time CRDs are not in place.

Should the capability for providing flow through the cross-connect lines be lost, a 10-day repair time is allowed before shutdown is required. This repair time is justified based on the very small probability for ever needing RHR pumps and heat exchangers to supply an adjacent unit.

REFERENCES i

l 1. Residual Heat Removal System (BFNP FSAR subsection 4.8) l

2. Core Standby Cooling Systems (BFNP FSAR Section 6) l 3.5.C. RHR Service Water System and Emergency Eauioment Coolina Water System 2

(EECWS) i i The EECW has two c ompletely redundant and independent headers (north j and south) in a loop arrangement inside and outside the Reactor i Building. Four RTiRSW pumps, two per header, (A3, B3, C3 and D3) are I dedicated to automatically supplying the EECW system needs. Four additional pumps (A1, B1, C1 and D1) can serve as RHRSW system pumps or be manually valved into the EECW system headers and serve as backup i

for the RHRSW pumps dedicated to supplying the EECW system. Those

j. components requiring EECW, except the control air compressors which i

BFN 3.5/4.5-26 Unit 2 2

3.5 BASES (Cont'd) '. ,

are not safety related, are able to be fed from both headers thu's assuring' continuity of operation if either header becomes inoperable.

The control air compressors only use the EECW north header as an emergency backup supply.

There are four RHR heat exchanger headers (A, B, C, & D) with one RHR heat exchanger from each unit on each header. There are two RHRSW pumps on each header; one normally assigned to each header (A2, B2, C2, or D2) and one on alternate assignment (A1, B1, Cl, or D1). One RHR heat exchanger header can adequately deliver the flow supplied by both RHRSW pumps to any two of the three RHR heat exchangers on the header. One RHRSW pump can supply the full flow requirement of one RHR heat exchanger. Two RHR heat exchangers can more than adequately handle the cooling requirements of one unit in any abnormal or postaccident situation.

The RHR Service Water System was designed as a shared system for three units. The specification, as written, is conservative when consider-ation is given to particular pumps being out of service and to possible valving arrangements. If unusual operating conditions arise such that more pumps are out of service than allowed by this specification, a special case request may be made to the NRC to allow continued operation if the actual system cooling requirements can be assured.

Since the standby coolant supply capability provides added long term redundancy to the other emergency and containment cooling systems, a 5-hour time to establish flow path availability is allowed. This time l limit does not reduce the other requirements associated with '

RHRSW/EECW system pump operability.  ;

1 Should one of the two RHRSW pumps normally or alternately assigned to l the RHR heat exchanger header supplying the standby coolant supply connection become inoperable, an equal capability for long-term fluid makeup to the unit reactor and for cooling of the unit containment remains OPERABLE. Because of the availability of an equal makeup and cooling capability, a 30-day repair period is justified. Should the capability to provide standby coolant supply be lost, a 10-day repair i

time is justified based on the low probability for ever needing the l standby coolant supply. -

With only one unit fueled, four RHRSW pumps are required to be j OPERABLE for indefinite operation to meet the requirements of

Specification 3.5.B.1 (RHR system). If only three RHRSW pumps are OPERABLE, a 30-day LCO exists because of the requirement of Specification 3.5.B.5 (RHR system).

3.5.D Eautoment Area Coolers There is an equipment area cooler for each RHR pump and an equipment I area cooler for each set (two pumps, either the A and C or B and D l pumps) of core spray pumps. The equipment area coolers take auction l

l BFN 3.5/4.5-27 Unit 2

-I J

i .

3.5 BAEfd (Cont'd), . . )

l

. near the cooling air discharge of the motor of the pump (s) served and j discharge air near the cooling air suction of the motor of the pump (s)  !

served. This ensures that cool air is supplied for. cooling the pump  ;

motors, l

The equipment area coolers also remove the pump, and equipment waste i heat from the basement rooms housing the engineered safeguard i equipment. The various conditions under which the operation of the equipment air coolers is required have been identified by evaluating the normal and abnormal operating transients and accidents over the full range of planned operations. The surveillance and testing of the equipment area coolers in each of their various modes is accomplished during the testing of the equipment served by these coolers. This testing is adequate to assure the OPERABILITY of the equipment area coolers.

REFERENCES

1. Residual Heat Removal System (BFN FSAR Section 4.8)

2. Core Standby Cooling System (BFN FSAR Section 6) 3.5.E. High Pressure Coolant Injection System (HPCIS)

The HPCIS is provided to assure that the reactor core is adequately cooled to limit fuel clad temperature in the event of a small break in the nuclear system and loss of coolant which does not result in rapid depressurization of the reactor vessel. The HPCI system permits the reactor to be shut down while maintaining sufficient reactor vessel water level inventory until the vessel is depressurized. The HPCIS continues to operate until reactor vessel pressure is below the pressure at which LPCI operation or Core Spray system operation maintains core cooling. The capacity of the system is selected to provide the required core cooling. The HPCI pump is designed to pump 5000 gpm at reactor pressures between 1120 and 150 psig. The HPCIS is not required to be OPERABLE below 150 psig since this is well within the range of the low pressure cooling systems and below the pressure of any events for which HPCI is required to provide core cooling.

The minimum required NPSH for HPCI is 21 feet. There is adequate elevation head between the suppression pool and the HPCI pump, such that the required NPSH is available with a suppression pool temperature up to 140*F with no containment back pressure.

