Text

Proposed Tech Specs,Revising TS Bases to Include Changes Made Since Rev 1 Was Sent to NRC 960201
	ML20140E321
Person / Time
Site:	Grand Gulf
Issue date:	04/18/1997
From:	; ENTERGY OPERATIONS, INC.
To:	;
Shared Package
ML20140E318	List: ML20140E312; ML20140E321;
References
	NUDOCS 9704250222
	Download: ML20140E321 (126)
	v • d • e

-

Reactor Core SLs 4 - B 2.1.1 B 2.0 SAFETY LIMITS (SLs)

B 2.1.1 ' Reactor' Core SLs BASES.

iBACKGROUND GDC 10 (Ref. 1) requires, and SLs ensure, that specified u acceptable fuel design limits are not exceeded during steady-state operation, normal operational transients, and anticipated. operational occurrences (A00s).

The fuel cladding integrity.SL is_ set.such that no significant fuel damage is. calculated to occur if the limit is not_ violated. Because. fuel damage is not directly observable, a stepback approach-is used to establish an SL, such that the.MCPR is not less than the limit specified in Specification 2.1.1.2. MCPR greater than the specified limit represents a conservative margin relative to the.

conditions required to maintain fuel cladding integrity.

The- fuei cladding is one of. the physical barriers that '

separate the radioactive materials from the environs. The integrity of this cladding barrier is related to-its relative freedom from perforations or cracking. Although some corrosion or use related cracking may occur during the life of the cladding,- fission product migration from this source is incrementally cumulative and continuously measurable. Fuel cladding. perforations, however, can result from thermal stresses, which occur' from reactor operation significantly above design conditions.

While fission product migration from cladding perforation is just as measurable as;that from use related cracking, the thermally caused cladding perforations' signal a threshold

. beyond which.still greater thermal stresses may cause gross, rather than incremental, ~ cladding deterioration. Therefore,

'the_ fuel cladding SL is defined with a margin to the conditions that would produce onset of transition boiling (i.e., MCPR - 1.00). These conditions represent a significant departure from the condition intended by design for planned operation. The MCPR fuel cladding integrity SL ensures that during normal operation and during A00s, at least 99.9% of the fuel rods in the core do not experience transition boiling.

9704250222 970418 PDR ADOCK 05000416 P PDR j (continued)

' GRAND GULF B 2.0-1 Revision No. O

_ _ - ~ ,

. . - _ - . . . ~ . - . _ - _ - _ . - . - - - . - - . - - .. - .- -.

Reactor Core SLs

B 2.1.1 l

BASES BACKGROUND Operation above the boundary of the nucleate boiling regime (continued) could result ir. excessive cladding temperature because of the onset of transition boiling and the resultant sharp reduction in heat transfer coefficient. Inside the steam film, high cladding temperatures are reached, and a cladding j water (zirconium water) reaction may take place. This l chemical reaction results in oxidation of the fuel cladding !

to a structurally weaker form. This weaker form may lose l its integrity, resulting in an uncontrolled release of i activity to the reactor coolant. 1 APPLICABLE The fuel cladding must not sustain damage as a result of SAFETY ANALYSES normal operation and A00s. The reactor core SLs are established to preclude violation of the fuel design criterion that an MCPR SL is to be established, such that at least 99.9%'of the fuel rods in the core would not be expected to experience the onset of transition boiling.

The Reactor Protection System setpoints (LC0 3.3.1.1,

" Reactor Protection System (RPS) Instrumentation"), in combination with other LCOs, are designed to prevent any anticipated combination of transient conditions for Reactor Coolant System water level, pressure, and THERMAL POWER level that would result in reaching the MCPR SL.

2.1.1.1 Fuel Cladding Integrity The use of the fuel vendor's critical power correlation is I valid for critical power calculations at pressures ;

2 785 psig and core flows 2 10% of rated (Ref. 6). For '

operation at low pressures or low flows, the fuel cladding integrity SL is established by a limiting condition on core THERMAL POWER, with the following basis:

Since the pressure drop in the bypass region is essentially all elevation head, the core pressure drop at low power and flow will always be

> 4.5 psi. Analyses show that with a bundle flow of 28 x 10 lb/hr, bundle pressure drop is nearly 8

independent of bundle power and has a value of i 3.5 psi. Thus the bundle flow with a 4.5 psi driving head will be > 28 x 10' lb/hr. Full scale (continued)

GRAND GULF B 2.0-2 Revision No. 2 l

J

Reactor Core SLs B 2.1.1 BASES APPLICABLE 2.1.1.1 Fuel Claddinq Integrity (continued)

SAFETY ANALYSES ATLAS test data taken at pressures from 14.7 psia to 800 psia indicate that the fuel assenibly critical power at this flow is approximately 3.35 MWt. With the design peaking factors, this corresponds to a THERMAL POWER > 50% RTP. Thus a THERMAL POWER limit of 25% RTP for reactor pressure < 785 psig is conservative. Because of the design thermal hydraulic compatibility of the reload fuel designs with the cycle 1 fuel, this justification and the associated low pressure and low flow limits remain applicable for future cycles of cores containing these fuel designs.

2.1.1.2 MCPR The MCPR SL ensures sufficient conservatism in the operating MCPR limit that, in the event of an A00 from the limiting condition of operation, at least 99.9% of the fuel rods in the core would be expected to avoid boiling transition. The margin between calculated boiling transition (i.e.,

MCPR - 1.00) and the MCPR SL is based on a detailed statistical procedure that considers the uncertainties in monitoring the core operating state. One specific uncertainty included in the SL is the c ertainty inherent in the ANFB critical power correlation. 6eference 6 1 describes the methodology used in determining the MCPR SL.

The fuel vendor's critical power correlations are base; on a i significant body of practical test data, providing a aigh degree of assurance that the critical power, as evaluated by the correlation, is within a small percentage of the actual critical power being estimated. As long as the core pressure and flow are within the range of validity of the correlations, the assumed reactor conditions used in I defining the SL introduce conservatism into the limit because bounding high radial power factors and bounding flat local peaking distributions are used to estimate the number of rods in boiling transition. These conservatisms and the inherent accuracy of the fuel vendor's correlation provide a reannable degree of assurance that 99.9% of the rods in the core would not be susceptible to transition boiling during sustained operation at the MCPR SL. If boiling transition were to occur, there is reason to believe that the integrity (continued)

GRAND GULF B 2.0-3 Revision No. 2

- , l Reactor Core SLs , ,

B 2.1.1 BASES f

APPLICABLE 2.1.1.2 -MCPR (continued)

SAFETY ANALYSES of the fuel would not be compromised. Significant test data accumulated by the NRC and private organizations indicate that the use of a boiling transition limitation to protect >

against cladding failure is a very conservative approach.

Much of the data indicate that BWR fuel can survive for an extended period of time in an environment of boiling ,

transition. i 2.1.1.3 Reactor Vessel Water Level 1

.During MODES 1 and 2, the reactor vessel water level is 1 required to be above the top of the active fuel to provide !

core cooling capability. With fuel in the reactor vessel 1 during periods when the reactor is shut down, consideration must be given to water level requirements due to the effect of decay heat. If the water level should drop below the top of the active irradiated fuel during this period, the ability to remove decay heat is reduced. This reduction in cooling capability could lead to elevated cladding temperatures and clad perforation in the event that the water level becomes less than two-thirds of the core height.

The reactor vessel water level SL has been established at the top of the active irradiated fuel to provide a point that can be monitored and to also provide adequate margin for effective action.

SAFETY LIMITS The reactor core SLs are established to protect the ;

integrity of the fuel clad barrier to the release of i radioactive materials to the environs. SL 2.1.1.1 and l SL 2.1.1.2 ensure that the core operates within the fuel design criteria. SL 2.1.1.3 ensures that the reactor vessel water level is greater than the top of the active irradiated fuel in order to prevent elevated clad temperatures and resultant clad perforation.

APPLICABILITY SLs 2.1.1.1, 2.1.1.2, and 2.1.1.3 are applicable in all MODES.

(continued) -.

GRAND GULF B 2.0-4 Revision No. 0 1

Reactor Core SLs B 2.1.1 BASES (continued)

SAFETY LIMIT 2.2.1 VIOLATIONS If any SL is violated, the NRC Operations Center must be notified within I hour, in accordance with 10 CFR 50.72 (Ref. 3).

2.2.2 Exceeding an SL may cause fuel damage and create a potential for radioactive releases in excess of 10 CFR 100, " Reactor Site Criteria," limits (Ref. 4). Therefore, it is required to insert all insertable control rods and restore compliance with the SL within 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months s- (The required actions for a violation of the reactor water level SL include manually initiating ECCS to restore water level and depressurizing the reactor vessel, if necessary, for ECCS operation.) The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time ensures that the operators take prompt remedial action and also ensures that the probability of an accident occurring during this period is minimal.

2.2.3 If any SL is violated, the General Manager, Plant Operations and the Vice President, Operations GGNS shall be notified within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period provides time for plant operators and staff to take the appropriate immediate action and assess the condition of the unit before reporting to the senior management.

2.2.4 If any SL is violated, a Licensee Event Report shall be prepared and submitted within 30 days to the NRC in ,

accordance with 10 CFR 50.73 (Ref. 5). The report will l describe the applicable circumstances preceding the i violation, the effect of the violation upon unit components, !

systems, or structures, and the corrective actions taken to !

prevent recurrence. A copy of the report shall also be I submitted to the General Manager, Plant Operations and the Vice President, Operations GGNS.

(continued) i GRAND GULF B 2.0-5 Revision No. 1

l Reactor Core SLs

B 2.1.1 BASES ;

SAFETY LIMIT 2.2.5 VIOLATIONS i (continued) If any SL is violated, restart of the unit shall not commence until authorized by the NRC. This requirement ensures the NRC that all necessary reviews, analyses, and actions are completed before the unit begins its restart to normal operation.

P.EFERENCES 1. 10 CFR 50, Appendix A, GDC 10,

2. XN-NF524(A), Revision 2, April 1989.

3. 10 CFR 50.72.

4. 10 CFR 100.

5. 10 CFR 50.73.

6. NEDE-240ll-P-A, GESTAR-II.

l

7. GNRI-96/00230, Amendment 131 to the Operating License.

l GRAND GULF B 2.0-6 Revision No. 2

i l

SDM B 3.1.1 J

BASES ACTIONS D.1, 0.2 D.3, and D.4 (continued) status. Actions must continue until all required components are OPERABLE. i E.1, E.2, E.3, E.4, and E.5 With SDM not within limits in MODE 5, the operator must .

immediately suspend CORE ALTERATIONS that could reduce SDM, i

~

e.g., insertion of fuel in the core or the withdrawal of control rods. Suspension of these activities shall not !

preclude completion of movement of a component to a safe condition. . Inserting control rods or removing fuel from the !

core will reduce the total reactivity and are therefore l excluded from.the suspended actions.

Action must also be immediately initiated to fully insert all insertable control rods in core cells containing one or >

more fuel assemblies. Action must continue until all !

insertable control rods in core cells containing one or more :

fuel assemblies have been fully inserted. Control rods in >

core cells containing no fuel assemblies do not affect the '

reactivity of the core and therefore do not have to be inserted.

, i l Action must also be initiated within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months to provide means i l for control of potential radioactive releases. This '

includes ensuring secondary containment is OPERABLE; at least one SGT subsystem is OPERABLE; and secondary .

containment isolation capability (i.e., at least one ,

secondary containment isolation valve and associated .

instrumentation are OPERABLE or other acceptable i administrative controls to assure isolation capability) in- ,

each penetration flow path not isolated that is assumed to :

be isolated to mitigate radioactivity releases. This may be 4 performed as an administrative check, by examining logs or l other information, to determine if the components are out of service for maintenance or other reasons. It is not necessary to perform the SRs needed to demonstrate the i i OPERABILITY of the components. If, however, any required ;

component is inoperable, then it must be restored to ;

OPERABLE status. In this case, SRs may need to be performed i to restore the component to OPERABLE status. Actions must k

. continue until all required components are OPERABLE.

(continued)

I I l

GRAND GULF B 3.1-4 Revision No. 0 l

1 l

c SDM B 3.1.1 BASES (continued)

SURVEILLANCE SR 3.1.1.1 REQUIREMENTS Adequate SDM must be demonstrated to ensure the reactor can be made subcritical from any initial operating condition.

Adequate SDM is demonstrated by testing before or during the first startup after fuel movement or shuffling within the reactor pressure vessel, or control rod replacement.

Control rod replacement refers to the decoupling and removal of a control rod from a core location, and subsequent replacement with a new control rod or a control rod from another core location. Since core reactivity will vary during the cycle as a function of fuel depletion and poison burnup, the beginning of cycle (B0C) test must also account for changes in core reactivity during the cycle. Therefore, to obtain the SDM, the initial measured value must be increased by an adder, "R", which is the difference between the calculated value of maximum core reactivity during the operating cycle and the calculated BOC core reactivity. If the value of R is negative (i.e., B0C is the most reactive point in the cycle), no correction to the B0C measured value is required. For the SDM demonstrations that rely solely on I calculation, additional margin (0.10% Ak/k) must be added to the SDM limit of 0.28% Ak/k to account for uncertainties in the calculation of the highest worth control rod.

The SDM may be demonstrated during an in sequence control rod withdrawal, in which the highest worth control rod is analytically determined, or during local criticals, where the highest worth control rod is determined by testing.

Local critical tests require the withdrawal of out of sequence control rods. This testing would therefore require bypassing of the Rod Pattern Control System to allow the out of sequence withdrawal, and therefore additional requirements must be met (see LC0 3.10.7, " Control Rod Testing-Operating").

The Frequency of 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after reaching criticality is allowed to provide a reasonable amount of time to perform l the required calculations and appropriate verification.

During MODE 5, adequate SDM is also required to ensure the reactor does not reach criticality during control rod ,

withdrawals. An evaluation of each in vessel fuel movement during fuel loading (including shuffling fuel within the core) is required to ensure adequate SDM is maintained (continued) i GRAND GULF B 3.1-5 Revision No. 2

SDM B 3.1.1 BASES SURVEILLANCE SR 3.1.1.1 (continued)

REQUIREMENTS during refueling. This evaluation ensures the intermediate loading patterns are bounded by the safety analyses for the final core loading pattern. For example, bounding analyses that demonstrate adequate SDM for the most reactive configurations during the refueling may be performed to demonstrate acceptability of the entire fuel movement sequence. These bounding analyses include additional margin to the SDM limit to account for the associated uncertainties. Spiral offload or reload sequences -

inherently satisfy the SR, provided the fuel assemblies are reloaded in the same configuration analyzed for the new cycle. Removing fuel from the core will always result in an increa.;e in SDN.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 26.

2. UFSAR, Section 15.4.9.

3. NED0-21231, " Banked Position Withdrawal Sequence,"

Section 4.1, January 1977.

4. UFSAR, Section 15.4.1.1.

5. UFSAR, Section 4.3.2.4.1 l

GRAND GULF B 3.1-6 Revision No. 2 J

Reactivity Anomalies -

B 3.1.2 B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.2 Reactivity Anomalies BASES BACKGROUND In'accordance with GDC 26, GDC 28, and GDC 29 (Ref. 1),

reactivity shall be controllable such that subcriticality is maintained under cold conditions and acceptable fuel design limits are not exceeded during normal operation and anticipated operational occurrences. Reactivity ' anomaly is used as a measure of the predicted versus measured core reactivity during power operation. The continual confirmation of core reactivity is necessary to ensure that the Design Basis Accident (DBA) and transient safety analyses remain valid. A large reactivity anomaly could be the result of unanticipated changes in fuel reactivity, control rod worth, or operation at' conditions not consistent '

with those assumed in the predictions of core reactivity, and could potentially result in a loss of SDM or violation ,

of acceptable fuel design limits. Comparing predicted '

versus measured core reactivity validates the nuclear methods used in the safety analysis and supports the SDM demonstrations (LC0 3.1.1, " SHUTDOWN MARGIN (SDM)") in ensuring the reactor can be brought safely to' cold, i subcritical conditions. '

When the reactor core is critical or in normal power operation, a reactivity balance exists and the net i reactivity is zero. A comparison of predicted and measured I reactivity is convenient under such a balance, since i parameters are being maintained relatively stable under l steady state power conditions. The positive reactivity inherent in the core design is balanced by the negative reactivity of the control components, thermal feedback, neutron leakage, and materials in the core that absorb neutrons, such as burnable absorbers, producing zero net ,

reactivity. 1 I

In order to achieve the required fuel cycle energy output, I the uranium enrichment in the new fuel loading and the fuel !

loaded in the previous cycles provide excess positive reactivity beyond that required to sustain steady state operation at the beginning of cycle (BOC). When the reactor is critical at RTP, the excess positive reactivity is compensated by burnable absorbers (if any), control rods, (continued)

GRAND GULF B 3.1-7 Revision No. O

Control Rod OPERABILITY >

B 3.1.3 BASES

-)

SURVEILLANCE SR 3.1.3.5 (continued) [

REQUIREMENTS position (notch position 48) or prior to declaring the control rod OPERABLE after work on the control rod or CRD System that could affect coupling. This includes control '

rods inserted one notch and then returned to the " full out"

position during the performance of SR 3.1.3.2. This

Frequency is acceptable, considering the low probability that a control rod will become uncoupled when it is not ,

being moved and operating experience related to uncoupling i events. >

l REFERENCES 1. 10 CFR 50, Appendix A, GDC 26, GDC 27, GDC 28, and GDC 29.

2. UFSAR, Section 4.3.2.5.5. ;

3. UFSAR, Section 4.5.1.1.2.5.3.

j

4. UFSAR, Section 5.2.2.2.3. '

1

5. UFSAR, Section 15.4.1. J

6. UFSAR, Section 15.4.9.

]

7 .. NED0-21231, " Banked Position Withdrawal Sequence,"

Section 7.2, January 1977.

8. NEDE-24011-P-A, " General Electric Standard Application ,

for Reactor Fuel (GESTAR II)."

9. AECM-90/0146, Proposed Amendment to the Operating License (PCOL-90/07, Revision 1), dated August 15, 1990.

10. MAEC-90/0285, Issuance of Amendment No. 73 to Facility i Operating License No. NPF Grand Gulf Nuclear !

Station, Unit 1, Regarding Fuel Cycle 5 Reload (TAC No. 76992), dated November 15, 1990, i

GRAND GULF B 3.1-20 Revision No. 2

~

Control Rod Scram Times [ f B 3.1.4 !

B 3.1 REACTIVITY CONTROL SYSTEMS B 3.1.4 . Control Rod Scram Times i BASES r

BACKGROUND The scram function of the Control Rod Drive (CRD) System controls reactivity changes during abnormal operational transients to ensure that specified acceptable fuel design ;

limits are not exceeded (Ref. 1). The control rods are ;

scrammed by positive means, using hydraulic pressure exerted 6 on the CR0 piston. l When a scram signal is initiated, control air is vented from '

the scram valves, allowing them to open by spring action.

Opening the exhaust valves reduces the pressure above the ;

main drive piston to atmospheric pressure, and opening the inlet valve applies the accumulator or reactor pressure to !

the bottom of the piston. Since the notches in the index

_ tube are tapered on the lower edge, the collet fingers are '

forced open by cam action, allowing the index tube to move '

upward without restriction because of the high differential pressure across the piston. As the drive moves upward and !

accumulator pressure drops below the reactor pressure, a .

ball check valve opens, letting the reactor pressure l complete the scram action. If the reactor pressure is low, such as during startup, the accumulator will fully insert the control rod within the required time without assistance '

from reactor pressure. l APPLICABLE The analytical methods and assumptions used in evaluating ;

SAFETY ANALYSES the control rod scram function are presented in References 2, 3, 4, and 5. The Design Basis Accident (DBA) and transient analyses assume that all of the control. rods scram at a specified insertion rate. The resulting negative scram reactivity forms the basis for the determination of plant thermal limits (e.g., the MCPR). Other distributions of scram times (e.g., several control rods scramming slower than the average time, with several control rods scramming faster than the average time) can also provide sufficient scram reactivity. Surveillance of each individual control rod's scram time ensures the scram reactivity assumed in the DBA and transient analyses can be met.

'l (continued)

GRAND GULF B 3.1-21 Revision No. O

l Control Rod Scram Times B 3.1.4 BASES l

APPLICABLE The scram function of the CRD System protects the MCPR SAFETY ANALYSES Safety Limit (SL) (see Bases for LC0 3.2.2, " MINIMUM (continued) CRITICAL POWER RATIO (MCPR)"), and the 1% cladding plastic strain fuel design limit (see Bases for LC0 3.2.1, " AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)," and LC0 3.2.3,

" LINEAR HEAT GENERATION RATE (LHGR)"), which ensure that no fuel damage will occur if these limits are not exceeded.

Above 950 psig, the scram function is designed to insert negative reactivity at a rate fast enough to prevent the actual MCPR from becoming less than the MCPR SL during the analyzed limiting power transient. Below 950 psig, the scram function is assumed to perform during the control rod drop accident (Ref. 6) and, therefore, also provides -

protection against violating fuel damage limits during reactivity insertion accidents (see Bases for LC0 3.1.6,

" Control Rod Pattern"). For the reactor vessel overpressure protection analysis, the scram function, along with the safety / relief valves, ensure that the peak vessel pressure is maintained within the applicable ASME Code limits.

Control rod scram times satisfy Criterion 3 of the NRC Policy Statement.

LCO The scram times specified in Table 3.1.4-1 (in the accompanying LCO) are required to ensure that the scram reactivity assumed in the DBA and transient analysis is met.

To account for single failure and " slow" scramming control rods, the scram times specified in Table 3.1.4-1 are faster than those assumed in the design basis analysis. The scram times have a margin to allow up to 7.5% of the control rods (e.g., 193 x 7.5% = 14) to have scram times that exceed the specified limits (i.e., " slow" control rods) assuming a single stuck control rod (as allowed by LCO 3.1.3, " Control Rod OPERABILITY") and an additional control rod failing to l scram per the single failure criterion. The scram times are specified as a function of reactor steam dome pressure to account for the pressure dependence of the scram times. The scram times are specified relative to measurements based on ,

reed switch positions, which provide the control rod I position indication. The reed switch closes (" pickup") when the index tube passes a specific location and then opens

(" dropout") as the index tube travels upward. The scram times specified in Table 3.1.4-1 are to the " pickup" of the reed switches at the identified notch position.

(continued)

GRAND GULF B 3.1-22 Revision No. 2

Control Rod Scram Times -

B 3.1.4 ,

4 4

BASES !

LCO To ensure that local scram reactivity rates are maintained (continued) within acceptable limits, no " slow" control rod may occupy a location adjacent to another " slow" control rod or adjacent '

to a withdrawn stuck control rod, 1 ,

Table 3.1.4-1 is modified by two Notes, which state control rods with scram times not within the limits of the Table are j

] considered " slow" and that control rods with scram times '

> 7 seconds are considered inoperable as required by SR 3.1.3.4. .

This LC0 applies only to OPERABLE control rods since inoperable control rods will be inserted and disarmed (LC03.1.3). Slow scramming control rods may be conservatively declared inoperable and not accounted for as

" slow" control rods. !

