Text

Technical Specification Bases 3.3
	ML20134H889
Person / Time
Site:	Grand Gulf
Issue date:	05/12/2020
From:	Siva Lingam; NRC/NRR/DORL/LPL4
To:	;
	Lingam S
References
	Download: ML20134H889 (321)
	v • d • e

RPS Instrumentation B 3.3.1.1 BASES BACKGROUND The RPS is comprised of two independent trip systems (A (continued) and B), with two logic channels in each trip system (logic channels A1 and A2, B1 and B2), as shown in Reference 1. The outputs of the logic channels in a trip system are combined in a one-out-of-two logic so either channel can trip the associated trip system. The tripping of both trip systems will produce a reactor scram. This logic arrangement is referred to as one-out-of-two taken twice logic. Each trip system can be reset by use of a reset switch. If a full scram occurs (both trip systems trip), a relay prevents reset of the trip systems for 10 seconds after the full scram signal is received. This 10 second delay on reset ensures that the scram function will be completed.

Two scram pilot valves are located in the hydraulic control unit (HCU) for each control rod drive (CRD). Each scram pilot valve is solenoid operated, with the solenoids normally energized. The scram pilot valves control the air supply to the scram inlet and outlet valves for the associated CRD. When either scram pilot valve solenoid is energized, air pressure holds the scram valves closed and, therefore, both scram pilot valve solenoids must be de-energized to cause a control rod to scram.

The scram valves control the supply and discharge paths for the CRD water during a scram. One of the scram pilot valve solenoids for each CRD is controlled by trip system A, and the other solenoid is controlled by trip system B. Any trip of trip system A in conjunction with any trip in trip system B results in de-energizing both solenoids, air bleeding off, scram valves opening, and control rod scram.

The backup scram valves, which energize on a scram signal to depressurize the scram air header, are also controlled by the RPS.

Additionally, the RPS System controls the SDV vent and drain valves such that when both trip systems trip, the SDV vent and drain valves close to isolate the SDV.

Application of TSTF-493, Rev. 4 (Ref. 17) to APRM Functions 2.a, 2.b, 2.d, 2.f; Function 9, Turbine Stop Valve Closure, and Function 10, Turbine Control Valve Fast Closure 10 CFR 50.36(c)(1)(ii)(A) requires that Technical Specifications include Limited Safety System Settings (LSSSs) for variables that have significant safety functions. LSSSs are defined by the regulation as

"...settings for automatic protective devices...so chosen that automatic protective actions will correct the abnormal situation before a safety limit is exceeded." The Analytical Limit is the limit of the process variable at (continued)

GRAND GULF B 3.3-2 LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES BACKGROUND which a protective action is initiated, as established by (continued) the safety analysis, to ensure that a safety limit (SL) is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit, therefore, ensures that the SL is not exceeded.

However, in practice, the actual settings for automatic protective channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.

The trip setpoint is a predetermined setting for a protection channel chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit, thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the channel (e.g., calibration) and uncertainties in how the channel might actually perform (e.g., repeatability), changes in the point of action of the channel over time (e.g., drift during surveillance intervals), and any other factors that may influence its actual performance (e.g., harsh accident environments). In this manner, the trip setpoint ensures that SLs are not exceeded.

Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...is capable of performing its specified safety function(s)." Relying solely on the trip setpoint to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as found" value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE because drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as found" setting of the protection channel.

Therefore, the channel would remain OPERABLE because it would have performed its safety function and the only corrective action required would be to reset the (continued)

GRAND GULF B 3.3-2a LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE environment errors (for channels that must function in harsh SAFETY ANALYSES, environments as defined by 10 CFR 50.49) are accounted for.

LCO, and APPLICABILITY The OPERABILITY of scram pilot valves and associated (continued) solenoids, backup scram valves, and SDV valves, described in the Background section, are not addressed by this LCO.

The individual Functions are required to be OPERABLE in the MODES specified in the Table that may require an RPS trip to mitigate the consequences of a design basis accident or transient. To ensure a reliable scram function, a combination of Functions is required in each MODE to provide primary and diverse initiation signals.

RPS is required to be OPERABLE in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies.

Control rods withdrawn from a core cell containing no fuel assemblies do not affect the reactivity of the core and therefore are not required to have the capability to scram. Provided all other control rods remain inserted, the RPS function is not required. In this condition, the required SDM (LCO 3.1.1, "SHUTDOWN MARGIN (SDM)") and refuel position one-rod-out interlock (LCO 3.9.2, "Refuel Position One-Rod-Out Interlock") ensure that no event requiring RPS will occur. During normal operation in MODES 3 and 4, all control rods are fully inserted and the Reactor Mode SwitchCShutdown Position control rod withdrawal block (LCO 3.3.2.1, "Control Rod Block Instrumentation") does not allow any control rod to be withdrawn. Under these conditions, the RPS function is not required to be OPERABLE.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Application of TSTF-493, Rev. 4 (Ref. 17) to APRM Functions 2.a, 2.b, 2.d, 2.f; Function 9, Turbine Stop Valve Closure; and Function 10, Turbine Control Valve Fast Closure Permissive and interlock setpoints allow blocking trips during plant startups, and restoring trips when the permissive conditions are not satisfied; however, they are not explicitly modeled in the safety analyses.

These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis before preventive or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy.

(continued)

GRAND GULF B 3.3-4 LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE The APRM subsystem is divided into four APRM/OPRM channels SAFETY ANALYSES, and four 2-Out-Of-4 Voter channels. Each APRM/OPRM channel LCO, and provides inputs to each of the four voter channels. The APPLICABILITY four voter channels are divided into two groups of two each, (continued) with each group of two providing inputs to one RPS trip system. The system is designed to allow one APRM/OPRM channel, but no voter channels, to be bypassed. A trip from any one un-bypassed APRM/OPRM channel will result in a half-trip" in all four of the voter channels, but no trip inputs to either RPS trip system. Since APRM Functions 2.a, 2.b, 2.d, and 2.f are implemented in the same hardware, these functions are combined with APRM Inop Function 2.c. Any Function 2.a, 2.b, 2.c, or 2.d trip from any two un-bypassed APRM/OPRM channels will result in a full trip in each of the four 2-Out-Of-4 Voter channels, which in turn results in two trip inputs to each RPS trip system logic channel (A1, A2, B1, and B2). Similarly, any Function 2.d or 2.f trip from any two un-bypassed APRM/OPRM channels will result in a full trip from each Voter channel. Three of the four APRM/OPRM channels and all four of the voter channels are required to be OPERABLE to ensure that no single failure will preclude a scram on a valid signal. In addition, to provide adequate coverage of the entire core, consistent with the design bases for APRM Functions 2.a, 2.b, and 2.d, at least 20 LPRM inputs, with at least three LPRM inputs from each of the four axial levels at which the LPRMs are located, must be operable for each APRM/OPRM channel. For the OPRM Upscale, Function 2.f, LPRMs are assigned to cells of four detectors. A minimum of 30 cells, each with a minimum of two LPRMs, must be OPERABLE for the OPRM Upscale Function 2.f to be OPERABLE. A total of 8 cells must be "responsive" in order for the OPRM Upscale Function 2.f to be OPERABLE. The number of "responsive" cells is defined as the number of operable cells (those having at least the minimum number of LPRMs), minus the number of "Cells Aligned Along the Instability Axis", minus the number of cells that are operable but have only D level operating LPRMs. The number of "Cells Aligned Along the Instability Axis" is defined in the COLR.

(continued)

GRAND GULF B 3.3-6a LBDCR 18136

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE 2.b. Average Power Range Monitor Fixed Neutron Flux-High SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY The Average Power Range Monitor Fixed Neutron Flux - High Function is required to be OPERABLE in MODE 1 where the potential consequences of the analyzed transients could result in the SLs (e.g., MCPR and RCS pressure) being exceeded. Although the Average Power Range Monitor Fixed Neutron Flux - High Function is assumed in the CRDA analysis that is applicable in MODE 2, the Average Power Range Monitor Neutron Flux - High, Setdown Function conservatively bounds the assumed trip and, together with the assumed IRM trips, provides adequate protection. Therefore, the Average Power Monitor Fixed Neutron Flux C High Function is not required in MODE 2.

2.c. Average Power Range Monitor-Inop Three of the four APRM/OPRM channels are required to be OPERABLE for each of the APRM Functions. This function (Inop) provides assurance that the minimum number of channels is OPERABLE.

For any APRM/OPRM channel, any time its keylock switch is in any position other than OPER, a module is unplugged, or the automatic self-test system detects a critical fault with the APRM/OPRM channel, an Inop trip is sent to all four 2-out-of-4 voter channels. Inop trips from two or more un-bypassed APRM/OPRM channels result in a trip output from all four 2-out-of-4 voter channels to their associated trip system. This Function was not specifically credited in the accident analysis, but it is retained for the RPS as required by the NRC approved licensing basis.

There is no Allowable Value for this Function.

This Function is required to be OPERABLE in the MODES where the APRM Functions are required.

(continued)

GRAND GULF B 3.3-9 LBDCR 16277

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE 2.d. Average Power Range Monitor Flow Biased Simulated SAFETY ANALYSES, Thermal Power - High (continued)

LCO, and APPLICABILITY Each APRM channel uses one total drive flow signal (continued) representative of total core flow. The total drive flow signal is generated by processing logic, part of the APRM/OPRM channel, by summing up the flow calculated from two flow transmitter signal inputs, one from each of the two recirculation loop flows. The flow processing logic OPERABILITY is part of the APRM/OPRM channel OPERABILITY requirements for this Function.

The clamped Allowable Value is based on analyses that take credit for the APRM Simulated Thermal Power - High Function for mitigating the Loss of Feedwater Heating event. The THERMAL POWER time constant of < 6 seconds is based on the fuel heat transfer dynamics and provides a signal proportional to the THERMAL POWER.

The Average Power Range Monitor Flow Biased Simulated Thermal Power - High Function is required to be OPERABLE in MODE 1 when there is the possibility of generating excessive THERMAL POWER and potentially exceeding the SL applicable to high pressure and core flow conditions (MCPR SL). During MODES 2 and 5, OTHER IRM and APRM Functions provide protection for fuel cladding integrity.

2.e 2-Out-Of-4 Voter The 2-Out-Of-4 Voter Function provides the interface between the APRM Functions, including the OPRM Upscale Function, and the final RPS trip system logic. As such, it is required to be OPERABLE in the MODES when the APRM Functions are required and is necessary to support the safety analysis applicable to each of those Functions. Therefore, the 2-Out-Of-4 Voter Function must be OPERABLE in MODES 1 and 2.

All four voter channels are required to be OPERABLE. Each voter channel includes self-diagnostic function. If any voter channel detects a critical fault in its own processing, a trip is issued from that voter channel to the associated trip system.

(continued)

GRAND GULF B 3.3-9d LBDCR 18136

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE The 2-Out-Of-4 Voter Function votes APRM Functions 2.a, 2.

SAFETY ANALYSES, b, and 2.d independently of Function 2.f. The voter also LCO, and includes separate outputs to RPS for the two independently APPLICABILITY voted sets of functions, each of which is redundant (four (continued) total outputs). Function 2.e must be declared inoperable if any of its functionality is inoperable. However, due to the independent voting of APRM trips, and the redundancy of outputs, there may be conditions where the voter function 2.e is inoperable, but trip capability for one or more of the other APRM Functions through that voter is still maintained. This may be considered when determining the condition of other APRM Functions resulting from partial inoperability of the Voter Function 2.e.

There is no Allowable Value for this Function.

2.f. Oscillation Power Range Monitor (OPRM) Upscale The OPRM Upscale trip function complies with GDC 10 and GDC 12, thereby providing protection from exceeding the fuel MCPR SL due to anticipated thermal- hydraulic power oscillations. This is accomplished by implementing the Detect and Suppress - Confirmation Density (DSS-CD) stability solution. DSS-CD introduces an enhanced detection algorithm, the Confirmation Density Algorithm (CDA) to the Option III stability solution, which reliably detects the inception of power oscillations and generates an early power suppression trip signal prior to any significant oscillation amplitude growth and MCPR degradation.

References 12 describes DSS-CD and licensing basis for the CDA. It also describes the DSS-CD Armed Region and the three additional algorithms for detecting thermal-hydraulic instability related neutron flux oscillations: (1) the period based detection algorithm (PBDA), (2) the amplitude based algorithm (ABA), and (3) the growth rate algorithm (GRA). All four algorithms are implemented in the OPRM Upscale trip function; however the safety analysis takes credit only for the CDA. The remaining three algorithms provide defense-in-depth and additional protection against unanticipated oscillations. OPRM Upscale trip function OPERABILITY is based only on the CDA.

The hardware design is unchanged from the Option III solution described in Reference 15 while the firmware/software is modified relative to Option III to reflect the CDA to the Option III algorithms.

The OPRM Upscale Function receives input signals from the LPRMs, which are combined into "cells" for evaluation by the OPRM algorithms.

DSS-CD operability requires at least eight responsive OPRM cells per channel.

(continued)

GRAND GULF B 3.3-9e LBDCR 18069

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE The OPRM Upscale Function is required to be OPERABLE when SAFETY ANALYSES the plant is t 16.8% RTP, which is established as a power LCO and level that is greater than or equal to 5% below the APPLICABILITY lower boundary of the Armed Region. This requirement is (continued) designed to encompass the region of power-flow operation where anticipated events could lead to thermal-hydraulic instability and related neutron flux oscillations. The OPRM Upscale Function is automatically trip-enabled when THERMAL POWER, as indicated by the APRM Simulated Thermal Power, is t to 21.8% RTP corresponding to the plant-specific MCPR monitoring threshold and reactor recirculation drive flow, is < 75% of rated flow. This region is the OPRM Armed Region. Note h allows for entry into the DSS-CD Armed Region without automatic arming of DSS-CD prior to completely passing though the DSS-CD Armed Region during both a single startup and a single shutdown following DSS-CD implementation.

An OPRM Upscale trip is issued from an OPRM channel when the CDA in that channels detects oscillatory changes in the neutron flux indicated by periodic confirmations and amplitude exceeding specified setpoints for a specified number of OPRM cells in the channel. An OPRM Upscale trip is also issued from the channel if any of the defense-in-depth algorithms (PBDA, ABA, and GRA) exceed trip conditions for one or more cells in that channel.

Three of the four channels are required to be OPERABLE. Each channel is capable of detecting thermal-hydraulic instabilities, by detecting the related neutron flux oscillations, and issuing a trip signal before the MCPR SL is exceeded There is no Allowable Value for this function. The setpoint for the OPRM Upscale CDA is specified in the COLR.

The OPRM Upscale function settings are not traditional instrumentation setpoints determined under an instrument setpoint methodology. In accordance with the NRC Safety Evaluation for Amendment 188 (Reference 13), the OPRM Upscale trip function is not LSSS SL-related. Reference 20 confirms the OPRM Upscale trip function settings based on DSS-CD also do not have traditional instrumentation setpoints determined under an instrument setpoint methodology.

(continued)

GRAND GULF B 3.3-9f LBDCR 16070

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE 8.a, b. Scram Discharge Volume Water Level - High SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY in MODES 1 and 2, and in MODE 5 with any control rod withdrawn from a core cell containing one or more fuel assemblies, since these are the MODES and other specified conditions when control rods are withdrawn. At all other times, this Function may be bypassed.

9. Turbine Stop Valve Closure, Trip Oil Pressure - Low Closure of the TSVs results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, a reactor scram is initiated at the start of TSV closure in anticipation of the transients that would result from the closure of these valves. The Turbine Stop Valve Closure, Trip Oil Pressure -

Low Function is the primary scram signal for the turbine trip event analyzed in Reference 4. For this event, the reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the End of Cycle Recirculation Pump Trip (EOC-RPT) System, ensures that the MCPR SL is not exceeded.

Turbine Stop Valve Closure, Trip Oil Pressure - Low signals are initiated by the electrohydraulic control (EHC) fluid pressure at each stop valve. Two independent pressure transmitters are associated with each stop valve. One of the two transmitters provides input to RPS trip system A; the other, to RPS trip system B. Thus, each RPS trip system receives an input from four Turbine Stop Valve Closure, Trip Oil Pressure - Low channels, each consisting of one pressure transmitter. The logic for the Turbine Stop Valve Closure, Trip Oil Pressure - Low Function is such that three or more TSVs must be closed to produce a scram.

This Function must be enabled at THERMAL POWER 35.4% RTP, which is the Analytical Limit. This is normally accomplished automatically by reactor power signals derived from the power range neutron monitoring system.

(continued)

GRAND GULF B 3.3-15 LBDCR 14027

RPS Instrumentation B 3.3.1.1 BASES

APPLICABLE 10. Turbine Control Valve Fast Closure, Trip Oil SAFETY ANALYSES, Pressure-Low (continued)

LCO, and APPLICABILITY with each control valve, the signal from each transmitter being assigned to a separate RPS logic channel. This Function must be enabled at THERMAL POWER 35.4% RTP. This is normally accomplished automatically by reactor power signals derived from the power range neutron monitoring system. The basis for the setpoint of this automatic bypass is identical to that described for the Turbine Stop Valve Closure, Trip Oil Pressure - Low Function.

The Turbine Control Valve Fast Closure, Trip Oil Pressure -

Low Allowable Value is selected high enough to detect imminent TCV fast closure.

Four channels of Turbine Control Valve Fast Closure, Trip Oil Pressure - Low Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. This Function is required, consistent with the analysis assumptions, whenever THERMAL POWER is 35.4% RTP. This Function is not required when THERMAL POWER is < 35.4% RTP since the Reactor Vessel Steam Dome Pressure - High and the Average Power Range Monitor Fixed Neutron Flux - High Functions are adequate to maintain the necessary safety margins.

11. Reactor Mode Switch-Shutdown Position The Reactor Mode Switch - Shutdown Position Function provides signals, via the manual scram logic channels, that are redundant to the automatic protective instrumentation channels and provide manual reactor trip capability. This Function was not specifically credited in the accident analysis, but it is retained for the RPS as required by the NRC approved licensing basis.

The reactor mode switch is a single switch with four channels, each of which inputs into one of the RPS logic channels.

(continued)

GRAND GULF B 3.3-17 LBDCR 14027

RPS Instrumentation B 3.3.1.1 BASES

ACTIONS B.1 and B.2 (continued) of extensive numbers of inoperabilities affecting all diverse Functions, and the low probability of an event requiring the initiation of a scram.

Alternately, if it is not desired to place the inoperable channels (or one trip system) in trip (e.g., as in the case where placing the inoperable channel or associated trip system in trip would result in a scram or RPT), Condition D must be entered and its Required Action taken.

As noted, Condition B is not applicable to APRM Functions 2.a, 2.b, 2.c, 2.d, or 2.f. Inoperability of one required APRM/OPRM channel affects both trip systems and is not associated with a specific trip system, as are the APRM 2-Out-Of-4 Voter and other non-APRM/OPRM channels for which Condition B applies. For an inoperable APRM/OPRM channel, Required Action A.1 must be satisfied, and is the only action (other than restoring OPERABILITY) that will restore capability to accommodate a single failure. Inoperability of more than one required APRM/OPRM channel of the same trip function results in loss of trip capability and entry into Condition C, as well as entry into Condition A for each channel. Because Conditions A and C provide Required Actions that are appropriate for the inoperability of APRM Functions 2.a, 2.b, 2.c, 2.d, and 2.f, and these functions are not associated with specific trip systems as are the APRM 2-Out-Of-4 Voter and other non-APRM channels, Conditions B does not apply.