The HPCIS is not designed to operate at full capacity until reactor pressure exceeds 150 psig and the steam supply to the HPCI turbine is automatically isolated before reactor pressure decreases below 100 psig. The ADS, CSS, and RHRS (LPCI) must be OPERABLE when starting up from a COLD CONDITION. Steam pressure is sufficient at 150 psig to run the HPCI turbine for OPERABILITY testing yet still below the shutoff head of the CSS and RHRS pumps so they will inject water into BFN- 3.5/4.5-28 l Unit 2

-l 13 . 5 : BASES (Cont'd), -

I. .

the vessel if required. The ADS provides additional backup to reduce pressure to the range where the CSS and RHRS will inject into the i vessel if necessary. Considering the low reactor pressure, the redundancy and availability of CSS, RHRS, and ADS during startup from a COLD CONDITION, twelve hours is allowed as a reasonable time to demonstrate HPCI OPERABILITY once sufficient steam pressure becomes available. The alternative to demonstrate HPCI OPERABILITY PRIOR TO STARTUP using auxiliary steam is provided for plant operating flexibility.

With the HPCIS inoperable, a seven-day period to return the system to service is justified based on the availability of the ADS, CSS, RHRS (LPCI) and the RCICS. The availability of these redundant and diversified' systems provides adequate assurance of core cooling while HPCIS is out of service.

The surveillance requirements, which are based on industry codes and I standards, provide adequate assurance that the HPCIS will be OPERABLE when required.

3.5.F Reactor Core Isolation Coolina System (RCICS)

The RCICS functions to provide makeup water to the reactor vessel during shutdown and isolation from the main heat sink to supplement or replace the normal makeup sources. The RCICS provides its design flow between 150 psig and 1120 pois reactor pressure. Below 150 psig, RCICS is not required to be OPERABLE since this pressure is substantially below that for any events in which RCICS is needed to maintain sufficient coolant to the reactor vessel. RCICS will continue to operate below 150 psig at reduced flow until it automatically isolates at greater than or equal to 50 psig reactor l steam pressure. 150 psig is also below the shutoff head of the CSS

, and RHRS, thus, considerable overlap exists with the cooling systems j l that provide core cooling at low reactor pressure. The minimum j l required NPSH for RCIC is 20 feet. There is adequate elevation head between the suppressien pool and the RCIC pump, such that the required l l

' NPSH is available with a suppression pool temperature up to 140*F with no containment back pressure.

, The ADS, CSS, and RHRS (LPCI) must be OPERABLE when starting up from a COLD CONDITION. Steam pressure is sufficient at 150 psig to run the

RCIC turbine for OPERABILITY testing, yet still below the shutoff head

! of the CSS and RHRS pumps so they will inject water into the vessel if required. Considering the low reactor pressure and the availability

, of the low pressure coolant systems during startup from a COLD CONDITION, twelve hours is allowed as a reasonable time to demonstrate RCIC OPERABILITY once sufficient steam pressure becomes available.

The alternative to demonstrate RCIC OPERABILITY PRIOR TO STARTUP using

, ' auxiliary steam is re evided for plant operating flexibility, f

BFN 3.5/4.5-29 l Unit 2 f

4 4

-- r -

3.5 BASES (Cont'd), ,'. ,

With the RCICS inoperable, a seven-day period to return the system to service is justified based on the availability of the HPCIS to cool the core and upon. consideration that the average risk associated with-failure of the RCICS to cool the core when required is not increased.

The surveillance requirements, which are based on industry codes and standards, provide adequate assurance that the RCICS will be OPERABLE when required.

3.5.G Automatic Deoressurization System (ADS)

The ADS consists of six of the thirteen relief valves, It is designed to provide depressurization of the reactor coolant system during a.

small break loss of coolant accident (LOCA) if HPCI fails or is unable to maintain the required water level in the reactor vessel. ADS operation reduces the reactor vescel pressure to within the operating pressure range of the low pressure emergency core cooling systems (core spray and LPCI) so that they can operate to protect the fuel barrier. Specification 3.5.G applies only to the automatic feature of the pressure relief system. ,

Specification 3.6.D specifies the requirements for the pressure relief function of the valves. It is possible for any number of the valves assigned to the ADS to be incapable of performing their ADS functions because of instrumentation failures, yet be fully capable of performing their pressure relief function.

The emergency core cooling system LOCA analyses for small line breaks assumed that four of the six AD3 valves were operable. By requiring six valves to be OPERABLE, additional conservatism is provided to >

account for the possibility of a single failure in the ADS system.

j Reactor operation with one of the six ADS valves inoperable is allowed to continue for fourteen days provided the HPCI, core spray, and LPCI systems are OPERABLE. Operation with more than one ADS valve l inoperable is not acceptable.

With one ADS valve known to be incapable of automatic operation, five valves remain OPERABLE to perform the ADS function. This condition is i within the analyses for a small break LOCA and the peak clad temperature is well below the 10 CFR 50.46 limit. Analysis has shown that four valves are capable of depressurizing the reactor rapidly enough to maintain peak clad temperature within acceptable limits.