APPLICABILITY In MODES 1 and 2, a scram is assumed to function during I transients and accidents analyzed for these plant conditions. These events are assumed to occur during startup and power operation; therefore, the scram function :

of the control rods is required during these MODES. In MODES 3 and 4, the control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control I i rod block is applied. This provides adequate requirements .

4 I

for control rod scram capability during these conditions. l Scram requirements in MODE 5 are contained in LC0 3.9.5, !

! " Control Rod OPERABILITY-Refueling."

l

ACTIONS A.1 When the requirements of this LCO are not met, the rate of negative reactivity insertion during a scram may not be within the assumptions of the safety analyses. Therefore, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an .

orderly manner and without challenging plant systems. I i

(continued) )

J GRAND GULF B 3.1-23 Revision No. 1

~

l Control Rod Scram Times l B 3.1.4 t i

BASES (continued)

SURVEILLANCE The four SRs of this LC0 are modified by a Note stating that REQUIREMENTS during a single control rod scram time surveillance, the CRD :

pumps shall be isolated from the associated scram accumulator. With the CRD pump isolated-(i.e., charging valve closed), the influence of the CRD pump head does not affect the single control rod scram times. During a' full core scram, the CRD pump head would be seen by all control .

rods and would have a negligible effect on the scram !

insertion times.

4 SR 3.1.4.1 The scram reactivity used in DBA and transient analyses is based on assumed control rod scram time. Measurement of the scram times with reactor steam dome pressure a 950 psig demonstrates acceptable scram times for the analyzed I transients.

Scram insertion times increase with increasing reactor pressure because of the competing effects of reactor steam

-dome pressure and stored accumulator energy. Therefore, demonstration of adequate scram times at reactor steam dome pressure greater than 950 psig ensures that the scram times will be within the specified limits at higher pressures.

Limits are specified as a function of reactor pressure to account for the sensitivity of the scram insertion times with pressure and to allow a range of pressures over which scram time testing can be performed. To ensure scram time testing-is performed within a reasonable time following a refueling or after a shutdown a 120 days, all control rods are required to be tested before exceeding 40% RTP. This i Frequency is acceptable, considering the additional surveillances performed for control rod OPERABILITY, the frequent verification of adequate accumulator pressure, and the required testing of control rods affected by work on l control rods or the CRD System. j SR 3.1.4.2 l Additional testing of a sample of control rods is required l to verify the continued performance of the scram function during the cycle. A representative sample contains at least :

10% of the control rods. The sample remains

" representative" if no more than 20% of the control rods in !

(continued)

GRAND GULF B 3.1-24 Revision No. 2

o Control Rod Scram Times

B 3.1.4 4 BASES SURVEILLANCE SR 3.1.4.2 (continued) ;

REQUIREMENTS the tested sample are determined to be " slow." If more than 20% of the sample is declared to be " slow" per the criteria in Table 3.1.4-1, additional control rods are tested until this 20% criterion (e.g., 20% of the entire sample size) is satisfied, or until the total number of " slow" control rods (throughout the core, from all surveillances) exceeds the LC0 limit. For planned testing, the control rods selected for the sample should be different for each test. Data from inadvertent scrams should be used whenever possible to avoid ,

unnecessary testing at power, even if the control rods with '

data were previously tested in a sample. The 120 day Frequency is based on operating experience that has shown control rod scram times do not significantly change over an operating cycle. This requency is also reasonable, based !

on the additional Surveillances done on the CRDs at more frequent intervals in accordance with LC0 3.1.3 and LC0 3.1.5, " Control Rod Scram Accumulators."

SR 3.1.4.3 When work that could affect the scram insertion time is performed on a control rod or the CRD System, testing must be done to demonstrate that each affected control rod retains adequate scram performance over the range of )

applicable reactor pressures from zero to the maximum permissible pressure. The scram testing must be performed once before declaring the control rod OPERABLE. The required scram time testing must demonstrate that the affected control rod is still within acceptable limits. The limits for reactor pressures < 950 psig are established based on a high probability of meeting the acceptance criteria at reactor pressures a 950 psig. Limits for a i 950 psig are found in Table 3.1.4-1. If testing demonstrates the affected control rod does not meet these limits, but is within the 7 second limit of Table 3.1.4-1 Note 2, the control rod can be declared OPERABLE and " slow."

Specific examples of work that could affect the scram times include (but are not limited to) the following: removal of any CRD for maintenance or modification; replacement of a control rod; and maintenance or modification of a scram solenoid pilot valve, scram valve, accumulator isolation valve, or check valves in the piping required for scram.

(continued)

GRAND GULF B 3.1-25 Revision No. O

~

i Control Rod Pattern l B 3.1.6 BASES (continued)

ACTIONS A.1 and A.2 With one or more OPERABLE control rods not in compliance with the prescribed control rod sequence, action may be taken to either correct the control rod pattern or declare the associated control rods inoperable within 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months .

Noncompliance with the prescribed sequence may be the result of " double notching," drifting from a control rod drive cooling water transient, leaking scram valves, or a power reduction to s 10% RTP before establishing the correct control rod pattern. The number of OPERABLE control rods not in compliance with the prescribed sequence is limited to eight to prevent the operator from attempting to correct a control rod pattern that significantly deviates from the prescribed sequence. When the control rod pattern is not in compliance with the prescrit,ed sequence, all control rod movement should be stopped except for moves needed to correct the control rod pattern, or scram if warranted.

Required Action A.1 is modified by a Note, which allows I control rods to be bypassed in Rod Action Control System (RACS) to allow the affected control rods to be returned to i their correct position. This ensures that the control rods 1 will be moved to the correct position. A control rod not in '

compliance with the prescribed sequence is not considered inoperable except as required by Required Action A.2.

OPERABILITY of control rods is determined by compliance with LC0 3.1.3; LC0 3.1.4, " Control Rod Scram Times"; and LCO 3.1.5, " Control Rod Scram Accumulators." The allowed Completion Time of 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months is reasonable, considering the restrictions on the number of allowed out of sequence control rods and the low probability of a CRDA occurring during the time the control rods are out of sequence.

B.1 and B.2 If nine or more OPERABLE control rods are out of sequence, the control rod pattern significantly deviates from the prescribed sequence. Control rod withdrawal should be suspended immediately to prevent the potential for further deviation from the prescribed sequence. Control rod insertion to correct control rods withdrawn beyond their allowed position is allowed since, in general, insertion of control rods has less impact on control rod worth than I (continued)

GRAND GULF B 3.1-34 Revision No. 0

~

Control Rod Pattern

8 3.1.6 l

BASES ACTIONS B.1 and B.2 (continued) withdrawals have. Required Action B.1 is modified by a Note that allows the affected control rods to be bypassed in RACS in accordance with SR 3.3.2.1.9 to allow insertion only.

With nine or more OPERABLE control rods not in compliance with BPWS, the reactor mode switch must be placed in the shutdown position within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . With the reactor mode switch in shutdown, the reactor is shut down, and therefore does not meet the applicability requirements of this LCO.

The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is reasonable to allow insertion of control rods to restore compliance, and is appropriate' relative to the low probability of a CRDA occurring with the control rods out of sequence.

SURVEILLANCE SR 3.1.6.1 REQUIREMENTS The control rod pattern is verified to be in compliance with the BPWS at a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency, ensuring the assumptions of the CRDA analyses are met. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency of this Surveillance was developed considering that the primary check of the control rod pattern compliance with the BPWS is performed by the RPC (LC0 3.3.2.1). The RPC provides control rod blocks to enforce the required control rod sequence and is required to be OPERABLE when operating at s; 10% RTP.

REFERENCES 1. NEDE-24011-P-A, " General Electric Standard Application for Reactor Fuel (GESTAR II)." I

2. UFSAR, Section 15.4.9.

3. NUREG-0979, "NRC Safety Evaluation Report Related to the Final Design Approval of the GESSAR II BWR/6 Nuclear Island Design, Docket No. 50-447,"

Section 4.2.1.3.2, April 1983.

4. NUREG-0800, " Standard Review Plan," Section 15.4.9,

" Radiological Consequences of Control Rod Drop Accident (BWR)," Revision 2, July 1981.

5. 10 CFR 100.11, " Determination of Exclusion Area, Low Population Zone, and Population Center Distance."

(continued)

GRAND GULF B 3.1-35 Revision No. 2 1

1

- APLHGR B 3.2.1 B 3.2 POWER DISTRIBUTION LIMITS ,

B 3.2.1 Average Planar Linear Heat Generation Rate (APLHGR)

BASES c

BACKGROUND The APLHGR is a measure of the average LHGR of all the fuel rods in a fuel assembly at any axial location. Limits on the APLHGR are specified to ensure that the fuel design limits identified in Reference 1 are not exceeded during anticipated operational occurrences (A00s) and that the peak cladding temperature (PCT) during the postulated design basis loss of coolant accident (LOCA) does not exceed the limits specified in 10 CFR 50.46.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the fuel design limits are presented in the UFSAR, Chapters 4, 6, and 15, and in References 2 and 6. The I analytical methods and assumptions used in evaluating Design Basis Accidents (DBAs), anticipated operational transients, and normal operations that determine APLHGR limits are presented in UFSAR, Chapters 4, 6, and 15, and in l References 2, 3, 4 and 6.

Fuel design evaluations are performed to demonstrate that the 1% limit on the fuel cladding plastic strain and other fuel design limits described in References 1 and 6 are not I exceeded during A00s for operation with LHGR up to the operating limit LHGR. APLHGR limits are developed as a function of exposure and, along with the LHGR limits, ensure adherence to fuel design limits during the limiting A00s (Refs. 2 and 3).

LOCA analyses are performed to ensure that the above i determined APLHGR limits are adequate to meet the PCT and maximum oxidation limits of 10 CFR 50.46. The analysis is :

performed using calculational models that are consistent with the requirements of 10 CFR 50, Appendix K. A discussion of the fuel vendor analysis codes is provided in References 5 and 6 for Siemens and GE, respectively. The PCT following a postulated LOCA is a function of the average heat generation rate of all the rods of a fuel assembly at any axial location and is not strongly influenced by the rod to rod power distribution within an assembly. The Siemens I APLHGR limits specified are equivalent to the LHGR of the highest powered fuel rod assumed in the LOCA (continued) 1 GRAND GULF B 3.2-1 Revision No. 2 I

APLHGR -

B 3.2.1 BASES APPLICABLE analysis ' divided by'its local peaking factor. The GE APLHGR SAFETY ANALYSES limits specified are equivalent to the design LHGR divided (continued) by the hot uncontrolled bundle lattice local peaking with 40% voids. A conservative multiplier is applied to the LHGR assumed in the LOCA analysis consistent with 10CFR50, Appendix K.

For GE fuel the APLHGR limits are multiplied by the smaller of either the flow dependent APLHGR factor (MAPFAC,) or the power dependent APLHGR factor (MAPFAC,) corresponding to the existing core flow and power state to ensure adherence to the fuel mechanir.. design bases during the limiting transient. MAPFAC,'s are generated to protect the core from slow flow runout transients. A curve is provided based on the maximum credible flow runout transient for Loop Manual operation. The result of a single failure or single operator error during operation in Loop Manual is the runout of only one loop because both recirculation loops are under independent control. MAPFAC,'s are generated to protect the core from plant transients other than core flow increases.

For single recirculation loop nperation, the APLHGR multiplier is limited to a maximum value which is specified in the'COLR. This multiplier is due to the conservative analysis assumption of an earlier departure from nucleate boiling with one recirculation loop available, resulting in a more severe cladding heatup during a LOCA.

The APLHGR satisfies Criterion 2 of the NRC Policy i Statement. .

LC0 The APLHGR limits specified in the COLR are the result of fuel design, DBA, and transient analyses. For two recirculation loops operating, the limit is determined by the exposure dependent APLHGR limits. With only one recirculation loop in operation, in conformance with the requirements of LCO 3.4.1, " Recirculation Loops Operating,"

the limit is determined by multiplying the exposure dependent APLHGR limit by the limiting value specified for single recirculation loop operation in the COLR, which has been determined by a specific single recirculation loop analysis (Ref. 2).

(continued) l GRAND GULF B 3.2-2 Revision No. 2

l APLHGR !

B 3.2.1

]

l BASES (continued) I l

i APPLICABILITY The APLHGR limits are primarily derived from fuel design ;

evaluations and LOCA and transient analyses that are assumed I to occur at high power levels. Lesign calculations and operating experience have shown that as power is reduced, the margin to the required APLHGR limits increases. This trend continues down to the power range of 5% to 15% RTP when entry into MODE 2 occurs. When in MGDE 2, the intermediate range monitor (IRM) scram function provides prompt scram initiation during any significint transient, thereby effectively removing any APLHGR linit compliance !

concern in MODE 2. Therefore, at THERMAL POWER levels i

< 25% RTP, the reactor operates with substantial margin to j the APLHGR limits; thus, this LC0 is not required. i ACTIONS A.1 !

If any APLHGR exceeds the required limit, an assumption l regarding an initial condition of the DBA and transient .

analyses may not be met. Therefore, prompt action is taken l to restore the APLHGR(s) to within the required limit (s) !

such that the plant will be operating within analyzed conditions and within the design limits of the fuel rods.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is sufficient to restore the

, APLHGR(.s) to within its limit and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the APLHGR out of specification.

B.1 If the APLHGR cannot be restored to within its required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LC0 does not apply. To achieve this status, THERMAL POWER must be reduced to < 25% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 25% RTP in an orderly manner and without challenging plant systems.

(continued) I e

GRAND GULF B 3.2-3 Revision No. 2

APLHGR B 3.2.1 I

BASES (continued)

SURVEILLANCE SR 3.2.1.1 REQUIREMENTS APLHGRs are required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is 2 25% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. They are compared to the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency.-is based on both engineering judgment and recognition of the slowness of changes in power distribution under normal conditions. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after-THERMAL POWER 2 25% RTP is achieved is acceptable given the large inherent margin to operating limits at low power levels.

REFERENCES 1. UFSAR, Chapter 4.

2. UFSAR, Chapter 15, Appendix 15C.

3. UFSAR, Chapter 15, Appendix 15D.

4. XN-NF-80-19(P)(A), " Exxon Nuclear Methodology for Boiling Water Reactors, Neutronics Methods for Design and Analysis," Volume 1 (as supplemented).

5. XN-NF-80-19(A), " Exxon Nuclear Methodology for Boiling Water Reactors, ECCS Evaluation Model," Volume 2 (as supplemented).

6. NEDE-24011-P-A, " General Electric Standard Application for Reactor Fuel (GESTAR)."

GRAND GULF B 3.2-4 Revision No. 2

. j MCPR l B 3.2.2 .

I B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 Minimum Critical Power Ratio (MCPR)

BASES BACKGROUND MCPR is a ratio of the fuel assembly power that would result in the onset of boiling transition to the actual fuel assembly power. The MCPR Safety Limit (SL) is set such that 99.9% of the fuel rods avoid boiling transition if the limit is not violated (refer to the Bases for SL 2.1.1.2). The operating limit MCPR is established to ensure that no fuel damage results during anticipated operational occurrences (A00s). Although fuel damage does not necessarily occur if a fuel rod actually experiences boiling transition (Ref.1),

the critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion.

The onset of transition boiling is a phenomenon that is readily detected during the testing of various fuel bundle designs. Based on these experimental data, correlations have been developed to predict critical bundle power (i.e.,

the bundle power level at the onset of transition boiling) for a given set of plant parameters (e.g., reactor vessel pressure, flow, and subcooling). Because plant operating I conditions and bundle power levels are monitored and determined relatively easily, monitoring the MCPR is a convenient way of ensuring that fuel failures due to inadequate cooling do not occur.

l l

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the A00s to establish the operating limit MCPR are presented in the UFSAR, Chapters 4, 6, and 15, and References 2, 3, 4, and 5. To ensure that the MCPR SL is not exceeded during any transient event that occurs with moderate frequency, limiting transients have been analyzed to determine the largest reduction in critical power ratio (CPR). The types of transients evaluated are loss of flow, increase in pressure and power, positive reactivity insertion, and coolant temperature decrease. The limiting transient yields the largest change in CPR (ACPR). When the largest ACPR is added to the MCPR SL, the required operating limit MCPR is l obtained.

l (continued)

GRAND GULF B 3.2-5 Revision No. O I

w MCPR

B 3.2.2 1

BASES APPLICABLE The MCPR operating limits derived from the transient SAFETY ANALYSES analysis are dependent on the operating core flow and power (continued) state (MCPR, and MCPR,, respectively) to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency (Refs. 3, 4, and 5). Flow dependent MCPR limits are determined by steady state thermal hydraulic methods using the three dimensional BWR simulator code (Ref.

6). MCPR, curves are provided based on the maximum credible I flow runout transient for Loop Manual operation. The result of a single failure or single operator error during Loop Manual operation is the runout of only one loop because both :

recirculation loops are under independent control.

1 Power dependent MCPR limits (MCPR,) are determined by the three dimensional BWR simulator ~ code and the one dimensional transient code (Ref 7). The MCPR, limits are established -I for a set of exposure intervals. The limiting transients are analyzed at the limiting exposure for each interval. l Due to the sensitivity of the transient response to initial I core flow levels at power levels below those at which the I turbine stop valve closure and turbine control valve fast '

closure scram trips are bypassed, high and low flow MCPR, operating limits are provided for operating between 25% RTP and the previously mentioned bypass power level.

The MCPR satisfies Criterion 2 of the NRC Policy Statement.

LCO The MCPR operating limits specified in the COLR are the result of the Design Basis Accident (DBA) and transient analysis. The MCPR operating limits are determined by the larger of the MCPR, and MCPR, limits.

APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 25% RTP, the reactor is operating at a slow recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 25% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs.

(continued)

GRAND GULF B 3.2-6 Revision No. 2

)

MCPR :

8 3.2.2 l

l BASES 1

APPLICABILITY Studies of the variation of limiting transient behavior have I (continued) been performed over the range of power and flow conditions. i These studies encompass the range of key actual plant parameter values important to typically limiting transients.

The results of these studies demonstrate that a margin is expected between performance and the MCPR requirements, and I that margins increase as power is reduced to 25% RTP, This trend is expected to continue to the 5% to 15% power range l when entry into MODE 2 occurs. When in MODE 2, the ,

intermediate range monitor (IRM) provides rapid scram initiation for any significant power increase transient, )

j which effectively eliminates any MCPR compliance concern.

Therefore, at THERMAL POWER levels < 25% RTP, the reactor is operating with substantial margin to the MCPR limits and

, this LC0 is not required.

l ACTIONS A.1 If any MCPR is outside the required limit, an assumption regarding an initial condition of the design basis transient analyses may not be met. Therefore, prompt action should be taken to restore the MCPR(s) to within the required limit (s) such that the plant remains operating within analyzed conditions. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is normally sufficient to restore the MCPR(s) to within its limit and is acceptable based on the low probability of a transient or DBA occurring simultaneously with the MCPR out of specification.

F B.1 If the MCPR cannot be restored to within the required limit within the associated Completion Time, the plant must be brought to a MODE or other specified condition in which the LC0 does not apply. To achieve this status, THERMAL POWER must be reduced to < 25% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 25% RTP in an orderly manner and without challenging plant systems.

(continued)

GRAND GULF B 3.2-7 Revision No. O

MCPR -

B 3.2.2 BASES (continued) ,

SURVEILLANCE SR 3.2.2.1 REQUIREMENTS The MCPR is required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is a 25% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. It is compared to the specified limits '

in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24' hour '

Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution during normal operation. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after

' THERMAL POWER reaches a 25% RTP is acceptable given the large inherent margin to operating limits at low power levels.

r REFERENCES 1. NUREG-0562, " Fuel Failures As A Consequence of Nucleate Boiling or Dry Out," June 1979.

2. NEDE-24011-P-A, General Electric Standard Application for Reactor Fuel (GESTAR-II).

3. UFSAR, Chapter 15, Appendix 158.

4. UFSAR, Chapter 15, Appendix 15C.

5. UFSAR, Chapter 15, Appendix 15D.

6. NEDE-30130-P-A, Steady State Nuclear Methods.

l

7. NED0-24154, Qualification of the One-Dimensional Core l

Transient Model for Boiling Water Reactors.

8. Deleted I

9. GNRI-96/00230, Amendment 131 to the Operating License. l GRAND GULF B 3.2-8 Revision No. 2

. LHGR J B 3.2.3 l

B 3.2 POWER DISTRIBUTION LIMITS B 3.2.3 Linear Heat Generation Rate (LHGR) i BASES BACKGROUND The LHGR is' a measure of the heat generation rate of a fuel :

rod in a fuel assembly at any axial location. Limits on the-LHGR are specified to ensure that fuel design limits are not exceeded anywhere in the core during normal operation, including anticipated operational occurrences (A00s).

Exceeding the LHGR limit could potentially result in fuel damage and subsequent release of radioactive materials.

Fuel design limits are specified to ensure that fuel system

' damage, fuel rod failure or inability to cool the fuel does not occur during the anticipated operating conditions identified in UFSAR Chapters 6 and 15.

APPLICABLE .The analytical methods and assumptions used in evaluating SAFETY ANALYSES the fuel system design are presented in the UFSAR, Chapters 4, 6, and 15, and in References 1 and 2. The fuel assembly '

is designed to ensure (in conjunction with the core nuclear and thermal hydraulic design, plant equipment, instrumentation, and protection system) that fuel damage ,

will not result in the release of radioactive' materials in !

excess of the guidelines of 10 CFR, Parts 20, 50, and 100. l The mechanisms that could cause fuel damage during I operational transients and that are considered in fuel l evaluations are:

l

a. Rupture of the fuel rod cladding caused by strain from the relative expansion of the UO pellet; and 2

b. Severe overheating of the fuel rod cladding caused by inadequate cooling.

i A value of 1% plastic strain of the fuel cladding has been defined as the limit below which fuel damage caused by overstraining of the fuel cladding is not expected to occur (Ref. 3).

Fuel design evaluations have been performed and demonstrate that the 1% fuel cladding plastic strain design limit is not exceeded during continuous operation with LHGRs up to the (continued)

GRAND GULF B 3.2-9 Revision No. O

... . -- .. - - - _- -- . .- . - - - ~.

LHGR B 3.2.3 BASES

APPLICABLE operating limit specified in the COLR. The analysis also SAFETY ANALYSES includes allowances for short term transient operation above (continued) the operating limit to account for A00s, plus an allowance for densification power spiking.

1 For Siemens fuel the LHGR limits are multiplied by-the I smaller of either the flow dependent LHGR factor (LHGRFAC,)

or the power dependent LHGR factor (LHGRFAC,) corresponding to the existing core flow and power state to ensure adherence to the fuel mechanical design bases during the limiting transient. LHGRFAC,'s are generated to protect the core from slow flow runout transients.- A curve is provided based on the maximum credible flow runout transient for Loop Manual operation. The result of a single failure or single operator error during operation in Loop Manual is the runout of only one loop because both recirculation loops are under independent control. LHGRFAC,'s are generated to protect-the core from plant transients other than core flow increases.