C.1 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same trip system for the same Function result in the Function not maintaining RPS trip capability.

A Function is considered to be maintaining RPS trip capability when sufficient channels are OPERABLE or in trip (or the associated trip system is in trip), such that both trip systems will generate a trip signal from the given Function on a valid signal. For the typical Function with one-out-of-two taken twice logic and the IRM and APRM Functions, this would require both trip systems to have one channel OPERABLE or in trip (or the associated trip system (continued)

GRAND GULF B 3.3-21 LBDCR 16277

RPS Instrumentation B 3.3.1.1 BASES

ACTIONS C.1 (continued) in trip). For Function 6 (Main Steam Isolation Valve -

Closure), this would require both trip systems to have each channel associated with the MSIVs in three MSLs (not necessarily the same MSLs for both trip systems), OPERABLE or in trip (or the associated trip system in trip). For Function 9 (Turbine Stop Valve Closure, Trip Oil Pressure -

Low), this would require both trip systems to have three channels, each OPERABLE or in trip (or the associated trip system in trip).

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

D.1 Required Action D.1 directs entry into the appropriate Condition referenced in Table 3.3.1.1-1. The applicable Condition specified in the table is Function and MODE or other specified condition dependent and may change as the Required Action of a previous Condition is completed. Each time an inoperable channel has not met any Required Action of Condition A, B, or C, and the associated Completion Time has expired, Condition D will be entered for that channel and provides for transfer to the appropriate subsequent Condition.

E.1, F.1, G.1, and H.1 If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. The Completion Times are reasonable, based on operating experience, to reach the specified condition from full power conditions in an orderly manner and without challenging plant systems. In addition, the Completion Time of Required Actions E.1 is consistent with the Completion Time provided in LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)."

(continued)

GRAND GULF B 3.3-22 LBDCR 16070

RPS Instrumentation B 3.3.1.1 BASES

ACTIONS I.1 (continued)

If the channel(s) is not restored to OPERABLE status or placed in trip (or the associated trip system placed in trip) within the allowed Completion Time, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by immediately initiating action to fully insert all insertable control rods in core cells containing one or more fuel assemblies. Control rods in core cells containing no fuel assemblies do not affect the reactivity of the core and are, therefore, not required to be inserted. Action must continue until all insertable control rods in core cells containing one or more fuel assemblies are fully inserted. Subsequently, if the manual scram channels are inoperable, the reactor mode switch is locked in the shutdown position to prevent inadvertent control rod withdrawals.

J.1 If OPRM Upscale trip capability is not maintained, Condition J exists and Backup Stability Protection (BSP) is required.

The Manual BSP Regions are described in Reference 12. The Manual BSP Regions are procedurally established consistent with the guidelines identified in Reference 12 and require specified manual operator actions if certain predefined operational conditions occur.

The Completion Time of immediate is based on the importance of limiting the period of time during which no automatic or alternate detect and suppress trip capability is in place.

J. 2 Action J.2 is required to be taken if OPRM Upscale trip capability is not maintained. As described in Section 7.4 of Reference 12, the Automated BSP Scram Region is designed to avoid reactor instability by automatically preventing entry into the region of the power and flow operating map that is susceptible to reactor instability. The reactor trip would be initiated by the modified APRM flow-biased scram setpoints for flow reduction events that would have terminated in the Manual BSP Region I. The Automated BSP Scram Region ensures an early scram and SLMCPR protection.

The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to complete the specified action is reasonable, based on operational experience, and based on the importance of restoring an automatic reactor trip for thermal hydraulic instability events.

(continued GRAND GULF B 3.3-23 LBDCR 16070

RPS Instrumentation B 3.3.1.1 BASES

ACTIONS J.3 (continued)

Backup Stability Protection is intended as a temporary means to protect against thermal-hydraulic instability events.

The reporting requirements of Specification 5.6.7 to submit an OPRM report documents the corrective actions and schedule to restore the required channels to an OPERABLE status.

Submitting the report in 90 days from entering Condition J is adequate to allow time to evaluate the cause of the inoperability and to determine the appropriate corrective actions and schedule to restore the required channels to OPERABLE status.

K.1 If the Actions for Condition J are not completed within the associated Completion Times, then Action K.1 is required.

The Bases for the Manual BSP Regions and associated Completion Time is addressed in the Bases for J.1. The Manual BSP Regions are required in conjunction with the BSP Boundary.

K.2 The BSP Boundary, as described in Section 7.3 of Reference 12, defines an operating domain where potential instability events can be effectively addressed by the specified BSP manual operator actions. The BSP Boundary is constructed such that the immediate final statepoint for a flow reduction event initiated from this boundary and terminated at the core natural circulation line (NCL) would not exceed the Manual BSP Region I stability criterion. Potential instabilities would develop slowly as a result of the feedwater temperature transient (Reference 12).

The Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to complete the specified actions is reasonable, based on operational experience, to reach the specific condition from full power conditions in an orderly manner and without challenging plant system.

K.3 Backup Stability Protection (BSP) is a temporary means for protection against thermal-hydraulic instability events. An extended period of inoperability without automatic trip capability is not justified. Consequently, the required channels are required to be restored to OPERABLE status within 120 days.

Based on engineering judgment, the likelihood of an instability event that could not be adequately handled by the use of the BSP Regions (see Action K.1) and the BSP Boundary (see Action K.2) during a 120-day period is negligibly small. The 120-day period is intended to GRAND GULF B 3.3-23a LBDCR 16070

RPS Instrumentation B 3.3.1.1 BASES

ACTIONS K.3 (continued) allow for the case where limited design changes or extensive analysis might be required to understand or correct some unanticipated characteristic of the instability detection algorithms or equipment. This action is not intended and was not evaluated as a routine alternative to returning failed or inoperable equipment to OPERABLE status.

Correction of routine equipment failure or inoperability is expected to normally be accomplished within the completion times allowed for Actions for Conditions A and B.

A note is provided to indicate that LCO 3.0.4 is not applicable. The intent of the note is to allow plant startup while operating with the 120 day Completion Time for Action K.3. The primary purpose of this exclusion is to allow an orderly completion of design and verification activities, in the event of a required design change, without undue impact on plant operation.

L.1 If the required channels are not restored to OPERABLE status and the Actions of Condition K are not met within the associated Completion Times, then the plant must be placed in an operating condition in which the LCO does not apply.

To achieve this status, the plant must be brought to < 16.8%

RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reach the specified operating power level from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RPS REQUIREMENTS instrumentation Function are located in the SRs column of Table 3.3.1.1-1.

The Surveillances are modified by a Note to indicate that, when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the RPS reliability analysis (Ref. 9) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RPS will trip when necessary.

(continued)

GRAND GULF B 3.3-23b LBDCR 16070

RPS Instrumentation B 3.3.1.1 BASES

SURVEILLANCE SR 3.3.1.1.1 and SR 3.3.1.1.19 REQUIREMENTS (continued) Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift on one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The agreement criteria include an expectation of overlap when transitioning between neutron flux instrumentation. The overlap between SRMs and IRMs must be demonstrated prior to withdrawing SRMs from the fully inserted position since indication is being transitioned from SRMs to the IRMs. This will ensure that reactor power will not be increased into a neutron flux region without adequate indication. The overlap between IRMs and APRMs is of concern when reducing power into the IRM range.

On power increases, the system design will prevent further increases (by initiating a rod block) if adequate overlap is not maintained.

Overlap between IRMs and APRMs exists when sufficient IRMs and APRMs concurrently have on-scale readings such that the transition between MODE 1 and MODE 2 can be made without either APRM downscale rod block, or IRM upscale rod block. Overlap between SRMs and IRMs similarly exists when, prior to withdrawing the SRMs from the fully inserted position, IRMs are above 2/40 on range 1 before SRMs have reached the upscale rod block.

If overlap for a group of channels is not demonstrated (e.g., IRM/APRM overlap), the reason for the failure of the Surveillance should be determined and the appropriate channel(s) that are required in the current MODE or condition should be declared inoperable.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-23c LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES

SURVEILLANCE SR 3.3.1.1.2 REQUIREMENTS (continued) To ensure that the APRMs are accurately indicating the true core average power, the APRMs are calibrated to the reactor power calculated from a heat balance. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

A restriction to satisfying this SR when < 21.8% RTP is provided that requires the SR to be met only at 21.8% RTP because it is difficult to accurately maintain APRM indication of core THERMAL POWER consistent with a heat balance when < 21.8% RTP. At low power levels, a high degree of accuracy is unnecessary because of the large inherent margin to thermal limits (MCPR and APLHGR). At 21.8% RTP, the Surveillance is required to have been satisfactorily performed in accordance with SR 3.0.2. A Note is provided which allows an increase in THERMAL POWER above 21.8% if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reaching or exceeding 21.8% RTP. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

SR 3.3.1.1.3 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

As noted, SR 3.3.1.1.3 is not required to be performed when entering MODE 2 from MODE 1 since testing of the MODE 2 required IRM and APRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads, or movable links. This allows entry into MODE 2 if the Frequency is not met per SR 3.0.2. In this event, the SR must be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after entering MODE 2 from MODE 1.

Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

(continued)

GRAND GULF B 3.3-24 LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.3 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.4 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended Function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.5 and SR 3.3.1.1.6 Deleted (continued)

GRAND GULF B 3.3-25 LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.7 REQUIREMENTS (continued) LPRM gain settings are determined from the Core power distribution calculated by the Core Performance Monitoring system based on the local flux profiles measured by the Traversing Incore Probe (TIP) System.

Clean Page B 3.3-26This establishes the relative local flux profile for appropriate representative input to the APRM System. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.8 and SR 3.3.1.1.11 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.8 for the designated function is modified by two Notes identified in Table 3.3.1.1.1. The first Note requires evaluation of channel performance for the condition where the as found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluating channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in channel performance prior to returning the channel to service.

Performance of these channels will be evaluated under the Corrective Action Program. Entry into the Corrective action Program ensures required review and documentation of the condition to establish a reasonable expectation for continued OPERABILITY.

The second Note requires that the as-left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP issued in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.

If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.

The second Note also requires the NTSP and the methodologies for calculating the as-left and the as-found tolerances to be in the Technical Requirements Manual.

(continued)

GRAND GULF B 3.3-26 LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.9 REQUIREMENTS (continued) The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.1.1-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.9 for the designated function is modified by two Notes identified in Table 3.3.1.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluating channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in channel performance prior to returning the channel to service.

Performance of these channels will be evaluated under the Corrective Action Program. Entry into the Corrective Action Program ensures required review and documentation of the condition to establish a reasonable expectation for continued OPERABILITY.

The second Note requires that the as-left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP issued in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained.

If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable.

The second Note also requires the NTSP and the methodologies for calculating the as-left and the as-found tolerances to be in the Technical Requirements Manual.

(continued)

GRAND GULF B 3.3-27 LBDCR 18114

PAGE INTENTIONALLY LEFT BLANK RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.10, SR 3.3.1.1.12 and SR 3.3.1.1.17 REQUIREMENTS A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

Note 1 states that neutron detectors are excluded from CHANNEL CALIBRATION because of the difficulty of simulating a meaningful signal.

Changes in neutron detector sensitivity are compensated for by performing the calorimetric calibration (SR 3.3.1.1.2) and the LPRM calibration against the TIPs (SR 3.3.1.1.7). A second Note is provided that requires the APRM and IRM SRs to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1. Testing of the MODE 2 APRM and IRM Functions cannot be performed in MODE 1 without utilizing jumpers, lifted leads or movable links. This Note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2. Twelve hours is based on operating experience and in consideration of providing a reasonable time in which to complete the SR.

Note 3 to SR 3.3.1.1.10 states that the APRM recirculation flow transmitters are excluded from CHANNEL CALIBRATION of Function 2.d, Average Power Range Monitor Flow Biased Simulated Thermal Power -

High.

SR 3.3.1.1.10 and SR 3.3.1.1.12 for the designated function is modified by two notes identified in Table 3.3.1.1-1. The first note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluating channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in channel performance prior to returning the channel to service. Performance of these channels will be evaluated under the Corrective Action Program. Entry into the Corrective Action Program ensures required review and documentation of the condition to establish a reasonable expectation for continued OPERABILITY.

(continued)

GRAND GULF B 3.3-27a LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.10, SR 3.3.1.1.12 and SR 3.3.1.1.17(continued)

REQUIREMENTS (continued)

The second note requires that the as-left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP). Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable. The second note also requires the NTSP and the methodologies for calculating the as-left and the as-found tolerances to be in the Technical Requirements Manual The only analog components involved with main signal processing are input isolation amplifiers (one per LPRM and one per flow input), a sample-and-hold circuit, and an analog-to-digital (A/D) converter. These analog components are highly reliable and very stable with virtually no drift. In addition, the sample-and-hold circuit and A/D converters are tested as part of the automatic self-test.

The processing hardware for the APRM Functions is digital and has no drift. One of the most sensitive signals, the flow processing, is automatically compared between channels. Any digital failures will be identified by the automatic self-test, CHANNEL CHECK, or in very rare cases by the CHANNEL FUNCTIONAL TEST.

The automatic self-test includes steps that check the performance and accuracy of the sample and hold circuits and the A/D converters, and the related processing. Self-test logic also periodically tests the input amplifiers and processing for accuracy. In addition, CHANNEL FUNCTIONAL TESTS include an automated "cal check" which will check the performance of all of the analog amplifiers and the entire processing loop.

The combined improvement justifies the factor-of-four increase in calibration interval, particularly in that the calibration will actually be checked at the CHANNEL FUNCTIONAL TEST and self-test frequencies.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-27b LBDCR 18114

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.13 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The functional testing of control rods, in LCO 3.1.3, "Control Rod OPERABILITY," and SDV vent and drain valves, in LCO 3.1.8, "Scram Discharge Volume (SDV) Vent and Drain Valves," overlaps this Surveillance to provide complete testing of the assumed safety function.

The LOGIC SYSTEM FUNCTIONAL TEST for APRM Function 2.e simulates APRM and OPRM trip conditions at the 2-out-of-4 Voter channel inputs to check all combinations of two tripped inputs to the 2-out-of-4 logic in the voter channels and APRM related redundant RPS relays. The test is only required to include the voting logic of the 2-out-of-4 Voter channels and RPS relays not tested as part of the CHANNEL FUNCIONAL TEST.

The periodic LPRM calibrations provide an indirect test of LPRM interfaces including detectors. The design of the APRM/OPRM instrumentation allows virtually all testing and routine adjustments to be performed with no changes to the configuration (e.g., no disconnecting wires), so the risk of problems caused by the normal operation of the system is greatly reduced.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.14 This SR ensures that scrams initiated from the Turbine Stop Valve Closure, Trip Oil Pressure - Low and Turbine Control Valve Fast Closure, Trip Oil Pressure - Low Functions will not be inadvertently bypassed when THERMAL POWER is 35.4% RTP. This involves calibration of the bypass channels. Adequate margins for the instrument setpoint methodology are incorporated into the actual setpoint.

If any bypass channel setpoint is nonconservative (i.e., the Functions are bypassed at 35.4% RTP, then the affected Turbine Stop Valve, Trip Oil Pressure - Low and Turbine Control Valve Fast Closure, Trip Oil Pressure

- Low Functions are considered inoperable. Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel is considered OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-28 LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES SURVEILLANCE SR 3.3.1.1.15 (continued)

REQUIREMENTS RPS RESPONSE TIME for the APRM 2-Out-Of-4 Voter Function 2.e includes the output relays of the voter and the associated RPS relays and contactors. (The digital portion of the APRM and 2-Out-Of-4 Voter channels are excluded from RPS RESPONSE TIME testing because self-testing and calibration checks the time base of the digital electronics.

Confirmation of the time base is adequate to assure required response times are met. Neutron detectors are excluded from RPS RESPONSE TIME testing because the principles of detector operation virtually ensure an instantaneous response time.) This test may be performed in one measurement or in overlapping segments, with verification that all associated components are tested.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.1.16 and SR 3.3.1.1.18 Deleted GRAND GULF B 3.3-29a LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES (continued)

SURVEILLANCE SR 3.3.1.1.20 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

For the APRM Functions, this test supplements the automatic self-test functions that operate continuously in the APRM/OPRM and voter channels. The CHANNEL FUNCTIONAL TEST covers the APRM/OPRM channels (including recirculation flow processing -- applicable to Function 2.b only), the 2-Out-Of-4 Voter channels, and the interface connections into the RPS trip systems from the voter channels. Any setpoint adjustment shall be consistent with the assumptions of the current plant-specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Note 1 is provided for APRM Function 2.a that requires this SR to be performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 from MODE 1. Testing the MODE 2 APRM Function cannot be performed in MODE 1 without utilizing jumpers or lifted leads. This note allows entry into MODE 2 from MODE 1 if the associated Frequency is not met per SR 3.0.2.

Note 2 is provided for APRM Functions 2.a, 2.b, and 2.c to clarify the APRM/OPRM channels and 2-Out-Of-4 Voter channels are included in the CHANNEL FUNCTIONAL TEST.

Note 3 is provided for APRM Functions 2.d and 2.f to clarify the APRM/OPRM channels and the 2-Out-Of-4 Voter channels plus the flow input function, excluding the flow transmitters, are included in the CHANNEL FUNCTIONAL TEST.

(continued)

GRAND GULF B 3.3-29b LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES (continued)

REFERENCES 1. UFSAR, Figure 7.2-1.

2. UFSAR, Section 5.2.2.

3. UFSAR, Section 6.3.3.

4. UFSAR, Chapter 15.

5. UFSAR, Section 15.4.1.

6. NEDO-23842, "Continuous Control Rod Withdrawal in the Startup Range," April 18, 1978.

7. UFSAR, Section 15.4.9.

(continued)

GRAND GULF B 3.3-29c LBDCR 18127

RPS Instrumentation B 3.3.1.1 BASES REFERENCES 8. Letter, P. Check (NRC) to G. Lainas (NRC), BWR (continued) Scram Discharge System Safety Evaluation, December 1, 1980, as attached to NRC Generic Letter dated December 9, 1980.

9. NEDO-30851-P-A, Technical Specification Improvement Analyses for BWR Reactor Protection System, March 1988.

10. NEDO-32291-A, System Analyses for Elimination of Selected Response Time Testing Requirements, October 1995.

11. GNRI-97/00181, Amendment 133 to the Operating License.

12. NEDC-33075P, General Electric Boiling Water Reactor Detect and Suppress Solution - Confirmation Density, Revision 7.

13. NRC letter to Entergy Operations, Inc., Grand Gulf Nuclear Station, Unit 1 - Issuance of Amendment Re:

Power Range Neutron Monitoring System Replacement (TAC No. ME2531), March 28, 2012 (TS Amendment 188)

14. Deleted

15. NEDC-32410-P-A, Nuclear Measurement Analysis and Control - Power Range Neutron Monitor (NUMAC PRNM)

Retrofit Plus Option III Stability trip Function, Vols 1 and 2, and Supplement 1

16. Deleted

17. TSTF-493, Clarify Application of Setpoint Methodology for LSSS Functions GRAND GULF B 3.3-30 LBDCR 16070

>>XY

í

Ç

"& #9F 1@F $'!%:F 4*>)AF B67+F D52F ;3F (.8<5?-/=F

Z[

,C,F 0EF

²\

F F

F

¬¸; É 4a

çf ¢^

Ã

Ñ W

<=£u³Å

§&.