4 3.5.H. Maintenance of Filled Discharae Pipe If the discharge piping of the core spray, LPCI, HPCIS, and RCICS are 4 not filled, a water hammer can develop in this piping when the pump I

and/or pumps are started. To minimize damage to the discharge piping and to ensure added margin in the operation of these systems, this Technical Specification requires the discharge lines to be filled BFN 3.5/4.5-30 l Unit 2

5 3.5 BASES (Cont'd), -

l whenever the system is in an OPERABLE condition. If a discharge pipe

'is not filled, the pumps that supply that line must be assumed to be

inoperable for Technical Specification purposes.

1 The core spray and RHR system discharge piping high point vent is visually checked for water flow once a month and prior to testing to 1 ensure that the lines are filled. The visual checking will avoid 2

starting the core spray or RHR system with a discharge line not filled. In addition to the visual observation and to ensure a filled

! discharge line other than prior to testing, a pressure suppression chamber head tank is located approximately 20 feet above the discharge 3

line high point to supply makeup water for these systems. The

condensate head tank located approximately 100 feet above the

! discharge high point serves as a backup charging system when the 1- pressure suppression chamber head tank is not in service. System discharge pressure indicators are used to determine the water level l above the discharge line high point. The indicators will reflect

approximately 30 psig for a water level at the high point and 45 psig for a water level in the pressure suppression chamber head tank and i are monitored daily to ensure that the discharge lines are filled.

When in their normal standby condition, the auction for the HPCI and l RCIC pumps are aligned to the condensate storage tank, which is physically at a higher elevation than the HPCIS and RCICS piping.

This assures that the HPCI and RCIC discharge piping remains filled.

Further assurance is provided by observing water flow from these systems' high points monthly.

3.5.I. Averane Planar Linear Heat Generation Rate (APLHGR)

This specification assures that the peak cladding temperature following the postulated design basis loss-of-coolant accident will not exceed the limit specified in the 10 CFR 50, Appendix K.

The peak cladding temperature following a postulated loss-of-coolant accident is primarily a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is only dependent secondarily on the rod-to-rod power distribution within an assembly. Since expected local variations in power distribution within a fuel assembly affect the calculated peak clad temperature by less than i 20*F relative to the peak temperature for a typical fuel design, the limit on the average linear heat generation rate is sufficient to assure that calculated temperatures are within the 10 CFR 50 Appendix K limit.

3.5.J. Linear Heat Generation Rate (LHGR1 This specification assures that the linear heat generation rate in any rod is less than the design linear heat generation if fuel pellet densification is postulated.

BFN 3.5/4.5-31 l Unit 2 I

1 3.5 BASES (Cont'd), . .

i The LHGR shall be checked daily during reactor operation at 1 25 percent power to determine if fuel burnup, or control rod movement has caused changes in power distribution. For LHGR to be a limiting value below 25 percent of rated thermal power, the largest total peaking would have to be greater than approximately 9.7 which is precluded by a considerable margin when employing any permissible control rod pattern.

3.5.K. Minimum Critical Power Ratio (MCPR)

At core thermal power levels less than or equal to 25 percent, the reactor will be operating at minimum recirculation pump speed and the l moderator void content will be very small. For all designated i control rod patterns which may be employed at this point, operating I plant experience and thermal hydraulic analysis indicated that the resulting MCPR value is in excess of requirements by a considerable ,

margin. With this low void content, any inadvertent core flow increase would only place operation in a more conservative mode relative to MCPR. The daily requirement for calculating MCPR above 25 percent rated thermal power is sufficient since power distribution j shifts are very slow when there have not been significant power or control rod changes. The requirement for calculating MCPR when a ,

I limiting control rod pattern la approached ensures that MCPR will be known following a change in power or power shape (regardless of magnitude) that could place operation at a thermal limit. l 3.5.L. APRM Setooints 1 I

Operation is constrained to the LHGR limit of Specification 3.5.J. ,

This limit is reached when core maximum fraction of limiting power  !

density (CMFLPD) equals 1.0. For the case where CMFLPD exceeds the -

fraction of rated thermal power, operation is permitted only at less than 100-percent rated power and only with APRM scram settings as l

required by Specification 3.5.L.1. The scram trip setting and rod block trip setting are adjusted to ensure that no combination of CMFLPD and FRP will increase the LHGR transient peak beyond that allowed by the 1-percent plastic strain limit. A 6-hour time period l to achieve this condition is justified since the additional margin gained by the setdown adjustment is above and beyond that ensured by )

. the safety analysis.

, 3.5.M. Core Thermal-Hydraulic Stability I The minimum margin to the onset of thermal-hydraulic instability

. occurs in Region I of Figure 3.5.M-1. A manually initiated scram j upon entry into this region is sufficient to preclude core l oscillations which could challenge the MCPR safety limit.

i

Because the probability of thermal-hydraulic oscillations is lower

and the margin to the MCPR safety limit is greater in Region II than j in Region I of figure 3.5.M-1, an immediate scram upon entry into the I

1 BFN 3.5/4.5-32

Unit 2 i

~

3.5 BASES (Cont'd), ,

region is not necessary. However, in order to minimize the probability of core instability following entry into Region II, the operator will take immediate action to exit-the region. Although formal surveillances are not performed while exiting Region II

-(delaying exit for surveillances is undesirable), an immediate manual scram will be initiated if evidence of thermal-hydraulic instability is observed.