An analogous application of the MAPLHGR is used for the same purposes for GE fuel.

The LHGR satisfies Criterion 2 of the NRC Policy Statement.

LC0_ The LHGR is a basic assumption in the fuel design analysis.

The fuel has been designed to operate at rated core power with sufficient design margin to the LHGR calculated to cause a 1% fuel cladding plastic strain. The operating limit to accomplish this objective is specified in the COLR.

APPLICABILITY The LHGR limits are derived from fuel design analysis that I is limiting at high power level conditions. At core thermal l power levels < 25% RTP, the reactor is operating with a !

substantial margin to the LHGR limits and, therefore, the ;

Specification is only required when the reactor is operating i at 2: 25% RTP.

I ACTIONS A.1 I

If any LHGR exceeds its required limit, an assumption j regarding an initial condition of the fuel design analysis is not met. Therefore, prompt action should be taken to I

(continued)

GRAND GULF B 3.2-10 Revision No. 2 I

-v LHGR B 3.2.3 ,

BASES ACTIONS A.1 (continued)

I restore the LHGR(s)_to within its required' limit (s) such that the plant is operating within analyzed conditions and within the design limits of the fuel rods. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is normally sufficient to restore the LHGR(s) to within its limit and is acceptable based on the low probability of a transient or' Design Basis Accident occurring simultaneously with the LHGR out of specification.

B.1 If the LHGR cannot be restored to within its required limit within the associated Completion Time, the plant must be.

brought to a MODE or other specified condition in which the LC0 does not apply. To achieve this status, THERMAL POWER must-be reduced to < 25% RTP within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The allowed Completion Time is reasonable, based on operating experience, to reduce THERMAL POWER to < 25% RTP in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.2.3.1 REQUIREMENTS The LHGRs are required to be initially calculated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after THERMAL POWER is a 25% RTP and then every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. They are compared with .the specified limits in the COLR to ensure that the reactor is operating within the assumptions of the safety analysis. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Frequency is based on both engineering judgment and recognition of the slowness of changes in power distribution under normal conditions. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowance after

~

THERMAL POWER a 25% RTP is achieved is acceptable given the large inherent margin to operating limits at lower power levels.

REFERENCES 1. UFSAR, Chapter,15.

2. UFSAR, Chapter 4.

3. NUREG-0800, " Standard Review Plan," Section 4.2, II. A.2(g), Revision 2, July 1981.

l GRAND GULF B 3.2-11 Revision No. 2

,-a w ,,,.as a .e 4--- aa 4, .m %.a._ ,_ s , 6 - _ - +., m 4 a e. -.a. .= . 2:-= .= m . mm -- =cAa a am . - _. a - +

i.' O y

)

?

i i

f i

i d

s s

PAGE INTENTIONALLY LEFT BLANK 4

s W - -

RPS Instrumentation B 3.3.1.1 l

BASES i

1 !

APPLICABLE 3. Reactor Vessel Steam Dome Pressure-High '

l SAFETY ANALYSES, LCO, and An increase in the RPV pressure during reactor operation

)

i APPLICABILITY' compresses the steam voids and results in a positive !

(continued) reactivity insertion. This causes the neutron flux and 1

THERMAL POWER transferred to the reactor coolant to l

, increase, which could challenge the integrity of the fuel '

cladding and the RCPB. The Reactor Vessel Steam Dome I i

. Pressure-High Function initiates a scram for transients j that result in a pressure increase, counteracting the pressure increase by rapidly reducing core power. For the overpressurization protection analysis of Reference 2, the

reactor scram (the analyses conservatively assume scram on the Average Power Range Monitor Fixed Neutron Flux-High ,

signal, not the Reactor Vessel Steam Dome Pressure-High j signal), along with the S/RVs, limits the peak RPV pressure i to less than the ASME Section III Code limits.

$ High reactor pressure signals are initiated from four i

pressure transmitters that sense reactor pressure. The Reactor Vessel-Steam Dome Pressure-High Allowable Value is chosen to provide a sufficient margin to the ASME ,

Section III Code limits during the event.

Four channels of Reactor Vessel Steam Dome Pressure-High Function, with two ena6nels in each trip system arranged in a one-out-of-two logic, are-required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal. The Function is

-required to be OPERABLE in MODES I and 2 when the RCS is pressurized and the potential for pressure increase exists.

4. Reactor Vessel Water Level-Low. Level 3 Low RPV water level indicates the capability to cool the fuel may be threatened. Should RPV water level decrease too -

far, fuel damage could result. Therefore, a reactor scram is initiated at Level 3 to substantially reduce the heat generated in the fuel from fission. The Reactor Vessel Water Level-Low, Level 3 Function is assumed in the analysis of the. recirculation line break (Ref. 3). The reactor scram reduces the amount of energy required to be i (continued) i B 3.3-10 Revision No. 2 GRAND GULF s

u RPS instrumentation .

B 3.3.1.1 BASES APPLICABLE 4. Reactor Vessel Water Level--Low, level 3 (continued)

SAFETY ANALYSES, LCO, and absorbed and, along with the actions of the Emergency Core APPLICABILITY Cooling Systems (ECCS), ensures that the feel peak cladding temperature remains below the limits of 10 CFR 50.46.

Reactor Vessel Water Level--Low, Level 3 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

i Four channels of Reactor Vessel Water Level--Low, Level 3 Function, with two channels in each trip system arranged in a one-out-of-two logic, are required to be OPERABLE to ensure that no single instrument failure will preclude a scram from this Function on a valid signal.

The Reactor Vessel Water Level--Low, Level 3 Allowable Value is selected to ensure that, for transients involving loss of all normal feedwater flow, initiation of the low pressure ECCS at RPV Water Level I will not be required.

The ranction is required in MODES 1 and 2 where considerable energy exists in the RCS resulting in the limiting transients and accidents. ECCS initiations at Reactor Vessel Water LeveI--Low Low, Level 2 and Low Low Low, Level 1 provide sufficient protection for level transients in all other MODES.

5. Reactor Vessel Water Level--High, level 8 High RPV water level indicates a potential problem with the feedwater levei conti 1 system, resulting in the addition of reactivity associated sith the introduction of a significant amount of relatively cold feedwater. Therefore, a scram is initiated at Level 8 to ensure that MCPR is maintained above the MCPR SL. Tha Reactor Vessel Water Level--High, Level 8 Function is one of ti:a many functions assumed to be OPERABLE and capable of providing a reactor scram during transients. l It is directly assumed in the analysis of feedwater controller failure, maximum demand (Ref. 4).

(continued)

GRAND GULF B 3.3-11 Revision No. 2

RPS Instrumentation-B 3.3.1.1 i

BASES APPLICABLE- 5. Reactor Vessel Water Level-High, Level 8 (continued)

SAFETY ANALYSES, LCO, and Reactor Vessel Water Level-High, Level 8 signals are APPLICABILITY initiated from four level transmitters that sense the 1 difference between the pressure due to a constant column of !

water (reference leg) and the pressure.due to the actual l water level (variable leg) in the vessel. The Reactor i Vessel Water Level-High, Level 8 Allowable Value is i specified to ensure that the MCPR SL is not violated during the assumed transient. The Function is bypassed when the reattor mode switch is not in the run position.

Four channels of the Reactor Vessel Water Level-High, Level 8 Function, with two channels in each trip system arranged in a one-out-of-two logic, are available and are required to be OPERABLE when THERMAL POWER is a 25% RTP to ensure that no single instrument failure will preclude a i scram from this Function on a valid signal. With THERMAL POWER < 25% RTP, this Function is not required since MCPR is not a concern below 25% RTP.

6. Main Steam Isolation Valve-Closure MSIV closure results in loss of the main turbine and the l condenser as a heat sink for the Nuclear Steam Supply System 1 and indicates a need to shut down the reactor to reduce heat generation. Therefore, a reactor scram is initiated on a Main Steam Isolation Valve-Closure signal before the MSIVs are completely closed in anticipation of the complete loss of the normal heat sink and subsequent overpressurization transient. However, for the overpressurization protection analysis of Reference 2, the Average Power Range Monitor Fixed Neutron Flux-High Function, along with the S/RVs, limits the peak RPV pressure to less than the ASME Code limits. That is, the direct scram on position switches for MSIV closure events is not assumed in the overpressurization analysis. Additionally, MSIV closure is assumed in the transients analyzed in Reference 4 (e.g., low steam line pressure, manual closure of MSIVs, high steam line flow).

The reactor scram reduces the amount of energy required to be absorbed and, along with the actions of the ECCS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

(continued)

GRAND GULF B 3.3-12 Revision No. 1

RPS Instrumentation' -

B 3.3.1.1 BASES APPLICABLE 6. Main Steam Isolation Valve--Closute (continued)

SAFETY ANALYSES, LCO, and MSIV closure signals are initiated from position switches APPLICABILITY located on each of the eight MSIVs. Each MSIV has two '

position switches; one inputs to RPS trip system A while the other inputs to RPS trip system B. Thus, each RPS trip system receives an input from eight Main Steam Isolation Valve--Closure channels, each consisting of one position switch. The logic for the Main Steam Isolation Valve--Closure Function is arranged such that either the inboard or outboard valve on three or more of the main steam 7 lines (MSLs) must close in order for a scram to occur. The Function is bypassed when the reactor mode switch is not in the run position.

The Main Steam Isolation Valve--Closure Allowable Value is specified to ensure that a scram occurs prior to a significant reduction in steam flow, thereby reducing the severity of the subsequent pressure transient. ,

Sixteen channels of the Main Steam Isolation Valve--Closure Function with eight channels in each trip system are r required to be OPERABLE to ensure that no single instrument ;

failure will preclude the scram from this Function on a valid signal. This Function is only required in MODE 1 since, with the MSIVs open and the heat generation rate ;

high, a pressurization transient can occur if the MSIVs close. In MODE 2, the heat generation rate is low enough so that the other diverse RPS functions provide sufficient ,

protection.

7. Drywell Pressure--High High pressure in the drywell could indicate a break in the '

RCPB. A reactor scram is initiated to minimize the possibility of fuel damage and to reduce the amount of energy being added to the coolant and the drywell. The ,

Drywell Pressure--High Function is the scram signal used l for large break LOCA events inside the drywell.

I (continued)

GRAND GULF B 3.3-13 Revision No. 2

v ECCS Instrumentation B 3.3.5.1 ]

FA5E5

~~

1 BACKGROUND Diesel Generators (continued)

Feature (ESF) buses if a loss of offsite power occurs.

(Refer to Bases for LCO 3.3.8.1.)

APPLICABLE The actions of the ECCS are explicitly assumed in the safety SAFETY ANALYSES, analyses of References 1, 2, and 3. The ECCS is initiated _

to preserve the integrity of the fuel cladding by limiting LCO, and APPLICABILITY the post LOCA peak cladding temperature to less than the 10 CFR 50.46 limits.

ECCS instrumentation satisfies Criterion 3 of the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are descril'ed below in the individual Functions discussion.

The OPERABILITY of the ECCS instrumentation is dependent upon the OPERABILITY of the individual instrumentation channel Functions specified in Table 3.3.5.1-1. Each Function must have a required number of OPERABLE channels, with their setpoints within the specified Allowable Values, where appropriate. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Each ECCS subsystem must also respond within its assumed response time. Table 3.3.5.1-1, footnote (b), is added to show that certain ECCS instrumentation Functions are also required to be OPERABLE to perform DG initiation.

Allowable Values are specified for each ECCS Function specified in the table. Nominal trip setpoints are -

specified in the setpoint calculations. The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS.

Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. Trip setpoints are those predetermined values of output at which an action should take place. The setpoints are compared to the actual proces s parameter (e.g., reactor vessel water level), and when the measured output value of the process parameter exceeds the setpoint, the associated device (e.g.,

trip unit) changes state. The analytic limits are derived from the limiting values of the process parameters obtained (continued)

GRAND GULF B 3.3-93 Revision No. 0 l

ECCS Instrumentation -

B 3.3.5.1 BASES APPLICABLE from the safety analysis. The Allowable Values are derived SAFETY ANALYSES, from the analytic limits, corrected for calibration, LCO, and process, and some of the instrument errors. The trip APPLICABILITY setpoints are then determined, accounting for the remaining (continued) instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions that may require ECCS (or DG) initiation to mitigate the consequences of a design basis accident or transient. To ensure reliable ECCS and DG function, a combination of Functions is required to provide primary and secondary initiation signals.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

Low Pressure Core Sprav and Low Pressure Coolant Injection Systems 1.a. 2.a. Reactor Vessel Water Level-Low Low Low, level 1 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. l The low pressure ECCS and associated DGs are initiated at Level 1 to ensure that core spray and flooding functions are i available to prevent or minimize fuel damage. The Reactor l Vessel Water Level-Low Low Low, level 1 is one of the -

Functions assumed to be OPERABLE and capable of initiating the ECCS during the transients and accidents analyzed in References 1, 2, and 3. The core cooling function of the ECCS, along with the scram action of the Reactor Protection l System (RPS), ensures that the fuel peak cladding )

temperature remains below the limits of 10 CFR 50.46.

(continued)

GRAND GULF B 3.3-94 Revision No. 2

e ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 1.q, 2.f. Manual Initiation (continued)

SAFETY ANALYSES, LC0, and instrumentation. There is one push button for each of the APPLICABILITY two Divisions of low pressure ECCS (i.e., Division 1 ECCS, LPCS and LPCI A; Division 2 ECCS, LPCI B and LPCI C).

The Manual Initiation Function is not assumed in any accident or transient analyses in the UFSAR. However, the Function is retained for the low pressure ECCS function as required by the NRC in the plant licensing basis.

There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons. Each channel of the Manual Initiation Function (one channel per Division) is only required to be OPERABLE when the associated ECCS is required to be OPERABLE. Refer to LC0 3.5.1 and LC0 3.5.2 for Applicability Bases for the low pressure ECCS subsystems.

High Pressure Core Spray S_ystem 3.a. Reactor Vessel Water Level--Low Low, level 2 Low RPV water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the HPCS System and associated DG are initiated at Level 2, after a j confirmation delay permissive to maintain level above the top of the active fuel.

A nominal 1/2 second confirmation delay permissive is installed to avoid spurious system initiation signals. This confirmation delay permissive is limited to a maximum of a 1 second delay to support the HPCS System response time of 27 seconds assumed in the accident analysis. To insure that the confirmation delay permissive does not drift excessively it is calibrated as part of the CHANNEL FUNCTIONAL TEST required for this Function by SR 3.3.5.1.2. The Reactor Vessel Water Level--Low Low, Level 2 is one of the Functions assumed to be OPERABLE and capable of initiating HPCS during the transients and accidents, analyzed in References 1, 2, l and 3. The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

(continued)

GRAND GULF B 3.3-99 Revision No. 2 1

4 e

4 PAGE INTENTIONALLY LEFT BLANK 1

l i

ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.a. Reactor Vessel Water Level--Low low. Level 2 SAFETY ANALYSES,_ (continued)

LCO, and APPLICABILITY Reactor Vessel Water Level--Low Low, Level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water' level (variable leg) in the vessel.

i (continued)

GRAND GULF B 3.3-99a Revision No. 2

~

ECCS Instrum:ntation -

B 3.3.5.1 BASES APPLICABLE 3.a. Reactor Vessel Water Level--Low Low, Level 2 SAFETY ANALYSES, (continued)

LCO, and APPLICABILITY The Reactor Vessel Water Level-Low Low, Level 2 Allowable Value is chosen such that for complete loss of feedwater flow, the Reactor Core Isolation Cooling (RCIC) System flow I with HPCS assumed to fail will be sufficient to avoid initiation of low pressure ECCS at Reactor Vessel Water i Level-Low Low Low, Level 1. l Four channels of Reactor Vessel Water Level-Low Low, Level 2 Function are only required to be OPERABLE when HPCS !

is required to be OPERABLE to ensure that no single l instrument failure can preclude HPCS initiation. Refer to l LC0 3.5.1 and LCO 3.5.2 for HPCS Applicability Bases.

3.b. Drywell Pressure-High High pressure in the drywell could indicate a break in the RCPB. The HPCS System and associated DG are initiated upon receipt of the Drywell Pressure-High Function in order to minimize the possibility of fuel damage. The Drywell Pressure-High Function is assumed in the analysis of the recirculation line break (Ref. 2). The core cooling function of the ECCS, along with the scram action of the RPS, ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46.

This HPCS initiation function is not considered to be inoperable with indicated reactor vessel water level on the wide range instrument greater than the Level 8 setpoint coincident with the reactor steam dome pressure < 600 psig since the HPCS System would provide the nececsary injection if required (i.e., if the water level reaches the low water level initiation setpoint).

Drywell Pressure-High signals are initiated from four pressure transmitters that sense drywell pressure. The Allowable Value was selected to be as low as possible and be indicative of a LOCA inside primary containment.

The Drywell Pressure-High Function is required to be OPERABLE when HPCS is required to be OPERABLE in conjunction (continued)

GRAND GULF B 3.3-100 Revision No. 2

- ECCS Instrumentation B 3.3.5.1 BASES APPLICABLE 3.b. Drywell Pressure-Hiah (continued) i SAFETY ANALYSES, .

LCO, and with times when the primary containment is required to be APPLICABILITY OPERABLE. Thus, four channels of the HPCS Drywell Pressure-High Function are required to be OPERABLE in MODES 1,.2, and 3, to ensure that no single instrument failure can preclude ECCS. initiation. In MODES 4 and 5, the Drywell Pressure-High Function is not required since there is insufficient energy in the reactor to pressurize the drywell to the Drywell Pressure-High Function's .setpoint.

Refer to LCO 3.5.1 for the Applicability Bases for the HPCS System.

Reactor Ve3sel Water Level-High, level 8 3.c.

High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal is used to close the HPCS injection valve to prevent overflow into the main steam lines (MSLs). The Reactor Vessel Water Level-High, Level 8 Function is assumed in the accident and l transient analyses.

Reactor Vessel Water Level-High, Level 8. signals for HPCS ,

are initiated from two level transmitters from the wide range water level measurement instrumentation. Both Level 8 signals are required in order to close the HPCS injection valve. This ensures that no single instrument failure can preclude HPCS initiation. The Reactor Vessel Water Leal-High, Level 8 Allowable Value is chosen to isolate flow from the HPCS System prior to water overflowing into the MSLs.

Two channels of Reactor Vessel Water Level-High, Level 8 Function are only required to be OPERABLE when HPCS is required to be OPERABLE. Refer to LC0 3.5.1 and LC0 3.5.2 for HPCS Applicability Bases. l 3.d. Condensate Storace Tank Level-Low :

Low level in the CST indicates the unavailability of an- '

adequate supply of makeup water from this normal source.

Normally the suction valves between HPCS and tho CST are open and, upon receiving a HPCS initiation signal, water for (continued) ,

i i

GRAND GULF B 3.3-101 Revision No. 2 I

_ ,1

i

. 1 I

ECCS Instrumentation B 3.3.5.1 1

BASES '

APPLICABLE 3.d. Condensate Storage Tank Level-Low (continued)

SAFETY ANALYSES, LCO, and HPCS injectica would be taken from the CST. However, if the APPLICABILITY water level in the CST falls below a preselected level, first the suppression pool suction valve automatically opens, and then the CST suction valve automatically closes. !

This ensures that an adequate supply of makeup water is !

available to the HPCS pump. To prevent losing suction to '

the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes. The Function is implicitly assumed in the accident and transient analyses (which take credit for HPCS) since the analyses assume that the HPCS suction source is the suppression pool.

1 Condensate Storage Tank Level-Low signals are initiated from two level transmitters. The logic is arranged such that either transmitter and associated trip unit can cause the suppression pool suction valve to open and the CST suction valve to close. The Condensate Storage Tank Level-Low Function Allowable Value is high enough to ensure adequate pump suction head while water is being taken from the CST.

Two channels of the Condensate Storage Tank Level-Low Function are only required to be OPERABLE when HPCS is required to be OPERABLE to ensure that no single instrument failure can preclude HPCS swap to suppression pool source.

Thus, the Function is required to be OPERABLE in MODES 1, 2, and 3. In MODES 4 and 5, the Function is required to be OPERABLE only when HPCS is required to be OPERABLE to fulfill the requirements of LC0 3.5.2, HPCS is aligned to the CST and the CST water level is not within the limits of SR 3.5.2.2. With CST water level within limits, a sufficient supply of water exists for injection to minimize the consequences of a vessel draindown event. Refer to LC0 3.5.1 and LC0 3.5.2 for HPCS Applicability Bases.

3.e. Suppression Pool Water Level-High Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the S/RVs. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of HPCS from the CST to the suppression pool (continued)

GRAND GULF B 3.3-102 Revision No. O

._ ._ _ _. _ __ _. _ _... __s s

ECCS Instrumentation :

B 3.3.5.1

BASES SURVEILLANCE SR 3.3.5.1.1 4 REQUIREMENTS 4

(continued) Performance of the CHANNEL CHECK once every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ensures 4

that a gross failure of instrumentation has not occurred. A CHANNEL CHECK is normally a comparison of the parameter indicated on one channel to a similar parameter on other channels. It is based on the assumption that instrument channels monitoring the same parameter should read approximately the same value. Significant deviations between the instrument channels could be an indication of excessive instrument drift in one of the channels or something even more serious. A CHANNEL CHECK will detect 1 gross channel failure; thus, it is key to verif.ving the instrumentation continues to operate properly between each CHANNEL CALIBRATION.

4 Agreement criteria are determined by the plant staff, based i on a combination of the channel instrument uncertainti9s. <

including indication and readability. If a channel is I outside the criteria, it may be an indication that the i

instrument has drifted outside its limit. l t !

. The Frequency is based upon operating experience that. ;

demonstrates channel failure is rare. The CHANNEL CHECK '

supplements less formal, but more frequent, checks of l I

channels during normal operational use of the displays 1 associated with the channels required by the LCO.

SR 3.3.5.1.2 4

A CHANNEL FUNCTIONAL TEST is performed on each required ,

channel to ensure that the entire channel will perform the l intended function.

1 Any setpoint adjustment shall be consistent with the l assumptions of the current plant specific setpoint methodology. The required setpoint adjustments include a calibration of the HPCS Reactor Vessel Water Level - Low Low, Level 2 Function confirmation delay permissive.

! The Frequency of 92 days is based on the reliability analyses of Reference 4.

1 (continued)

GRAND GULF B 3.3-121 Revision No. 2

U

'CS Instrumentation -

B 3.3.5 1 BASES SURVEILLANCE SR 3.3.5.1.3 REQUIREMENTS (continued) The calibration of trip units provides a check of the actual trip setpoints. The channel must be declared inoperable if the trip setting is discovered to be not within its required Allowable Value specified in Table 3.3.5.1-1. If the trip setting is discovered to be less conservative than accounted-for in the appropriate setpoint methodology, but is not beyond the Allowable Value, the channel performance is still within the requirements of the plant safety analyses. Under these conditions, the setpoint must be readjusted to be equal to or more conservative than the setting accounted for in the appropriate setpoint methodology.