¨ *ŽzAVKfBgCDh

{lS '/

i

ł

t ] _`?

?>s 1/4 n 1/2}T(0

'3/4E FG

J~U° *2

ó 5

6

¥b ! 7

x8

Ø -

$

cd@

¹Mµ)v1 xoN

w+/-n Ú ÷

-HIL ! Â Ü -œ e ø OPQ

%

ij

©k

3+º " ú #é9

û ü " :

lm ý ,

y¶¿R ÿá

â - #

zpq

<<r

!* &* * * $* '"#* ) %* (*

SRM Instrumentation B 3.3.1.2 BASES

SURVEILLANCE SR 3.3.1.2.1 and SR 3.3.1.2.3 (continued)

REQUIREMENTS gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.1.2.2 To provide adequate coverage of potential reactivity changes in the core, one SRM is required to be OPERABLE in the quadrant where CORE ALTERATIONS are being performed, and the other OPERABLE SRM must be in an adjacent quadrant containing fuel. Note 1 states that this SR is required to be met only during CORE ALTERATIONS. It is not required to be met at other times in MODE 5 since core reactivity changes are not occurring. This Surveillance consists of a review of plant logs to ensure that SRMs required to be OPERABLE for given CORE ALTERATIONS are, in fact, OPERABLE. In the event that only one SRM is required to be OPERABLE, per Table 3.3.1.2-1, footnote (b), only the

a. portion of this SR is required. Note 2 clarifies that more than one of the three requirements can be met by the same OPERABLE SRM. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-36 LBDCR 18127

SRM Instrumentation B 3.3.1.2 BASES

SURVEILLANCE SR 3.3.1.2.4 REQUIREMENTS (continued) This Surveillance consists of a verification of the SRM instrument readout to ensure that the SRM reading is greater than a specified minimum count rate. This ensures that the detectors are indicating count rates indicative of neutron flux levels within the core. Verification of the signal to noise ratio also ensures that the detectors are inserted to a normal operating level. In a fully withdrawn condition, the detectors are sufficiently removed from the fueled region of the core to essentially eliminate neutrons from reaching the detector. Any count rate obtained while fully withdrawn is assumed to be "noise" only. With few fuel assemblies loaded, the SRMs will not have a high enough count rate to satisfy the SR. Therefore, allowances are made for loading sufficient "source" material, in the form of irradiated fuel assemblies, to establish the minimum count rate.

To accomplish this, the SR is modified by a Note that states that the count rate is not required to be met on an SRM that has less than or equal to four fuel assemblies adjacent to the SRM and no other fuel assemblies are in the associated core quadrant. With four or less fuel assemblies loaded around each SRM and no other fuel assemblies in the associated quadrant, even with a control rod withdrawn the configuration will not be critical.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.1.2.5 Performance of a CHANNEL FUNCTIONAL TEST demonstrates the associated channel will function properly.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-37 LBDCR 18127

SRM Instrumentation B 3.3.1.2 BASES

SURVEILLANCE SR 3.3.1.2.5 (continued)

REQUIREMENTS The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being otherwise verified to be OPERABLE (i.e., satisfactorily performing the CHANNEL CHECK) and the time required to perform the Surveillances.

SR 3.3.1.2.6 Performance of a CHANNEL CALIBRATION verifies the performance of the SRM detectors and associated circuitry. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The neutron detectors are excluded from the CHANNEL CALIBRATION because they cannot readily be adjusted. The detectors are fission chambers that are designed to have a relatively constant sensitivity over the range, and with an accuracy specified for a fixed useful life.

The Note to the Surveillance allows the Surveillance to be delayed until entry into the specified condition of the Applicability. The SR must be performed in MODE 2 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months of entering MODE 2 with IRMs on Range 2 or below. The allowance to enter the Applicability with the Frequency not met is reasonable, based on the limited time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed after entering the Applicability and the inability to perform the Surveillance while at higher power levels. Although the Surveillance could be performed while on IRM Range 3, the plant would not be expected to maintain steady state operation at this power level. In this event, the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable, based on the SRMs being (continued)

GRAND GULF B 3.3-38 LBDCR 18127

PBDS Deleted B 3.3 INSTRUMENTATION B 3.3.1.3 Deleted Pages B 3.3-39a through B 3.3-39i have been deleted.

GRAND GULF B 3.3-39a LBDCR 10027

Control Rod Block Instrumentation B 3.3.2.1 B 3.3 INSTRUMENTATION B 3.3.2.1 Control Rod Block Instrumentation BASES BACKGROUND Control rods provide the primary means for control of reactivity changes. Control rod block instrumentation includes channel sensors, logic circuitry, switches, and relays that are designed to ensure that specified fuel design limits are not exceeded for postulated transients and accidents. During high power operation, the rod withdrawal limiter (RWL) provides protection for control rod withdrawal error events. During low power operations, control rod blocks from the rod pattern controller (RPC) enforce specific control rod sequences designed to mitigate the consequences of the control rod drop accident (CRDA).

During shutdown conditions, control rod blocks from the Reactor Mode Switch C Shutdown Position ensure that all control rods remain inserted to prevent inadvertent criticalities.

The purpose of the RWL is to limit control rod withdrawal to preclude a MCPR Safety Limit (SL) violation. The RWL supplies a trip signal to the Rod Control and Information System (RCIS) to appropriately inhibit control rod withdrawal during power operation equal to or greater than the low power setpoint (LPSP). The RWL has two channels, either of which can initiate a control rod block when the channel output exceeds the control rod block setpoint. The rod block logic circuitry in the RCIS is arranged as two redundant and separate logic circuits. These circuits are energized when control rod movement is allowed. The output of each logic circuit is coupled to a comparator by the use of isolation devices in the rod drive control cabinet. The two logic circuit signals are compared and rod blocks are applied when either circuit trip signal is present. Control rod withdrawal is permitted only when the two signals agree.

Each rod block logic circuit receives control rod position indication from a separate channel of the Rod Position Information System, each with a set of reed switches for control rod position indication. Control rod position is the primary data input for the RWL. The power range neutron monitoring system is used to determine reactor power level, with an LPSP and a high power setpoint (HPSP) used to determine allowable control rod withdrawal distances. Below the LPSP, the RWL is automatically bypassed (Ref. 1).

(continued)

GRAND GULF B 3.3-40 LBDCR 14027

Control Rod Block Instrumentation B 3.3.2.1 BASES BACKGROUND The purpose of the RPC is to ensure control rod patterns (continued) during startup are such that only specified control rod sequences and relative positions are allowed over the operating range from all control rods inserted to 10% RTP.

The sequences effectively limit the potential amount and rate of reactivity increase during a CRDA. The RPC, in conjunction with the RCIS, will initiate control rod withdrawal and insert blocks when the actual sequence deviates beyond allowances from the specified sequence. The rod block logic circuitry is the same as that described above. The RPC also uses the power range neutron monitoring system to determine when reactor power is above the power at which the RPC is automatically bypassed (Ref. 1).

With the reactor mode switch in the shutdown position, a control rod withdrawal block is applied to all control rods to ensure that the shutdown condition is maintained. This function prevents criticality resulting from inadvertent control rod withdrawal during MODE 3 or 4, or during MODE 5 when the reactor mode switch is required to be in the shutdown position. The reactor mode switch has two channels, with each providing inputs into a separate rod block circuit. A rod block in either circuit will provide a control rod block to all control rods.

APPLICABLE 1.a. Rod Withdrawal Limiter SAFETY ANALYSES, LCO, and The RWL is designed to prevent violation of the MCPR SL APPLICABILITY and the cladding 1% plastic strain fuel design limit that may result from a single control rod withdrawal error (RWE) event. The analytical methods and assumptions used in evaluating the RWE event are summarized in Reference 2. A statistical analysis of RWE events was performed to determine the MCPR response as a function of withdrawal distance and initial operating conditions. From these responses, the fuel thermal performance was determined as a function of RWL allowable control rod withdrawal distance and power level.

The RWL satisfies Criterion 3 of the NRC Policy Statement.

Two channels of the RWL are available and are required to be OPERABLE to ensure that no single instrument failure can preclude a rod block from this Function. The RWL high power function channels are OPERABLE when control rod withdrawal is limited to no more than two notches. The RWL low power function channels are OPERABLE when control rod withdrawal is limited to no more than four notches.

(continued)

GRAND GULF B 3.3-41 LBDCR 14027

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.1, SR 3.3.2.1.2, SR 3.3.2.1.3, and REQUIREMENTS SR 3.3.2.1.4 (continued) control rod block occurs. Proper operation of the RWL is verified by SR 3.3.2.1.1 which verifies proper operation of the two-notch withdrawal limit and SR 3.3.2.1.2 which verifies proper operation of the four-notch withdrawal limit. Proper operation of the RPC is verified by SR 3.3.2.1.3 and SR 3.3.2.1.4. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. As noted, the SRs are not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after specified conditions are met (e.g., after any control rod is withdrawn in MODE 2). This allows entry into the appropriate conditions needed to perform the required SRs. The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.5 The LPSP is the point at which the RPCS makes the transition between the function of the RPC and the RWL. This transition point is automatically varied as a function of power. This power level is derived from the power range neutron monitoring system (one channel to each trip system). These power setpoints must be verified periodically to be within the Allowable Values. If any LPSP is nonconservative, then the affected Functions are considered inoperable. Since this channel has both upper and lower required limits, it is not allowed to be placed in a condition to enable either the RPC or RWL Function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.6 This SR ensures the high power function of the RWL is not bypassed when power is above the HPSP. The analytical limit for the HPSP is 70%. The power level is derived from the power range neutron monitoring system. Periodic testing of the HPSP channels is required to verify the setpoint to be less than or equal to the limit. Adequate margins in accordance with setpoint methodologies are included. If the HPSP is nonconservative, then the RWL is considered inoperable. Alternatively, the HPSP can be placed in the conservative condition (nonbypass). If placed (continued)

GRAND GULF B 3.3-46 LBDCR 19098

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.6 (continued)

REQUIREMENTS in the nonbypassed condition, the SR is met and the RWL would not be considered inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.7 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.2.1.8 The CHANNEL FUNCTIONAL TEST for the Reactor Mode Switch C Shutdown Position Function is performed by attempting to withdraw any control rod with the reactor mode switch in the shutdown position and verifying a control rod block occurs.

As noted in the SR, the Surveillance is not required to be performed until 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the reactor mode switch is in the shutdown position, since testing of this interlock with the reactor mode switch in any other position cannot be performed without using jumpers, lifted leads, or movable limits. This allows entry into MODES 3 and 4 if the Frequency is not met per SR 3.0.2.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-47 LBDCR 19098

Control Rod Block Instrumentation B 3.3.2.1 BASES SURVEILLANCE SR 3.3.2.1.9 REQUIREMENTS (continued) LCO 3.1.3 and LCO 3.1.6 may require individual control rods to be bypassed in RACS to allow insertion of an inoperable control rod or correction of a control rod pattern not in compliance with BPWS. With the control rods bypassed in the RACS, the RPC will not control the movement of these bypassed control rods. Individual control rods may also be required to be bypassed to allow continuous withdrawal for determining the location of leaking fuel assemblies, adjustment of control rod speed, or control rod scram time testing. To ensure the proper bypassing and movement of those affected control rods, a second licensed operator or other qualified member of the technical staff must verify the bypassing and movement of these control rods is in conformance with applicable analyses. As noted, only one bypassed control rod may be moved at a time. This restriction minimizes the potential rate of change of reactivity. Compliance with this SR allows the RPC and RWL to be OPERABLE with these control rods bypassed.

REFERENCES 1. UFSAR, Section 7.6.1.7.3.

2. UFSAR, Section 15.4.2.

3. NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel" (latest approved revision).

4. "Modifications to the Requirements for Control Rod Drop Accident Mitigating Systems," BWR Owners Group, July 1986.

5. NEDO-21231, "Banked Position Withdrawal Sequence,"

January 1977.

6. NRC SER, Acceptance of Referencing of Licensing Topical Report NEDE-24011-P-A, "General Electric Standard Application for Reactor Fuel, Revision 8, Amendment 17," December 27, 1987.

GRAND GULF B 3.3-48 LBDCR 18127

PAM Instrumentation B 3.3.3.1 BASES

LCO indication for valves in this state is not required to be (continued) OPERABLE. In addition, Note (b) of Table 3.3.3.1-1 requires only one position indication for those penetrations which only have one position indication provided to the control room.

Listed below is a discussion of the specified instrument Functions listed in Table 3.3.3.1-1, in the accompanying LCO.

1. Reactor Vessel Pressure Reactor vessel pressure is a Category I variable provided to support monitoring of Reactor Coolant System (RCS) integrity and to verify operation of the Emergency Core Cooling Systems (ECCS). Two independent pressure transmitters with a range of 0 psig to 1500 psig monitor pressure. Wide range recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

2, 3. Reactor Vessel Water Level Reactor vessel water level is a Category I variable provided to support monitoring of core cooling and to verify operation of the ECCS. The wide range and fuel zone water level channels provide the PAM Reactor Vessel Water Level Function. The wide range water level channels measure from 75 inches above the bottom of the dryer skirt down to a point just above the top of the active fuel. The fuel zone water level channels overlap with the wide range channels and measure down to the bottom of the active fuel. Both the wide range and the fuel zone water levels are measured by two independent differential pressure transmitters. The output from these channels is recorded on two independent recorders. These recorders are the primary indication used by the operator during an accident. Therefore, the PAM Specification deals specifically with this portion of the instrument channel.

The wide range water level instruments are uncompensated for variation in reactor water density and are calibrated to be most accurate at operational pressure and temperature.

(continued)

GRAND GULF B 3.3-51 LBDCR 11001

PAM Instrumentation B 3.3.3.1 BASES (continued)

ACTIONS A Note has been provided to modify the ACTIONS related to PAM instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable PAM instrumentation channels provide appropriate compensatory measures for separate inoperable functions. As such, a Note has been provided that allows separate Condition entry for each inoperable PAM Function.

A.1 When one or more Functions have one required channel that is inoperable, the required inoperable channel must be restored to OPERABLE status within 30 days. The 30 day Completion Time is based on operating experience and takes into account the remaining OPERABLE channel(s) (or in the case of a Function that has only one required channel, other non-Regulatory Guide 1.97 instrument channels to monitor the Function), the passive nature of the instrument (no critical automatic action is assumed to occur from these instruments), and the low probability of an event requiring PAM instrumentation during this interval.

B.1 If a channel has not been restored to OPERABLE status in 30 days, this Required Action specifies initiation of actions to prepare and submit a Special Report to the NRC. This report discusses the cause of the inoperability and identifies proposed restorative actions. The Special Report shall be submitted in accordance with 10 CFR 50.4 within 14 days of entering Condition B. This Action is appropriate in lieu of a (continued)

GRAND GULF B 3.3-57 LBDCR 19007

PAM Instrumentation B 3.3.3.1 BASES

ACTIONS E.1 (continued)

The allowed Completion Times are reasonable, based on operating experience, to reach the required plant condition from full power conditions in an orderly manner and without challenging plant systems.

F.1 Since alternate means of monitoring primary containment area radiation have been developed and tested, the Required Action is not to shut down the plant but rather to initiate actions to prepare and submit a Special Report to the NRC. These alternate means may be temporarily installed if the normal PAM channel cannot be restored to OPERABLE status within the allotted time. The report provided to the NRC should discuss the alternate means used, describe the degree to which the alternate means are equivalent to the installed PAM channels, justify the areas in which they are not equivalent, and provide a schedule for restoring the normal PAM channels. The Special Report shall be submitted in accordance with 10CFR50.4 within 14 days of entering Condition F.

SURVEILLANCE The following SRs apply to each PAM instrumentation Function REQUIREMENTS in Table 3.3.3.1-1 except as noted below.

SR 3.3.3.1.1 Performance of the CHANNEL CHECK ensures that a gross instrumentation failure has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between instrument channels could be an indication of excessive instrument drift in one of the channels or of something even more serious. CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

The high radiation instrumentation should be compared to similar plant instruments located throughout the plant.

(continued)

GRAND GULF B 3.3-59 LBDCR 18127

PAM Instrumentation B 3.3.3.1 BASES

SURVEILLANCE SR 3.3.3.1.1 (continued)

REQUIREMENTS Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including isolation, indication, and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of those displays associated with the required channels of this LCO.

SR 3.3.3.1.2 Deleted SR 3.3.3.1.3 CHANNEL CALIBRATION is a complete check of the instrument loop including the sensor. The test verifies that the channel responds to the measured parameter with the necessary range and accuracy. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

For Functions 12 and 13 the CHANNEL CALIBRATION consists of an electronic calibration of the channel, not including the detector, for range decades above 10R/hr and a one point calibration check of the detector below 10R/hr with an installed or portable gamma source. The neutron detectors are excluded from the CHANNEL CALIBRATION because they cannot readily be adjusted. The detectors are fission (continued)

GRAND GULF B 3.3-60 LBDCR 18127

Remote Shutdown System B 3.3.3.2 BASES ACTIONS A.1 (continued)

The Required Action is to restore the Function (both divisions, if applicable) to OPERABLE status within 30 days. The Completion Time is based on operating experience and the low probability of an event that would require evacuation of the control room.

B.1 If the Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reach the required MODE from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.3.3.2.1 REQUIREMENTS Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the sensor or the signal processing equipment has drifted outside its limit. As specified in the Surveillance, a CHANNEL CHECK is only required for those channels that are normally energized.

(continued)

GRAND GULF B 3.3-65 LBDCR 18127

Remote Shutdown System B 3.3.3.2 BASES SURVEILLANCE SR 3.3.3.2.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.2.2 SR 3.3.3.2.2 verifies each required Remote Shutdown System transfer switch and control circuit performs the intended function. This verification is performed from the remote shutdown panel and locally, as appropriate.

Operation of the equipment from the remote shutdown panel is not necessary. The Surveillance can be satisfied by performance of a continuity check. This will ensure that if the control room becomes inaccessible, the plant can be placed and maintained in MODE 3 from the remote shutdown panel and the local control stations. However, this Surveillance is not required to be performed only during a plant outage.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.3.2.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. The test verifies the channel responds to measured parameter values with the necessary range and accuracy.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 19.

GRAND GULF B 3.3-66 LBDCR 18127

EOC-RPT Instrumentation B 3.3.4.1 B 3.3 INSTRUMENTATION B 3.3.4.1 End of Cycle Recirculation Pump Trip (EOC-RPT) Instrumentation BASES BACKGROUND The EOC-RPT instrumentation initiates a recirculation pump trip (RPT) to reduce the peak reactor pressure and power resulting from turbine trip or generator load rejection transients to provide additional margin to core thermal MCPR Safety Limits (SLs).