Clear indications of thermal-hydraulic instability are APRM oscillations which exceed 10 percent peak-to-peak or LPRM oscillations which exceed 30 percent peak-to-peak (approximately equivalent to APRM oscillations of 10 percent during regional oscillations). Periodic LPRM upscale or downscale alarms may a)so be indicators of thermal hydraulic instability and will be immediately investigated.

Periodic upscale or downscale LPRM alarms will occur before regional oscillations are large enough to threaten the MCPR safety limit.

Therefore, the criteria for initiating a manual scram described in the preceding paragraph are sufficient to ensure that the MCPR safety limit will not be violated in the event that core oscillations initiate while exiting Region II.

Normal operation of the reactor is restricted to thermal power and core flow conditions (i.e., outside Regions I and II) where thermal-hydraulic instabilities are very unlikely to occur.

3.5.N. References

1. Loss-of-Coolant Accident Analysis for Browns Ferry Nuclear Plant Unit 2, NEDO - 24088-1 and Addenda.

2. "BWR Transient Analysis Model Utilizing the RETRAN Program,"

TVA-TR81-01-A.

J

[ 3. Generic Reload Fuel Application, Licensing Topical Report,

NEDE - 24011-P-A and Addenda, i

4.5 Core and Containment Cooling Systems Surveillance Freauencies i

The testing interval for the core and containment cooling systems is j based on industry practice, quantitative reliability analysis, t judgment and practicality. The core cooling systems have not been designed to be fully testable during operation. For example, in the

case of the HPCI, automatic initiation during power operation would result in pumping cold water into the reactor vessel which is not

desirable. Complete ADS testing during power operation causes an 4

undesirable loss-of-coolant inventory. To increase the availability of the core and containment cooling system, the components which make up the system, i.e., instrumentation, pumps, valves, etc., are tested frequently. The pumps and motor operated injection valves are also BFN 3.5/4.5-33 Unit 2 4

l Core and Containment Coolina Systems Surveillance Freauencies ', .

4.5 l

l (Continued) tested in accordance with Specification 1.0.MM to assure their OPERABILITY. A simulated automatic actuation test once each cyc.

combined with testing of the pumps and injection valves in accordance with Specification 1.0.MM is deemed to be adequate testing of these systems. Monthly alignment checks of valves that are not locked or sealed in position which affect the ability of the systems to perform

- their intended safety function are also verified to be in the proper position. Valves which automatically reposition therselves on an initiation signal are permitted to be in a position other than normal ,

! to facilitate other operational modes of the system. f l When components and subsystems are out-of-service, overall core and  !

! containment cooling reliability is maintained by OPERABILITY of the remaining redundant equipment.

l Whenever a CSCS system or loop is made inoperable, the other CSCS systems or loops titat are required to be OPERABLE shall be considered OPERABLE if they are within the required surveillance testing frequency and there is no reason to suspect they are inoperable. If the function, system, or loop under test or calibration is found inoperable or exceeds the trip level setting, the LCO and the required

3. surveillance testing for the system or loop shall apply.

Average Planar LHGR. LHGR. and MCPR 1

The APLHGR, LHGR, and MCPR shall be checked daily to determine if fuel i burnup, or control rod movement has caused changes in power i distribution. Since changes due to burnup are slow, and only a few l control rods are moved daily, a daily check of power distribution is I i adequate. l l

l i

l l

BFN 3.5/4.5-34 l Unit 2

3.5 BASES (Cont'd) , ',

Should one RHR pump (containment cooling mode) become inoperable ~, a complement of three full capacity containment heat removal systems is still available. Any two of the remaining pumps / heat exchanger combinations would provide more than adequate containment cooling for any abnormal or postaccident situation. Because of the availability of equipment in excess of normal redundancy requirements, a 30-day repair period is justified.

Should two RHR pumps (containment cooling mode) become inoperable, a full heat removal system is still available. The remaining pump / heat exchanger combinations would provide adequate containment cooling for any abnormal postaccident situation. Because of the availability of a full complement of heat removal equipment, a 7-day repair period is justified.

Observation of the stated requirements for the containment cooling mode assures that the suppression pool and the drywell will be sufficiently cooled, following a loss-of-coolant accident, to prevent primary containment overpressurization. The containment cooling function of the RHRS is permitted only after the core has reflooded to i the two-thirds core height level. This prevents inadvertently diverting water needed for core flooding to the less urgent task of i containment cooling. The two-thirds core height level interlock may l be manually bypassed by a keylock switch.

Since the RHRS is filled with low quality water during power operation, it is planned that the system be filled with demineralized (condensate) water before using the shutdown cooling function of the RHR System. Since it is desirable to have the RHRS in service if a

" pipe-break" type of accident should occur, it is permitted to be out of operation for only a restricted amount of time and when the system pressure is low. At least one-half of the containment cooling function must remain OPERABLE during this time period. Requiring two OPERABLE CSS pumps during cooldown allows for flushing the RHRS even if the shutdown were caused by inability to meet the CSS specifications (3.5 A) on a number of OPERABLE pumps.

When the reactor vessel pressure is atmospheric, the limiting  !

conditions for operation are less restrictive. At atmospheric l pressure, the minimum requirement is for one supply of makeup water to ,

the core. Requiring two OPERABLE RHR pumps and one CSS pump provides )

redundancy to ensure makeup water availability.