The Frequency of 92 days is based on the reliability analysis of Reference 4.

SR 3.3.5.1.4 and SR 3.3.5.1.5 A CHANNEL CALIBRATION is a complete check of the instrument loop and the sensor. This test verifies the channel responds to the measured parameter within the necessary range and accuracy. CHANNEL CALIBRATION leaves the channel adjusted to account for instrument drifts between successive calibrations consistent with the plant specific setpoint methodology.

The Frequency of SR 3.3.5.1.4 and SR 3.3.5.1.5 is based upon the assumption of the magnitude of= equipment drift in the setpoint analysis.

SR 3.3.5.1.6 The LOGIC SYSTEM FUNCTIONAL TEST demonstrates the OPERABILITY of the required initiation logic for a specific channel. The system functional testing performed in LC0 3.5.1, LC0 3.5.2, LC0 3.8.1, and LCO 3.8.2 overlaps this Surveillance to provide complete testing of the assumed safety function.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for unplanned transients if the (continued)

GRAND GULF B 3.3-122 Revision No. 2

U

- RCIC System Instrumentation B 3.3.5.2 l

1 BASES BACKGROUND To prevent losing suction to the pump, the suction valves !

(continued) are interlocked so that one suction path must be open before the other automatically closes.

The RCIC System provides makeup water to the reactor until the reactor vessel water level reaches the high water level (Level 8) trip (two-out-of-two logic), at which time the RCIC steam supply, steam supply bypass, and cooling water supply valves close (the injection valve also closes due to the closure of the steam supply valves). The RCIC System restarts if vessel level again drops to the low level initiation point (Level 2).

APPLICABLE The function of the RCIC System is to provide makeup SAFETY ANALYSES, coolant to the reactor in response to transient events.

LCO, and The RCIC System is not an Engineered Safety Feature APPLICABILITY System and no credit is taken in the safety analysis for RCIC System operation. Based on its contribution to the reduction of overall plant risk, however, the RCIC System, and therefore its instrumentation, are included as required by the NRC Policy Statement. Certain instrumentation Functions are retained for other reasons and are described below in the individual Functions discussion.

The OPERABILITY of the RCIC System instrumentation is dependent on the OPERABILITY of the individual instrumentation channel Functions specified in Tabl e 3.3.5.2-1. Each Function must have a required number of OPERABLE channels with their setpoints within the specified Allowable Values, where appropriate. A channel is inoperable if its actual trip setpoint is not within its required Allowable Value. The actual setpoint is calibrated consistent with applicable setpoint methodology assumptions.

Allowable Values are specified for each RCIC System instrumentation Function specified in the table. Nominal trip setpoints are specified in the setpoint calculations.

The nominal setpoints are selected to ensure that the setpoints do not exceed the Allowable Value between CHANNEL CALIBRATIONS. Operation with a trip setpoint less conservative than the nominal trip setpoint, but within its Allowable Value, is acceptable. Each Allowable Value specified accounts for instrument uncertainties appropriate to the Function. These uncertainties are described in the setpoint methodology.

(continued)

GRAND GULF B 3.3-125 Revision No. O

RCIC System Instrumentation -

B 3.3.5.2 j l

BASES APPLICABLE The individual Functions are required to be OPERABLE in SAFETY ANALYSES, MODE 1, and in MODES 2 and 3 with reactor steam dome LCO, and pressure > 150 psig, since this is when RCIC is required to APPLICABILITY be OPERABLE. (Refer to LC0 3.5.3 for Applicability Bases (continued) for the RCIC System.)

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water Level-Low Low, level 2 Low reactor pressure vessel (RPV) water level indicates that normal feedwater flow is insufficient to maintain reactor vessel water level and that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result. Therefore, the RCIC System is initiated at Level 2 to assist in maintaining water level above the top of the active fuel.

Reactor Vessel Water Level-Low Low, level 2 signals are initiated from four level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-Low Low, level 2 Allowable Value is set high enough such that for complete loss of feedwater flow, the RCIC System flow (with high pressure core spray assumed to fail) will be sufficient to avoid initiation of low pressure ECCS at Level 1.

Four channels of Reactor Vessel Water Level-Low Low, level 2 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation.

Refer to LC0 3.5.3 for RCIC Applicability Bases.

2. Reactor Vessel Water Level-High, level 8 High RPV water level indicates that sufficient cooling water inventory exists in the reactor vessel such that there is no danger to the fuel. Therefore, the Level 8 signal closes I (continued)

GRAND GULF B 3.3-126 Revision No. 2

RCIC System Instrumentation B 3.3.5.2 BASES APPLICABLE 2. Reactor Vessel Water level-High, level 8 (continued)

SAFETY ANALYSES, LCO, and the RCIC steam supply valve to prevent overflow into the APPLICABILITY main steam lines (MSLs).

Reactor Vessel Water Level--High, level 8 signals for RCIC are initiated from two level transmitters from the narrow range water level measurement instrumentation, which sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel.

The Reactor Vessel Water Level-High, Level 8 Allowable Value is high enough to preclude isolating the injection valve of the RCIC during normal operation, yet low enough to trip the RCIC System prior to water overflowing into the MSLs.

Two channels of Reactor Vessel Water Level-High, Level 8 Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC initiation. Refer to LC0 3.5.3 for RCIC Applicability Bases.

L Condensate Storage Tank Level-Low Low level in the CST indicates the unavailability of an adequate supply of makeup water from this normal source.

Normally the suction valve between the RCIC pump and the CST is open and, upon receiving a RCIC initiation signal, water for RCIC injection would be taken from the CST. However, if the water level in the CST falls below a preselected level, first the' suppression pool suction valve automatically opens and then the CST suction valve automatically closes. This ensures that. an adequate supply of makeup water is available to the RCIC pump. To prevent losing suction to the pump, l the suction valves are interlocked so that the suppression i pool suction valve must.be open before the CST suction valve automatically closes.

Two level transmitters are used to detect low water level in the CST. The Condensate Storage Tank Level-Low Function (continued)

GRAND GULF B 3.3-127 Revision No. 2

RCIC System Instrumentation ,

B 3.3.5.2 BASES APPLICABLE 3. Condensate Storage Tank Level-Low (continued)

SAFETY ANALYSES, LCO, and Allowable Value is set high enough to ensure adequate pump APPLICABILITY suction head while water is being taken from the CST.

Two channels of Condensate Storage Tank Level-Low Function are available and are required to be OPERABLE when 001C is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source.

Refer to LC0 3.5.3 for RCIC Applicability Bases.

4. Suppression Pool Water Level-Hich Excessively high suppression pool water level could result in the loads on the suppression pool exceeding design values should there be a blowdown of the reactor vessel pressure through the safety / relief valves. Therefore, signals indicating high suppression pool water level are used to transfer the suction source of RCIC from the CST to the suppression pool to eliminate the possibility of RCIC continuing to provide additional water frcm a source outside primary containment. This Function satisfies Criterion 3 of the NRC Policy Statement. To prevent losing suction to the pump, the suction valves are interlocked so that the suppression pool suction valve must be open before the CST suction valve automatically closes.

Suppression pool water level signals are initiated from two level transmitters. The Allowable Value for the Suppression Pool Water Level-High Function is set low enough to ensure that RCIC will be aligned to take suction from the suppression pool before the water level reaches the point at which suppression design luads would be exceeded.

Two channels of Suppression Pool Water Level-High Function are available and are required to be OPERABLE when RCIC is required to be OPERABLE to ensure that no single instrument failure can preclude RCIC swap to suppression pool source.

Refer to LC0 3.5.3 for RCIC Applicability Bases.

(continued)

GRAND GULF B 3.3-128 Revision No. O

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 1

BASES i i

. APPLICABLE 2.o. Containment and Drywell Ventilation Exhaust I Radiation-Hiah (continued)

SAFETY ANALYSES, LCO, and APPLICABILITY Four channels of Containment and Drywell Ventilation Exhaust-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function. Two upscale-Hi Hi, one i

{

upscale-Hi Hi and one downscale, or two downscale signals '

from the same trip system actuate the trip system and initiate isolation of the associated containment and drywell isolation valves.

The Allowable Values are chosen to promptly detect gross failure of the fuel cladding and to ensure offsite doses remain below 10 CFR 20 and 10 CFR 100 limits.

The Function is required to be OPERABLE during CORE ALTERATIONS, operations with a potential for draining the ;

reactor vessel (0PDRVs), and movement of irradiated fuel :

assemblies in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure offsite dose limits are not exceeded.

This Function isolates the Group 7 valves.

2.h. Manual Initiation The Manual Initiation push button channels introduce signals .

into the primary containment and drywell isolation logic i that are redundant to the automatic protective instrumentation and provide manual isolation capability.

There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for the isolation function as required by the NRC in the plant licensing basis.

There are four push buttons 'for the logic, two manual initiation push buttons per tri; system. There is no Allowable Value for this Funttion since the channels are mechanically actuated based solely on the position of the push buttons. ,

Four channels of the Manual Initiation Function are available and are required to be OPERABLE.

(continued)

GRAND GULF B 3.3-148 Revision No. 2

m Primary Containment and Drywell Isolation Instrumentation -

B 3.3.6.1 BASES APPLICABLE 3. Reactor Core Isolation Cooling System Isolation SAFETY ANALYSES, LCO, and 3.a. RCIC Steam Line Flow-High APPLICABILITY (continued) RCIC Steam Line Flow-High Function is provided to detect a break of the RCIC steam lines and initiates closure of the steam line isolation valves. If the steam is allowed to continue flowing out of the break, the reactor will depressurize and core uncovery can occur. Therefore, the isolation is initiated on high flow to prevent or minimize core damage. The isolation action, along with the scram ,

function of the Reactor Protection System (RPS), ensures that the fuel peak cladding temperature remains below the limits of 10 CFR 50.46. Specific credit for this Function is not assumed in any UFSAR accident analyses since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC steam line break from becoming bounding.

The RCIC Steam Line Flow-High signals are initiated from two transmitters d at are connected to the system steam lines. Two channeh of RCIC Steam Line Flow-High Functions ,

are available and are required to be OPERABLE to ensure that j no single instrument failure can preclude the isolation j function. '

The Allowable Value is chosen to be low enough to ensure that the trip occurs to prevent fuel damage and maintains l the MSLB event as the bounding event. l This Function isolates the Group 4 valves.

3.b. RCIC Steam Line Flow Time Delay The RCIC Steam Line Flow Time Delay is provided to prevent ,

false isolations on RCIC Steam Line Flow-High during system '

startup transients and therefore improves system reliability. This Function is not assumed in any UFSAR .

transient or accident analyses. l The Allowable Value was chosen to be long enough to prevent false isolations due to system starts but not so long as to impact offsite dose calculations.

(continued)

GRAND GULF B 3.3-149 Revision No. O I

. l

+

Primary Containment and Drywell Isolation Instrumentation B 3.3.6.1 :

l BASES APPLICABLE 3.f. Main Steam Line Tunnel Ambient Temperature--High SAFETY ANALYSES LCO, and Ambient Temperature-High is provided to detect a leak in APPLICABILITY the RCPB and provides diversity to the high flow (continued) instrumentation. The isolation occurs when a very small leak has occurred. If the small leak is allowed to continued without isolation, offsite limits may be reached.

However, credit for these instruments is not taken in any transient or accident analysis in the UFSAR, since bounding 1 analyses are performed for large breaks such as MSLBs.

Ambient temperature signals are initiated from thermocouples located in the area being monitored. Two channels of Main Steam Tunnel Temperature-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

Each Function has one temperature element.

The Allowable Values are chosen to detect a leak equivalent to 25 gpm.

This Function isolates the Group 4 valves.

3.0. Main Steam Line Tunnel Temperature Timer l l

The Main Steam Line Tunnel Temperature Timer is provided to allow all the other systems that may be leaking in the main steam tunnel (as indicated by the high temperature) to be l isolated before RCIC is automatically isolated. This l ensures maximum RCIC System operation by preventing l isolations due to leaks in other systems. This Function is not assumed in any UFSAR transient or accident analysis; however, maximizing RCIC availability is an important function.

Two channels for RCIC Main Steam Line Tunnel Timer Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Values are based on maximizing the availability of the RCIC System; that is, providing sufficient time to isolate all other potential leakage sources in the main steam tunnel before RCIC is isolated.

This Function isolates the Group 4 valves.

(continued)

GRAND GULF B 3.3-152 Revision No. O

Primary Containment and Drywell Isolation Instrumentation -

B 3.3.6.1

BASES )

APPLICABLE 3.1. RCIC/RHR Steam Line Flow-High SAFETY ANALYSES, LCO, and The steam lines between RCIC and RHR formerly installed for i APPLICABILITY the RHR steam condensing mode have been mechanically

, (continued) isolated in both the RHR A and RHR B rooms and' abandoned.

1 The RCIC/RHR high steam line flow is provided.to detect a break on the RCIC side of the steam line and -isolate the i RCIC system. If the steam were allowed to continue flowing

. out of the break, the reactor would depressurize and the

.i core could uncover. Therefore, the isolation is initiated

, at high flow to prevent or minimize core damage. Specific l credit for this Function is not assumed in any UFSAR accident or transient analysis since the bounding analysis is performed for large breaks such as recirculation and MSL breaks. However, these instruments prevent the RCIC/RHR steam line break from becoming bounding.

The RCIC/RHR steam line flow signals are initiated from two ,

transmitters that are connected to the steam 'ine. Two channels with one channel in each trip system are available

and required to be OPERABLE to ensure that no single

instrument failure can preclude the isolation function. The 4

Allowable Value is selected to ensure that the trip occurs ,

to prevent fuel damage and maintains the MSLB as the boundary event.

This Function actuates the Group 4 valves.

3.i. Drywell Pressure-High High drywell pressure can indicate a break in the RCPB. The RCIC isolation of the turbine exhaust is provided to prevent communication with the drywell when high drywell pressure exists. A potential leakage path exists via the turbine exhaust. The isolation is delayed until the system becomes unavailable for injection (i.e., low steam line pressure).

The isolation of the RCIC turbine exhaust by Drywell Pressure--High is indirectly assumed in the UFSAR accident analysis because the turbine exhaust leakage path is not assumed to contribute to offsite doses.

High drywell pressure signals are initiated from pressure transmitters that sense the pressure in the'drywell. Two channels of RCIC Drywell Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function, j (continued) i GRAND GULF B 3.3-153 Revision No. 2 !

~

Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE vessel water level), and when the measured output value of ,

SAFETY ANALYSES, the process parameter exceeds the setpoint, the associated i LCO, and device (e.g., trip unit) changes state. The analytic limits APPLICABILITY are derived from the limiting values of the process (continued) parameters obtained from the safety analysis. The Allowable Values are derived from the analytic limits, corrected for calibration, process, and some of the instrument errors.

The trip setpoints are then determined accounting for the remaining instrument errors (e.g., drift). The trip setpoints derived in this manner provide adequate protection because instrumentation uncertainties, process effects, calibration tolerances, instrument drift, and severe environment errors (for channels that must function in harsh environments as defined by 10 CFR 50.49) are accounted for.

In general, the individual Functions are required to be OPERABLE in the MODES or other specified conditions when SCIVs and the SGT System are required.

The specific Applicable Safety Analyses, LCO, and Applicability discussions are listed below on a Function by Function basis.

1. Reactor Vessel Water Level--Low Low. Level 2 Low reactor pressure vessel (RPV) water level indicates that the capability to cool the fuel may be threatened. Should RPV water level decrease too far, fuel damage could result.

An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The Reactor Vessel Water Level--Low Low, Level 2 Function is one of the Functions assumed to be OPERABLE and capable of providing isolation and initiation signals. The isolation and initiation of systems on Reactor Vessel Water Level--Low Low, Level 2 support actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

Reactor Vessel Water Level--Low Low, Level 2 signals are initiated from level transmitters that sense the difference between the pressure due to a constant column of water (reference leg) and the pressure due to the actual water level (variable leg) in the vessel. Four channels of (continued)

GRAND GULF B 3.3-174 Revision No. O I

-= ._ ._- . - .-

Secondary Containment Isolation Instrumentation

B 3.3.6.2 BASES APPLICABLE 1. Reactor Vessel Water Level-Low Law Level 2 SAFETY ANALYSES, (continued)

LCO, and .

APPLICABILITY Reactor Vessel Water Level-Low Low, Level 2 Function are l available and are required to be OPERABLE to ensure that no '

single instrument failure can preclude the isolation 1 function.

The Reactor Vessel Water Levei-Low Low, level 2 Allowable Value was chosen to be the same as the High Pressure Core Spray (HPCS)/ Reactor Core Isolation Cooling (RCIC) Reactor Vessel Water Level-Low Low, level 2 Allowable Value (LC0 3.3.5.1, " Emergency Core Cooling System (ECCS) .

l Instrumentation," and LCO 3.3.5.2, " Reactor. Core Isolation Cooling (RCIC) System !nstrumentation"), since this could indicate the capability to cool-the fuel is being threatened.

The Reactor Vessel Water Level-Low Low, Level 2 Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the Reactor Coolant System (RCS); thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, this Function is not required. In addition, the Function is also required to be OPERABLE during operations with a potential for draining the reactor vessel (0PDRVs) because the capability of isolating potential sources of leakage must be provided to ensure that offsite dose limits are not exceeded if core damage occurs.

2. Dr_ywell Pressure-Hiah High drywell pressure can indicate a break in the reactor coolant pressure boundary (RCPB). An isolation of the secondary containment and actuation of the SGT System are initiated in order to minimize the potential of an offsite dose release. The isolation of high drywell pressure supports actions to ensure that any offsite releases are within the limits calculated in the safety analysis.

l (continued)

GRAND GULF B 3.3-175 Revision No. 2

1

- Secondary Containment Isolation Instrumentation B 3.3.6.2 BASES APPLICABLE 2. Drywell Pressure-High (continued)

I SAFETY ANALYSES, LCO, and High drywell pressure signals are initiated from pressure APPLICABILITY transmitters that sense the pressure in the drywell. Four channels of Drywell Pressure-High Function are available and are required to be OPERABLE to ensure that no single instrument failure can preclude the isolation function.

The Allowable Value was chosen to be the same as the ECCS Drywell Pressure-High Function Allowable Value (LC0 3.3.5.1) since this is indicative of a loss of coclant accident.

The Drywell Pressure-High Function is required to be OPERABLE in MODES 1, 2, and 3 where considerable energy exists in the RCS; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. This Function is not required in MODES 4 and 5 because the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES.

3. 4. Fuel Handling Area Ventilation and Pool Sweep Exhaust Radiation-High High

! High secondary containment exhaust radiation is an indication of possible gross failure of the fuel cladding.

The release may have originated from the primary containment due to a break in the RCPB or the refueling floor due to a fuel handling accident. When Exhaust Radiation-High High is detected, secondary containment isolation and actuation of the SGT System are initiated to limit the release of fission products as assumed in the UFSAR safety analyses (Ref. 1).

The Exhaust Radiation-High High signals are initiated from radiation detectors that are located on the ventilation exhaust piping coming from the fuel handling area and the fuel handling area pool sweep, respectively. The signal from each detector is input to an individual monitor whose trip outputs are assigned to an isolation channel. Four (continued)

GRAND GULF B 3.3-176 Revision No. 2 l

.e.

Secondary Containment Isolation Instrumentation -

B 3.3.6.2

, BASES APPLICABLE 3, 4. Fuel Handling Area Ventilation and Pool Sweep Exhaust SAFETY ANALYSES, Radiation-High High LCO, and-(continued)

APPLICABILITY channels of Fuel Handling Area Ventilation Exhaust Radiation-High High Function and four channels of fuel Handling Area Pool Sweep Exhaust Radiation-High High i Function are available and are required to be OPERABLE to ensure that no ' single instrument failure can preclude the l isolation function.

The Allowable Values are chosen to promptly detect gross i failure of the fuel cladding. )

l The Exhaust Radiation-High High Functions are required to !

be OPERABLE in MODES 1, 2, and 3 where considerable energy exists; thus, there is a probability of pipe breaks resulting in significant releases of radioactive steam and gas. In MODES 4 and 5, the probability and consequences of these events are low due to the RCS pressure and temperature limitations of these MODES; thus, these Functions are not required. In addition, the Functions are required to be OPERABLE during CORE ALTERATIONS, OPDRVs, and movement of irradiated fuel assemblies in the primary or secondary containment because the capability of detecting radiation releases due to fuel failures (due to fuel uncovery or dropped fuel assemblies) must be provided to ensure that offsite dose limits are not exceeded.

5. Manual Initiation The Manual Initiation push button channels introduce signals into the secondary containment isolation logic that are redundant to the automatic protective instrumentation channels, and provide manual isolation capability. There is no specific UFSAR safety analysis that takes credit for this Function. It is retained for the secondary containment isolation instrumentation as required by the NRC approved licensing basis.

There are four push buttons for the logic, two manual initiation push buttons per trip system. There is no Allowable Value for this Function since the channels are mechanically actuated based solely on the position of the push buttons.

(continued)

GRAND GULF B 3.3-177 Revision No. O

~

Recirculation Loops Operating B 3.4.1 BASES ACTIONS A.1 (continued) frequent core. monitoring by operators allowing abrupt changes in core flow conditions to be quickly detected.

This Required Action does not require tripping the recirculation pump in the lowest flow loop when the mismatch between total jet pump flows of the two loops is greater than the required limits. However, in cases where large flow mismatches occur, low flow or reverse flow can occur in the low flow loop jet pumps, causing vibration of the jet pumps. If zero or reverse flow is detected, the condition should be alleviated by changing flow control valve position to re-establish forward flow or by tripping the ' pump.

B.1, C.1, and D.1 Due to thermal hydraulic stability concerns, operation of the plant is divided into four regions based on THERMAL POWER and core flows. Region A is a power / flow ratio with power > 100/. rod line and core flow < 40% of the rated core I fl ow. Region B is a power / flow ratio with the power > 80%

and s 100% rod lines and flow < 40% of the rated flow.

Region C is a power / flow ratio with the power > 80% rod line and core flow > 40% and < 45% of the rated core flow, respectively. In Region B, increased potential for instability exists, and operation is restricted. Action is required to exit the region within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by reducing THERMAL POWER through control rod insertion or by increasing recirculation loop flow (if one or more pumps are on fast speed) by opening the flow control valve. Operation in Region C is also more susceptible to instability than normal operating parameters. However, operation in this region is allowed during startups if required for fuel conditioning.

Under other circumstances, action is required to exit the region within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by reducing THERMAL POWER through control rod insertion or by increasing recirculation loop flow (if one or more pumps are on fast speed) by opening the flow control valve. If evidence of instability occurs (i.e., APRM oscillations > 10% or periodic LPRM upscale or downscale, in addition to the guidance provided in Reference 5) during operation in either Region B or C, an immediate reactor scram is required (Ref. 4). The allowed (continued)

GRAND GULF B 3.4-5 Revision No. 2

Recirculation Loops Operating -

B 3.4.1

]

l BASES ACTIONS 8.1, C.1, and 0.1 (continued)

Completion Times are reasonable, based on operating experience, to restore plant parameters to normal in an orderly manner and without challenging plant systems.