The need for the additional negative reactivity in excess of that normally inserted on a scram reflects end of cycle reactivity considerations. Flux shapes at the end of cycle are such that the control rods may not be able to ensure that thermal limits are maintained by inserting sufficient negative reactivity during the first few feet of rod travel upon a scram caused by Turbine Control Valve (TCV) Fast Closure, Trip Oil Pressure -

Low, or Turbine Stop Valve (TSV) Closure, Trip Oil Pressure - Low. The physical phenomenon involved is that the void reactivity feedback due to a pressurization transient can add positive reactivity at a faster rate than the control rods can add negative reactivity. The protection functions of the EOC-RPT have been designed to ensure safe operation of the reactor during load rejection transients. This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the EOC-RPT, as well as LCOs on other system parameters and equipment performance.

Technical Specifications are required by 10 CFR 50.36 to include LSSSs for variables that have significant safety functions. LSSS are defined by the regulation as Where a limiting safety system setting is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a SL is exceeded. The Analytical Limit is the limit of the process variable at which a protective action is initiated, as established by the safety analysis, to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.

(continued)

GRAND GULF B 3.3-67 LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

BACKGROUND The trip setpoint is a predetermined setting for a protection channel (continued) chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the channel (e.g., calibration), uncertainties in how the channel might actually perform (e.g., repeatability), changes in the point of action of the channel over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the trip setpoint ensures that SLs are not exceeded.

Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as is capable of performing its specified safety function(s). Relying solely on the NTSP to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the as-found value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE because drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the as-found setting of the protection channel.

Therefore, the channel would still remain OPERABLE because it would have performed its safety function and the only corrective action required would be to reset the channel within the established as-left tolerance around the trip setpoint to account for further drift during the next surveillance interval.

Although the channel is OPERABLE under these circumstances, the trip setpoint must be adjusted to a value within the as-left tolerance, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned (as-found criteria).

However, there is also some point beyond which the channel may not be able to perform its function due to, for example, greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the channels and is designated as the Allowable Value.

(continued)

GRAND GULF B 3.3-67a LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

BACKGROUND If the actual setting (as-found setpoint) of the channel is found to be (continued) conservative with respect to the Allowable Value, but is beyond the as found tolerance, the channel is OPERABLE, but degraded. The degraded condition will be further evaluated during performance of the SR. This evaluation will consist of resetting the channel setpoint to the trip setpoint (within the allowed tolerance) and evaluating the channel response. If the channel is functioning as required and expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.

The EOC-RPT instrumentation as discussed in Reference 1 is comprised of sensors that detect initiation of closure of the TSVs, or fast closure of the TCVs, combined with relays, logic circuits, and fast acting circuit breakers that interrupt the fast speed power supply to each of the recirculation pump motors. The channels include electronic equipment (e.g., trip units) that compares measured input signals with pre-established setpoints. When the setpoint is exceeded, the channel output relay actuates, which then outputs an EOC-RPT signal to the trip logic.

When the EOC-RPT breakers trip open, the recirculation pumps downshift to slow speed. The EOC-RPT has two identical trip systems, either of which can actuate an RPT. The EOC-RPT function is met by the trip of the fast speed breakers. The slow speed breaker closure (down shift) does not have to occur to complete the EOC -RPT function.

Each EOC-RPT trip system is a two-out-of-two logic for each Function; thus, either two TSV Closure, Trip Oil Pressure - Low or two TCV Fast Closure, Trip Oil Pressure - Low signals are required for a trip system to actuate. If either trip system actuates, both recirculation pumps will trip from fast speed operation. There are two EOC-RPT breakers in series per recirculation pump. One trip GRAND GULF B 3.3-67b LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

BACKGROUND system trips one of the two EOC-RPT breakers for each (continued) recirculation pump and the second trip system trips the other EOC-RPT breaker for each recirculation pump.

APPLICABLE The TSV Closure, Trip Oil Pressure - Low and the TCV Fast SAFETY ANALYSES, Closure, Trip Oil Pressure C Low Functions are designed to LCO, and trip the recirculation pumps from fast speed operation in APPLICABILITY the event of a turbine trip or generator load rejection to mitigate the neutron flux, heat flux, and pressure transients, and to increase the margin to the MCPR SL. The analytical methods and assumptions used in evaluating the turbine trip and generator load rejection, as well as other safety analyses that assume EOC-RPT, are summarized in References 2, 3, and 4.

To mitigate pressurization transient effects, the EOC-RPT must trip the recirculation pumps from fast speed operation after initiation of initial closure movement of either the TSVs or the TCVs. The combined effects of this trip and a scram reduce fuel bundle power more rapidly than does a scram alone, resulting in an increased margin to the MCPR SL.

Alternatively, MCPR limits for an inoperable EOC-RPT as specified in the COLR are sufficient to mitigate pressurization transient effects. The EOC-RPT function is automatically disabled when the power range neutron monitoring system indicates < 35.4% RTP.

EOC-RPT instrumentation satisfies Criterion 3 of the NRC Policy Statement.

Permissive and interlock setpoints allow the blocking of trips during plant startups, and restoration of trips when the permissive conditions are not satisfied, but they are not explicitly modeled in the Safety Analyses.

These permissives and interlocks ensure that the starting conditions are consistent with the safety analysis, before preventive or mitigating actions occur. Because these permissives or interlocks are only one of multiple conservative starting assumptions for the accident analysis, they are generally considered as nominal values without regard to measurement accuracy.

The OPERABILITY of the EOC-RPT is dependent on the OPERABILITY of the individual instrumentation channel Functions. Each Function must have a required number of OPERABLE channels in each trip system, with their setpoints set within the setting tolerance of the trip setpoint where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions. Channel OPERABILITY also includes the associated EOC-RPT breakers. Each channel (including the associated EOC-RPT breakers) must also respond within its assumed response time.

(continued)

GRAND GULF B 3.3-68 LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

APPLICABLE Allowable Values are specified for each EOC-RPT Function SAFETY ANALYSES, specified in the Trip setpoints and the methodologies for calculation of LCO, and the as-left and as-found tolerances are described in the Technical APPLICABILITY Requirements Manual. The nominal setpoints are selected to ensure that (continued) the actual setponts remain conservative with respect to the as-found tolerance between successive CHANNEL CALIBRATIONS. After each calibration, the trip setpoints shall be left within the as-left band around the setpoint.

(continued)

GRAND GULF B 3.3-68a LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

APPLICABLE Trip setpoints are those predetermined values of output at SAFETY ANALYSES, which an action should take place. The setpoints are LCO, and compared to the actual process parameter (e.g., TSV position, and when APPLICABILITY the measured output value of the process parameter exceeds the (continued) setpoint, the associated device (e.g., trip unit) changes state. The analytical limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytical limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

The specific Applicable Safety Analysis, LCO, and Applicability discussions are listed below on a Function by Function basis.

Alternatively, since this instrumentation protects against a MCPR SL violation with the instrumentation inoperable, modifications to the MCPR limits (LCO 3.2.2) may be applied to allow this LCO to be met. The MCPR penalty for the Condition EOC-RPT inoperable is specified in the COLR.

Turbine Stop Valve Closure, Trip Oil Pressure - Low Closure of the TSVs and a main turbine trip result in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, an EOC-RPT is initiated on TSV Closure, Trip Oil Pressure - Low in anticipation of the transients that would result from closure of these valves. EOC-RPT decreases reactor power and aids the reactor scram in ensuring the MCPR SL is not exceeded during the worst case transient.

Closure of the TSVs is determined by measuring the EHC fluid pressure at each stop valve. There is one pressure (continued)

GRAND GULF B 3.3-69 LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

APPLICABLE transmitter associated with each stop valve, and the SAFETY ANALYSES, signal from each transmitter is assigned to a separate LCO, and trip channel. The logic for the TSV Closure, Trip Oil APPLICABILITY Pressure - Low Function is such that two or more TSVs (continued) must be closed to produce an EOC-PT. This Function must be enabled at THERMAL POWER 35.4% RTP. This is normally accomplished automatically by reactor power signals derived from the power range neutron monitoring system.

(continued)

GRAND GULF B 3.3-69a LBDCR 14027

EOC-RPT Instrumentation B 3.3.4.1 BASES

APPLICABLE Turbine Stop Valve Closure, Trip Oil Pressure - Low SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY Four channels of TSV Closure, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal. The TSV Closure, Trip Oil Pressure - Low Allowable Value is selected high enough to detect imminent TSV closure.

This protection is required, consistent with the safety analysis assumptions, whenever THERMAL POWER is 35.4% RTP with any recirculating pump in fast speed. Below 35.4% RTP or with the recirculation in slow speed, the Reactor Vessel Steam Dome Pressure - High and the Average Power Range Monitor (APRM) Fixed Neutron Flux - High Functions of the Reactor Protection System (RPS) are adequate to maintain the necessary safety margins.

TCV Fast Closure, Trip Oil Pressure - Low Fast closure of the TCVs during a generator load rejection results in the loss of a heat sink that produces reactor pressure, neutron flux, and heat flux transients that must be limited. Therefore, an RPT is initiated on TCV Fast Closure, Trip Oil Pressure - Low in anticipation of the transients that would result from the closure of these valves. The EOC-RPT decreases reactor power and aids the reactor scram in ensuring that the MCPR SL is not exceeded during the worst case transient.

(continued)

GRAND GULF B 3.3-70 LBDCR 16224

Page Intentionally Left Blank EOC-RPT Instrumentation B 3.3.4.1 BASES

APPLICABLE TCV Fast Closure, Trip Oil Pressure-Low (continued)

SAFETY ANALYSES, LCO, and Fast closure of the TCVs is determined by measuring the EHC APPLICABILITY fluid pressure at each control valve. There is one pressure transmitter associated with each control valve, and the signal from each transmitter is assigned to a separate trip channel. The logic for the TCV Fast Closure, Trip Oil Pressure - Low Function is such that two or more TCVs must be closed (pressure transmitter trips) to produce an EOC-RPT.

This Function must be enabled at THERMAL POWER 35.4% RTP.

This is normally accomplished automatically by reactor power signals derived from the power range neutron monitoring system. Four channels of TCV Fast Closure, Trip Oil Pressure C Low, with two channels in each trip system, are available and required to be OPERABLE to ensure that no single instrument failure will preclude an EOC-RPT from this Function on a valid signal. The TCV Fast Closure, Trip Oil Pressure - Low Allowable Value is selected high enough to detect imminent TCV fast closure.

This protection is required consistent with the analysis, whenever the THERMAL POWER is 35.4% RTP with any recirculating pump in fast speed. Below 35.4% RTP or with recirculation pumps in slow speed, the Reactor Vessel Steam Dome Pressure - High and the APRM Fixed Neutron Flux - High Functions of the RPS are adequate to maintain the necessary safety margins.

ACTIONS A Note has been provided to modify the ACTIONS related to EOC-RPT instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable EOC-RPT instrumentation channels provide appropriate compensatory measures for separate inoperable (continued)

GRAND GULF B 3.3-71 LBDCR 14027

PAGE INTENTIONALLY LEFT BLANK EOC-RPT Instrumentation B 3.3.4.1 BASES

SURVEILLANCE SR 3.3.4.1.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each required channel (continued) to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.2 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.4.1.3. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is conservative with respect to the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

SR 3.3.4.1.2 is modified by two Notes in the SR table. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. The second Note requires that the as-left setting for the channel be within the as-left tolerance of the NTSP. Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as left tolerance of the NTSP, then the channel shall be declared inoperable. The second Note also requires that NTSP and the methodologies for calculating the as-left and the as-found tolerances be in the Technical Requirements Manual.

7KH6XUYHLOODQFH)HTXHQF\LVFRQWUROOHGXQGHUWKH6XUYHLOODQFH

)UHTXHQF\&RQWURO3URJUDP.

(continued)

GRAND GULF B 3.3-74 LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

SR 3.3.4.1.3 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

SR 3.3.4.1.3 is modified by two Notes in the SR table. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition. The second Note requires that the as-left setting for the channel be within the as-left tolerance of the NTSP. Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as left tolerance of the NTSP, then the channel shall be declared inoperable. The second Note also requires that NTSP and the methodologies for calculating the as-left and the as-found tolerances be in the Technical Requirements Manual.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-74a LBDCR 18114

EOC-RPT Instrumentation B 3.3.4.1 BASES

SURVEILLANCE SR 3.3.4.1.4 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers is included as a part of this test, overlapping the LOGIC SYSTEM FUNCTIONAL TEST, to provide complete testing of the associated safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel would also be inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.5 This SR ensures that an EOC-RPT initiated from the TSV Closure, Trip Oil Pressure - Low and TCV Fast Closure, Trip Oil Pressure - Low Functions will not be inadvertently bypassed when THERMAL POWER is 35.4% RTP. This involves calibration of the bypass channels.

Adequate margins for the instrument setpoint methodologies are incorporated into the actual setpoint. If any bypass channel's setpoint is nonconservative (i.e., the Functions are bypassed at 35.4% RTP), the affected TSV Closure, Trip Oil Pressure - Low and TCV Fast Closure, Trip Oil Pressure - Low Functions are considered inoperable.

Alternatively, the bypass channel can be placed in the conservative condition (nonbypass). If placed in the nonbypass condition, this SR is met and the channel considered OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-75 LBDCR 18127

EOC-RPT Instrumentation B 3.3.4.1 BASES

SURVEILLANCE SR 3.3.4.1.6 REQUIREMENTS (continued) This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The EOC-RPT SYSTEM RESPONSE TIME acceptance criteria are included in the applicable plant procedures.

A Note to the Surveillance states that breaker interruption time may be assumed from the most recent performance of SR 3.3.4.1.7. This is allowed since the time to open the contacts after energization of the trip coil and the arc suppression time are short and do not appreciably change, due to the design of the breaker opening device and the fact that the breaker is not routinely cycled.

Response times cannot be determined at power because operation of final actuated devices is required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.1.7 This SR ensures that the RPT breaker interruption time is provided to the EOC-RPT SYSTEM RESPONSE TIME test. Breaker Interruption time is defined as Breaker Response time plus Arc Suppression time. Breaker Response is the time from application of voltage to the trip coil until the main contacts separate. Arc Suppression is the time from main contact separation until the complete suppression of the electrical arc across the open contacts. Breaker Response shall be verified by testing and added to the manufacturer's design Arc Suppression time of 12 ms to determine Breaker Interruption time. The breaker arc suppression time shall be validated by the performance of periodic contact gap (continued)

GRAND GULF B 3.3-76 LBDCR 18127

EOC-RPT Instrumentation B 3.3.4.1 BASES

SURVEILLANCE SR 3.3.4.1.7 (continued)

REQUIREMENTS measurements and high potential tests on the breaker vacuum interrupters in accordance with plant procedures. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 7.6.1.8.

2. UFSAR, Section 5.2.2.

3. UFSAR, Sections 15.1.2 and 15.1.3.

4. UFSAR, Sections 15.2.2, 15.2.3 and 15.2.5.

5. GENE-770-06-1, "Bases for Changes To Surveillance Test Intervals And Allowed Out-Of-Service Times For Selected Instrumentation Technical Specifications," February 1991.

GRAND GULF B 3.3-77 LBDCR 18127

ATWS-RPT Instrumentation B 3.3.4.2 BASES

ACTIONS B.1 (continued)

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in the Function not maintaining ATWS-RPT trip capability. A Function is considered to be maintaining ATWS-RPT trip capability when sufficient channels are OPERABLE or in trip such that the ATWS-RPT System will generate a trip signal from the given Function on a valid signal, and both recirculation pumps can be tripped. This requires two channels of the Function in the same trip system to each be OPERABLE or in trip, and the four motor breakers (two fast speed and two LFMG) to be OPERABLE or in trip.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is sufficient for the operator to take corrective action (e.g., restoration or tripping of channels) and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period and the fact that one Function is still maintaining ATWS-RPT trip capability.

C.1 Required Action C.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within both Functions result in both Functions not maintaining ATWS-RPT trip capability. The description of a Function maintaining ATWS-RPT trip capability is discussed in the Bases for Required Action B.1, above.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient for the operator to take corrective action and takes into account the likelihood of an event requiring actuation of the ATWS-RPT instrumentation during this period.

D.1 and D.2 With any Required Action and associated Completion Time not met, the plant must be brought to a MODE or other specified condition in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 2 within 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months (Required Action D.2). Alternately, the associated (continued)

GRAND GULF B 3.3-83 Revision No. 0

ATWS-RPT Instrumentation B 3.3.4.2 BASES

ACTIONS D.1 and D.2 (continued) recirculation pump may be removed from service since this performs the intended Function of the instrumentation (Required Action D.1). The allowed Completion Time of 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months is reasonable, based on operating experience, both to reach MODE 2 from full power conditions and to remove a recirculation pump from service in an orderly manner and without challenging plant systems.

SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains ATWS-RPT trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the recirculation pumps will trip when necessary.

SR 3.3.4.2.1 Performance of the CHANNEL CHECK ensures that gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is (continued)

GRAND GULF B 3.3-84 LBDCR 18127

ATWS-RPT Instrumentation B 3.3.4.2 BASES

SURVEILLANCE SR 3.3.4.2.1 (continued)

REQUIREMENTS outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of this LCO.

SR 3.3.4.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.2.3 Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.4.2.4. If the trip setting is discovered to be less conservative than the setting accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-85 LBDCR 18127

ATWS-RPT Instrumentation B 3.3.4.2 BASES

SURVEILLANCE SR 3.3.4.2.4 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.4.2.5 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required trip logic for a specific channel. The system functional test of the pump breakers, included as part of this Surveillance, overlaps the LOGIC SYSTEM FUNCTIONAL TEST to provide complete testing of the assumed safety function. Therefore, if a breaker is incapable of operating, the associated instrument channel(s) would be inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 5.4.1.7.10.

2. NEDE-770-06-1, "Bases For Changes To Surveillance Test Intervals and Allowed Out-of-Service Times For Selected Instrumentation Technical Specifications," February 1991.

GRAND GULF B 3.3-86 LBDCR 18127

Page Intentionally Left Blank

ECCS Instrumentation B 3.3.5.1 BASES

BACKGROUND Automatic Depressurization System (continued) confirmed Reactor Vessel Water Level - Low, Level 3 in each of the two ADS trip systems. Each of these transmitters connects to a trip unit, which then drives a relay whose contacts form the initiation logic.

Each ADS trip system (trip system A and trip system B) includes a time delay between satisfying the initiation logic and the actuation of the ADS valves. The time delay chosen is long enough that the HPCS has time to operate to recover to a level above Level 1, yet not so long that the LPCI and LPCS systems are unable to adequately cool the fuel if the HPCS fails to maintain level. An alarm in the control room is annunciated when either of the timers is running. Resetting the ADS initiation signals resets the ADS Initiation Timers.

The ADS also monitors the discharge pressures of the three LPCI pumps and the LPCS pump. Each ADS trip system includes two discharge pressure permissive transmitters from each of the two low pressure ECCS pumps in the associated Division (i.e., Division 1 ECCS inputs to ADS trip system A and Division 2 ECCS inputs to ADS trip system B).