I Verification that the LPCI subsystem cross-tie valve is closed and

, power to its operator is disconnected ensures that each LPCI subsystem remains independent and a failure of the flow path in one subsystem will not affect the flow path of the other LPCI subsystem.

4 Since the RHR system cross-connect capability provides added long term

redundancy to the other emergency and containment cooling systems, a i

i

[ BFN- 3.5/4.5-28 Unit 3 P

3.5 Bases (Cont'd), '.

5-hour time to establish flow path availability is allowed. This time limit does not reduce the other requirements associated with RHR system pump operability.

Should one RHR pump or associated heat exchanger located on the unit cross-connection in the adjacent unit become inoperable, an equal capability for long-term fluid makeup to the reactor and for cooling of the containment remains OPERABLE. Because of the availability of an equal m6keup and cooling capability, a 30-day repair period is justified.

The suppression chamber can be drained when the reactor vessel pressure is atmospheric, irradiated fuel is in the reactor vessel, and work is not in progress which has the potential to drain the vessel.

By requiring the fuel pool gate to be open with the vessel head removed, the combined water inventory in the fuel pool, the reactor cavity, and the separator / dryer pool, between the fuel pool low level alarm and the reactor vessel flange, is about 65,800 cubic feet (492,000 gallons). This will provide adequate low-pressure cooling in lieu of CSS and RHR (LPCI and containment cooling mode) as currently required in Specifications 3.5.A.4 and 3.5.B.9. The additional requirements for providing standby coolant supply available will ensure a redundant supply of coolant supply. Control rod drive maintenance may continue during this period provided no more than one drive is removed at a time unless blind flanges are installed during the period of time CRDs are not in place.

Should the capability for providing flow through the cross-connect lines be lost, a 10-day repair time is allowed before shutdown is required. This repair time is justified based on the very small probability for ever needing RHR pumps and heat exchangers to supply an adjacent unit.

REFERENCES

1. Residual Heat Removal System (BFNP FSAR subsection 4.8)

2. Core Standby Cooling Systems (BFNP FSAR Section 6) 3.5.C. RHR Service Water System and Emergency Eautoment Cooling Water System (EECWS)

The EECW has two completely redundant and independent headers (north and south) in a loop arrangement inside and outside the Reactor Building. Four RHRSW pumps, two per header, (A3, B3, C3 and D3) are dedicated to automatically supplying the EECW system needs. Four additional pumps (A1, B1, C1 and D1) can serve as RHRSW system pumps or be manually valved into the EECW system headers and scrve as backup for the RHRSW pumps dedicated to supplying the EECW system. Those components requiring EECW, except the control air compressors which BFN 3.5/4.5-29 Unit 3

l

\ l E3.5 BASES (Cont'd), -

l l

are not safety related, are able to be fed from both headers thus assuring continuity of.' operation if either= header becomes inoperable. I The control air compressors only use the EECW north header as an emergency backup supply.  ;

There are four RHR heat exchanger headers (A, B, C, & D) with one RHR heat exchanger from each unit on each header. There are two RHRSW pumps on each header; one normally assigned'to each header (A2, B2,  !

C2, or D2) and one on alternate assignment (A1, B1, C1, or D1). One RHR heat exchanger header can adequately deliver the flow supplied by both RHRSW pumps to any two of the three RHR heat exchangers on the header. One RHRSW pump can supply the full flow requirement of one RHR heat exchanger. Two RHR heat exchangers can more than adequately handle the cooling requirements of one unit in any abnormal or postaccident situation.

The RHR Service Water System was designed as a shared system for three units. The specification, as written, is conservative when consider-ation is given to particular pumps being out of service and to possible valving arrangements. If unusual operating conditions arise such that more pumps are out of service than allowed by this specification, a special case request may be made to the NRC to allow continued operation if the actual system cooling requirements can be i assured.

t i i Since the standby coolant supply capability provides added long term redundancy to the other emergency and containment cooling systems, a 5-hour time to establish flow path availability is allowed. This time 3 limit does not reduce the other requirements associated with RHRSW/EECW system pump operability.

' Should one of the two RHRSW pumps normally or alternately assigned to the RHR heat exchanger header supplying the standby coolant supply

connection become inoperable, an equal capability for long-term fluid makeup to the unit reactor and for cooling of the unit containment remains OPERABLE. Because of the availability of an equal makeup and cooling capability, a 30-day repair period is justified. Should the capability to provide standby coolant supply be lost, a 10-day repair time is justified based on the low probability for ever needing the

standby coolant supply. -

With only one unit fueled, four RHRSW pumps are required to be l 7' OPERABLE for indefinite cperation to meet the requirements of l Specification 3.5.B.1 (RHR system). If only three RHRSW pumps are l OPERABLE, a 30-day LCO exists because of the requirement of l Specification 3.5.B.5 (RHR system).

1

, 3.5.D Eauipment Area Coolers  !

I I There is an equipment area cooler for each RHR pump and an equipment i area cooler for each set'(two pumps, either the A and C or B and D pumps) of core spray pumps. The equipment area coolers take suction

! l 4

l BFN 3.5/4.5-30 Unit 3 1

4 l

i

. j 4

3.5 BM7d (Cont'd). .

near the cooling air discharge of the motor of the pump (s) served and discharge air near the tooling air suction of the motor of the pump (s) served. This ensures that cool air is supplied for cooling the pump motors.