E.1 With no recirculation loops in operation in MODE 1, or while otherwise operating in Region A, the unit is very susceptible to instability, and an immediate scram is required. This action limits the time during which thermal hydraulic instability is of highest probability.

F.1 With no recirculation loops in operation in MODE 2, the unit is required to be brought to a MODE in which the LC0 does not apply. Action must be initiated immediately to reduce THERMAL POWER to be within the limits to assure thermal hydraulic stability concerns are addressed. The plant is then required to be placed in MODE 3 in 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In this condition, the recirculation loops are not required to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

G.1 If the required limit modifications for single recirculation loop operation are not performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after transition from two recirculation loop operation to single recirculation loop operation, the required limits which have not been modified must be immediately declared not met. The Required Actions for the associated limits must then be taken.

(continued)

GRAND GULF B 3.4-6 Revision No. O I

. S/RVs B 3.4.4 8 3.4. REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 Safety / Relief Valves (S/RVs)

BASES BACKGROUND The American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (Ref. 1) requires the Reactor Pressure Vessel be protected from ' overpressure during upset conditions by self actuated safety valves. As part of the nuclear pressure relief system, the size and number of safety / relief valves (S/RVs) are selected such that peak pressure in the nuclear system will not exceed the ASME Code limits for the reactor coolant pressure boundary (RCPB).

I The S/RVs are located on the main steam lines between the reactor vessel and the first isolation valve-within the drywell. Each S/RV discharges steam through a discharge line to a point below the minimum water level in the suppression pool.

The S/RVs can actuate by either of two modes: the safety mode or the relief mode. In the safety mode (or spring mode l

of operation), the direct action of the steam pressure in the main steam lines will act against a spring loaded disk that will pop open when the valve inlet pressure exceeds the spring force. In the relief mode (or power actuated mode of operation), a pneumatic piston or cylinder and mechanical linkage assembly are used to open the valve by overcoming the spring force, even with the valve inlet pressure equal to 9 psig. The pneumatic operator is arranged so that its malfunction will not prevent the valve disk from lifting if steam inlet pressure reaches the spring lift set pressures.

In the relief mode, valves may be opened manually or automatically at the selected preset pressure. Six of the S/RVs providing the relief function also provide the low-low set relief function specified in Lt0 3.6.1.6, " Low-Low Set (LLS) Valves." Eight of the S/RVs that provide the relief function are part of the Automatic Depressurization System specified in LC0 3.5.1, "ECCS-Operating." The instrumentation associated with the relief valve function and low-low set relief function is discussed in the Bases for LC0 3.3.6.5, " Relief and Low-Low Set (LLS)

Instrumentation," and instrumentation for the ADS function is discussed in LCO 3.3.5.1, " Emergency Core Cooling System (ECCS). Instrumentation."

(continued) l GRAND GOLF B 3.4-17 Revision No. 0 l

l

S/RVs

4 8 3.4.4 BASES (continued) i APPLICABLE The overpressure protection system must accommodate the SAFETY ANALYSES most sen re pressure transient. Evaluations have determined that the most severe transient is the closure of all main steam isolation valves (MSIVs) followed by reactor scram on I high neutron flux (i.e., failure of the direct scram associated with MSIV position) (Ref. 2). For the purpose of i the analyses, six of tt - S/RVs are assumed to operate in the relief mode, and seven in the safety mode. The analysis results demonstrate that the design S/RV capacity is capable of maintaining reactor pressure below the ASME Code limit of 110% of vessel design pressure (110% x 1250 psig -

1375 psig). This LC0 helps to ensure that the acceptance limit of 1375 psig is met during the design basis event.

Reference 3 discusses additional events that are expected to actuate the S/RVs. From an overpressure standpoint, the i design basis events are bounded by the MSIV closure with flux scram eve 6t described above.

S/RVs satisfy Criterion 3 of the NRC Policy Statement.

LC0 The safety function of seven S/RVs is required to be OPERABLE in the safety mode, and an additional six S/RVs (other than the sevel S/RVs that satisfy the safety function) must be OPli3BLE in the relief mode. The !

requirements of this LO are applicable only to the l capability of the S/RVs to mechanically open to relieve excess pressure. In Reference 2, an evaluation was l performed to establish the parametric relationship between '

the peak vessel pressure and the number of OPERABLE S/RVs.

The results show that with a minimum of seven S/RVs in the safety mode and six S/RVs in the relief mode OPERABLE, the i ASME Code limit of 1375 psig is not exceeded. '

The S/RV setpoints are established to ensure the ASME Code 4 limit on peak reactor pressure is satisfied. The ASME Code specifications require the lowest safety valve be set at or l below vessel design pressure (1250 psig) and the highest i safety valve be set so the total accumulated pressure does i not exceed 110% of the design pressure for conditions. The transient evaluations in Reference 3 are based on these setpoints, but also include the additional uncertainties of i 3% of the nominal setpoint to account for potential I setpoint drift to provide an added degree of conservatism.

l (continued)

GRAND GULF B 3.4-18 Revision No. 2

~

l l S/RVs I B 3.4.4 l

BASES L

I t i LC0 Operation with fewer valves OPERABLE than specified, or with !

l (continued) setpoints outside the ASME limits, could result in a more i severe reactor response'to a transient than predicted,

possibly resulting in the ASME Code limit on reactor

_ pressure being exceeded. l l

APPLICABILITY In MODES 1, 2, and 3, the specified number of S/RVs must be I OPERABLE since there may be considerable energy in the ,

reactor core and the limiting design basis transients are i assumed to occur. The S/RVs may be required to provide pressure relief to discharge energy from the core until such time that the Residual Heat Removal (RHR) System is capable :

of dissipating the heat. '

l In MODE 4, decay heat is low enough for the RHR System to j provide adequate cooling, and reactor pressure is low enough !

that the overpressure limit is unlikely to be approached by 1 assumed operational transients or accidents. In MODE 5, the !

reactor vessel head is unbolted or. removed and the reactor is at atmospheric pressure. The S/RV function is not needed '

during these conditions.

ACTIONS A.1 and A.2 With less than the minimum number of required S/RVs OPERABLE, a transient may result in the violation of the ASME Code limit on reactor pressure. If one or more required S/RVs are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating- )

experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. ,

I SURVEILLANCE SR 3.4.4.1

' REQUIREMENTS 1 This-Surveillance demonstrates that the required S/RVs will open at the pressures assumed in the safety analysis of Reference 2. The demonstration of the S/RV safety function l

l J (continued) i GRAND GULF B 3.4-19 Revision No. 2 i

%J S/RVs .

B 3.4.4 BASES SURVEILLANCE SR 3.4.4.1 (continued)

REQUIREMENTS lift settings must be performed during shutdown, since this is a bench test, and in accordance with the Inservice Testing Program. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures. The safety lift setpoints will still be set within a tolerance of i 1 percent, but the setpoints will be tested to within i 3 percent to determine acceptance or failure of the as-found valve lift setpoint.

If a valve is tested and the lift setpoint is found outside the 3 percent tolerance, two additional valves are to be tested (Reference 4).

The Frequency was selected because this Surveillance must be performed during shutdown conditions and is based on the time between refuelings.

SR 3.4.4.2 i The required relief function S/RVs are required to actuate automatically upon receipt of specific initiation signals.

A system functional test is performed to verify the mechanical portions of the automatic relief function operate as designed when initiated either by an actual or simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in ,

SR 3.3.6.5.4 overlaps this SR to provide complete testing of !

the safety function.

The 18 month Frequency is based on the need to perform this ,

Surveillance under the conditions that apply during a plant '

outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown these components usually pass the SR when performed at-the 18 month Frequency. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents an RPV pressure blowdown.

SR 3.4.4.3 A manual actuation of each required S/RV (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to I

(continued) 1 GRAND GULF B 3.4-20 Revision No. 2

S/RVs I B 3.4.4 BASES SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by method 1), plant startup is allowed prior to performing this .

test because valve OPERABILITY and the setpoints for I overpressure protection are verified, per ASME requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed l for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR. If performed by method 2), valve OPERABILITY has been demonstrated for all installed S/RVs based upon the successful operation of a test sample of S/RVs.

1. Manual actuation of the S/RV, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g.,

tailpipe temperature or pressure). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam i flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the S/RVs divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure ,

recommended by the valve manufacturer. I

2. The sample population of S/RVs tested each refueling i outage to satisfy SR 3.4.4.1 will be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. The successful performance of l the test sample of S/RVs provides reasonable assurance that the remaining installed S/RVs will perform in a ,

similar fashion. After the S/RVs are replaced, the '

i relief-mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure ;

that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified.

(continued)

GRAND GULF B 3.4-20a Revision No. 2

m -

)

9 PAGE INTENTIONALLY LEFT BLANK f

F l

l I

~

l l

S/RVs B 3.4.4 BASES ?

SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS This verifies that each replaced S/RV will properly perform its intended function.

If the valve fails to actuate due only to the failure of the i solenoid but is capable of opening on overpressure, the safety function of the S/RV is considered OPERABLE.

The STAGGERED TEST BASIS Frequency ensures that each solenoid for each S/RV relief-mode actuator is alternately '

tested. The Frequency of the required relief-mode actuator testing was developed based on the S/RV tests required by the ASME Boiler and Pressure Vessel Code,Section XI (Ref.

1) as implemented by the Inservice Testing Program of

Specification 5.5.6. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

(Reference 5) l l

4

[ REFERENCES 1. ASME, Boiler and Pressure Vessel Code, Sections III

and XI.

l 2. UFSAR, Section 5.2.2.2.3. [

] 3. UFSAR, Section 15.

i ,

4. GNRI-96/00134, Amendment 123 to the Operating License. I l 5. GNRI-96/00229, Amendment 130 to the Operating License. I

, i b

i F

P GRAND GULF B 3.4-21 Revision No. 2

c O

RCS Operational LEAKAGE -

B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.5 RCS Operational LEAKAGE l

BASES BACKGROUND The RCS includes systems and components that contain or ,

transport the coolant to or from the reactor core. The ,

pressure containing components of the RCS and the portions l of connecting systems out to and including the isolation

, valves define the reactor coolant pressure boundary (RCPB).

The joints of the RCPB components are welded or bolted.

During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. l Limits on RCS operational LEAKAGE are required to ensure appropriate action is taken before the integrity of the RCPB 1 is impaired. This LCO specifies the types and limits of '

LEAKAGE.

This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3).

The safety significance of leaks from the RCPB varies widely depending on the source, rate, and duration. Therefore, detection of LEAKAGE in 2he drywell is necessary. Methods for quickly separating tLe identified LEAKAGE from the unidentified LEAKAGE are necessary to provide the operators quantitative information to permit them to take corrective action should a leak occur detrimental to the safety of the facility or the public.

A limited amount of leakage inside the drywell is expected i

from auxiliary systems that cannot be made 100% leaktight.

Leakage from these systems should be detected and isolated from the drywell atmosphere, if possible, so as not to mask RCS operational LEAKAGE detection.

This LC0 deals with protection of the RCPB from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LC0 include the possibility of a loss of coolant accident.

(continued)

GRAND GULF B 3.4-22 Revision No. O

t . .

RHR Shutdown Cooling System--Cold Shutdown 1 B 3.4.10 l l

' BASES ;

' SURVEILLANCE SR. 3.4.10.1 (continued) l REQUIREMENTS determined by the flow rate necessary to provide sufficient decay heat removal capability. The Frequency of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is i ~

sufficient in view of other visual and audible indications available to the operator for monitoring the RHR subsystem in the control room. ,

REFERENCES None. !

I t

I l

l .

l f

t k

i p

p i

GRAND GULF B 3.4-51 Revision No. O

1

. 1 RCS P/T Limits -

B 3.4.11 1 B 3.4 REACTOR COOLANT SYSTEM (RCS) !

B 3.4.11 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature 1

changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

Figure 3.4.11-1 contains P/T limit curves for heatup, cooldown, and inservice leak and hydrostatic testing. The ,

heatup curve provides limits for both heatup and criticality. {

Each P/T limit curve defines an acceptable region for normal l operation. The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the l applicable curve to determine that operation is within the ;

allowable region (i.e., to the right of the applicable curve).

The LC0 establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure. Therefore, the LCO limits apply mainly to the vessel.

10 CFR 50, Appendix G (Ref.1), requires the establishment of P/T limits for material fracture toughness requirements of the RCPB materials. Reference 1 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code,Section III, Appendix G (Ref. 2).

The actual shift in the RT, of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3), 10 CFR 50, Appendix H (Ref. 4) and the UFSAR Reactor Materials Surveillance Program (Ref. 9, 10, 11). The operating P/T limit curves will be adjusted, as (continued)

GRAND GULF B 3.4-52 Revision No. 2

l RCS P/T Limits l B 3.4.11 l BASES ;

l I SURVEILLANCE SR 3.4.11.5, SR 3.4.11.6, and SR 3.4.11.7 REQUIREMENTS (continued) Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other P/T limits

( during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LC0 !

limits.

The flange temperatures must be verified to be above the limits 30 minutes before and while tensioning the vessel

head bolting studs to ensure that once the head is tensioned the limits are satisfied. When.in MODE 4 with RCS temperature s 80'F, 30 minute checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature s 100*F, monitoring of the flange temperature is required every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to ensure the temperatures are within the limits.

The 30 minute Frequency reflects the urgency of maintaining the temperatures within limits, and also limits the time that the temperature limits could be exceeded. .The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Frequency is reasonable based on the rate of temperature 4 change possible at these temperatures. .

i SR 3.4.11.8 and SR 3.4.11.9 Differential temperatures within the applicable limits 1 ensure that thermal stresses resulting from increases in '

THERMAL POWER or recirculation loop flow during single ;

recirculation loop operation will not exceed design 1 f allowances. Performing the Surveillance within 15 minutes i before beginning such an increase in power or flow rate I provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the change in operation.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.9 is to j compare the temperatures of the operating recirculation loop and the idle loop.

(continued)

GRAND GULF B 3.4-59 Revision No. 0

RCS P/T Limits -

B 3.4.11 I

BASES I i

l SURVEILLANCE SR 3.4.11.8 and SR 3.4.11.9 (continued)

REQUIREMENTS Plant specific test data has determined that the bottom head is not subject to temperature stratification with natural circulation at power levels as low as 36% of RTP with any single loop flow rate _ when the recirculation pump is on high l speed operation. Therefore, SR 3.4.11.8 and SR 3.4.11.9 !

have been modified by a Note that requires the Surveillance to be met only when THERMAL POWER or loop flow is being increased when the above conditions are not met. The Note for SR 3.4.11.9 further limits the requirement for this Surveillance to exclude comparison of the idle loop temperature if the idle loop is isolated from the RPV since

! the water in the loop cannot be introduced into the 4

remainder of the reactor coolant system.

d REFERENCES 1. 10 CFR 50, Appendix G.

2. ASME, Boiler and Pressure Vessel Code,Section III, Appendix G.

3. ASTM E 185-82, " Standard Practice for Conducting Surveillance Tests For Light-Water Cooled Nuclear Power Reactor Vessels," July 1982.

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

6. ASME, Boiler and Pressure Vessel Code,Section XI, Appendix E.

7. NED0-21778-A, " Transient Pressure Rises Affecting Fracture Toughness Requirements Far BWRs,"

December 1978.

8. UFSAR, Section 15.4.4.

1

9. GNRI-96/00176, Amendment 127 Safety Evaluation

10. CNRI-96/00186, Amendment 127 Safety Evaluation, Correction

11. UFSAR, Section 5.3.1.6.1 GRAND GULF B 3.4-60 Revision No. 2

ECCS-Operating 8 3.5.1 BASES BACKGROUND pool to inject into the core. A discharge test line is (continued) provided to route water from and to the suppression pool to allow testing of each LPCI pump without injecting water into the RPV.

The HPCS System (Ref. 3) consists of a single motor driven pump, a spray sparger above the core, and piping and valves to transfer water from the suction source to the sparger.

Suction piping is provided from the CST and the suppression pool. Pump-suction is normally aligned to the CST source to minimize injection of suppression pool water into the RPV.

However, if the CST water supply is low or the suppression pool level is high, an automatic transfer to the suppression pool water source ensures a water supply for continuous operation of the HPCS System. The HPCS System is designed to provide core cooling over a wide range of RPV pressures (0 psid to 1177 psid, vessel to suction source). Upon receipt of an initiation signal, the HPCS pump automatically starts approximately 10 seconds after AC power is available and valves in the flow path begin to open. Since the HPCS System is designed to operate over the full range of expected RPV pressures, HPCS flow begins as soon as the necessary valves are open. A full flow test line is provided to route water from and to the CST to allow testing of the HPCS System during normal operation without spraying water into the RPV.

The ECCS pumps are provided with minimum flow bypass lines, which discharge to the suppression pool. The valves in these lines automatically open to prevent pump damage due to overheating when other discharge line valves are closed or RPV pressure is greater than the LPCS or LPCI pump discharge pressures following system initiation. To ensure rapid delivery of water to the RPV and to minimize water hammer ,

effects, the ECCS discharge line " keep fill" systems are 1 designed to maintain all pump discharge lines filled with l water.

The ADS (Ref. 4) consists of 8 of the 20 S/Rvs. It is designed to provide depressurization of the primary system 1 during a small break LOCA if HPCS fails or is unable to l maintain required water level in the RPV. ADS operation reduces the RPV pressure to within the operating pressure range of the low pressure ECCS subsystems (LPCS and LPCI),

so that these subsystems can provide core cooling. Each ADS (continued)

GRAND GULF B 3.5-3 Revision No. O

ECCS-Operating -

B 3.5.1 BASES BACKGROUND valve is supplied with pneumatic power from an air storage (continued) system, which consists of air accumulators located in the drywell.

APPLICABLE- The ECCS performance is evaluated for the entire spectrum of SAFETY ANALYSES break sizes for a postulated LOCA. The accidents for which ECCS operation is required are presented in References 5, 6, and 7. The required analyses and assumptions are defined in 10 CFR 50 (Ref. 8), and the results of these analyses are described in Reference 9.

This LCO helps to ensure that the following acceptance criteria for the ECCS, established by 10 CFR 50.46 (Ref.10), will be met following a LOCA assuming the worst case single active component failure in the ECCS:

a. Maximum fuel element cladding temperature is s 2200*F;

b. Maximum cladding oxidation is s 0.17 times the total cladding thickness before oxidation;

c. Maximum hydrogen generation from zirconium water reaction is s 0.01 times the hypothetical amount that would be generated if all of the metal in the cladding surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react;

d. The core is maintained in a coolable geometry; and

e. Adequate long term cooling capability is maintained.

The limiting single failures are discussed in Reference 11.

For large break and small break LOCAs, HPCS System failure l

is the most severe failure. One ADS valve failure is analyzed as a limiting single failure for events requiring ADS operation. The remaining OPERABLE ECCS subsystems provide the capability to adequately cool the core and prevent excessive fuel damage.

The ECCS satisfy Criterion 3 of the NRC Policy Statement.

l (continued)

GRAND GULF B 3.5-4 Revi.sion No. 2

m O

ECCS-Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.4 (continued)

REQUIREMENTS losses, and RPV pressure present during LOCAs. These values may be established during pre-operational testing. The Frequency for this Surveillance is in accordance with the Inservice Testing Program requirements.

SR 3.5.1.5 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance test verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCS, LPCS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup, and actuation of all automatic valves to their required positions. This Surveillance also ensures that the HPCS System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool. The LOGIC SYSTEM FUNCTIONAL TEST performed in LC0 3.3.5.1, " Emergency Core Cooling System (ECCS)

Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function. ,

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. :

Operating experience has shown that these components usually !

pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability i standpoint.

I This SR is modified by a Note that excludes vessel injection / spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

i l

(continued) j l

GRAND GULF B 3.5-11 Revision No. I

V ECCS-Operating -

B 3.5.1 BASES SURVEILLANCE SR 3.5.1.6 REQUIREMENTS (continued) The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals.

A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LC0 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The 18 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

Operating experience has shown that these components usually pass the SR when performed at the 18 month Frequency, which is based on the refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This prevents an RPV_ pressure blowdown. j l

SR 3.5.1.7 A manual actuation of each required ADS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by method 1), plant startup is allowed prior to performing this ,

test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be i performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and (continued)

GRAND GULF B 3.5-12 Revision No. 2

o

. ECCS-Operating B 3.5.1

. BASES :

SURVEILLANCE -SR 3.5.1.7 (continued)

REQUIREMENTS provides a reasonable time to complete the SR. If performed by method 2), valve OPERABILITY has been demonstrated for all installed ADS valves based upon- the successful operation of a test sample of S/RVs.

1. Manual actuation of the ADS valve, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, '

or any other method suitable to verify steam flow (e.g., tailpipe temperature or pressure). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the ADS valves divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

2. The sample population of S/RVs tested each refueling outage to satisfy SR 3.4.4.1 will be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that all ADS valves will perform in a similar fashion.

After the S/RVs are replaced, the relief-mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified. This verifies that each replaced S/RV will properly perform its intended function.

SR 3.5.1.6 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LC0 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The STAGGERED TEST BASIS Frequency ensures that both

. solenoids for each ADS valve relief-mode actuator are (continued)

GRAND GULF B 3.5-13 Revision No. 2 i

ECCS-Operating .

B 3.5.1 BASES SURVEILLANCE SR 3.5.1.7 (continued)

REQUIREMENTS alternately tested. The Frequency of the required relief-mode actuator testing was developed based on the tests required by the ASME Boiler and Pressure Vessel Code, l Section XI as implemented by the Inservice Testing Program I of Specification 5.5.6. The testing Frequency required by the Inservice Testing Program is based on operating !

experience and valve performance. Therefore, the Frequency l was concluded to be acceptable from a reliability I standpoint.

I SR 3.5.1.8 This SR ensures that the HPCS System response time is less than or equal to the maximum value assumed in the accident analysis. Specific testing of the ECCS actuation instrumentation inputs into the HPCS System ECCS SYSTEM RESPONSE TIME is not required by this SR. Specific response j time testing of this instrumentation is not required since j these actuation channels are only assumed to respond within i the diesel generator start time; therefore, sufficient l margin exists in the diesel generator 10 second start time when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. The diesel generator starting and any sequence loading delays along with the Reactor Vessel Water Level - Low Low, Level 2 confirmation delay permissive must be added to the HPCS System equipment response times to obtain the HPCS System ECCS SYSTEM RESPONSE TIME. The acceptance criterion for the HPCS System ECCS SYSTEM RESPONSE TIME is s 27 seconds.

(continued)

GRAND GULF B 3.5-13a Revision No. 2

u g O' ECCS-Operating B 3.5.1 BdSES SURVEILLANCE- SR 3.5.1.8 (continued)

REQUIREMENTS HPCS System ECCS SYSTEM RESPONSE TIME tests are conducted every 18 months. This Frequency is consistent with the typical industry refueling cycle and is based on industry operating experience.

REFERENCES 1. UFSAR, Section 6.3.2.2.3.