The signals are used as a permissive for ADS actuation, indicating that there is a source of core coolant available once the ADS has depressurized the vessel. Any one of the four low pressure pumps provides sufficient core coolant flow to permit automatic depressurization.

The ADS logic in each trip system is arranged in two strings. One string has a contact from each of the following variables: Reactor Vessel Water Level - Low Low Low, Level 1; Drywell Pressure - High or ADS Bypass Timer; Reactor Vessel Water Level - Low, Level 3; ADS Initiation Timer; and two low pressure ECCS Discharge Pressure -High contacts. The other string has a contact from each of the following variables: Reactor Vessel Water Level - Low Low Low, Level 1; Drywell Pressure - High or ADS Bypass Timer; and two low pressure ECCS Discharge Pressure -

High contacts. To initiate an ADS trip system, the following applicable contacts must close in the associated string: Reactor Vessel Water Level

- Low Low Low, Level 1; Drywell Pressure - High or ADS Bypass Timer; Reactor Vessel Water Level - Low, Level 3; ADS Initiation Timer; and one of the two low pressure ECCS Discharge Pressure - High contacts.

(continued)

GRAND GULF B 3.3-91 LBDCR 18011

ECCS Instrumentation B 3.3.5.1 BASES

BACKGROUND Diesel Generators (continued)

Feature (ESF) buses if a loss of offsite power occurs. (Refer to Bases for LCO 3.3.8.1.)

APPLICABLE The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES, analyses of References 1, 2, and 3. The ECCS is initiated LCO, and to preserve the integrity of the fuel cladding by limiting APPLICABILITY the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of the NRC Policy Statement.

Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints set within the setting tolerances of the trip setpoint, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each ECCS subsystem must also respond within its assumed response time. Allowable Values are specified for each ECCS Function specified in Table 3.3.5.1-1. For Function 3.d, Condensate Storage Tank Level- Low, the nominal trip setpoint and methodologies for calculation of the as-left and as-found tolerances are described in the Technical Requirements Manual. The trip setpoints are selected to ensure that the setpoints remain conservative to the as-left tolerance band between CHANNEL CALIBRATIONS. After each calibration the trip setpoint shall be left within the as-left band around the nominal trip setpoint. Table 3.3.5.1-1 is modified by a footnote which is added to show that certain ECCS instrumentation Functions also perform DG initiation.

Nominal trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of (continued)

GRAND GULF B 3.3-93 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE the process parameter exceeds the setpoint, the associated SAFETY ANALYSES, device (e.g., trip unit) changes state. The analytical LCO, and limits are derived from the limiting values of the process APPLICABILITY parameters obtained from the safety analysis. The Allowable (continued) Values are derived from the analytical limits, corrected for calibration, process, and some of the instrument errors. The nominal trip setpoints are then determined, accounting for the remaining instrument errors (e.g.,

drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis accident or transient. To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals.

Functions 1.a, 2.a, and 3.a initiate automatic ECCS injection on low water level. A draining event is a slow evolution when compared to a design basis LOCA assumed to occur at full power, and thus there is adequate time to take manual actions (hours versus minutes). TS 3.5.2, Action E, prohibits plant conditions that could result in Drain Times less than one hour. Therefore, there is sufficient time for the licensed operators to take manual action to stop the draining event, and to manually start an ECCS injection/spray subsystem or the additional method of water injection.

Consequently, there is no need for automatic initiation of ECCS to respond to an unexpected draining event in Mode 4 or 5. Automatic initiation of an ECCS injection/spray subsystem, with injection rates of thousands of gpm, may be undesirable as it can lead to overflowing the RPV cavity.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Low Pressure Core Spray and Low Pressure Coolant Injection Systems 1.a, 2.a. Reactor Vessel Water Level- Low Low Low, Level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. The low pressure ECCS and associated DGs are initiated at Level 1 to ensure that core spray and flooding GRAND GULF B 3.3-94 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 1.a, 2.a. Reactor Vessel Water Level-Low Low Low, Level 1 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY functions are available to prevent or minimize fuel damage. The Reactor Vessel Water Level - Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients and accidents analyzed in References 1, 2, and 3. The core cooling function of the ECCS, along with the scram action of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level -Low Low Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level -Low Low Low, Level 1 Allowable Value is chosen to allow time for the low pressure core flooding systems to activate and provide adequate cooling.

Two channels of Reactor Vessel Water Level -Low Low Low, Level 1 Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE, to ensure that no single instrument failure can preclude ECCS initiation. (Two channels input to LPCS and LPCI A, while the other two channels input to LPCI B and LPCI C.)

1.b, 2.b. Drywell Pressure-High High pressure in the drywell could indicate a break in the reactor coolant pressure boundary (RCPB). The low pressure ECCS and associated DGs are initiated upon receipt of the Drywell Pressure - High Function in order to minimize the possibility of fuel damage. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

High drywell pressure signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.

Negative barometric fluctuations are accounted for in the Allowable Value.

(continued)

GRAND GULF B 3.3-95 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 1.b, 2.b. Drywell Pressure - High (continued)

SAFETY ANALYSES, LCO, and The Drywell Pressure - High Function is required to be APPLICABILITY OPERABLE when the associated ECCS and DGs are required to be OPERABLE in conjunction with times when the primary containment is required to be OPERABLE. Thus, four channels of the LPCS and LPCI Drywell Pressure - High Function are required to be OPERABLE in MODES 1, 2, and 3 to ensure that no single instrument failure can preclude ECCS initiation. (Two channels input to LPCS and LPCI A, while the other two channels input to LPCI B and LPCI C.) In MODES 4 and 5, the Drywell Pressure - High Function is not required since there is insufficient energy in the reactor to pressurize the primary containment to Drywell Pressure - High setpoint.

Refer to LCO 3.5.1 for Applicability Bases for the low pressure ECCS subsystems and to LCO 3.8.1 for Applicability Bases for the DGs.

1.c, 2.c. Low Pressure Coolant Injection Pump A and Pump B Start - Time Delay Relay The purpose of this time delay is to stagger the start of the two ECCS pumps that are in each of Divisions 1 and 2, thus limiting the starting transients on the 4.16 kV emergency buses. This Function is only necessary when power is being supplied from the standby power sources (DG). However, since the time delay does not degrade ECCS operation, it remains in the pump start logic at all times. The LPCI Pump Start - Time Delay Relays are assumed to be OPERABLE in the accident and transient analyses requiring ECCS initiation. That is, the analysis assumes that the pumps will initiate when required.

There are two LPCI Pump Start - Time Delay Relays, one in each of the RHR "A" and RHR "B" pump start logic circuits. The Allowable Value for the LPCI Pump Start - Time Delay Relay is chosen to be short enough so that ECCS operation is not degraded.

Each LPCI Pump Start - Time Delay Relay Function is only required to be OPERABLE when the associated LPCI subsystem is required to be OPERABLE.

(continued)

GRAND GULF B 3.3-96 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 1.d, 2.d. Reactor Vessel Pressure - Low (Injection SAFETY ANALYSES, Permissive)

LCO, and APPLICABILITY Low reactor vessel pressure signals are used as permissives (continued) for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. The Reactor Vessel Pressure - Low is one of the Functions assumed to be OPERABLE and capable of permitting initiation of the ECCS during the transients analyzed in References 1 and 3. In addition, the Reactor Vessel Pressure - Low Function is directly assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

The Reactor Vessel Pressure - Low signals are initiated from four pressure transmitters that sense the reactor pressure. The four pressure transmitters each drive a master and slave trip unit (for a total of eight trip units).

The Allowable Value is low enough to prevent overpressurizing the equipment in the low pressure ECCS, but high enough to ensure that the ECCS injection prevents the fuel peak cladding temperature from exceeding the limits of 10 CFR 50.46.

Three channels of Reactor Vessel Pressure - Low Function per associated Division are only required to be OPERABLE when the associated ECCS is required to be OPERABLE to ensure that no single instrument failure can preclude ECCS initiation. (Three channels are required for LPCS and LPCI A, while three other channels are required for LPCI B and LPCI C.).

(continued)

GRAND GULF B 3.3-97 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 1.g, 2.f. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and instrumentation. There is one push button for each of the APPLICABILITY two Divisions of low pressure ECCS (i.e., Division 1 ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI B and LPCI C).

The Manual Initiation Function is not assumed in any accident or transient analyses in the UFSAR. However, the Function is retained for the low pressure ECCS function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. Each channel of the Manual Initiation Function (one channel per Division) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE.

High Pressure Core Spray System 3.a. Reactor Vessel Water Level - Low Low, Level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the HPCS System and associated DG are initiated at Level 2, after a confirmation delay permissive to maintain level above the top of the active fuel.

A nominal 1/2 second confirmation delay permissive is installed to avoid spurious system initiation signals. This confirmation delay permissive is limited to a maximum of a 1 second delay to support the HPCS System response time of 32 seconds assumed in the accident analysis. To insure that the confirmation delay permissive does not drift excessively it is calibrated as part of the CHANNEL FUNCTIONAL TEST required for this Function by SR 3.3.5.1.2.

The Reactor Vessel Water Level - Low Low, Level 2 is one of the Functions assumed to be OPERABLE and capable of initiating HPCS during the transients and accidents, analyzed in References 1, 2, (continued)

GRAND GULF B 3.3-99 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 3.d. Condensate Storage Tank Level - Low (continued)

SAFETY ANALYSES, LCO, and HPCS injection would be taken from the CST. However, if the APPLICABILITY water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens, and then the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the HPCS pump.

To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes. The Function is implicitly assumed in the accident and transient analyses (which take credit for HPCS) since the analyses assume that the HPCS suction source is the suppression pool.

Condensate Storage Tank Level - Low signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated trip unit can cause the suppression pool suction valve to open and the CST suction valve to close. The Condensate Storage Tank Level - Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the CST.

Two channels of the Condensate Storage Tank Level - Low Function are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS swap to suppression pool source. Thus, the Function is required to be OPERABLE in MODES 1, 2, and 3.

In MODES 4 and 5, the Function is required to be OPERABLE only when HPCS is required to be OPERABLE to fulfill the requirements of LCO 3.5.2, HPCS is aligned to the CST and the CST water level is not within the limits of SR 3.5.2.3. With CST water level within limits, a sufficient supply of water exists for injection to minimize the consequences of a vessel draindown event. Refer to LCO 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.

3.e. Suppression Pool Water LevelHigh Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the S/RVs. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of HPCS from the CST to the suppression pool (continued)

GRAND GULF B 3.3-102 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

APPLICABLE 3.h. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and if required (i.e., if the water level reaches the low water APPLICABILITY level initiation setpoint).

The Manual Initiation Function is not assumed in any accident or transient analysis in the UFSAR. However, the Function is retained for the HPCS function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button. One channel of the Manual Initiation Function is only required to be OPERABLE when the HPCS System is required to be OPERABLE.

Automatic Depressurization System 4.a, 5.a. Reactor Vessel Water Level - Low Low Low, Level 1 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, ADS receives one of the signals necessary for initiation from this Function. The Reactor Vessel Water Level - Low Low Low, Level 1 is one of the Functions assumed to be OPERABLE and capable of initiating the ADS during the accidents analyzed in Reference 2. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level - Low Low Low, Level 1 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of Reactor Vessel Water Level - Low Low Low, Level 1 Function are only required to be OPERABLE when ADS is required to be OPERABLE to ensure that no single instrument failure can preclude ADS initiation. (Two channels input to ADS trip system A while the other two channels input to ADS trip system B). Refer to LCO 3.5.1 for ADS Applicability Bases.

(continued)

GRAND GULF B 3.3-105 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

ACTIONS B.1, B.2, and B.3 (continued) untripped, and the Completion Times started concurrently for the channels in both Divisions, this results in the affected portions in both Divisions of ECCS and DG being concurrently declared inoperable.

For Required Action B.2, redundant automatic initiation capability is lost if two Function 3.a or two Function 3.b channels are inoperable and untripped in the same trip system. In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.3 is not appropriate and the feature(s) associated with the inoperable, untripped channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Notes are provided (the Note to Required Action B.1 and Required Action B.2) to delineate which Required Action is applicable for each Function that requires entry into Condition B if an associated channel is inoperable. This ensures that the proper loss of initiation capability check is performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that a redundant feature in both Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable, untripped channels within the same variable as described in the paragraph above. For Required Action B.2, the Completion Time only begins upon discovery that the HPCS System cannot be automatically initiated due to two inoperable, untripped channels for the associated Function in the same trip system.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

(continued)

GRAND GULF B 3.3-111 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

ACTIONS C.1 and C.2 (continued) and LPCI B, respectively. For Functions 1.d and 2.d, the affected portions of the Division are the low pressure ECCS pumps (Divisions 1 and 2, respectively).

In this situation (loss of redundant automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action C.2 is not appropriate and the feature(s) associated with the inoperable channels must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

The Note states that Required Action C.1 is only applicable for Functions 1.c, 1.d, 2.c, and 2.d. The Required Action is not applicable to Functions 1.g, 2.f, and 3.h (which also require entry into this Condition if a channel in these Functions is inoperable), since they are the Manual Initiation Functions and are not assumed in any accident or transient analysis. Thus, a total loss of manual initiation capability for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (as allowed by Required Action C.2) is allowed. Required Action C.1 is also not applicable to Function 3.c (which also requires entry into this Condition if a channel in this Function is inoperable), since the loss of one channel results in a loss of the Function (two-out-of-two logic). This loss was considered during the development of Reference 4 and considered acceptable for the 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowed by Required Action C.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action C.1, the Completion Time only begins upon discovery that the same feature in both Divisions (e.g., any Division 1 ECCS and Division 2 ECCS) cannot be automatically initiated due to inoperable channels within the same variable as described in the paragraph above. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

(continued)

GRAND GULF B 3.3-113 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

ACTIONS E.1 and E.2 (continued)

In this situation (loss of redundant automatic initiation capability), the 7 day allowance of Required Action E.2 is not appropriate and the feature(s) associated with each inoperable channel must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of initiation capability for feature(s) in both Divisions. A Note is provided (the Note to Required Action E.1) to delineate that Required Action E.1 is only applicable to low pressure ECCS Functions. Required Action E.1 is not applicable to HPCS Functions 3.f and 3.g since the loss of one channel results in a loss of the Function (one-out-of-one logic). This loss was considered during the development of Reference 4 and considered acceptable for the 7 days allowed by Required Action E.2.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

For Required Action E.1, the Completion Time only begins upon discovery that three channels of the variable (Pump Discharge Flow Low) cannot be automatically initiated due to inoperable channels. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration of channels.

If the instrumentation that controls the pump minimum flow valve is inoperable such that the valve will not automatically open, extended pump operation with no injection path available could lead to pump overheating and failure. If there were a failure of the instrumentation such that the valve would not automatically close, a portion of the pump flow could be diverted from the reactor injection path, causing insufficient core cooling.

These consequences can be averted by the operator's manual control of the valve, which would be adequate to maintain ECCS pump (continued)

GRAND GULF B 3.3-116 LBDCR 18128

ECCS Instrumentation B 3.3.5.1 BASES

SURVEILLANCE SR 3.3.5.1.1 REQUIREMENTS (continued) Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.5.1.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology. The required setpoint adjustments include a calibration of the HPCS Reactor Vessel Water Level - Low Low, Level 2 Function confirmation delay permissive.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-121 LBDCR 18127

ECCS Instrumentation B 3.3.5.1 BASES

SURVEILLANCE SR 3.3.5.1.3 REQUIREMENTS (continued) The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be not within its required Allowable Value specified in Table 3.3.5.1-1.

If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analyses. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than the setting accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.1.3 for Function 3.d, Condensate Storage Tank Level -Low, is modified by two Notes as identified in Table 3.3.5.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.

The second Note applied to SR 3.3.5.1.3 for Function 3.d, Condensate Storage Tank Level -Low, requires that the as- left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP).

Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the (continued)

GRAND GULF B 3.3-122 LBDCR 18127

ECCS Instrumentation B 3.3.5.1 BASES

SURVEILLANCE SR 3.3.5.1.3 (continued)

REQUIREMENTS NTSP, then the channel shall be declared inoperable. The second Note also requires that NTSP and the methodologies for calculating the as-left and the as-found tolerances be in the TRM.

SR 3.3.5.1.4 and SR 3.3.5.1.5 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.5.1.5 for Function 3.d, Condensate Storage Tank Level-Low, is modified by two Notes as identified in Table 3.3.5.1-1. The first Note requires evaluation of channel performance for the condition where the as-found setting for the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded, after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.

The second Note applied to SR 3.3.5.1.5 for Function 3.d, Condensate Storage Tank Level -Low, requires that the as- left setting for the channel be within the as-left tolerance of the NTSP. Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as- left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical (continued)

GRAND GULF B 3.3-122a LBDCR 18127

ECCS Instrumentation B 3.3.5.1 BASES

SURVEILLANCE SR 3.3.5.1.6 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.1, LCO 3.5.2, LCO 3.8.1, and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 5.2.

2. UFSAR, Section 6.3.

3. UFSAR, Chapter 15.

4. NEDC-30936-P-A, "BWR Owners' Group Technical Specification Improvement Analyses for ECCS Actuation Instrumentation, Part 2," December 1988.

5. Regulatory Guide 1.105, Setpoints for Safety-Related Instrumentation, Revision 3.

GRAND GULF B 3.3-123 LBDCR 18127

RPV Water Inventory Control Instrumentation B 3.3.5.2 B 3.3 INSTRUMENTATION B 3.3.5.2 Reactor Pressure Vessel (RPV) Water Inventory Control Instrumentation BASES BACKGROUND The RPV contains penetrations below the top of the active fuel (TAF) that have the potential to drain the reactor coolant inventory to below the TAF.

If the water level should drop below the TAF, the ability to remove decay heat is reduced, which could lead to elevated cladding temperatures and clad perforation. Safety Limit 2.1.1.3 requires the RPV water level to be above the top of the active irradiated fuel at all times to prevent such elevated cladding temperatures.

Technical Specifications are required by 10 CFR 50.36 to include limiting safety system settings (LSSS) for variables that have significant safety functions. LSSS are defined by the regulation as "Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the process variable at which a safety action is initiated to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur. The actual settings for the automatic isolation channels are the same as those established for the same functions in MODES 1, 2, and 3 in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS)

Instrumentation," or LCO 3.3.6.1, "Primary Containment and Drywell Isolation Instrumentation".

With the unit in MODE 4 or 5, RPV water inventory control is not required to mitigate any events or accidents evaluated in the safety analyses. RPV water inventory control is required in MODES 4 and 5 to protect Safety Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur. Under the definition of DRAIN TIME, some penetration flow paths may be excluded from the DRAIN TIME calculation if they will be isolated by valves that will close automatically without offsite power prior to the RPV water level being equal to the TAF when actuated by RPV water level isolation instrumentation.

GRAND GULF B 3.3-124 LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES BACKGROUND (continued)

The purpose of the RPV Water Inventory Control Instrumentation is to support the requirements of LCO 3.5.2, "Reactor Pressure Vessel (RPV)

Water Inventory Control," and the definition of DRAIN TIME. There are functions that are required for manual initiation or operation of the ECCS injection/spray subsystem required to be OPERABLE by LCO 3.5.2 and other functions that support automatic isolation of Residual Heat Removal subsystem and Reactor Water Cleanup system penetration flow path(s) on low RPV water level.