The equipment area coolers also remove the pump, and equipment waste heat from the basement rooms housing the engineered safeguard ,

equipment. The various conditions under which the operation of the  !

equipment air coolers is required have been identified by evaluating i the normal and abnormal operating transients and accidents over the full range of planned operations. The surveillance'and testing of the equipment area coolers in each of their various modes is accomplished i during the testing of the equipment served by these coolers. This 1 testing is adequate to assure the OPERABILITY of the equipment area j Coolers.

REFERENCES 1

1. Residual Heat Removal System (BFN FSAR Section 4.8)

2. Core Standby Cooling System (BFN FSAR Section 6) 3.5.E. Hinh Pressure Coolant Injection System (HPCIS) l The HPCIS is provided to assure that the reactor core is adequately cooled to limit fuel clad temperature in the event of a small break in '

the nuclear system and loss of coolant which does not result in rapid depressurization of the reactor vessel. The HPCI system permits the reactor to be shut down while maintaining sufficient reactor vessel water level inventory until the vessel is depressurized. The HPCIS j continues to operate until reactor vessel pressure is below the pressure at which LPCI operation or Core Spray system operation maintains core cooling. The capacity of the system is selected to

! provide the required core cooling. The HPCI pump is designed to pump 5000 gpm at reactor pressures between 1120 and 150 psig. The HPCIS is not required to be OPERABLE below 150 psig since this is well within the range of the low pressure cooling systems and below the pressure of any events for which HPCI is required to provide core cooling.

l f

The minimum required NPSH for HPCI is 21 feet. There is adequate elevation head between the suppression pool and the HPCI pump, such that the required NPSH is available with a suppression pool l temperature up to 140*F with no containment back pressure.

The HPCIS is not designed to operate at full capacity until reactor pressure exceeds 150 psig and the steam supply to the HPCI turbine is automatically isolated before reactor pressure decreases below 100 psig. The ADS, CSS, and RHRS (LPCI) must be OPERABLE when starting up

. from a COLD CONDITION. Steam pressure is sufficient at 150 psig to

! run the HPCI turbine for OPERABILITY testing, yet still below the

shutoff head of the CSS and RHRS pumps so they will inject water into

BFN 3.5/4.5-31 l

, Unit 3

3.5 BASES (Cont'd). .

the vessel if required. The ADS provides additional backup to reduce pressure to the range where the CSS and RHRS will inject into the vessel if necessary. Considering the low reactor pressure, the redundancy and availability of CSS, RHRS, and ADS during startup from a COLD CONDITION, twelve hours is allowed as a reasonable time to demonstrate HPCI OPERABILITY once sufficient. steam pressure becomes available. The alternative to demonstrate HPCI OPERABILITY PRIOR TO STARTUP using auxiliary steam is provided for plant operating flexibility.

With the HPCIS inoperable, a seven-day period to return the system to service is justified based on the availability of the ADS, CSS,-RHRS (LPCI) and the RCICS. The availability of these redundant and diversified systems provides adequate assurance of core cooling while HPCIS is out of service.

The surveillance requirements, which are based on industry codes and standards, provide adequate assurance that the HPCIS will be OPERABLE when required.

3.5.F Reactor Core Isolation Coolina System (RCICS)

The RCICS functions to provide makeup water to the reactor vessel during shutdown and isolation from the main heat sink to supplement or replace the normal makeup sources. The RCICS provides its design flow between 150 psig and 1120 psig reactor pressure. Below 150 psig, l RCICS is not required to be OPERABLE since this pressure is i substantially below that for any events in which RCICS is needed to maintain sufficient coolant to the reactor vessel. RCICS will continue to operate below 150 psig at reduced flow until it automatically isolates at greater than or equal to 50 psig reactor steam pressure. 150 psig is also below the shutoff head of the CSS and RHRS, thus, considerable overlap exists with the cooling systems that provide core cooling at low reactor pressure. The minimum required NPSH for RCIC is 20 feet. There is adequate elevation head between the suppression pool and the RCIC pump, such that the required l NPSH is available with a suppression pool temperature up to 140*F with I no containment back pressure.

The ADS, CSS, and RHRS (LPCI) must be OPERABLE when starting up from a COLD CONDITION. Steam pressure is sufficient at 150 psig to run the

' RCIC turbine for OPERABILITY testing, yet still below the shutoff head i of the CSS and RHRS pumps co they will inject water into the vessel if i

required. Considering the low reactor pressure and the availability of the low pressure coolant systems during startup from a COLD i CONDITION, twelve hours is allowed as a reasonable time to demonstrate RCIC OPERABILITY once sufficient steam pressure becomes available.

The alternative to demonstrate RCIC OPERABILITY PRIOR TO STARTUP using

' auxiliary steam is provided for plant operating flexibility.

BFN 3.5/4.5-32 l t . Unit 3 d

2-

. - - ,-- . - - . - .. ., .~. -

. - -. ..- . . _. . - - . - . .- . . . - - . . _ . . - -~-

I 3.5 BASES (Cont'd).