2. -UFSAR, Section 6.3.2.2.4.

3. UFSAR, Section 6.3.2.2.1.

4. UFSAR, Section 6.3.2.2.2.

5. UFSAR, Section 15.6.6.

6. UFSAR, Section 15.6.4.

7. UFSAR, Section 15.6.5.

8. 10 CFR 50, Appendix K.

9. UFSAR, Section 6.3.3.

10. 10 CFR 50.46.

11. UFSAR, Section'6.3.3.3.

12. Memorandum from R.L. Baer (NRC) to V. Stello, Jr.

(NRC), " Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.

13. UFSAR, Section 6.3.3.7.8.

14. UFSAR, Section 7.3.1.1.1.4.2.

15. GNRI-96/00229, Amendment 130 to the Operating License. l GRAND GULF B 3.5-14 Revision No. 2

- - - . .. . au . - . .-.-- . . . . 2-.. - . - , . , - - r. a, . . . . - - - .- . - -..

e 1

PAGE INTENTIONALLY LEFT BLANK 4

4 4

i

ECCS--Shutdown B 3.5.2 BASES SURVEILLANCE SR 3.5.2.4 (continued)

REQUIREMENTS initiation signal is allowed to be in a nonaccident position provided the valve will automatically reposition in the proper stroke time. 'This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves. The 31 day Frequency is appropriate because the valves are operated under procedural control and the probability of their being mispositioned during this time period is low.

In MODES 4 and 5,'the RHR System may operate in the shutdown cooling mode, or be aligned to allow alternate means to remove decay heat and sensible heat from the reactor.

Therefore, RHR valves that are required for LPCI subsystem operation may be aligned for decay heat removal. This SR is modified by a Note that allows one LPCI subsystem of the RHR System to be considered OPERABLE for the ECCS function if all the required valves in the LPCI flow path can be 1 manually realigned (remote or local) to allow injection into the RPV and the system is not otherwise inoperable'. This will ensure adequate core cooling if an inadvertent vessel draindown should occur.

SR 3.5.2.7 This SR ensures that the HPCS System response time is less than or equal to the maximum value assumed in the accident analysis. Specific testing of the ECCS actuation instrumentation inputs into the HPCS System ECCS SYSTEM RESPONSE TIME is not required by this SR. Specific response time testing of this instrumentation is not required since these actuation channels are only assumed to respond within the diesel generator start time; therefore, sufficient margin exists in the diesel generator 10 second start time i when compared to the typical channel response time (milliseconds) so as to assure adequate response without a specific measurement test. The diesel generator starting and any sequence loading delays along with the Reactor Vessel Water Level - Low Low, Level 2 confirmation delay permissive must be added to the HPCS System equipment response times to obtain the HPCS System ECCS SYSTEM I

(continued)

GRAND GULF B 3.5-19 Revision No. 2

i o .

ECCS--Shutdown .

B 3.5.2 i

BASES ;

SURVEILLANCE SR 3.5.2.7. (continued) i REQUIREMENTS .

RESPONSE TIME. The acceptance criterion for the HPCS System ,

ECCS SYSTEM RESPONSE TIME is s 27 seconds. .HPCS System ECCS SYSTEM RESPONSE. TIME tests are conducted every

.18 months. This Frequency is consistent with-the typical I industry refueling cycle and is based on industry operating '

experience.

REFERENCES 1. -UFSAR, Section 6.3.3.4.

Y ;

1 i

l 2

l 1

GRAND GULF B 3.5-20 Revision No. 2 w

PCIVs B 3.6.1.3 BASES ACTIONS C.1 (continued)

With the hydrostatic leakage rate or MSIV leakage rate not within limit, the assumptions of the safety analysis may not be met. Therefore, the leakage must be restored to within limit within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Restoration can be accomplished by isolating the penetration that caused the limit to be exceeded by use of one closed and de-activated automatic valve, closed manual valve, or blind flange. When a penetration is isolated, the leakage rate for the_ isolation penetration is assumed to be the actual pathway leakage through the isolation device. If two isolation devices are used to isolate the penetration, the_ leakage rate is assumed to be the lesser actual pathway leakage of the two devices.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable considering the time required to restore the leakage by isolating the penetration and the relative importance to the overall containment function.

D.1, D.2, and 0.3 In the event one or more primary containment purge valves are not within the purge valve leakage limits, purge valve leakage must be restored to within limits or the affected penetration must be isolated. The method of isolation must be by the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, closed manual valve, and blind fl ange. If a purge valve with resilient seals is utilized to satisfy Required Action D.1 it must have been demonstrated to meet the leakage requirements of SR 3.6.1.3.5. The specified Completion Time is reasonable, considering that one primary containment purge valve remains closed, so that a gross breach of primary containment does not exist.

In accordance with Required Action D.2, this penetration flow path must be verified to be isolated on a periodic basis. The periodic verification is necessary to ensure that primary containment penetrations required to be isolated following an accident, which are no longer capable of being automatically isolated, will be isolated should an event occur. This Required Action does not require any testing or valve manipulation. Rather, it involves (continued)

GRAND GULF B 3.6-19 Revision No. 0

.- .. ~. . - . _ . - - . .

9 2

PCIVs -

B 3.6.1.3 1

, BASES ACTIONS D.1, 0.2, and D.3 (continued) i

' verification that those isolation devices outside primary containment and potentially capable of being mispositioned are in the correct position. For the isolation devices 1 inside primary containment, the time period specified as i

" prior to entering MODE 2 or 3, from MODE 4 if not performed within the previous 92 days" is based on engineering judgment and is considered reasonable in view of

! administrative controls that will ensure that isolation l device misalignment is an unlikely possibility. !

For the primary containment purge valve with resilient seal j that is isolated in accordance with Required Action D.1, i SR 3.6.1.3.5 must be performed at least once every 92 days. '

4 This provides assurance that degradation of the resilient seal is detected and confirms that the leakage rate of the primary containment. purge valve does not increase during the time the penetration is isolated. Since more reliance is placed on a single valve while in this Condition, it is l

.j

! prudent to perform the SR more often. Therefore, a '

Frequency of once per 92 days was chosen and has been shown l acceptable based on operating experience. )

E.1 and E.2 3 If any Required Action and associated Completion Time cannot be met in MODE 1, 2, or 3, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this

status, the plant must be brought to at least MODE 3 within i^ 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

~

1 i F.1, G.1, H.1, and H.2 I l

I If any Required Action and associated Completion Time cannot be met, the plant must be placed in a condition in which the LC0 does not apply. If applicable, CORE ALTERATIONS and movement of irradiated fuel assemblies in the primary and 1 (continued)

GRAND GULF B 3.6-20 Revision No. 2

1 PCIVs l B 3.6.1.3 BASES i

I SURVEILLANCE S F, 3.6.1.3.3 (continued) ,

REQUIREMENTS i to ensure that post accident leakage of radioactive fluids or gases outside the primary containment boundary is within design limits. For devices inside primary containment, drywell, or steam tunnel, the Frequency of " prior to ;

entering MODE 2 or 3 from MODE 4, if not performed within '

the previous 92 days", is appropriate since these devices are operated under administrative controls and the probability of their misalignment is low.

Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to !

be verified by use of administrative controls. Allowing i verification by administrative controls is considered i acceptable since access to these areas is typically I restricted during MODES 1, 2, and 3. Therefore, the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A second Note is included to clarify that PCIVs that are open under administrative controls are not required to meet the i

SR during the time that the PCIVs are open. !

SR 3.6.1.3.4 l Verifying the isolation time of each power operated and each automatic PCIV is within limits is required to demonstrate OPERABILITY. MSIVs may be excluded from this SR since MSIV ,

full closure isolation time is demonstrated by SR 3.6.1.3.6. '

The isolation time test ensures that the valve will isolate in a time period less than or equal to that assumed in the safety analysis. Generally, PCIVs in a direct leak path (open path from containment to environs) must close more rapidly than PCIVs in indirect leak paths. Maximum isolation times are based on system performance requirements, equipment qualification, regulatory requirements, or offsite dose analyses for specific accidents. These requirements ensure the radiological consequences do not exceed the guideline values established by the applicable regulatory documents (10CFR 100 or GDC 19). Closure times explicitly assumed in accident analyses are listed in UFSAR Table 6.2-44 Note d. The Frequency of this SR is in accordance with the Inservice Testing Program.

(continued)

GRAND GULF B 3.6-23 Revision No. 1

PCIVs -

B 3.6.1.3 l BASES SURVEILLANCE SR 3.6.1.3.5 l REQUIREMENTS (continued) For primary containment purge valves with resilient seals, I

. additional leakage rate testing beyond the test requirements of 10 CFR 50, Appendix J (Ref. 3), is required to ensure OPERABILITY. Operating experience has demonstrated that this type of seal has the potential to degrade in a shorter time period than do other seal types. Based on this observation, and the importance of maintaining this penetration leak tight (due to the direct path between primary containment and the environment), a Frequency of 36 months, with consideration given to operational experience '

and safety significance. Additionally, this SR must be performed for all purge valves within 92 days following any purge valve failing to meet it's acceptance criteria. This ensures that any common mode seal degradation is identified.

The Frequency for this SR is modified by two notes. The first note indicates that SR 3.0.2 is only applicable to the "36 month" statement in the frequency. The second note indicates that all valves do not have to be retested due to the failure of another valve, provided they have been tested within 92 days prior to any valve failing to meet it's acceptance criteria.

The SR is modified by a Note stating that the primary '

containment purge valves are only required to meet leakage rate testing requirements in MODES 1, 2, and 3. If a LOCA inside primary containment occurs in these MODES, purge ,

valve leakage must be minimized to ensure offsite '

radiological release is within limits. At other times when the purge valves are required to be capable of closing (e.g., during handling of irradiated fuel), pressurization concerns are not present and the purge valves are not '

required to meet any specific leakage criteria.

SR 3.6.1.3.6 <

Verifying that the full closure isolation time of each MSIV is within the specified limits is required to demonstrate OPERABILITY. The full closure isolation time test ensures that the MSIV will isolate in a time period that does not (continued)

GRAND GULF B 3.6-24 Revision No. 2 l

PCIVs B 3.6.1.3 BASES I

SURVEILLANCE SR 3.6.1.3.7 REQUIREMENTS (continued) exceed the times assumed in the DBA analyses. The 3 second time limit is measured from the start of valve motion to complete valve closure. The 5 second time limit is measured from initiation of the actuating signal to complete valve closure. The Frequency of this SR is in accordance with the Inservice Testing Program.

Automatic PCIVs close on a primary containment isolation '

signal to prevent leakage of radioactive material from primary containment following a DBA. This SR ensures that (continued)

GRAND GULF B 3.6-24a Revision No. 2 I

I D

0 i

I t

1 1

l PAGE INTENTIONALLY LEFT BLANK 1

l

. l 1

1 l

l l

l

1 LLS Valves B 3.6.1.6 BASES (continued) l LC0 Six LLS valves are required to be OPERABLE to satisfy the assumptions of the safety analysis (Ref. 2). The requirements of this LCO are applicable to the mechanical and electrical / pneumatic capability of the LLS valves to function for controlling the opening and closing of the S/RVs.

APPLIC'BILITY In MODES 1, 2, and 3, an event could cause pressurization of the reactor and opening of S/RVs. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES.

Therefore, maintaining the LLS valves OPERABLE is not required in MODE 4 or 5.

1 ACTIONF A.1 With one LLS valve inoperable, the remaining OPERABLE LLS ,

valves are adequate to perform the designed function. I However, the overall reliability is reduced. The 14 day l Completion Time takes into account the redundant capability I afforded by the remaining LLS S/RVs and the low probability i of an event in which the remaining LLS S/RV capability would ,

be inadequate. l B.1 and B.2 l If two or more LLS valves are inoperable or if the inoperable LLS valve cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to M0f t 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months , lhe allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.6.1 REQUIREMENTS A manual actuation of each required LLS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by (continued)

GRAND GULF B 3.6-33 Revision No. 2

4 LLS Valves .

B 3.6.1.6 BASES SURVEILLANCE SR 3.6.1.6.1 (continued)

REQUIREMENTS method 1), plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per ASME requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR. If performed by method 2), valve OPERABILITY has been demonstrated for all installed LLS valves based upon the successful operation of a test sample of S/RVs.

1. Manual actuation of the LLS valve, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g., tailpipe temperature or pressure). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the LLS valves divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

2. The sample population of S/RVs tested each refueling outage to satisfy SR 3.4.4.1 will be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs provides reasonable assurance that all LLS valves will perform in similar fashion.

After the S/RVs are replaced, the relief-mode actuator of the newly-installed S/RVs will be uncoupled from the S/RV stem, and cycled to ensure that no damage has occurred to the S/RV during transportation and installation. Following cycling, the relief-mode actuator is recoupled and the proper positioning of the stem nut is independently verified. This verifies that each replaced S/RV will properly perform its intended function.

(continued)

GRAND GULF B 3.6-34 Revision No. 2

LLS Valves B 3.6.1.6 BASES i l

SURVEILLANCE SR 3.6.1.6.1 (continued)

' REQUIREMENTS The STAGGERED. TEST BASIS Frequency ensures that both l solenoids for each LLS valve relief-mode actuator are alternatively tested. The Frequency of the required relief-mode actuator testing was developed based on the tests required by the ASME Boiler and Pressure Vessel Code,Section XI as implemented by the Inservice Testing Program of Specification-5.5.6. The testing Frequency required by the Inservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. (Reference 4) '

SR 3.6.1.6.2 ,

The LLS designed S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system !

functional test is performed to verify that the mechanical portions (i e., solenoids) of the automatic LLS function operate . designed when initiated either by an actual or simulatec' automatic initiation signal. The LOGIC SYSTEM i FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety function.

The 18 month Frequency is based on the need to perform this :

Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the '

Surveillance were performed with the reactor at power.

Operating experience has'shown these components usually pass '

the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency was concluded to be acceptable from i a reliability standpoint.

This SR is modified by a Note that excludes valve actuation.

This ;.revents a reactor pressure vessel pressure blowdown. ,

REFERENCES 1. GESSAR-II, Appendix 3B, Attachment A, Section 3BA.8.

2. UFSAR, Section 5.2.2.2.3.3.

3. ASliE, Boiler and Pressure Vessel Code,Section XI.

4. GNRI-96/00229, Amendment 130 to the Operating License. I GRAND GULF B 3.6-35 Revision No. 2

RHR Containment Spray System , l B 3.6.1.7 '

8 3.6 CONTAINMENT SYSTEMS B 3.6.1.7 Residual Heat Removal (RHR) Containment Spray System BASES BACKGROUND The primary containment is designed with a suppression pool so that, in the event of a loss of coolant accident (LOCA),

steam released from the primary syrtem is channeled through the suppression pool water and cc:,densed without producing significant pressurization of the primary containment. The primary containment is designed so that with the pool initially at the minimum water volume and the worst single failure of the primary containment heat removal systems, suppression pool energy absorption combined with subsequent operator controlled pool cooling will prevent the primary containment pressure from exceeding its design value.

However, the primary containment must also withstand a postulated bypass leakage pathway that allows the passage of steam from the drywell directly into the primary containment airspace, bypassing the suppression pool. The primary containment also must withstand a low energy steam release into the primary containment airspace. The RHR Containment Spray System is designed to mitigate the effects of bypass leakage and low energy line breaks.

There are two redundant, 100% capacity RHR containment spray subsystems. Each subsystem consists of a suction line from the suppression pool, an RHR pump, a heat exchanger, and +

three spray spargers inside the primary containment (outside of the drywell) above the refueling floor. Dispersion of the spray water is accomplished by 350 nozzles in each subsystem.

The RHR containment spray mode will be automatically initiated, if required, following a LOCA.

APPLICABLE Reference I contains the results of analyses that predict SAFETY ANALYSES the primary containment pressure response for a LOCA with

, the maximum allowable bypass leakage area.

The equivalent flow path area for bypass leakage has been specified to be 0.9 ft 2. The analysis demonstrates that with containment spray operation the primary containment pressure remains within design limits.

(continued) i GRAND GULF B 3.6-36 Revision No. 0

"- MSIV LCS B 3.6.1.9 B 3.6 CONTAINMENT SYSTEMS B 3.6.1.9 Main Steam-Isolation Valve (MSIV) Leakage Control System (LCS)

BASES BACKGROUND The MSIV LCS supplements the isolation function of the MSIVs l by processing the fission products that could leak through ,

-the closed MSIVs after a Design Basis Accident (DBA) loss of coolant accident (LOCA).

The MSIV LCS consists of two independent subsystems: an inboard subsystem, which is connected between the inboard ;

and outboard MSIVs; and an outboard subsystem, which is connected immediately downstream of the outboard MSIVs.

Each subsystem is capable of processing leakage from MSIVs following a DBA LOCA. Each subsystem consists of valves and l piping. The outboard subsystem consists of two blowers.

Each subsystem operates in two process modes:

depressurization and bleedoff. The depressurization process reduces the steam line pressure to within the operating capability of equipment used for the bleedoff mode. During bleedoff (long term leakage control), the outboard MSIV-LCS blowers maintain a negative pressure in the main steam lines (Ref. 1). SGTS maintains the auxiliary building at a negative pressure which ensures long term leakage control for the inboard MSIV-LCS. This ensures that leakage through the closed MSIVs is collected by the MSIV LCS. In both process modes, the effluent is discharged to the auxiliary building, which encloses a volume served by the Standby Gas Treatment (SGT) System.

The MSIV LCS is manually initiated approximately 20 minutes following a DBA LOCA (Ref. 1). Only one Leakage Control System is needed to process MSIV leakage. The outboard MSIV-LCS is the primary LCS.

APPLICABLE The MSIV LCS mitigates the consequences of-a DBA LOCA by SAFETY ANALYSES ensuring that fission products that may leak from the closed MSIVs are diverted to the auxiliary building and ultimately filtered by the SGT System. The analyses in Reference 2 provide the evaluation of offsite dose consequences. The operation of the MSIV LCS prevents a release of untreated leakage for this type of event.

(continued)

GRAND GULF B 3.6-44 Revision No. 2

MSIV LCS -

B 3.6.1.9 BASES.

APPLICABLE The MSIV LCS satisfies Criterion 3 of the NRC Policy SAFETY ANALYSES Statement.

(continued)

LC0 One MSIV LCS subsystem can provide the required processing of the MSIV leakage. To ensure that this capability is

.available, assuming worst case single failure, two MSIV LCS

, . subsystems must be OPERABLE.

APPLICABILITY In MODES 1, 2, and 3, a DBA could lead to a fission product release to primary containment. Therefore, MSIV LCS

OPERABILITY is required during these MODES. In MODES 4 and 5, the probability and consequences of these events are

, reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the MSIV LCS OPERA 8tu is not required in MODE 4 or 5 to-ensure MSIV leakage is :

processed.

i ACTIONS A.1 With one MSIV LCS subsystem inoperable, the inoperable MSIV LCS subsystem must be restored to OPERABLE status within 30 days. In this Condition, the remaining OPERABLE MSIV LCS subsystem is adequate to perform the required leakage

. control function. However, the overall reliability is - .

reduced because a single failure in the remaining subsystem I could result in a total loss of MSIV leakage control l function. The 30 day Completion Time is based on the redundant capability afforded by the remaining 0PERABLE MSIV LCS subsystem and the low probability of a DBA LOCA occurring during this period.

B.1 With two MSIV LCS subsystems inoperable, at least one subsystem must be restored to OPERABLE status within 7 days.

'The 7 day Completion-Time is based on the low probability of the occurrence of a DBA LOCA.

(continued)

GRAND GULF- B 3.6-45 Revision No. O i

MSIV LCS l B 3.6.1.9 I

BASES 1

i ACTIONS C.1 and C.2 1 (continued)

If the MSIV LCS subsystem cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a' MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems. ;

i i

SURVEILLANCE SR 3.6.1.9.1 Each outboard MSIV LCS blower is operated for a 15 minutes to verify 0PERABILITY. The 31 day Frequency was developed ;

considering the known reliability of the LCS blower and l controls, the two subsystem redundancy,- and the low l probability of a significant degradation of the MSIV LCS '

subsystem occurring between surveillances and has been shown to be_ acceptable through operating experience.

SR 3.6.1.9.2 Deleted SR 3.6.1.9.3 A system functional test is performed to ensure that the I MSIV LCS will operate through its operating sequence. This i includes verifying that the automatic positioning of the valves and the operation of each interlock and timer are l correct, that the blowers start and develop the required flow rate and the necessary vacuum. The 18 month l

2 i

(continued)

GRAND GULF B 3.6-46 Revision No. 2

~-

c MSIV LCS -

B 3.6.1.9 BASES SURVEILLANCE SR 3.6.1.9.3 (continued) 1 PEQUIREMENTS Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance ,

were performed with_the reactor at power. Operating-experience has shown that these components usually pass the Surveillance when performed at the 18 month Frequency.

Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. UFSAR, Section 6.7.1.

1

2. UFSAR, Section 15.6.5.

I i

GRAND GULF B 3.6-47 Revision No. 0

- Secondary Containment B 3.6.4.1 BASES WWP +

LC0 . to the environment. For the secondary containment to be (continued) considered OPERABLE, it must have adequate leak tightness to ensure that the required vacuum can be established and maintained.

APPLICABILITY In MODES 1, 2, and 3, a LOCA could lead to a fission product release to primary containment that leaks to secondary containment. Therefore, secondary containment OPERABILITY is required during the same operating conditions that :

require primary containment OPERABILITY.

In MODES 4 and 5, the probability and consequences of the LOCA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining secondary containment OPERABLE is not required in MODE 4 or 5 to ensure a control volume, except for other situations for which significant releases of radioactive material can be postulated, such as during operations with a potential for draining the reactor _ vessel (0PDRVs), during CORE ALTERATIONS, or during movement of irradiated fuel assemblies in the primary or secondary containment.

ACTIONS A.1 If secondary containment is inoperable, it must be restored to OPERABLE status within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time provides a period of time to correct the problem that is commensurate with the importance of maintaining secondary ,

containment during MODES 1, 2, and 3. This time period also ensures that the probability of an accident (requiring secondary containment OPERABILITY) occurring during periods where secondary containment is inoperable is minimal.

8.1 and B.2 If the secondary containment cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least-MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating ;

l experience, to reach the required plant conditions from full ,

l pcwer conditions in an orderly manner and without challenging plant systems.

(continued) l GRAND GULF B 3.6-85 Revision No. O

Secondary Containment .

B 3.6.4.1 BASES ACTIONS C.1. C.2. and C.3 (continued)

Movement of irradiated fuel assemblies in the primary or secondary containment, CORE ALTERATIONS, and OPDRVs can be postulated to cause fission product release to the secondary containment. In such cases, the secondary containment is the only barrier to release of fission products to the environment. CORE ALTERATIONS and movement of irradiated i fuel assemblies must be immediately suspended if the secondary containment is inoperable.

Suspension of these activities shall not preclude completing an action that involves moving a component to a safe position. Also, action must be immediately initiated to suspend OPDRVs to minimize the probability of a vessel j draindown and subsequent potential for fission product release. Actions must continue until 0PDRVs are suspended.