The RPV Water Inventory Control Instrumentation supports operation of low pressure core spray (LPCS), low pressure coolant injection (LPCI),

and high pressure core spray (HPCS). The equipment involved with each of these systems is described in the Bases for LCO 3.5.2.

APPLICABLE With the unit in MODE 4 or 5, RPV water inventory control is not required SAFETY to mitigate any events or accidents evaluated in the safety analyses. RPV ANALYSES, LCO, water inventory control is required in MODES 4 and 5 to protect Safety and APPLICABILITY Limit 2.1.1.3 and the fuel cladding barrier to prevent the release of radioactive material should a draining event occur.

A double-ended guillotine break of the Reactor Coolant System (RCS) is not postulated in MODES 4 and 5 due to the reduced RCS pressure, reduced piping stresses, and ductile piping systems. Instead, an event is postulated in which a single operator error or initiating event allows draining of the RPV water inventory through a single penetration flow path with the highest flow rate, or the sum of the drain rates through multiple penetration flow paths susceptible to a common mode failure (e.g.,

seismic event, loss of normal power, single human error). It is assumed, based on engineering judgment, that while in MODES 4 and 5, one ECCS injection/spray subsystem can be manually initiated to maintain adequate reactor vessel water level.

As discussed in References 1, 2, 3, 4, and 5, operating experience has shown RPV water inventory to be significant to public health and safety.

Therefore, RPV Water Inventory Control satisfies Criterion 4 of 10 CFR 50.36(c)(2)(ii).

Permissive and interlock setpoints are generally considered as nominal values without regard to measurement accuracy.

GRAND GULF B 3.3-124a LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Low Pressure Core Spray and Low Pressure Coolant Injection Systems 1.a, 2.a. Reactor Vessel Pressure - Low (Injection Permissive)

Low reactor vessel pressure signals are used as permissives for the low pressure ECCS subsystems. This ensures that, prior to opening the injection valves of the low pressure ECCS subsystems, the reactor pressure has fallen to a value below these subsystems' maximum design pressure. While it is assured during Modes 4 and 5 that the reactor vessel pressure will be below the ECCS maximum design pressure, the Reactor Vessel Pressure - Low signals are assumed to be operable and capable of permitting initiation of the ECCS.

The Reactor Vessel Pressure - Low signals are initiated from four pressure transmitters that sense the reactor vessel pressure. The four pressure transmitters each drive a master and slave trip unit. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic for each Division.

The Allowable Value is low enough to prevent overpressuring the equipment in the low pressure ECCS.

Three channels of Reactor Vessel Pressure - Low Function per associated ECCS Division are only required to be OPERABLE in MODES 4 and 5 when ECCS Manual Initiation is required to be OPERABLE, since these channels support the manual initiation Function. In addition, the channels are only required when the associated ECCS subsystem is required to be OPERABLE by LCO 3.5.2.

1.b, 1.c, 2.b. Low Pressure Coolant Injection and Low Pressure Core Spray Pump Discharge Flow - Low (Bypass)

The minimum flow instruments are provided to protect the associated low pressure ECCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow is sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump.

One flow transmitter per ECCS pump is used to detect the associated subsystems' flow rates. The logic is arranged such that each transmitter causes its associated minimum flow valve to open. The logic will close the minimum flow valve once the closure setpoint is exceeded. The LPCI minimum flow valves are time delayed such that the valves will not open for 10 seconds after the switches detect low flow. The time delay is provided to limit reactor vessel inventory loss during the startup of the Residual Heat Removal (RHR) shutdown cooling mode (for RHR A and RHR B).

GRAND GULF B 3.3-124b LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

The Pump Discharge Flow - Low Allowable Values are high enough to ensure that the pump flow rate is sufficient to protect the pump.

One channel of the Pump Discharge Flow - Low Function is required to be OPERABLE in MODES 4 and 5 when the associated LPCS or LPCI pump is required to be OPERABLE by LCO 3.5.2 to ensure the pumps are capable of injecting into the Reactor Pressure Vessel when manually initiated.

1.d, 2.c. Manual Initiation The Manual Initiation push button channels introduce signals into the appropriate ECCS logic to provide manual initiation capability. There is one push button for each of the two Divisions of low pressure ECCS (i.e.,

Division 1 ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI B and LPCI C). The only manual initiation function required to be OPERABLE is that associated with the ECCS subsystem required to be OPERABLE by LCO 3.5.2.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

High Pressure Core Spray System 3 .a. Condensate Storage Tank Level - Low Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source. Normally the suction valves between HPCS and the CST are open and water for HPCS injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens, and then the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the HPCS pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.

Condensate Storage Tank Level - Low signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated trip unit can cause the suppression pool suction valve to open and the CST suction valve to close.

The Condensate Storage Tank Level - Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the CST.

One channel of the Condensate Storage Tank Level - Low Function is only required to be OPERABLE when HPCS is required to be OPERABLE to fulfill the requirements of LCO 3.5.2 and HPCS is aligned to the CST.

GRAND GULF B 3.3-124c LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued) 3.b, 3.c. HPCS Pump Discharge Pressure - High (Bypass) and HPCS System Flow Rate - Low (Bypass)

The minimum flow instruments are provided to protect the HPCS pump from overheating when the pump is operating and the associated injection valve is not fully open. The minimum flow line valve is opened when low flow and high pump discharge pressure are sensed, and the valve is automatically closed when the flow rate is adequate to protect the pump or the discharge pressure is low (indicating the HPCS pump is not operating).

One flow transmitter is used to detect the HPCS System's flow rate. The logic is arranged such that the transmitter causes the minimum flow valve to open, provided the HPCS pump discharge pressure, sensed by another transmitter, is high enough (indicating the pump is operating).

The logic will close the minimum flow valve once the closure setpoint is exceeded. (The valve will also close upon HPCS pump discharge pressure decreasing below the setpoint.)

The HPCS System Flow Rate - Low and HPCS Pump Discharge Pressure - High Allowable Value is high enough to ensure that pump flow rate is sufficient to protect the pump, yet low enough to ensure that the closure of the minimum flow valve is initiated to allow full flow into the core.

The HPCS Pump Discharge Pressure - High Allowable Value is set high enough to ensure that the valve will not be open when the pump is not operating.

One channel of each Function associated with one pump is required to be OPERABLE when HPCS is required to be OPERABLE by LCO 3.5.2 in MODES 4 and 5.

RHR System Isolation 4.a - Reactor Vessel Water Level - Low. Level 3 The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level - Low, Level 3 Function is only required to be OPERABLE when automatic isolation of the associated RHR penetration flow path is credited in calculating DRAIN TIME.

Reactor Vessel Water Level - Low, Level 3 signals are initiated from four level transmitters (two per trip system) that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. While four channels (two channels per trip system) of the Reactor Vessel Water GRAND GULF B 3.3-124d LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES APPLICABLE SAFETY ANALYSES, LCO, and APPLICABILITY (continued)

Level - Low, Level 3 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.

The Reactor Vessel Water Level - Low, Level 3 Allowable Value was chosen to be the same as the RPS Reactor Vessel Water Level - Low, Level 3 Allowable Value (LCO 3.3.1.1), since the capability to cool the fuel may be threatened.

This Function isolates the Group 3 valves.

Reactor Water Cleanup (RWCU) System Isolation 5 .a - Reactor Vessel Water level - Low Low, Level 2 The definition of DRAIN TIME allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level being equal to the TAF. The Reactor Vessel Water Level - Low Low, Level 2 Function associated with RWCU System isolation may be credited for automatic isolation of penetration flow paths associated with the RWCU System.

Reactor Vessel Water Level - Low Low, Level 2 is initiated from two channels per trip system that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. While four channels (two channels per trip system) of the Reactor Vessel Water Level - Low, Level 2 Function are available, only two channels (all in the same trip system) are required to be OPERABLE.

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was chosen to be the same as the ECCS Reactor Vessel Water Level - Low Low, Level 2 Allowable Value (LCO 3.3.5.1), since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level - Low Low, Level 2 Function is only required to be OPERABLE when automatic isolation of the associated penetration flow path is credited in calculating DRAIN TIME.

This Function isolates the Group 8 valves.

ACTIONS A Note has been provided to modify the ACTIONS related to RPV Water Inventory Control instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RPV Water Inventory Control instrumentation channels provide appropriate compensatory measures for separate GRAND GULF B 3.3-124e LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES ACTIONS (continued) inoperable Condition entry for each inoperable RPV Water Inventory Control instrumentation channel.

A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.2-1. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

B.1 and B.2 RHR System Isolation, Reactor Vessel Water Level- Low Level 3, and Reactor Water Cleanup System, Reactor Vessel Water Level - Low Low, Level 2 functions are applicable when automatic isolation of the associated penetration flow path is credited in calculating Drain Time. If the instrumentation is inoperable, Required Action B.1 directs an immediate declaration that the associated penetration flow path(s) are incapable of automatic isolation. Required Action B.2 directs calculation of DRAIN TIME. The calculation cannot credit automatic isolation of the affected penetration flow paths.

C.1 Low reactor steam dome pressure signals are used as permissives for the low pressure ECCS injection/spray subsystem manual initiation functions. If this permissive is inoperable, manual initiation of ECCS is prohibited. Therefore, the permissive must be placed in the trip condition within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the permissive in the trip condition, manual initiation may be performed. Prior to placing the permissive in the tripped condition, the operator can take manual control of the pump and the injection valve to inject water into the RPV.

The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is intended to allow the operator time to evaluate any discovered inoperabilities and to place the channel in trip.

D.1 and D.2 Required Actions D.1 and D.2 are intended to ensure that appropriate actions are taken if multiple, inoperable channels within the same Function result in a loss of automatic suction swap for the HPCS system from the condensate storage tank to the suppression pool. The HPCS system must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months or the HPCS pump suction must be aligned to the suppression pool, since, if aligned, the function is already performed.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is acceptable because it minimizes the risk of HPCS being needed without an adequate water source while allowing GRAND GULF B 3.3-124f LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES ACTIONS (continued) time for restoration or alignment of HPCS pump suction to the suppression pool.

E.1 If an LPCI or LPCS Discharge Flow - Low bypass function or HPCS System Discharge Pressure - High or Flow Rate - Low bypass function is inoperable, there is a risk that the associated ECCS pump could overheat when the pump is operating and the associated injection valve is not fully open. In this condition, the operator can take manual control of the pump and the injection valve to ensure the pump does not overheat. If a manual initiation function is inoperable, the ECCS subsystem pumps can be started manually and the valves can be opened manually, but this is not the preferred condition.

The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time was chosen to allow time for the operator to evaluate and repair any discovered inoperabilities. The Completion Time is appropriate given the ability to manually start the ECCS pumps and open the injection valves and to manually ensure the pump does not overheat.

F.1 With the Required Action and associated Completion Time of Conditions C, D, or E not met, the associated ECCS injection/spray subsystem may be incapable of performing the intended function, and must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RPV Water REQUIREMENTS Inventory Control instrument Function are found in the SRs column of Table 3.3.5.2-1.

SR 3.3.5.2.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK guarantees that undetected outright channel failure is limited; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL FUNCTIONAL TEST.

GRAND GULF B 3.3-124g LBDCR 18128

RPV Water Inventory Control Instrumentation B 3.3.5.2 BASES SURVEILLANCE Agreement criteria are determined by the plant staff, based on a REQUIREMENTS combination of the channel instrument uncertainties, including indication (continued) and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.5.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.2.3 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3 .5 .2 overlaps this Surveillance to complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Information Notice 84-81 "Inadvertent Reduction in Primary Coolant Inventory in Boiling Water Reactors During Shutdown and Startup," November 1984.

2. Information Notice 86- 74, "Reduction of Reactor Coolant Inventory Because of Misalignment of RHR Valves," August 1986.

3. Generic Letter 92-04, "Resolution of the Issues Related to Reactor Vessel Water Level Instrumentation in BWRs Pursuant to 10 CFR 50.54(F). "August 1992.

4. NRC Bulletin 93-03, "Resolution of lssues Related to Reactor Vessel Water Level Instrumentation in BWRs." May 1993.

5. Information Notice 94-52, "Inadvertent Containment Spray and Reactor Vessel Draindown at Millstone l," July 1994.

GRAND GULF B 3.3-124h LBDCR 18128, 18127

RCIC System Instrumentation B 3.3.5.3 B 3.3 INSTRUMENTATION B 3.3.5.3 Reactor Core Isolation Cooling (RCIC) System Instrumentation BASES BACKGROUND The purpose of the RCIC System instrumentation is to initiate actions to ensure adequate core cooling when the reactor vessel is isolated from its primary heat sink (the main condenser) and normal coolant makeup flow from the Reactor Feedwater System is unavailable, such that initiation of the low pressure Emergency Core Cooling Systems (ECCS) pumps does not occur. A more complete discussion of RCIC System operation is provided in the Bases of LCO 3.5.3, "RCIC System."

This is achieved by specifying limiting safety system settings (LSSS) in terms of parameters directly monitored by the RCIC instrumentation, as well as LCOs on other reactor system parameters and equipment performance.

Technical Specifications are required by 10 CFR 50.36 to include LSSSs for variables that have significant safety functions. LSSS are defined by the regulation as Where a LSSS is specified for a variable on which a safety limit has been placed, the setting must be chosen so that automatic protective actions will correct the abnormal situation before a Safety Limit (SL) is exceeded." The Analytical Limit is the limit of the process variable at which a safety action is initiated, as established by the safety analysis to ensure that a SL is not exceeded. Any automatic protection action that occurs on reaching the Analytical Limit therefore ensures that the SL is not exceeded. However, in practice, the actual settings for automatic protection channels must be chosen to be more conservative than the Analytical Limit to account for instrument loop uncertainties related to the setting at which the automatic protective action would actually occur.

The trip setpoint is a predetermined setting for a protection channel chosen to ensure automatic actuation prior to the process variable reaching the Analytical Limit and thus ensuring that the SL would not be exceeded. As such, the trip setpoint accounts for uncertainties in setting the channel (e.g., calibration), uncertainties in how the channel might actually perform (e.g., repeatability), changes in the point of action of the (continued)

GRAND GULF B 3.3-125 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES BACKGROUND (continued) channel over time (e.g., drift during surveillance intervals), and any other factors which may influence its actual performance (e.g., harsh accident environments). In this manner, the trip setpoint ensures that SLs are not exceeded. Therefore, for Function 3, Condensate Storage Tank Level-Low, the trip setpoint meets the definition of an LSSS (Ref. 2).

The Allowable Value specified in Table 3.3.5.3-1 serves as the LSSS such that a channel is OPERABLE if the trip setpoint is found not to exceed the Allowable Value. As such, the Allowable Value differs from the trip setpoint by an amount primarily equal to the expected instrument loop uncertainties, such as drift, during the surveillance interval. In this manner, the actual setting of the device will still meet the LSSS definition and ensure that a SL is not exceeded at any given point of time as long as the device has not drifted beyond that expected during the surveillance interval.

Technical Specifications contain values related to the OPERABILITY of equipment required for safe operation of the facility. OPERABLE is defined in Technical Specifications as "...being capable of performing its specified safety function(s)." Relying solely on the trip setpoint to define OPERABILITY in Technical Specifications would be an overly restrictive requirement if it were applied as an OPERABILITY limit for the "as-found" value of a protection channel setting during a Surveillance. This would result in Technical Specification compliance problems, as well as reports and corrective actions required by the rule which are not necessary to ensure safety. For example, an automatic protection channel with a setting that has been found to be different from the trip setpoint due to some drift of the setting may still be OPERABLE because drift is to be expected. This expected drift would have been specifically accounted for in the setpoint methodology for calculating the trip setpoint and thus the automatic protective action would still have ensured that the SL would not be exceeded with the "as-found" setting of the protection channel.

Therefore, the channel would still be OPERABLE because it would have performed its safety function and the only corrective action required would be to reset the channel within the established as-left tolerance around trip setpoint to account for further drift during the next surveillance interval.

Note that, although the channel is OPERABLE under these circumstances, the trip setpoint must be left adjusted to a value within the as-left tolerance, in accordance with uncertainty assumptions stated in the (continued)

GRAND GULF B 3.3-125a LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES BACKGROUND (continued) referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned (as-found criteria).

However, there is also some point beyond which the channel may not be able to perform its function due to, for example, greater than expected drift. This value needs to be specified in the Technical Specifications in order to define OPERABILITY of the channels and is designated as the Allowable Value. If the actual setting (as-found setpoint) of the channel is found to be conservative with respect to the Allowable Value but is beyond the as-found tolerance band, the channel is OPERABLE, but degraded. The degrade condition will be further evaluated during performance of the SR. This evaluation will consist of resetting the channel setpoint to the trip setpoint (within the allowed tolerance), and evaluating the channel response. If the channel is functioning as required and expected to pass the next surveillance, then the channel is OPERABLE and can be restored to service at the completion of the surveillance. After the surveillance is completed, the channel as-found condition will be entered into the Corrective Action Program for further evaluation.

The RCIC System may be initiated by either automatic or manual means.

Automatic initiation occurs for conditions of Reactor Vessel Water Level -

Low Low, Level 2. The variable is monitored by four transmitters that are connected to four trip units. The outputs of the trip units are connected to relays whose contacts are arranged in a one-out-of-two taken twice logic arrangement. Once initiated, the RCIC logic seals in and can be reset by the operator only when the reactor vessel water level signals have cleared.

The RCIC test line isolation valves close on a RCIC initiation signal to allow full system flow.

The RCIC System also monitors the water levels in the condensate storage tank (CST) and the suppression pool, since these are the two sources of water for RCIC operation. Reactor grade water in the CST is the normal source. Upon receipt of a RCIC initiation signal, the CST suction valve is automatically signaled to open (it is normally in the open position) unless the pump suction from the suppression pool valve is open. If the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens and then the CST suction valve automatically closes. Two level transmitters are used (continued)

GRAND GULF B 3.3-125b LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

BACKGROUND to detect low water level in the CST. Either switch can (continued) cause the suppression pool suction valve to open and the CST suction valve to close. The suppression pool suction valve also automatically opens and the CST suction valve closes if high water level is detected in the suppression pool (one-out-of-two logic similar to the CST water level logic). To prevent losing suction to the pump, the suction valves are interlocked so that one suction path must be open before the other automatically closes.

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip (two-out-of-two logic), at which time the RCIC steam supply valve closes (the injection valve also closes due to the closure of the steam supply valves) to prevent overflow into the main steam lines. The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).

APPLICABLE The function of the RCIC System is to provide makeup SAFETY ANALYSES, coolant to the reactor in response to transient events.

LCO, and The RCIC System is not an Engineered Safety Feature APPLICABILITY System and no credit is taken in the safety analysis for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the RCIC System, and therefore its instrumentation, are included as required by the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the RCIC System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.3-1. Each Function must have a required number of OPERABLE channels with their setpoints set within the setting tolerance of the trips setpoints where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each channel must also respond within its assumed response time.