With the RCICS inoperable, a seven-day period to return the system to j service is justified based on.the availability of the HPCIS to cool -

the core and upon consideration that the average risk associated with

! failure of the RCICS to cool the core when required is not increased.

The surveillance requirements, which are' based on industry codes and i standards, provide adequate assurance that the RCICS will be OPERABLE when required.

3.5.G Automatic Deoressurization System (ADS)

! The ADS consists of six of the thirteen relief valves. It is designed to provide depressurization of the reactor coolant system during a

, small break loss of coolant accident (LOCA) if HPCI fails or is unable to maintain the required water level in the reactor vessel. ADS q operation reduces the reactor vessel pressure to within the operating i pressure range of the low pressure emergency core cooling systems (core spray and LPCI) so that they can operate to protect the fuel

barrier. Specification 3.5.G applies only to the automatic feature of the pressure relief system.

' Specification 3.6.D specifies the requirements for the pressure relief function of the valves. It is possible for any number of the valves assigned to the ADS to be incapable of performing their ADS functions because of instrumentation failures, yet be fully capable of performing their pressure relief function.

The emergency core cooling system LOCA analyses for small line breaks assumed that four of the six ADS valves were OPERABLE. By requiring six valves to be OPERABLE, additional conservatism is provided to account for the possibility of a single failure in the ADS system.

Reactor operation with one of the six ADS valves inoperable is allowed to continue for fourteen days provided the HPCI, core spray, and LPCI systems are OPERABLE. Operation with more than one ADS valve inoperable is not acceptable.

With one ADS valve known to be incapable of automatic operation, five valves remain OPERABLE to perform the ADS function. This condition is within the analyses for a small break LOCA and the peak clad temperature is well below the 10 CFR 50.46 limit. Analysis has shown that four valves are capable of depressurizing the reactor rapidly enough to maintain peak clad temperature within acceptable limits.

H. Maintenance of Filled Discharge Ploe If the discharge piping of the core spray, LPCI, HPCIS, and RCICS are not filled, a water hammer can develop in this piping when the pump and/or pumps are started. To minimize damage to the discharge piping and to ensure added margin in the operation of these systems, this Technical Specification requires the discharge lines to be filled BFN 3.5/4.5-33 l Unit 3 1

l 3.5 BASES (Cont'd). ,

I, ,

whenever the system is in an OPERABLE condition. If a discharge pipe is not filled, the pumps that supply that line must be assumed to be '

inoperable for Technical Specification purposes.

The core spray and RHR system discharge piping high point vent is visually checked for water flow once a month and prior to testing to ensure that the lines are filled. The visual checking will avoid starting the core spray or RHR system with a discharge line not filled. In addition to the visual observation and to ensure a filled discharge line other than prior to testing, a pressure suppression chamber head tank is located approximately 20 feet above the discharge line high point to supply makeup water for these systems. The i condensate head tank located approximately 100 feet above the discharge high point serves as a backup charging system when the pressure suppression chamber head tank is not in service. System discharge pressure indicators are used to determine the water level above the discharge line high point. The indicators will reflect approximately 30 psig for a water level at the high point and 45 psig for a water level in the pressure suppression chamber head tank and are monitored daily to ensure that the discharge lines are filled.

When in their normal standby condition, the suction for the HPCI and RCIC pumps are aligned to the condensate storage tank, which is physically at a higher elevation than the HPCIS and RCICS piping.

This assures that the HPCI and RCIC discharge piping remains filled. I Further assurance is provided by observing water flow from these systems' high points monthly.

3.5.I. Average Planar Linear Heat Generation Rate (APLHGR)

This specification assures that the peak cladding temperature following the postulated design basis loss-of-coolant accident will not exceed the limit specified in the 10 CFR 50, Appendix K.

The peak cladding temperature following a postulated loss-of-coolant l accident is primarily a function of the average heat generation rate i of all the rods of a fuel assembly at any axial location and is only i dependent secondarily on the rod-to-rod power distribution within an assembly. Since expected local variations in power distribution within a fuel assembly affect the calculated peak clad temperature by less than i 20*F relative to the peak temperature for a typical fuel design, the limit on the average linear heat generation rate is sufficient to assure that calculated temperatures are within the l l

10 CFR 50 Appendix K limit.

3.5.J. Linear Heat Generation Rate (LHGR)

This specification assures that the linear heat generation rate in any rod is less than the design linear heat generation if fuel pellet densification is postulated.

l BFN 3.5/4.5-34 l Unit 3 l

l

'. l 3.5 BASES (Cont'd)

The LHGR shall be checked daily during reactor operation at f 1 25 percent power to determine if fuel burnup, or control rod l movement has caused changes in power distribution. For LHGR to be a  !

limiting value'below 25 percent of rated thermal power, the largest total peaking would have to be greater than approximately 9.7 which is precluded by a considerable margin when employing any permissible control rod pattern. l 3.5.K. Minimum Critical Power Ratio (MCPR)

I At core thermal power levels less than or equal to 25 percent, the reactor will be operating at minimum recirculation pump speed and the moderator void content will be very small. For all designated control rod patterns which may be employed at this point, operating plant experience and thermal hydraulic analysis indicated that the resulting MCPR value is in excess of requirements by a considerable margin. ,

With this low void content, any inadvertent core flow increase would l I

only place operation in a more conservative mode relative to MCPR.