Required Action C.1 has been modified by a Note stating that LCO 3.0.3 is not applicable. If moving irradiated fuel assemblies while in MODE 4 or 5, LC0 3.0.3 would not specify any action. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor i operations. Therefore, in either case, inability to suspend l movement of irradiated fuel assemblies would not be a sufficient reason to require a reactor shutdown. l I

SURVEILLANCE SR 3.6.4.1.1 and SR 3.6.4.1.2 REQUIREMENTS Verifying that Auxiliary Building and Enclosure Building equipment hatches, blowout panels, and access doors are closed ensures that the infiltration of outside air of such a magnitude as to prevent maintaining the desired negative pressure does not occur. Verifying that all such openings are closed provides adequate assurance that exfiltration from the secondary containment will not occur. In this application the term " sealed" has no connotation of leak tightness. Maintaining secondary containment OPERABILITY requires verifying each door in the access opening is closed, except when the access opening is being used for entry and exit. The 31 day Frequency for these SRs has been I shown to be adequate based on operating experience, and is considered adequate in view of the other controls on secondary containment access openings.

(continued)

GRAND GULF B 3.6-86 Revision No. 2

y Drywell B 3.6.5.1 BASES BACKGROUND c. All equipment hatches are closed; and (continued)

d. The Drywell Vacuum Relief System is OPERABLE except as provided in LC0 3.6.5.6, "Drywell Vacuum Relief System."

This Specification is intended to ensure that the performance of the drywell in the event of a DBA meets the assumptions used in the safety analyses (Ref. 1).

APPLICABLE Analytical methods and assumptions involving the drywell are SAFETY ANALYSES presented in Reference 1. The safety analyses assume that for a high energy line break inside the drywell, the steam and non-condensibles, with the exception of the allowable bypass leakage, is directed to the suppression pool through the horizontal vents where it is condensed and fission product scrubbing occurs. Maintaining the pressure suppression capability assures that safety analyses remain valid and that the peak LOCA temperature and pressure in the primary containment, as well as calculated doses, are within design limits.

The drywell satisfies Criteria 2 and 3 of the NRC Policy Statement.

LC0 Maintaining the drywell OPERABLE is required to ensure that the pressure suppression design functions assumed in the safety analyses are met. The drywell is OPERABLE if the drywell structural integrity is intact and the bypass leakage is within limits, except prior to the first startup after performing a required drywell bypass leakage test. At this time, the drywell bypass leakage must be 510% of the !

drywell bypass leakage limit. '

l l

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of l radioactive material to the primary containment. In MODES 4 )

and 5, the probability and consequences of these events are '

reduced due to the pressure and temperature limitations of these MODES. Therefore, the drywell is not required to be OPERABLE in MODES 4 and 5.

l l

(continued)

GRAND GULF B 3.6-103 Revision No. O i

. .. - .-. . . .~. . _ .

s Drywell - 4 B 3.6.5.1 BASES (continued)

ACTIONS A.1 In the event the drywell is inoperable, it must be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion l Time provides a period of time to correct the problem commensurate with the importance of maintaining the drywell )

OPERABLE during MODES l', 2, and 3. This time period also ,

ensures that the probability of an accident (requiring i drywell- 0PERABILITY) occurring during periods when the ~

drywell is inoperable is minimal. Also, the Completion Time is the same as that applied to inoperability of the primary i containment in LC0 3.6.1.1, " Primary Containment."

)

1 B.1 and B.2 l

If the drywell cannot be restored to OPERABLE status within ;

the required Completion Time, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to at least MODE 3 within I 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed I Completion Times are reasonable, based on operating '

experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

1 SURVEILLANCE SR 3.6.5.1.1 REQUIREMENTS The analyses in Reference 2 are based on a maximum drywell bypass leakage. This Surveillance ensures that the actual drywell bypass leakage is less than or equal to the acceptable A/Vil design value of 0.9 ft assumed in the 2

safety analysis. The testing is performed at a differential pressure of 2: 3.0 psid with one airlock door open (the I airlock door remaining open is changed for the performance of each required test) and the drywell bypass leakage is calculated from the measured leakage. As left drywell bypass leakage, prior to the first startup after performing a required drywell bypass leakage test, is required to be 5 !

10% of the drywell bypass leakage limit. At all other times between required drywell leakage rate tests, the acce tance criteria is based on design A/VTc. At the design A the containment temperature and pressurization response are bounded by the assumptions of (continued)

GRAND GULF B 3.6-104 Revision No. 2.

Q Drywell B 3.6.5.1 BASES SURVEILLANCE SR 3.6.5.1.1 (continued)

REQUIREMENTS the safety analysis. This Surveillance is performed at least once every 10 years on a performance based frequency.

The Frequency is consistent with the difficulty of performing the test, risk of high radiation exposure, and the remote possibility that sufficient component failures i will occur such that the drywell bypass leakage 1im!t will '

be exceeded. If during the performance of this required Surveillance the drywell bypass leakage rate is graater than the.drywell bypass leakage limit the Surveillance Frequency is. increased to every 48 months. If during the performance of the subsequent. consecutive Surveillance the drywell bypass leakage rate is less than or equal to the drywell bypass leakage limit the 10 year Frequency may be resumed.

If during the performance of two consecutive Surveillances the drywell bypass leakage is greater than the drywell

- bypass leakage limit the Surveillance Frequency is increased to at least-once every 24 months. The 24 months Frequency is maintained until during the performance of two consecutive surveillances the drywell bypass leakage rate is less than or equal to the drywell bypass leakage limit, at I which time the 10 year Frequency may be rr smed. For two Surveillances to be considered consecutive the Surveillances !

must be performed at least 12 months apart.

Since.the Frequency is performance based, the Frequency was I concluded to be acceptable from a reliability standpoint (Ref. 3).

SR 3.6.5.1.2 The exposed accessible drywell interior and exterior surfaces are inspected to ensure there are no apparent physical defects that would prevent the drywell from performing its intended function. This SR ensures that drywell structural integrity is maintained. The Frequency was chosen so that the interior and exterior surfaces of the drywell can be inspected in conjunction with the inspections of the primary containment required by 10 CFR 50, Appendix J (Ref. 2). Due to the passive nature of the drywell structure, the specified Frequency is sufficient to identify (continued)

GRAND GULF B 3.6-105 Revision No. 2

~

Drywell .

B 3.6.5.1

)

BASES ,

l SURVEILLANCE SR 3.6.5.1.2 (continued)

REQUIREMENTS component degradation that may affect drywell structural !

integrity. j SR 3.6.5.1.3 i This SR requires a test to be performed to verify air lock leakage of the drywell air lock at pressures 2: 3 psid. The 24 month Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for violating the drywell boundary.

This Surveillance verifies that the drywell air lock leakage rate supports meeting the drywell bypass leakage limit (SR 3.6.5.1.1). For performance monitoring purposes the test administrative limit on drywell air lock leakage is s'2 .

scfh. Operating experience has shown these components I usu d y pass the Surveillance and requires the SR to be performed once each refueling cycle. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint.

REFERENCES 1. UFSAR, Chapter 6 and Chapter 15.

2. 10 CFR 50, Appendix J.

3. GNRI-96/00162, Issuance of Amendment No. 126 to Facility Operating License No. NPF Grand Gulf Nuclear Station, Unit 1 (TAC No. M94176), dated August 1, 1996.

GRAND GULF B 3.6-105a Revision No. 2

. . . _ = . . _ _ - . . - - _ - _ . - - _ _ - . .....-~ . .- . . . . ~ . - . . . - . . - . - . .

.g -- -.

a J

b s

4 l

l i

I 1

f i

Il i

t PAGE INTENTIONALLY LEFT BLANK f

1 w_

Drywell Air Lock -

B 3.6.5.2 l

B 3.6 CONTAINMENT SYSTEMS B 3.6.5.2 Drywell Air Lock I i

BASES l

BACKGROUND The drywell air lock forms part of the drywell boundary and i provides a means for personnel access during MODES 2 and 3 during low power phase of unit startup. For this purpose, i one double door drywell air lock has been provided, which maintains drywell isolation during personnel entry and exit i from the drywell. Under the normal unit operation, the !

drywell air lock is kept sealed. The air pressure in the l seals is maintained > 60 psig by the seal air flask and-pneumatic system, which is maintained at a pressure

> 90 psig. I The drywell air lock is designed to the same standards as !

the drywell boundary. Thus, the drywell air lock must !

t withstand the pressure and temperature transients associated with the rupture of any primary system line inside the drywell and also the rapid reversal in pressure when the steam in the drywell is condensed by the Emergency Core Cooling System flow following loss of coolant accident .

flooding of the reactor pressure vessel (RPV). It is also l designed to withstand the high temperature associated with !

the break of a small steam line in the drywell that does not result in rapid depressurization of the RPV. l l

The air lock is nominally a right circular cylinder,10 ft in diameter, with doors at each end that are interlocked to prevent simultaneous opening. During periods when the drywell is not required to be OPERABLE, the air lock interlock mechanism may be disabled, allowing both doors of

, the air lock to remain open for extended periods when frequent drywell entry is necessary. Each air lock door has been designed and tested to certify its ability to withstand a pressure in excess of the maximum expected pressure following a Design Basis Accident (DBA).

, The air lock is provided with limit switches on both doors that provide control room indication of door position.

The drywell air lock forms part of the drywell pressure boundary. Not maintaining air lock OPERABILITY may result in degradation of the pressure suppression capability, which is assumed to be functional in the unit safety analyses.

(continued)

, GRAND GULF B 3.6-106 Revision No. 2

. Drywell Air Lock B 3.6.5.2 BASES (continued)

APPLICABLE Analytical methods and assumptions involving the drywell are SAFETY ANALYSES presented in Reference 2. The safety analyses assume that for a high energy line break inside the drywell, the steam and non-condensibles, with the exception of the allowable bypass leakage, is directed to the suppression pool through the horizontal vents where it is condensed and fission product scrubbing occurs. Since the drywell air lock is part of the drywell pressure boundary, its design and maintenance are essential to 5.upport drywell OPERABILITY, which assures that the safety analyses are met.

The drywell air lock satisfies Criterion 3 of the NRC Policy Statement.

'LC0 The drywell air lock forms part of the drywell pressure boundary. The air lock safety function assures that steam resulting from a DBA is directed to the suppression pool.

Thus, .the air lock's structural integrity is essential to the successful mitigation of such an event.

The air lock is required to be OPERABLE. For the air lock to be considered OPERABLE,- the air lock interlock mechanism must be OPERABLE and both air lock doors must be OPERABLE.

The interlock allows only one air lock door of an air lock -l to be opened at one time. This provision ensures that a gross breach of the drywell does not exist when the drywell is required to be OPERABLE.

Airlock leakage is excluded from this Specification. The air lock leakage rate is part of the drywell leakage rate and is controlled as part of OPERABILITY of the drywell in LC0 3.6.5.1, "Drywell" (Ref. 3).

Closure of a single door in the air lock'is necessary to support drywell OPERABILITY fellowing postulated events.

Nevertheless, both doors r.re kepi; closed when the air lock is not being used for entry into and exit from the drywell.

l t

(continued) t l GRAND GULF B 3.6-107 Revision No. 2 l

7 =

Drywell Air Lock -

B 3.6.5.2 BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature' limitations in these MODES. Therefore, the drywell air lock is not required to be OPERABLE in MODES 4 and 5.

ACTIONS. The ACTIONS are modified by a Note that allows entry and I l exit to perform repairs on the affected air lock component. :

If the outer door is inoperable, then it may be easily accessed to repair. If the inner door is inoperable, I

however, then there is a short time during which the drywell

' boundary is not intact (during access through the outer door). The ability to open the OPERABLE door, even if it means the drywell boundary is temporarily not intact, is acceptable due to the low probability of an event that could pressurize the drywell during the short time in which the OPERABLE door is expected to be open. The OPERABLE door must be immediately closed after each entry and exit.

8 A.1. A.2. and A.3 With one drywell air lock door inoperable, the OPERABLE door must be verified closed (Required Action A.1). This ensures :

that a leak tight drywell barrier is maintained by the use l of an OPERABLE air lock door. This action must be completed within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is consistent with the ACTIONS of LC0 3.6.5.1, "Drywell," which requires that the drywell be restored to OPERABLE status within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months .

In addition, the air lock penetration must be isolated by locking closed the OPERABLE air lock door within the 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time. The Completion Time is considered reasonable for locking the OPERABLE air lock door, considering that the OPERABLE door is being maintained closed.

I (continued) l GRAND. GULF B 3.6-108 Revision No. 2

]

r ,

Drywell Air Lock B 3.6.5.2 BASES ACTIONS A.1, A.2, and A.3 (continued)

Required Action A.3 verifies that the air lock has been isolated by the use of a locked and closed OPERABLE air lock door. This ensures that an acceptable drywell boundary is maintained. The Completion Time of once per 31 days is based on engineering judgment and is considered adequate in view of the low likelihood of a locked door being mispositioned and other administrative controls that ensure that the OPERABLE air lock door remains closed.

The Required Actions are modified by two Notes. Note 1 ensures only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable. The exception of the Note does not affect tracking the Completion Times from the initial entry into Condition A; only the requirement to comply with the Required Actions. Note 2 allows use of the air lock for entry and exit for 7 days under administrative controls.

Drywell entry may be required to perform Technical Specifications (TS) Surveillances and Required Actions, as well as other activities on equipment inside the drywell that are required by TS or activities on equipment that support TS-required equipment. This Note is not intended to preclude performing other activities (i.e., non-TS-required activities) if the drywell was entered, using the inoperable air lock, to perform an allowed activity listed above. The administrative controls required consist of tne stationing of a dedicated individual to assure closure of the OPERABLE door except during the entry and exit, and assuring the OPERABLE door is relocked after completion of the drywell entry and exit. This allowance is acceptable due to the low I probability of an event that could pressurize the drywell j during the short time that the OPERABLE door is expected to be open.

B.1, B.2, and B.3 With the drywell air lock interlock mechanism inoperable, the Required Actions and associated Completion Times consistent with Condition A are applicable.

The Required Actions are modified by two Notes. Note 1 ensures only the Required Actions and associated Completion Times of Condition C are required if both doors in the air lock are inoperable Note 2 allows entry and exit into the (continued)

GRAND GULF B 3.6-109 Revision No. O

Drywell Air Lock -

B 3.6.5.2 BASES 1

ACTIONS B.1, B.2, and B.3 '

(continued) drywell under the control of a dedicated individual stationed at the air lock to ensure that only one door is opened at a time.

C.1 and C.2 l

With the air lock inoperable for reasons other than those described in Condition A or B, Required Action C.1 requiresthat o closed. This Required Action must be completed within the I hour Completion Time. This specified time period is consistent with the ACTIONS of LC0 3.6.5.1, which requires l that the drywell be restored to OPERABLE status within l 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . !

Additionally, the air lock must be restored to OPERABLE status within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is l reasonable for restoring an inoperable air lock to OPERABLE {

status, considering that at least one door is maintained :

closed in the air lock. '

D.1 and 0.2 4

If the inoperable drywell air lock cannot be restored to OPERABLE status within the required Completion Time, the plant must be brought to a MODE in which the LC0 does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, (continued)

GRAND GULF B 3.6-110 Revision No. 2

m Drywell Air Lock B 3.6.5.2 BASES ACTIONS 0.1 and 0.2 (continued) based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

1 SURVEILLANCE SR 3.6.5.2.1 REQUIREMENTS The air lock door interlock is designed to prevent simultaneous opening of both doors in the air lock. Since both the inner and outer doors of the air lock are designed to withstand the maximum expected post accident drywell pressure, closure of either door will support drywell l OPERABILITY. Thus, the door interlock feature supports drywell 0PERABILITY while the air lock is being used for personnel transit in and out of the drywell. Periodic testing of this interlock demonstrates that the interlock will function as designed and that simultaneous inner and outer door opening will not inadvertently occur. Due to the nature of this interlock, and given that the interlock mechanism is only challenged when a drywell air lock door is opened, this test is only required to be performed once every 24 months. The 24 month Frequency is based on the need to perform this Surveillance under the reduced l reactivity conditions that apply during a plant outage and the potential for violating the drywell boundary. Operating experience has shown these components usually pass the Surveillance when performed and the Frequency is based on the refueling cycle. Therefore,theFrequencywasconcludedl to be acceptable from a reliability standpoint.

The Surveillance is modified by a Note requiring the Surveillance to be performed only upon entry into the drywell.

(continued)

GRAND GULF B 3.6-111 Revision No. 2

~ -

l l Drywell Air Lock -

B 3.6.5.2 l

. BASES .(continued)

I L REFERENCES 1. 10 CFR 50, Appendix J. 1 l

2. UFSAR, Chapters 6 and 15. ,

3. GNRI-96/00162, Issuance of Amendment No. 126 to I i

Facility Operating License No. NPF Grand Gulf 1 Nuclear Station, Unit 1 (TAC No. M94176), dated August 1, 1996.-

l j.-

l r

i i

L

< x l

[

1.

L 1

1 l-l l

i i

l l i t

i 1-i -- GRAND GULF B 3.6-112 Revision No. 2 i

s

% , % ..- - . r-- -

m Drywell Isolation Valve (s) l B 3.6.5.3 BASES l LC0 they are excluded from this Specification. Controls on (continued) their isolation function are adequately addressed in LC0 3.6.5.6, "Drywell Vacuum Relief System."

Drywell isolatior, valve leakage is also excluded from this Specification. The drywell isolation valve leakage rates are part of the drywell leakage rate and are controlled as part of OPERABILITY of the drywell in LC0 3.6.5.1, "Drywell" (Ref. 2).

The normally closed isolation valves or blind flanges are considered OPERABLE when, as applicable, manual valves are l closed or opened in accordance with applicable 1 administrative controls, automatic valves are de-activated and secured in their closed position, check valves with flow through the valve secured, or blind flanges are in place.

The valves covered by this LC0 are included (with their associated stroke time, if applicable, for automatic valves) in the applicable plant procedures.

APPLICABILITY In MODES 1, 2, and 3, a DBA could cause a release of radioactive material to the primary containment. In MODES 4 and 5, the probability and consequences of these events are reduced due to the pressure and temperature limitations in these MODES. Therefore, the drywell isolation valve (s) are not required to be OPERABLE in MODES 4 and 5.

ACTIONS The ACTIONS are modified by three Notes. The first Note j ,

allows penetration flow paths to be unisolated 1 intermittently under administrative controls. These controls consist of stationing a dedicated operator, who is in continuous communication with the control room, at the controls of the valve. In this way, the penetration can be rapidly isolated when a need for drywell isolation is indicated.

The second Note provides clarification that for the purpose of this LC0 separate Condition entry is allowed for each penetration flow path. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable drywell isolation valve. Complying with the Required Actions may allow for continued operation, and subsequent inoperable drywell I

(continued)

GRAND GULF B 3.6-115 Revision No. 2

Drywell Isolation Valve (s) -

B 3.6.5.3 BASES l

ACTIONS isolation valves are governed by subsequent Condition entry 1 (continued) and application of associated Required Actions.

The third Note requires the OPERABILITY of affected systems to be evaluated when a drywell isolation valve is inoperable. This ensures appropriate remedial actions are taken, if necessary, if the affected system (s) are rendered inoperable by an inoperable drywell isolation valve.

l 1

l I

l l

(continued)

GRAND GULF B 3.6-115a Revision No. 2

44 - -

O O

l PAGE INTENTIONALLY LEFT BLANK l

Drywell Isolation Valve (s) -

B 3.6.5.3 BASES ACTIONS A.1 and A.2 I (continued)

With one or more penetration flow paths with one drywell ;

isolation valve inoperable, the affected penetration flow path must be isolated. -The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. In this_ condition, the remaining OPERABLE drywell isolation valve is adequate to perform the isolation function. Howeve.', the overall reliability is reduced because a single failure in the OPERABLE drywell isolation valve could result in a loss of drywell isolation. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months Completion Time is acceptable, due to the low probability of the inoperable valve resulting in excessive drywell leakage and the low probability of the limiting event for drywell leakage occurring during this short time frame. In addition, the Completion Time is reasonable, considering the time required to isolate the penetration and the relative importance of supporting drywell OPERABILITY during MODES 1, 2, and 3.

1 For affected penetration flow paths that have been isolated I in accordance with Required Action A.1, the affected )

penetrations must be verified to be isolated on a periodic '

basis. This is necessary to ensure that drywell penetrations that are required to be isolated following an accident, and are no longer capable of being automatically l isolated, will be isolated should an event occur. This l Required Action does not require any testing or device I manipulation; rather, it involves verification that those devices outside drywell and capable of potentially being mispositioned are in the correct position. Since these devices are inside primary containment, the time period ,

specified as " prior to entering MODE 2 or 3 from MODE 4, if not performed within the previous 92 days," is based on i engineering judgment and is considered reasonable in '. lew of the inaccessibility of the devices and other administrative controls that will ensure that misalignment is an unlikely possibility. Also, this Completion Time is consistent with (continued)

GRAND GULF B 3.6-116 Revision No. 2

- ~ - - - - - -

p

. Drywell Isolation Valve (s)

B 3.6.5.3 BASES ACTIONS A.1 and A.2 (continued) the Completion Time specified for PCIVs in LC0 3.6.1.3,

" Primary Containment isolation Valves (PCIVs)."

Required Action A.2 is modified by a Note that applies to isolation devices located in high radiation areas and allows them to be verified by use of administrative controls.

Allowing verification by administrative controls is considered acceptable, since access to these areas is typically restricted. Therefore, the probability of misalignment, once they have been verified to be in the proper position, is low.

B.1 With one or more penetration flow paths with two drywell isolation valve (s) inoperable, the affected penetration flow path-must be isolated. The method of isolation must include the use of at least one isolation barrier that cannot be adversely affected by a single active failure. Isolation barriers that meet this criterion are a closed and de-activated automatic valve, a closed manual valve, a blind flange, and a check valve with flow through the valve secured. The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is acceptable, due to the low probability of the inoperable valves resulting in

. excessive drywell leakage and the low probability of the limiting event for drywell leakage occurring during this short time frame. The Completion Time is reasonable, considering the time required to isolate the penetration, and the probability of a DBA, which requires the drywell isolation valve (s) to close, occurring during this short time is very low.

l C.1 and C.2 1 If any Required Action and associated Completion Time cannot be met, the plant must be placed in a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the l required plant conditions from full power conditions in an i orderly manner and without challenging plant systems. )

(continued)

GRAND GULF B 3.6-117 Revision No. 2

Drywell Isolation Valve (s)

B 3.6.5.3 BASES (continued)

SURVEILLANCE SR 3.6.5.3.1 REQUIREMENTS This SR ensures that the 20 inch drywell purge isolation valves are closed as required or, if open, open for an l allowable reason. This SR is intended to be used for drywell purge isolation valves that are fully qualified to close under accident conditions; therefore, these valves are allowed to be open for limited periods of time. This SR has been modified by a Note indicating the SR is not required to be met when the drywell purge supply or exhaust valves are open for pressure control, ALARA or air quality ;

considerations for personnel entry, or Surveillances ar '

special testing of the purge system (e.g., testing of the containment and drywell ventilation radiation monitors) that require the valves to be open provided that, in MODES 1 and 2 the 20 inch and 6 inch containment vent and purge system supply and exhaust lines are isolated. The 31 day Frequency is consistent with other purge valve requirements.