Allowable Values are specified for each RCIC System instrumentation Function specified in Table 3.3.5.3-1. For Function 3, Condensate Storage Tank Level- Low, the nominal trip setpoint and methodologies for calculation of the as-left and as-found tolerances are described in the Technical Requirements Manual. The trip setpoints are selected to ensure that the setpoints remain conservative to the as-left (continued)

GRAND GULF B 3.3-125c LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE tolerance band between CHANNEL CALIBRATIONS. After each SAFETY ANALYSES calibration the trip setpoint shall be left within the as-LCO, and left band around the nominal trip setpoint. Nominal trip APPLICABIITY setpoints are those predetermined values of output at which (continued) an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytical limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytical limits, corrected for calibration, process, and some of the instrument errors. The nominal trip setpoints are then determined, accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

Note that, although the channel is OPERABLE under these circumstances, the trip setpoint must be left adjusted to a value within the as-left tolerance, in accordance with uncertainty assumptions stated in the referenced setpoint methodology (as-left criteria), and confirmed to be operating within the statistical allowances of the uncertainty terms assigned as-found criteria.

(continued)

GRAND GULF B 3.3-125d LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE The individual Functions are required to be OPERABLE in SAFETY ANALYSES, MODE 1, and in MODES 2 and 3 with reactor steam dome LCO, and pressure > 150 psig, since this is when RCIC is required to APPLICABILITY be OPERABLE. (Refer to LCO 3.5.3 for Applicability Bases (continued) for the RCIC System.)

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water Level - Low Low, Level 2 Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level above the top of the active fuel.

Reactor Vessel Water Level - Low Low, Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value is set high enough such that for complete loss of feedwater flow, the RCIC System flow (with high pressure core spray assumed to fail) will be sufficient to avoid initiation of low pressure ECCS at Level 1.

Four channels of Reactor Vessel Water Level - Low Low, Level 2 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

2. Reactor Vessel Water Level - High, Level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal closes (continued)

GRAND GULF B 3.3-126 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE 2. Reactor Vessel Water Level - High, Level 8 (continued)

SAFETY ANALYSES, LCO, and the RCIC steam supply valve to prevent overflow into the APPLICABILITY main steam lines (MSLs).

Reactor Vessel Water Level -High, Level 8 signals for RCIC are initiated from two level transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level - High, Level 8 Allowable Value is high enough to preclude closure of the steam supply valve of the RCIC system during normal operation, yet low enough to close the steam supply valve prior to water overflowing into the MSLs.

Two channels of Reactor Vessel Water Level - High, Level 8 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LCO 3.5.3 for RCIC Applicability Bases.

3. Condensate Storage Tank Level - Low Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source. Normally the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens and then the CST suction valve automatically closes. This ensures that an adequate supply of makeup water is available to the RCIC pump. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.

Two level transmitters are used to detect low water level in the CST. The Condensate Storage Tank Level - Low Function (continued)

GRAND GULF B 3.3-127 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE 3. Condensate Storage Tank Level - Low (continued)

SAFETY ANALYSES, LCO, and Allowable Value is set high enough to ensure adequate pump APPLICABILITY suction head while water is being taken from the CST.

Two channels of Condensate Storage Tank Level - Low Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source. Refer to LCO 3.5.3 for RCIC Applicability Bases.

4. Suppression Pool Water Level - High Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the safety/relief valves. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of RCIC from the CST to the suppression pool to eliminate the possibility of RCIC continuing to provide additional water from a source outside primary containment. This Function satisfies Criterion 3 of the NRC Policy Statement. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.

Suppression pool water level signals are initiated from two level transmitters. The Allowable Value for the Suppression Pool Water Level - High Function is set low enough to ensure that RCIC will be aligned to take suction from the suppression pool before the water level reaches the point at which suppression design loads would be exceeded.

Two channels of Suppression Pool Water Level - High Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source. Refer to LCO 3.5.3 for RCIC Applicability Bases.

(continued)

GRAND GULF B 3.3-128 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

APPLICABLE 5. Manual Initiation SAFETY ANALYSES, LCO, and The Manual Initiation push button switch introduces a signal APPLICABILITY into the RCIC System initiation logic that is redundant to (continued) the automatic protective instrumentation and provides manual initiation capability. There is one push button for the RCIC System.

The Manual Initiation Function is not assumed in any accident or transient analyses in the UFSAR. However, the Function is retained for the RCIC function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channel is mechanically actuated based solely on the position of the push button. One channel of Manual Initiation is required to be OPERABLE when RCIC is required to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to RCIC System instrumentation channels. Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition. Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable RCIC System instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable RCIC System instrumentation channel.

A.1 Required Action A.1 directs entry into the appropriate Condition referenced in Table 3.3.5.3-1 in the accompanying LCO. The applicable Condition referenced in the Table is Function dependent. Each time a channel is discovered to be inoperable, Condition A is entered for that channel and provides for transfer to the appropriate subsequent Condition.

(continued)

GRAND GULF B 3.3-129 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

ACTIONS B.1 and B.2 (continued)

Required Action B.1 is intended to ensure that appropriate actions are taken if multiple, inoperable, untripped channels within the same Function result in a complete loss of automatic initiation capability for the RCIC System. In this case, automatic initiation capability is lost if two Function 1 channels in the same trip system are inoperable and untripped. In this situation (loss of automatic initiation capability), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Action B.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after discovery of loss of RCIC initiation capability.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock." For Required Action B.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically initiated due to two inoperable, untripped Reactor Vessel Water Level - Low Low, Level 2 channels in the same trip system. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action B.2. Placing the inoperable channel in trip would conservatively compensate for the inoperability, restore capability to accommodate a single failure, and allow operation to continue.

Alternately, if it is not desired to place the channel in trip (e.g., as in the case where placing the inoperable channel in trip would result in an initiation), Condition E must be entered and its Required Action taken.

(continued)

GRAND GULF B 3.3-130 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

ACTIONS C.1 (continued)

A risk based analysis was performed and determined that an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (Ref. 1) is acceptable to permit restoration of any inoperable channel to OPERABLE status (Required Action C.1). A Required Action (similar to Required Action B.1), limiting the allowable out of service time if a loss of automatic RCIC initiation capability exists, is not required. This Condition applies to the Reactor Vessel Water Level -

High, Level 8 Function, whose logic is arranged such that any inoperable channel will result in a loss of automatic RCIC initiation capability. As stated above, this loss of automatic RCIC initiation capability was analyzed and determined to be acceptable. This Condition also applies to the Manual Initiation Function. Since this Function is not assumed in any accident or transient analysis, a total loss of manual initiation capability (Required Action C.1) for 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is allowed. The Required Action does not allow placing a channel in trip since this action would not necessarily result in the safe state for the channel in all events.

D.1, D.2.1, and D.2.2 Required Action D.1 is intended to ensure that appropriate actions are taken if multiple inoperable, untripped channels within the same Function result in automatic component initiation capability being lost for the feature(s). For Required Action D.1, the RCIC System is the only associated feature. In this case, automatic component initiation capability is lost if two Function 3 channels or two Function 4 channels are inoperable and untripped. In this situation (loss of automatic suction swap), the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months allowance of Required Actions D.2.1 and D.2.2 is not appropriate, and the RCIC System must be declared inoperable within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months from discovery of loss of RCIC initiation capability. As noted, Required Action D.1 is only applicable if the RCIC pump suction is not aligned to the suppression pool since, if aligned, the Function is already performed.

The Completion Time is intended to allow the operator time to evaluate and repair any discovered inoperabilities. This Completion Time also allows for an exception to the normal "time zero" for beginning the allowed outage time "clock."

(continued)

GRAND GULF B 3.3-131 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

ACTIONS D.1, D.2.1, and D.2.2 (continued)

For Required Action D.1, the Completion Time only begins upon discovery that the RCIC System cannot be automatically aligned to the suppression pool due to two inoperable, untripped channels in the same Function. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time from discovery of loss of initiation capability is acceptable because it minimizes risk while allowing time for restoration or tripping of channels.

Because of the redundancy of sensors available to provide initiation signals and the fact that the RCIC System is not assumed in any accident or transient analysis, an allowable out of service time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months has been shown to be acceptable (Ref. 1) to permit restoration of any inoperable channel to OPERABLE status. If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action D.2.1, which performs the intended function of the channel (shifting the suction source to the suppression pool).

Alternatively, Required Action D.2.2 allows the manual alignment of the RCIC suction to the suppression pool, which also performs the intended function. If Required Action D.2.1 or D.2.2 is performed, measures should be taken to ensure that the RCIC System piping remains filled with water. If it is not desired to perform Required Actions D.2.1 and D.2.2, Condition E must be entered and its Required Action taken.

E.1 With any Required Action and associated Completion Time not met, the RCIC System may be incapable of performing the intended function, and the RCIC System must be declared inoperable immediately.

SURVEILLANCE As noted in the beginning of the SRs, the SRs for each RCIC REQUIREMENTS System instrumentation Function are found in the SRs column of Table 3.3.5.3-1.

The Surveillances are modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated (continued)

GRAND GULF B 3.3-132 LBDCR 18128

RCIC System Instrumentation B 3.3.5.3 BASES

SURVEILLANCE Conditions and Required Actions may be delayed as follows:

REQUIREMENTS (a) for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 2 and 5; and (b) for up (continued) to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months for Functions 1, 3, and 4 provided the associated Function maintains trip capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 1) assumption of the average time required to perform channel Surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RCIC will initiate when necessary.

SR 3.3.5.3.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying that the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channel status during normal operational use of the displays associated with the channels required by the LCO.

(continued)

GRAND GULF B 3.3-133 LBDCR 18128 LBDCR 18127

PAGE INTENTIONALLY LEFT BLANK RCIC System Instrumentation B 3.3.5.3 BASES

SURVEILLANCE SR 3.3.5.3.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.3.3 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.5.3-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be re-adjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.3.4 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter with the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.5.3.4 for Function 3, Condensate Storage Tank Level-Low, is modified by two Notes as identified in Table 3.3.5.3-1. The first Note require evaluation of channel performance for the condition where the as-found setting for (continued)

GRAND GULF B 3.3-134 LBDCR 18128 LBDCR 18127

RCIC System Instrumentation B 3.3.5.3 BASES

SURVEILLANCE SR 3.3.5.3.4 (continued)

REQUIREMENTS the channel setpoint is outside its as-found tolerance but conservative with respect to the Allowable Value. Evaluation of channel performance will verify that the channel will continue to behave in accordance with safety analysis assumptions and the channel performance assumptions in the setpoint methodology. The purpose of the assessment is to ensure confidence in the channel performance prior to returning the channel to service. For channels determined to be OPERABLE but degraded after returning the channel to service the performance of these channels will be evaluated under the plant Corrective Action Program. Entry into the Corrective Action Program will ensure required review and documentation of the condition.

The second Note applied to SR 3.3.5.3.4 for Function 3, Condensate Storage Tank Level-Low, requires that the as-left setting for the channel be within the as-left tolerance of the Nominal Trip Setpoint (NTSP).

Where a setpoint more conservative than the NTSP is used in the plant surveillance procedures, the as-left and as-found tolerances, as applicable, will be applied to the surveillance procedure setpoint. This will ensure that sufficient margin to the Safety Limit and/or Analytical Limit is maintained. If the as-left channel setting cannot be returned to a setting within the as-left tolerance of the NTSP, then the channel shall be declared inoperable. The second Note also requires that the NTSP and the methodologies for calculating the as-left and the as-found tolerances be in the TRM.

(continued)

GRAND GULF B 3.3-134a LBDCR 18128

PAGE INTENTIONALLY LEFT BLANK RCIC System Instrumentation B 3.3.5.3 BASES

SURVEILLANCE SR 3.3.5.3.5 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.5.3 overlaps this Surveillance to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. NEDE-770-06-2, "Addendum to Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

2. Regulatory Guide 1.105, Setpoints for Safety-Related Instrumentation, Revision 3.

GRAND GULF B 3.3-135 LBDCR 18128 LBDCR 18127

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE setpoints are selected to ensure that the setpoints do not SAFETY ANALYSES, exceed the Allowable Value between CHANNEL CALIBRATIONS.

LCO, and Operation with a trip setpoint less conservative than the APPLICABILITY nominal trip setpoint, but within its Allowable Value, is (continued) acceptable. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual process parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g., trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors. The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

Certain Emergency Core Cooling Systems (ECCS) and RCIC valves (e.g., minimum flow) also serve the dual function of automatic isolation valves. The signals that isolate these valves are also associated with the automatic initiation of the ECCS and RCIC. Some instrumentation and ACTIONS associated with these signals are addressed in LCO 3.3.5.1, "ECCS Instrumentation," and LCO 3.3.5.3, "RCIC Instrumentation," and are not included in this LCO.

In general, the individual Functions are required to be OPERABLE in MODES 1, 2, and 3 consistent with the Applicability for LCO 3.6.1.1, "Primary Containment," and LCO 3.6.5.1, "Drywell," as applicable.

Functions that have different Applicabilities are discussed below in the individual Functions discussion.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

(continued)

GRAND GULF B 3.3-140 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES APPLICABLE 2.g. Containment and Drywell Ventilation Exhaust SAFETY ANALYSES, Radiation - High (continued)

LCO, and APPLICABILITY Four channels of Containment and Drywell Ventilation Exhaust - High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. Two upscale-Hi Hi, one upscale-Hi Hi and one downscale, or two downscale signals from the same trip system actuate the trip system and initiate isolation of the associated containment and drywell isolation valves.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding and to ensure offsite doses remain below 10 CFR 20 and 10 CFR 50.67 limits.

The Function is required to be OPERABLE during movement of recently irradiated fuel assemblies in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures (due to dropped fuel assemblies) must be provided to ensure offsite dose limits are not exceeded. Due to radioactive decay, this Function is only required to isolate primary containment during those fuel handling accidents involving the handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

This Function isolates the Group 7 valves.

2.h. Manual Initiation The Manual Initiation push button channels introduce signals into the primary containment and drywell isolation logic that are redundant to the automatic protective instrumentation and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.

There are four push buttons for the logic, two manual initiation push buttons per trip system. There is no (continued)

GRAND GULF B 3.3-148 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

APPLICABLE 5.a. Ambient Temperature - High (continued)

SAFETY ANALYSES, LCO, and Function are available and are required to be OPERABLE to APPLICABILITY ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are set low enough to detect a leak equivalent to 25 gpm.

The RHR Equipment Room Ambient Temperature - High Functions are only required to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, insufficient pressure and temperature are available to develop a significant steam leak in this piping and significant water leakage is protected by the Reactor Vessel Water Level - Low, Level 3 Function.

This function isolates the Group 3 valves.

5.b. Reactor Vessel Water Level - Low, Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, isolation of some reactor vessel interfaces occurs to begin isolating the potential sources of a break. The Reactor Vessel Water Level - Low, Level 3 Function associated with RHR Shutdown Cooling System isolation is not directly assumed in any transient or accident analysis, since bounding analyses are performed for large breaks such as MSLBs. The RHR Shutdown Cooling System isolation on Level 3 supports actions to ensure that the RPV water level does not drop below the top of the active fuel during a vessel draindown event through the 1E12-F008 and 1E12-F009 valves caused by a leak (e.g., pipe break or inadvertent valve opening) in the RHR Shutdown Cooling System.

Reactor Vessel Water Level - Low, Level 3 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels (two channels per trip system) of the Reactor Vessel Water Level - Low, Level 3 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

(continued)

GRAND GULF B 3.3-159 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

APPLICABLE 5.b. Reactor Vessel Water Level - Low, Level 3 (continued)

SAFETY ANALYSES, LCO, and The Reactor Vessel Water Level - Low, Level 3 Allowable Value was APPLICABILITY chosen to be the same as the RPS Reactor Vessel Water Level - Low, Level 3 Allowable Value (LCO 3.3.1.1) since the capability to cool the fuel may be threatened.

The Reactor Vessel Water Level - Low, Level 3 Function is required to be OPERABLE in MODE 3 with reactor pressure less than the RHR permissive pressure to prevent this potential flow path from lowering reactor vessel level to the top of the fuel. This instrumentation is required to be OPERABLE in MODES 1 and 2 and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR cut-in permissive pressure to support actions to ensure that offsite dose limits of 10CFR100 are not exceeded.

Otherwise, this function is only required to be operable when automatic isolation of the associated RHR system penetration flow path is credited in calculating drain time (See LCO 3.3.5.2). The definition of drain time allows crediting the closing of penetration flow paths that are capable of being automatically isolated by RPV water level isolation instrumentation prior to the RPV water level dropping below the TAF, but if the instrument function is inoperable, the automatic closure cannot be credited and a drain time calculation must be re-performed.

This Function isolates the Group 3 valves.

(continued)

GRAND GULF B 3.3-160 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

ACTIONS H.1 and H.2 (continued)

If the channel is not restored to OPERABLE status or placed in trip, or any Required Action of Condition F or G is not met and the associated Completion Time has expired, the plant must be placed in a MODE or other specified condition in which the LCO does not apply. This is done by placing the plant in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

I.1 and I.2 If the channel is not restored to OPERABLE status within the allowed Completion Time, the associated SLC subsystem(s) is declared inoperable or the RWCU System is isolated. Since this Function is required to ensure that the SLC System performs its intended function, sufficient remedial measures are provided by declaring the associated SLC subsystem inoperable or isolating the RWCU System.

The Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is acceptable because it minimizes risk while allowing sufficient time for personnel to isolate the RWCU System.

J.1, J.2.1, J.2.2, and J.2.3 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the RHR Shutdown Cooling System suction from the reactor vessel flow path should be isolated. However, if the shutdown cooling function is needed to provide core cooling, these Required Actions allow the penetration flow path to remain unisolated provided action is immediately initiated to restore the channel to OPERABLE status or to minimize any potential fission product release to the environment. This includes ensuring secondary containment is OPERABLE; one standby gas treatment subsystem is OPERABLE; and secondary containment isolation capability (i.e., at least one isolation valve and (continued)

GRAND GULF B 3.3-166 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

ACTIONS J.1, J.2.1, J.2.2, and J.2.3 (continued) associated instrumentation are OPERABLE or other acceptable administrative controls to assure isolation capability) in each secondary containment penetration flow path not isolated that is assumed to be isolated to mitigate radioactivity releases. This may be performed as an administrative check, by examining logs or other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the Surveillances needed to demonstrate the OPERABILITY of the components. If, however, any required component is inoperable, then it must be restored to OPERABLE status. In this case, the Surveillances may need to be performed to restore the component to OPERABLE status. Actions must continue until all required components are OPERABLE.

K.1 and K.2 If the channel is not restored to OPERABLE status or placed in trip within the allowed Completion Time, the associated penetration flow path(s) should be isolated (Required Action K.1). Isolating the affected penetration flow path(s) accomplishes the safety function of the inoperable instrumentation. Alternately, the plant must be placed in a condition in which the LCO does not apply. If applicable, movement of recently irradiated fuel assemblies must be immediately suspended.

Suspension of these activities shall not preclude completion of movement of a component to a safe condition.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each REQUIREMENTS Isolation Instrumentation Function are found in the SRs column of Table 3.3.6.1-1.