The daily requirement for calculating MCPR above 25 percent rated thermal power is sufficient since power distribution shifts are very slow when there have not been significant power or control rod changes. The requirement for calculating MCPR when a limiting control rod pattern is approached ensures that MCPR will be known following a change in power or power shape (regardless of magnitude) that could place operation at a thermal limit.

3.5.L. APRM Setooints Operation is constrained to the LHGR limit of Specification 3.5.J.

This limit is reached when core maximum fraction of limiting power l l

density (CMFLPD) equals 1.0. For the case where CMFLPD exceeds the i

fraction of rated thermal power, operation is permitted only at less than 100-percent rated power and only with APRM scram settings as l

required by Specification 3.5.L.1. The scram trip setting and rod l block trip setting are adjusted to ensure that no combination of CMFLPD and FRP will increase the LHGR transient peak beyond that i

allowed by the one-percent plastic strain limit. A six-hour time

period to achieve this condition is justified since the additional margin gained by the setdown adjustment is above and beyond that j

ensured by the safety analysis, i

3.5.M. Core Thermal-Hydraulic Stability 1

The minimum margin to the onset of thermal-hydraulic instability I occurs in Region I of Figure 3.5.M-1. A manually initiated scram upon

' entry into this region is sufficient to preclude core oscillations which could challenge the MCPR safety limit. l l

Because the probability of thermal-hydraulic oscillations is lower and the margin to the MCPR safety limit is greater in Region II than in Region I of Figure 3.5.M-1, an immediate scram upon entry into the  ;

l BFN 3.5/4.5-35 l

Unit 3

= , ?%

.. l MSIE (Cont'd) he 3.5 However, in order toAlthough minimize thefollo region is not necessary. it the region.

probability of core instabilitywill take d while exiting immediate Region II action to ex l l formal surveillances are notis undesirable), an immediate operatcr bilitymanua /

d ceperforme of thermal-hydraulic insta f (delaying exit for surveillancesscram will be initiated l is observed. lic instability are APRMpeak RM or LPRM l

Clear indications of thermal-hydrauwhich exceed Periodic10 percent pe oscillations which exceed 30 percent peak-to-peaing regional oscillations).of oscillations of 10 percent dur y also be indicators immediately investigated.

LPRM upscale or downscale alarms ma hydraulic instability and will be l occur before regional i it.

Periodic upscale or downscale LPRM alarms wilh tof threaten the M itiating a manual scram descr ty oscillations are large i ientenougTherefore, to ensure that the cillationstheMCPRcriteriasafor e i preceding paragraph are suff cviolated in the event that core os l limit will not beexiting Region II. nd initiate while is restricted to thermal power a Normal operation of the reactor tside Regions I and II) where core flow conditions (i.e., oulities are very unlikely to occur. I thermal-hydraulic instabi References for Browns Ferry Nuclear Plant 3.5.N.

1.

Loss-of-Coolant Accident Analysis "

Unit 3, NED0-24194A and Addenda. lizing the RETRAN Pr "BWR Transient Analysis Model Uti )

2.

TVA-TRB1-01-A. Licensing Topical Report, Generic Reload Fuel Application, 3.

NEDE-24011-P-A and Addenda. Surveillance Frequencies 4.5 Core and Containment Cooling Systems d containment coolin The testing interval for the core itative anreliability analysis, been  !

based on industry practice, operation. quantThe core coolingd system judgment and practicality.

designed to be fully testablei dur tionng during power operation.woul i

vessel which is not case of the HPCI, automatic init a peration causes an result in pumping cold tory. water into the To increase reactorCom the availability k

desirable. ling system, the components which m d i

]- undesirable loss-of-coolant in inven pumps, valves, etc., are teste i n valves are also of the core and i.e., containment coo up the system,instrumentat o ,The pumps and motor operated frequently.

l 3.5/4.5-3o pf BFN

' Unit 3

4.5 Core and Containment Coolina Systems Surveillance Freauencies - 4 (Continued) tested in accordance with Specification 1.0.MM to assure their OPERABILITY. A simulated automatic actuation test once each cycle I combined with testing of the pumps and injection valves in accordance with Specification 1.0.MM is deemed to be adequate testing of these i systems. Monthly alignment checks of valves that are not locked or sealed in position which affect the ability of the systems to perform 1 their intended safety function are also verified to be in the proper ,

position. Valves which automatically reposition themselves on an l initiation signal are permitted to be in a position other than normal  ;

to facilitate other operational modes of the system. 1 When components and subsystems are out-of-service, overall core and containment cooling reliability is maintained by OPERABILITY of the remaining redundant equipment.

Whenever a CSCS system or loop is made inoperable, the other CSCS systems or loops that are required to be OPERABLE shall be considered OPERABLE if they are within the required surveillance testing frequency and there is no reason to suspect they are inoperable. If the function, system, or loop under test or calibration is found inoperable or exceeds the trip level setting, the LCO and the required surveillance testing for the system or loop shall apply.

Average planar LHGR. LHGR. and MCPR The APLHGR, LHGR, and MCPR shall be checked daily to determine if fuel burnup, or control rod movement has caused changes in power distribution. Since changes due to burnup are slow, and only a few control rods are moved daily, a daily check of power distribution is adequate.

BFN 3.5/4.5-37 l Unit 3 1