SR 3.6.5.3.2 This SR requires verification that each drywell isolation manual valve and blind flange that is required to be closed during accident conditions is closed. The SR helps to ensure that drywell bypass leakage is maintained to a minimum. Due to the location of these devices, the Frequency specified as " prior to entering MODE 2 or 3 from MODE 4, if not performed in the previous 92 days," is appropriate because of the inaccessibility of the devices and because these devices are operated under administrative controls and the probability of their misaligr. ment is low.

Two Notes are added to this SR. The first Note allows valves and blind flanges located in high radiation areas to be verified by use of administrative controls. Allowing verification by administrative controls is considered acceptable since access to these areas is typically restricted during MODES 1, 2, and 3. Therefore, the probability of misalignment of these devices, once they have been verified to be in their proper position, is low. A second Note is included to clarify that the drywell isolation valves that are open under administrative controls are not required to meet the SR during the time that the devices are open.

(continued)

I GRAND GULF B 3.6-118 Revision No. O I

Drywell Isolation Valve (s)

B 3.6.5.3 BASES SURVEILLANCE SR 3.6.5.3.3

. REQUIREMENTS (continued) Verifying that the isolation time of each power operated and each automatic drywell isolation valve is within limits is required to demoastrate OPERABILITY. The isolation time '

test ensures the valve will isolate in a time period less than or equal to that assumed in the safety analysis. ' The ,

isolation time and Frequency of this SR are in accordance with the Inservice Testing Program. !

i

~

SR 3.6.5.3.4 3 Verifying thu each automatic drywell isolation valve closes j on a drywell isolation signal is required to prevent bypass leakage from the drywell following a DBA. This SR ensures l each automatic drywell isolation valve will actuate to its

is >lation position on a drywell isolation signal. The LOGIC SYSTEM FUNCTIONAL TEE in SR 3.3.6.1.7 overlaps this SR to provide complete ten N of the safety fu iction. The 5

18 month Frequency i; cased on the need to perform this

Surveillance under the conditions that apply during a plant ,

j outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power, since >

j isolation of penetrations would eliminate cooling water flow '

and disrupt the normal operation of many critical components. Operating experience has shown these components ;

usually pass this Surveillance when performed at the 18 month Frequency. Therefore, the Frequency was concluded 7

to be acceptable from a reliability standpoint.

REFERENCES 1. -UFSAR, Section 6.2.4.

2. GNRI-96/00162, Issuance of Amendment No. 126 to Facility Operating License No. NPF Grand Gulf Nuclear Station, Unit 1 (TAC No. M94176), dated August 1, 1996.

l 4

l GRAND GULF B 3.6-119 Rev1.icu No. 2

Drywell Pressure

B 3.6.5.4 I

i B 3.6 CONTAINMENT SYSTEMS B 3.6.5.4 Drywell Pressure BASES BACKGROUND Drywell-to-primary containment differantial pressure is an assumed initial condition in the analyses that determine the l primary containment thermal hydraulic and dynamic loads l during a postulated loss of coolant accident (LOCA).

If drywell pressure is less than the primary containment airspace pressure, the water level in the weir annulus Lill increase and, consequently, the liquid inertia above the top vent will increase. This will cause top vent clearing during a postulated LOCA to be delayed, and that would 1 increase the peak drywell pressure. In addition, an !

inadvertent upper pool dump occurring with a negative ;

drywell-to-primary containment differential pressure could '

result in overflow over the weir wall.

The limitation on negative drywell-to-primary containms .

differential prob re ensures that changes in calculated peak LOCA dryweli pressures due to differences in water ,

level of the suppression pool and the drywell weir annulus l are negligible. It also ensures that the possibility of weir wall overflow after an inadvertent upper pool dump is minimized. The limitation on positive drywell-to-primary containment differential pressure helps ensure that the horizontal vents are not cleared with normal weir annulus water level APPLICABLE Primary containment performance is evaluated for the entire l SAFETY ANALYSES spectrum of break sizes for postulated LOCAs. Among the I inputs is the design basis analysis is the initial drywell internal pressure (Ref.1). The initial drywell internal pressure afft cts the drywell pressure response to a LOCA (Ref.1) and the suppression pool swell load definition (Ref. 2).

Additional analyses (Refs. 3 and 4) have been performed to i show that if initial drywell pressure does not exceed the l negative pressure limit, the suppression pool rwell and vent l clearing loads will not be significantly increased and the l probability of weir wall overflow is minimized after an inadvertent upper pool dump.

_ (continued)

GRAND GULF B 3.6-120 Revision No. O

U

. SSW System and UHS B 3.7.1 BASES i APPLICABLE the performance of the SSW System is the failure of one of SAFETY ANALYSES the two standby DGs, which would in turn affect one SSW (continued) subsystem. The SSW flow assumed in the analyses is 7900 gpm I

. per pump to the heat exchanger (UFSAP,, Table 6.2-2, Ref. 7).

Reference 2 discusses SSW System performance during these conditions.

s The SSW System, together with the UHS, satisfy Criterion 3 of the NRC Policy Statement.

LC0 The OPERABILITY of subsystem A (Division 1) and subsystem B

. (Division 2) of the SSW System is required to ensure the 1

effective operation of the RHR System in removing heat from the reactor, and the effective operation of other safety related equipment during a DBA or transient. Requiring both subsystems to be OPERABLE ensures that either subsystem A

or B will be available to provide adequate capability to meet cooling requirements of the equipment required for safe t

shutdown in the event of a single failure.

A subsystem is considered OPERABLE when:

l a. The associated pump is OPERABLE; and

b. The associated piping, valves, instrumentation, and controls required to perform the safety related function are OPERABLE.

OPERABILITY of the UHS is based on a minimum basin water level at or above elevation 130 ft 3 in mean sea level (equivalent to an indicated level of 2: 7 ft 3 in) and an OPERABLE siphon line between the cooling tower basins.

Also, four cooling tower fans are required to be OPERABLE (2 per UHS cooling tower basin).

The isolation of the SSW System to components or systems may render those components or systems inoperable, but may not affect the OPERABILITY of the SSW System.

OPERABILITY of the High Pressure Core Spray (HPCS) Service Water System (SWS) is addressed by LC0 3.7.2, "HPCS SWS."

(continued)

GRAND GULF " 3.7-3 Revision No. 2

_.._y.__

SSW System and UHS .

B 3.7.1 4

BASES (continued)

APPLICABILITY In MODES 1, 2, and 3, the SSW System and the UHS are required to be OPERABLE to support OPERABILITY of the equipment serviced by the SSW System and UHS and required to be OPERABLE in these MODES.

In MODES 4 and 5,~the OPERABILIT requirements of the SSW System and UHS are determined b. -he systems they support.

ACTIONS A.1 If one cooling tower has one fan inoperable, action must be taken to restore the inoperable cooling' tower fan to OPERABLE status within 7 days.

The 7_ day Completion Time is reasonable, based on the low

, probability of an accident occurring during the 7 days that one cooling tower fan is inoperable, the number of available systems, and the time required to complete the Required Action.

] B.1 and D.1 i If one SSW subsystem is inoperable or if both fans in one

, cooling tower are inoperable (since this is equivalent to i the loss of function of one SSW subsystem), it must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months . With the unit

! in this condition, the remaining OPERABLE SSW subsystem is i

adequate to perform the heat removal. function. However, the overall reliability is reduced because a single failure in the OPERABLE SSW subsystem could result in loss of SSW i

function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time .tas developed taking

'i into account the redundant capabilities afforded by the

~

OPERABLE subsystem and the low probability of a DBA occurring during this period.

The Required Action is modified by two Notes indicating that the applicable Conditions of LC0 3.8.1, "AC Sources-Operating," and LCO 3.4.9, " Residual Heat Removal (RHR)

, Shutdown Cooling System-Hot Shutdown," be entered and the Required Actions taken if the inoperable SSW subsystem results in an inoperable DG or RHR shutdown cooling 4

subsystem, r 9spectively. This is in accordance with LC0 3.0.6 ano ensures the proper actions are taken for these components.

(continued)

GRAND GULF B 3.7-4 Revision No. O

Main Condenser Offgas B 3.7.5 BASES (continued)

APPLICABILITY The LC0 is applicable when steam is being exhausted to the main condenser and the resulting noncondensibles are being processed via the Main Condenser Offgas System. This occurs during MODE 1, and during MODES 2 and 3 with any main steam line not isolated and the SJAE in operation. In MODES 4 and 5, steam is not being exhausted to the main condenser and the requirements are not applicable.

ACTIONS A.1

^

If the offgas radioactivity rate limit is exceeded, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the gross gamma activity rate to within the limit. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on engineering judgment considering the time required to complete the Required Action, the large margins associated with permissible dose and exposure limits, and the low nrobability of a Main Condenser Offgas System rupture occurring.

B.1, B.2, B.3.1, and 8.3.2 !

If the gross gamma activity rate is not restored to within the limits within the associated Completion Time, the SJAE i must be isolated. This isolates the Main Condenser Offgas System from the source of the radioactive steam. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to perform the actions from full power conditions in an orderly manner and without challenging unit systems.

l l

l I

i (continued)

GRAND GULF B 3.7-?3 Revision No. 2 a

U Main Condenser Offgas ,

B 3.7.5 BASES ACTIONS B.1, B.2, B.3.1, and B.3.2 (continued)

An alternative to Required Actions B.1 and B.2 is to place the unit in a MODE 'in which the LC0 does not apply. To achieve'this status, the unit must be placed in at least MODE 3 within'12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the reg'iired unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.5.1 and 3.7.5 2 REQUIREMENTS SR 3.7.5.2, on a 31 day Frequency, requires an isotopic analysis of an offgas sample to ensure that the required limits are satisfied. The noble gases to be sampled include Xe-133, Xe-135, Xe-138, Kr-85,'Kr-87, and Kr-88. If the offgas pretreatment monitor measured release rate of I radioactivity increases significantly (by 2: 50% after correcting for expected increases due to changes in THERMAL POWER), an isotopic analysis is also performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the increase is noted as required by'SR 3.7.5.1, to ensure that the increase is not indicative of a sustained increase in the radioactivity rate. The 31 day i' Frequency is adequate in view of other instrumentation that continuously monitor the offgas, and is acceptable based on operating experience.

SR 3.7.5.2 is modified by a Note indicating that the SR is not required to be performed until 31 days after any SJAE is in operation. Only in this condition can radioactive i fission gases be in the Main Condenser Offgas System at i significant rates.

REFERENCES 1. UFSAR, Section 15.7.1.

2. NUREG-0800.

3. 10 CFR 100.

GRAND GULF B 3.7-24 Revision No. 1 i

1 l

i AC Sources-0perating B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued) i REQUIREMENTS s 0.9. This power factor is chosen to be representative of i

.the actual design basis inductive loading that the DG could '

experience. During the test the generator voltage and frequency is 4160 i 416 volts and 60 i 1.2 Hz within 10 l seconds after the start signal and the steady state generator voltage and frequency is maintained within these limits for the duration of the test.

The 18 month Frequency is consistent with the l recommendations of Regulatory Guide 1.108 (Ref. 9), l paragraph 2.a.(3); takes into consideration plant conditions required to perform the Surveillance; and is intended to be consistent with expected fuel cycle lengths.

This Surveillance is modified by two Notes. Note 1 states that momentary transients due to changing bus loads do not invalidate this test. The DG 11 and 12 load band is provided to avoid routine overloading of the TDI DG.

Routine overloading may. result in more frequent teardown inspections in accordance with vendor recommendations in order to maintain DG OPERABILITY. Similarly, momentary power factor transients above the limit do not invalidate the test. Note 2 stipulates that credit may be taken for l

unplanned. events that satisfy this SR. Examples _ of unplanned events may include:

1) Unexpected operational ~ events which cause the ;

equipment to perform the function specified by this l Surveillance, for which adequate documentation of the required performance is available; and

2) Post maintenance testing that requires performance of this Surveillance in order to restore the component to OPERABLE, provided the maintenance was required, or performed in conjunction with maintenance required to maintain OPERABILITY or reliability.

(continued)

GRAND GULF B 3.8-27 Revision No. 2

m o

AC Sources--Operating -

B 3.8.1 BASES SURVEILLANCE SR 3.8.1.14 (continued)

REQUIREMENTS i

(continued) When this Surveillance is conducted during Mode 1 or 2, the l following special administrative controls are placed in effect (Ref.16):

1) Only one DG may be tested in parallel to the offsite grid at a time, i

i 2) No additional maintenance or testing may be performed or planned to be performed on required safety systems, i subsystems, trains or components and devices that

! depend on the remaining DGs as sources of emergency J power, and

3) Precautions should be taken to avoid conducting the test during periods of severe weather, unstable offsite grid conditions, or maintenance and other test

, conditions that have an adverse effect on the test.

~

SR 3.8.1.15 i

This Surveillance demonstrates that the diesel engine can restart from a hot condition, such as subsequent to shutdown

.from normal Surveillances, and achieve the required voltage

.i -

2 a

l l

J (continued) l GRAND GULF B 3.8-27a Revision No. 2 l

< . - ~ .m

. i i

e AC Sources-0perating i B 3.8.1 BASES l 1

SURVEILLANCE SR 3.8.1.20 (continued).

REQUIREMENTS This SR is modified by a Note. The reason for the Note is to minimize wear on the DG during testing. For the purpose ,

of i.his testing, the DGs must be started from standby !

conditions, that is, with the engine coolant and oil l continuously circulated and temperature maintained consistent with manufacturer recommendations for DG 11 and DG 12. For DG 13, standby conditions mean that the lube oil is heated by the jacket water and continuously circulated through a portion of the system as recommended by the vendor. Engine jacket water is heated by an immersion heater and circulates through the system by natural circulation. ,

Diesel Generator Test Schedule $

The DG test schedule (Table 3.8.1-1) implements the industry I guidelines for assessment of diesel generator performance (Ref. 14). The purpose of this test schedule is to provide timely test data to establish a confidence level associated with the goal to maintain DG reliability at > 0.95 per test. f According to the industry guidelines (Ref. 14), each DG unit should be tested at least once every 31 days. Whenever a DG i has experienced 4 or more valid failures in the last 25 valid tests, the maximum time between tests is reduced to 7 days. Four failures in 25 valid tests is a failure rate ;

of 0.16, or the threshold of acceptable DG performance, and hence may be an early indication of the degradation of DG reliability. When considered in the light of a long history 1 of tests, however, 4 failures in the last 25 valid tests may only be a statistically probable distribution of random events. Increasing the test Frequency allows a more timely accumulation of additional test data upon which to base i judgment of the reliability of the DG. The increased test Frequency must be maintained until seven consecutive failure free tests have been performed.

The Frequency for accelerated testing is 7 days, but no less I ti,an 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months . Tests conducted at intervals of less than l 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months may be credited for compliance with Required '

Actions. However, for the purpose of re-establishing the normal 31-day Frequency, a successful test at an interval of l

(continued)

GRAND GULF B 3.8-33 Revision No. 1

._ _ _ . . . ~ . __ _ , _ _ . _ _ . _ . _ . _ _ _ . . _ _ _ . . _ . _

L

, AC Sources-Operating

i B 3.8.1 '

J BASES SURVEILLANCE- Diesel Generator Test Schedule (continued)

REQUIREMENTS

{

, less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months should be considered an invalid test and

, not count towards the seven consecutive failure free starts,

, and the consecutive test count is not reset.

r i

A test interval in excess of 7 days (or 31 days, as appropriate) constitutes a failure to meet SRs and results

-in the associated DG being declared inoperable. It does not, however, constitute a valid test or failure of the DG, and any consecutive test count is not reset.

i REFERENCES 1. 10 CFR 50, Appendix A,-GDC 17,

2. UFSAR, Chapter 8.

3. Regulatory Guide 1.9.

4. UFSAR, Chapter 6. _

5. UFSAR, Chapter 15,

6. Regulatory Guide 1.93.

7. Generic Letter 84-15, July 2, 1984. l I

8. 10 CFR 50, Appendix-A, GDC 18.

9. Regulatory Guide 1.108.

i

10. Regulatory Guide 1.137.

11. ANSI C84,1, 1982.

12. ASME, Boiler and Pressure Vessel Code,Section XI.

13. IEEE Standard 308,

14. NUMARC 87-00, Revision 1, August 1991,

15. Letter from E.G. Adensam to L.F. Dale, dated July 1984.

15. GNRI-96/00151, Amendment 124 to the Operating License. I GRAND GULF' B 3.8-34 Revision No. 2

~ , . . . - . . . .

U DC Sources-0perating B 3.8.4 BASES APPLICABLE a. An assumed loss of all offsite AC power or of all SAFETY ANALYSES. onsite AC power; and (continued)

b. A worst case single failure.

The DC sources satisfy Criterion 3 of the NRC Policy Statement.

LCO The DC electrical power subsystems are reauired to be '

OPERABLE to ensure the availability of the required power to shut down the reactor and maintain it in a safe condition after an anticipated operational occurrence (A00) or a postulated DBA. The required DC electrical power subsystems I consist of: l

a. Division 1

1. 125 volt battery 1A3 and

2. either 125 volt full capacity charger 1A4 or 1A5,

b. Division 2

1. 125 volt battery 183 and

2. either 125 volt full capacity charger 184 or 185,

c. Division 3

1. 125 volt battery 1C3 and l 2. 125 volt full capacity charger 104, and the corresponding control equipment and interconnecting cabling supplying power to the associated bus within the divisions. Loss of any DC electrical power subsystem does not prevent the minimum safety function from being performed (Ref. 4).

APPLICABILITY The DC electrical power sources are required to be OPERABLE in MODES 1, 2, and 3 to ensure safe unit operation and to ensure that:

a. Acceptable fuel design limits and reactor coolant pressure boundary limits are not exceeded as a result of A00s or abnormal transients; and (continued) 1 GRAND GULF 3.8-53 Revision No. 2

DC Sources--Operating

B 3.8.4 BASES APPLICABILITY b. Adequate core cooling is provided, and containment (continued) integrity and other vital functions are maintained in the event of a postulated DBA.

The DC electrical power requirements for MODES 4 and 5 are :

addressed in the Bases for LC0 3.8.5, "DC Sources--

Shutdown."

ACTIONS A.1 Condition A represents one division with a loss of ability to completely respond to a long term event, and a potential loss of ability to remain energized during normal operation.

Since eventual failure of the battery to maintain the required battery cell parameters is highly probable, it is ;

L l

I i

l (continued) ,

l GRAND GULF 3.8-53a Revision No. 1 I

i

y

Reactor Mode Switch Interlock Testing B 3.10.2 l l

)

BASES LC0 all control rods are fully inserted and a control rod block (continued) is initiated. Therefore, all control rods in core cells that contain one or more fuel assemblies must be verified fully inserted while in MODES 3, 4, and 5 with the reactor mode switch in other than the shutdown position. The 1 additional LCO requirement to preclude CORE ALTERATIONS is l appropriate for MODE 5 operations, as discussed below, and is inherently met in MODES 3 and 4 by the definition of CORE ALTERATIONS, which cannot be performed with the vessel head in place.

In MODE 5, with the reactor mode switch in the refuel position, only one control rod can be withdrawn under the refuel- position one rod out interlock (LC0 3.9.2, " Refuel Position One-Rod-Out Interlock"). The refueling equipment interlocks (LC0 3.9.1, " Refueling Equipment Interlocks")

appropriately control other CORE ALTERATIONS. Due to the increased potential for error'in controlling these multiple ;

interlocks and the limited duration of tests involving the '

reactor mode switch position, conservative controls are required, consistent with MODES 3 and 4. The additional controls of administratively not permitting other CORE ALTERATIONS will adequately ensure that the reactor does not become critical during these tests.

APPLICABILITY Any required periodic interlock testing involving the reactor mode switch, while in MODES 1 and 2, can be performed without the need for Special Operations exceptions. Mode switch manipulations in these MODES would likely result in unit trips. In MODES 3, 4, and 5, this Special Operations LCC is only permitted to be used to allow ,

reactor mode switch interlock testing that cannot conveniently be performed without this allowance. Such !

interlock testing may consist of required Surveillances, or '

may be the result of maintenance, repair, or troubleshooting l activities. In MODES 3, 4, and 5, the interlock functions l provided by the reactor mode switch in shutdown (i.e., all I control rods inserted and incapable of withdrawal) and !

refueling (i.e., refueling interlocks to prevent inadvertent '

criticality during CORE ALTERATIONS) positions can be administratively controlled adequately during the performance of certain tests.

l t

(continued)

GRAND GULF B 3.10-7 Revision No. O I

y e .

Reactor Mode Switch Interlock Testing o B 3.10.2 l

BASES (continued)

I ACTIONS A.1, A.2, A.3.1, and A.3.2 These Required Actions are provided to restore compliance with the Technical Specifications overridden by this Special Operations LC0. Restoring compliance will also result in exiting the Applicability of this Special Operations LCO.

All CORE ALTERATIONS except control rod insertion, if in progress, are immediately suspended in accordance with Required Action A.1, and all insertable control rods in core cells that contain one or more fuel assemblies are fully inserted within I hour, in accordance with Required Action A.2. This will preclude potential mechanisms that ,

could lead to criticality. Suspension of CORE ALTERATIONS shall not preclude the completion of movement of a component ,

to a safe condition. Placing the reactor mode switch in the shutdown position will ensure that all inserted control rods ;

remain inserted and result in operation in accordance with Table 1.1-1. Alternatively, if in N0DE 5, the reactor mode switch may be placed in the refuel position, which will also result in operating in accordance with Table 1.1-1. A Note is added to Required Action A.3.2 to indicate that this Required Action is not applicable in MODES 3 and 4, since only the shutdown position is allowed in these MODES. The allowed Completion Time of 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months for Required Actions A.2, A.3.1, and A.3.2 provides sufficient time to normally insert the control rods and place the reactor mode switch in the required position, based on operating experience, and is ,

acceptable given that all operations that could increase !

core reactivity have been suspended. l l

SURVEILLANCE SR 3.10.2.1 and SR 3.10.2.2 REQUIREMENTS i Meeting the requirements of this Special Operations LC0 ,

maintains operation consistent with or conservative to operating with the reactor mode switch in the shutdown position (or the refuel position for MODE 5). The functions of the reactor mode switch interlocks that are not in effect, due to the testing in progress, are adequately compensated for by the Special Operations LC0 requirements.

The administrative controls are to be periodically verified to ensure that the operational requirements continue to be met. To provide additional assurance that control rods are i not withdrawn, SR 3.10.2.1 is performed by two licensed operators or other technically qualified members of the unit technical staff. The.Surveillances performed at the 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months (continued)

GRAND GULF B 3.10-8 Revision No. 2

ML20140E321

Text

Navigation menu

Search