The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months provided the associated Function maintains (continued)

GRAND GULF B 3.3-167 LBDCR 18128

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

SURVEILLANCE trip capability. Upon completion of the Surveillance, or REQUIREMENTS expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be (continued) returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Refs. 5 and 6) assumption of the average time required to perform channel Surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the PCIVs or drywell isolation valves will isolate the penetration flow path(s) when necessary.

SR 3.3.6.1.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

(continued)

GRAND GULF B 3.3-168 LBDCR 18127

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

SURVEILLANCE SR 3.3.6.1.2 REQUIREMENTS (continued) A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.1.3 The calibration of trip units consists of a test to provide a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.1-1. For Function 1.c, Main Steam Line Flow High, there is a plant specific program which verifies the instrument channel functions by verifying the as-left and as-found settings are consistent with those established by the setpoint methodology. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.1.4, SR 3.3.6.1.5, and SR 3.3.6.1.7 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-169 LBDCR 18127

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

SURVEILLANCE SR 3.3.6.1.6 and SR 3.3.6.1.8 REQUIREMENTS (continued) The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing performed on isolation valves in LCO 3.6.1.3 and LCO 3.6.5.3 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.1.9 This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis.

Testing is performed only on channels where the assumed response time does not correspond to the diesel generator (DG) start time. For channels assumed to respond within the DG start time, sufficient margin exists in the 10 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. Testing of the closure times of the MSIVs is not included in this Surveillance since the closure time of the MSIVs is tested by SR 3.6.1.3.6. ISOLATION SYSTEM RESPONSE TIME acceptance criteria for this instrumentation is included in the applicable plant procedures.

As Noted, the channel sensor may be excluded from response time testing. This allowance to not perform specific response time testing of the sensors is applicable when the alternate testing requirements and restrictions of Reference 7 are performed. As stated in Reference 7, analysis has demonstrated that other Technical Specification testing requirements (CHANNEL CALIBRATIONS, CHANNEL CHECKS, CHANNEL FUNCTIONAL TESTS, and LOGIC SYSTEM FUNCTIONAL TESTS) and actions taken in response to NRC Bulletin 90-01 Supplement 1 are sufficient to identify failure modes or degradation in (continued)

GRAND GULF B 3.3-170 LBDCR 18127

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 BASES

SURVEILLANCE SR 3.3.6.1.9 (continued)

REQUIREMENTS instrument response times and assure operation of the analyzed instrument loops within acceptable limits. Reference 7 also identifies that there are no known channel sensor failure modes identified that can be detected by response time testing that cannot also be detected by other Technical Specification required surveillances. Therefore, when the requirements, including sensor types, of Reference 7 are complied with, adequate assurance of the response time of the sensors is provided.

This assurance of the response time of the sensors when combined with the response time testing of the remainder of the channel ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis. The calibration shall be performed such that fast ramp or step change to system components during calibrations is performed to verify that the response of the transmitter to the input change is prompt. Technicians shall monitor for response time degradation during the performance of calibrations.

Technicians shall be appropriately trained to ensure they are aware of the consequences of instrument response time degradation. These items are commitments made per Reference 8. If the alternate testing requirements of Reference 7 are not complied with then the entire channel will be response time tested including the sensors.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-170a LBDCR 18127 LBDCR 18128

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

APPLICABLE 1. Reactor Vessel Water Level - Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY Reactor Vessel Water Level - Low Low, Level 2 Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Reactor Vessel Water Level - Low Low, Level 2 Allowable Value was chosen to be the same as the High Pressure Core Spray (HPCS)/Reactor Core Isolation Cooling (RCIC) Reactor Vessel Water Level - Low Low, Level 2 Allowable Value (LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," and LCO 3.3.5.3, "Reactor Core Isolation Cooling (RCIC) System Instrumentation"), since this could indicate the capability to cool the fuel is being threatened.

The Reactor Vessel Water Level - Low Low, Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS);

thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required.

2. Drywell Pressure - High High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation of high drywell pressure supports actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

(continued)

GRAND GULF B 3.3-175 LBDCR 18128

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

APPLICABLE 3, 4. Fuel Handling Area Ventilation and Pool Sweep Exhaust SAFETY ANALYSES, Radiation -High High (continued)

LCO, and APPLICABILITY channels of Fuel Handling Area Ventilation Exhaust Radiation -

High High Function and four channels of Fuel Handling Area Pool Sweep Exhaust Radiation - High High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding.

The Exhaust Radiation - High High Functions are required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, these Functions are not required. In addition, the Functions are required to be OPERABLE during movement of recently irradiated fuel assemblies in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures (due to dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded. Due to radioactive decay, these Functions are only required to isolate secondary containment during those fuel handling accidents involving the handling of recently irradiated fuel (i.e., fuel that has occupied part of a critical reactor core within the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ).

5. Manual Initiation The Manual Initiation push button channels introduce signals into the secondary containment isolation logic that are redundant to the automatic protective instrumentation channels, and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for the secondary containment isolation instrumentation as required by the NRC approved licensing basis.

(continued)

GRAND GULF B 3.3-177 LBDCR 18128

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

APPLICABLE 5. Manual Initiation (continued)

SAFETY ANALYSES, LCO, and Four channels of the Manual Initiation Function are APPLICABILITY available and are required to be OPERABLE in MODES 1, 2, and 3 and during movement of recently irradiated fuel assemblies in the secondary containment, since these are the MODES and other specified conditions in which the Secondary Containment Isolation automatic Functions are required to be OPERABLE.

ACTIONS A Note has been provided to modify the ACTIONS related to secondary containment isolation instrumentation channels.

Section 1.3, Completion Times, specifies that once a Condition has been entered, subsequent divisions, subsystems, components, or variables expressed in the Condition discovered to be inoperable or not within limits will not result in separate entry into the Condition.

Section 1.3 also specifies that Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable secondary containment isolation instrumentation channels provide appropriate compensatory measures for separate inoperable channels. As such, a Note has been provided that allows separate Condition entry for each inoperable secondary containment isolation instrumentation channel.

A.1 Because of the diversity of sensors available to provide isolation signals and the redundancy of the isolation design, an allowable out of service time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months or 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months , depending on the Function, has been shown to be acceptable (Refs. 3 and 4) to permit restoration of any inoperable channel to OPERABLE status.

Functions that share common instrumentation with the RPS have a 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed out of service time consistent with the time provided for the associated RPS instrumentation channels. This out of service time is only acceptable provided the associated Function is still maintaining isolation capability (refer to Required Action B.1 Bases). If the inoperable channel cannot be restored to OPERABLE status within the allowable out of service time, the channel must be placed in the tripped condition per Required Action A.1. Placing the (continued)

GRAND GULF B 3.3-178 LBDCR 18128

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

SURVEILLANCE SR 3.3.6.2.1 REQUIREMENTS (continued) Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the indicated parameter for one instrument channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.2.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-181 LBDCR 18127

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

SURVEILLANCE SR 3.3.6.2.3 REQUIREMENTS (continued) Calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.2-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.2.4 and SR 3.3.6.2.5 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.6.2.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required isolation logic for a specific channel. The system functional testing, performed on SCIVs and the SGT System in LCO 3.6.4.2 and LCO 3.6.4.3, respectively, overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-182 LBDCR 18127

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES

SURVEILLANCE SR 3.3.6.2.7 REQUIREMENTS This SR ensures that the individual channel response times are less than or equal to the maximum values assumed in the accident analysis.

Testing is performed only on channels where the assumed response time does not correspond to the diesel generator (DG) start time. For channels assumed to respond within the DG start time, sufficient margin exists in the 10 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. Testing of the closure times of the isolation dampers is not included in this Surveillance since the closure time of the isolation dampers is tested by SR 3.6.4.2.2. ISOLATION SYSTEM RESPONSE TIME acceptance criteria for this instrumentation is included in the applicable plant procedures.

A Note to the Surveillance states that the radiation detectors may be excluded from ISOLATION SYSTEM RESPONSE TIME testing. This Note is necessary because of the difficulty of generating an appropriate detector input signal and because the principles of detector operation virtually ensure an instantaneous response time. Response time for radiation detector channels shall be measured from detector output or the input of the first electronic component in the channel.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-183 LBDCR 18127

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES

ACTIONS C.1 and C.2 (continued) status within the allowable out of service time, Condition D must be entered and its Required Action taken. The Required Actions do not allow placing the channel in trip since this action could either cause the initiation or it would not necessarily result in a safe state for the channel in all events.

D.1 With any Required Action and associated Completion Time not met, the associated RHR containment spray subsystem may be incapable of performing the intended function and the RHR containment spray subsystem associated with inoperable untripped channels must be declared inoperable immediately.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each RHR REQUIREMENTS Containment Spray System Function are located in the SRs column of Table 3.3.6.3-1.

The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains RHR containment spray initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel surveillance.

That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the RHR containment spray will initiate when necessary.

SR 3.3.6.3.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter (continued)

GRAND GULF B 3.3-192 LBDCR 18127

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES

SURVEILLANCE SR 3.3.6.3.1 (continued)

REQUIREMENTS indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus, it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

Agreement criteria are determined by the plant staff based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the channels required by the LCO.

SR 3.3.6.3.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.3.3 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.3-1. If the (continued)

GRAND GULF B 3.3-193 LBDCR 18127

RHR Containment Spray System Instrumentation B 3.3.6.3 BASES

SURVEILLANCE SR 3.3.6.3.3 (continued)

REQUIREMENTS trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.3.4 and SR 3.3.6.3.5 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.6.3.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.6.1.7, "Residual Heat Removal (RHR) Containment Spray," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-194 LBDCR 18127

SPMU System Instrumentation B 3.3.6.4 BASES

ACTIONS D.1 (continued)

With any Required Action and associated Completion Time not met, the associated SPMU subsystem may be incapable of performing the intended function and the SPMU subsystem associated with inoperable, untripped channels must be declared inoperable immediately.

SURVEILLANCE As noted at the beginning of the SRs, the SRs for each SPMU REQUIREMENTS System Function are located in the SRs column of Table 3.3.6.4-1.

The Surveillances are also modified by a Note to indicate that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains suppression pool makeup initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 3) assumption of the average time required to perform channel surveillance. That analysis demonstrated that the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the SPMU will initiate when necessary.

SR 3.3.6.4.1 Performance of the CHANNEL CHECK ensures that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect gross channel failure; thus it is key to verifying the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

(continued)

GRAND GULF B 3.3-205 LBDCR 18127

SPMU System Instrumentation B 3.3.6.4 BASES

SURVEILLANCE SR 3.3.6.4.1 (continued)

REQUIREMENTS Agreement criteria are determined by the plant staff, based on a combination of the channel instrument uncertainties, including indication and readability. If a channel is outside the criteria, it may be an indication that the instrument has drifted outside its limit.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The CHANNEL CHECK supplements less formal, but more frequent, checks of channels during normal operational use of the displays associated with the required channels of the LCO.

SR 3.3.6.4.2 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure the entire channel will perform the intended function.

Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.4.3 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in Table 3.3.6.4-1. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-206 LBDCR 18127

SPMU System Instrumentation B 3.3.6.4 BASES

SURVEILLANCE SR 3.3.6.4.4 and SR 3.3.6.4.5 REQUIREMENTS (continued) A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy.

CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.6.4.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.6.2.4, "Suppression Pool Makeup (SPMU) System," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 7.3.1.1.9.

2. UFSAR, Section 6.2.7.3.

3. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

GRAND GULF B 3.3-207 LBDCR 18127

Relief and LLS Instrumentation B 3.3.6.5 BASES (continued)

ACTIONS B.1 and B.2 (continued) from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE The Surveillances are modified by a Note to indicate that REQUIREMENTS when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains relief or LLS initiation capability, as applicable. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken. This Note is based on the reliability analysis (Ref. 2) assumption of the average time required to perform channel surveillance. That analysis demonstrated the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months testing allowance does not significantly reduce the probability that the relief and LLS valves will initiate when necessary.

SR 3.3.6.5.1 A CHANNEL FUNCTIONAL TEST is performed on each required channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.5.2 The calibration of trip units provides a check of the actual trip setpoints.

The channel must be declared inoperable if the trip setting is discovered to be less conservative than the Allowable Value specified in SR 3.3.6.5.3. If the trip setting is discovered to be less conservative than accounted for in the appropriate setpoint methodology but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analysis. Under these conditions, the setpoint must be readjusted to be (continued)

GRAND GULF B 3.3-212 LBDCR 18127

Relief and LLS Instrumentation B 3.3.6.5 BASES SURVEILLANCE SR 3.3.6.5.2 (continued)

REQUIREMENTS equal to or more conservative than accounted for in the appropriate setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.5.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.6.5.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed for S/RVs in LCO 3.4.4 and LCO 3.6.1.6 overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 5.2.2.

2. GENE-770-06-1, "Bases for Changes to Surveillance Test Intervals and Allowed Out-of-Service Times for Selected Instrumentation Technical Specifications," February 1991.

GRAND GULF B 3.3-213 LBDCR 18127

CRFA System Instrumentation B 3.3.7.1 BASES ACTIONS B.1 (continued)

With the required action and completion time not met, the associated isolation dampers must be closed. This effectively establishes the isolation made of CRFA operation.

The 1-hour completion time is intended to allow the operator time to establish this mode of operation. It is acceptable because it minimizes risk while allowing time to establish the CRFA subsystem in operation.

SURVEILLANCE The Surveillance is also modified by a Note to indicate REQUIREMENTS that when a channel is placed in an inoperable status solely for performance of required Surveillances, entry into associated Conditions and Required Actions may be delayed for up to 6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months , provided the associated Function maintains CRFA System initiation capability. Upon completion of the Surveillance, or expiration of the 6 hour6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months allowance, the channel must be returned to OPERABLE status or the applicable Condition entered and Required Actions taken.

SR 3.3.7.1.1 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LCO 3.7.3, "Control Room Fresh Air (CRFA) System," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-217 LBDCR 18127

LOP Instrumentation B 3.3.8.1 BASES

SURVEILLANCE SR 3.3.8.1.1 (continued)

REQUIREMENTS The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.8.1.2 and SR 3.3.8.1.3 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequencies are controlled under the Surveillance Frequency Control Program.

SR 3.3.8.1.4 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required actuation logic for a specific channel. The system functional testing performed in LCO 3.8.1 and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety functions.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 8.3.1.

2. UFSAR, Section 5.2.

3. UFSAR, Section 6.3.

4. UFSAR, Chapter 15.

(continued)

GRAND GULF B 3.3-231 LBDCR 18127

RPS Electric Power Monitoring B 3.3.8.2 B 3.3 INSTRUMENTATION B 3.3.8.2 Reactor Protection System (RPS) Electric Power Monitoring BASES BACKGROUND The RPS Electric Power Monitoring System is provided to isolate the RPS bus from the motor generator (MG) set or an alternate power supply in the event of overvoltage, undervoltage, or underfrequency. This system protects the loads connected to the RPS bus against unacceptable voltage and frequency conditions (Ref. 1) and forms an important part of the primary success path for the essential safety circuits. RPS buses supply power to the RPS logic, scram solenoids, MSIV isolation solenoids, and other essential equipment.

The RPS Electric Power Monitoring assembly will detect any abnormal high or low voltage or low frequency condition in the outputs of the two MG sets or the alternate power supply and will de-energize its respective RPS bus, thereby causing all safety functions normally powered by this bus to de-energize.

In the event of failure of an RPS Electric Power Monitoring System (e.g., both inseries electric power monitoring assemblies), the RPS loads may experience significant effects from the unregulated power supply. Deviation from the nominal conditions, such as an unregulated power supply can cause damage to the scram solenoids and other Class 1E devices.

In the event of a low voltage condition for an extended period of time, the scram solenoids can chatter and potentially lose their pneumatic control capability, resulting in a loss of primary scram action.

In the event of an overvoltage condition, the RPS logic relays and scram solenoids, as well as the main steam isolation valve solenoids, may experience a voltage higher than their design voltage. If the overvoltage condition persists for an extended time period, it may cause equipment degradation and the loss of plant safety function.

Two redundant Class 1E circuit breakers are connected in series between each RPS bus and its MG set, and between each RPS bus and its alternate power supply. Each of these (continued)

GRAND GULF B 3.3-232 LBDCR 16064

RPS Electric Power Monitoring B 3.3.8.2 BASES

ACTIONS B.1 (continued)

OPERABLE assemblies may then be used to power one RPS bus. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is sufficient for the plant operations personnel to take corrective actions and is acceptable because it minimizes risk while allowing time for restoration or removal from service of the electric power monitoring assemblies.

Alternately, if it is not desired to remove the power supply(s) from service (e.g., as in the case where removing the power supply(s) from service would result in a scram or isolation), Condition C or D, as applicable, must be entered and its Required Actions taken.

C.1 and C.2 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 1, 2, or 3, the plant must be brought to a MODE in which overall plant risk is minimized. The plant shutdown is accomplished by placing the plant in MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 2) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action C.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

GRAND GULF B 3.3-236 LBDCR 14043

RPS Electric Power Monitoring B 3.3.8.2 BASES

ACTIONS D.1 If any Required Action and associated Completion Time of Condition A or B are not met in MODE 4 or 5, with any control rod withdrawn from a core cell containing one or more fuel assemblies, the operator must immediately initiate action to fully insert all insertable control rods in core cells containing one or more fuel assemblies (Required Action D.1). This Required Action results in the least reactive condition for the reactor core and ensures that the safety function of the RPS (e.g., scram of control rods) is not required. All actions must continue until the applicable Required Actions are completed.

SURVEILLANCE SR 3.3.8.2.1 REQUIREMENTS A CHANNEL FUNCTIONAL TEST is performed on each overvoltage, undervoltage, and underfrequency channel to ensure that the entire channel will perform the intended function. Any setpoint adjustment shall be consistent with the assumptions of the current plant specific setpoint methodology.

As noted in the Surveillance, the CHANNEL FUNCTIONAL TEST is only required to be performed while the plant is in a condition in which the loss of the RPS bus will not jeopardize steady state power operation (the design of the system is such that the power source must be removed from service to conduct the Surveillance). The 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months is intended to indicate an outage of sufficient duration to allow for scheduling and proper performance of the Surveillance. The Note in the Surveillance is based on guidance provided in Generic Letter 91-09 (Ref. 3).

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.3.8.2.2 CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies that the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.3-237 LBDCR 18127

RPS Electric Power Monitoring B 3.3.8.2 BASES

SURVEILLANCE SR 3.3.8.2.3 REQUIREMENTS (continued) Performance of a system functional test demonstrates a required system actuation (simulated or actual) signal. The discrete relays/logic of the system will automatically trip open the associated power monitoring assembly circuit breaker. Only one signal per power monitoring assembly is required to be tested. This Surveillance overlaps with the CHANNEL CALIBRATION to provide complete testing of the safety function. The system functional test of the Class 1E circuit breakers is included as part of this test to provide complete testing of the safety function. If the breakers are incapable of operating, the associated electric power monitoring assembly would be inoperable.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 8.3.1.1.5.

2. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

3. NRC Generic Letter 91-09, "Modification of Surveillance Interval for the Electric Protective Assemblies in Power Supplies for the Reactor Protection System."

GRAND GULF B 3.3-238 LBDCR 18127

ML20134H889

Text

Navigation menu

Search