Text

Report of Technical Specification Bases Changes
	ML22223A051
Person / Time
Site:	Grand Gulf
Issue date:	08/11/2022
From:	Hardy J; Entergy Operations
To:	; Document Control Desk, Office of Nuclear Reactor Regulation
References
	GNRO2022-00023
	Download: ML22223A051 (133)
	v • d • e

entergy Entergy Operations, Inc.

P.O. Box 756 Port Gibson, Mississippi 39150 Jeffery Hardy Manager Regulatory Assurance Grand Gulf Nuclear Station Tel: 802-380-5124 GGNS TS 5.5.11.d GNRO2022-00023 August 11, 2022 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, D.C. 20555-0001

SUBJECT:

Grand Gulf Nuclear Station Report of Technical Specification Bases Changes Grand Gulf Nuclear Station, Unit 1 Docket No. 50-416 License No. NPF-29 Pursuant to Grand Gulf Nuclear Station (GGNS) Technical Specification (TS) 5.5.11 and 10 CFR 50.71 (e) Entergy Operations Inc. hereby submits an update of all changes made to the GGNS TS Bases since the last submittal (GNRO2020-00022, dated July 21, 2020)

[ML20203M087].

There are no commitments contained in this submittal. If you have any questions or need additional information, please contact Jeff Hardy at 802-380-5124.

s?;J4L\

JH/ram

Attachment:

Technical Specification Bases Change Summary

Enclosure:

Technical Specification Bases Pages

GNRO2022-00023 Page 2 of 4 cc: NRC Senior Resident Inspector Grand Gulf Nuclear Station Port Gibson, MS 39150 U.S. Nuclear Regulatory Commission ATTN: Document Control Desk Washington, DC 20555-0001

G N RO2022-00023 Page 3 of 4 Technical Specification Bases Change Summary LBDCR No. Change Summary Effected Pages 2020-036 Correction of a conversion error on B 3.4-16 Technical Specification Bases Page B 3.4-16.

2020-037 Correction of a conversion error on B 3.3-31 & B 3.3-34 Technical Specification Bases Pages 3.3-31 and 3.3-34.

2020-053 CR-GGN-2020-06400, Correction of B 3.0-6 Technical Specification 3.0.4 Bases.

2020-084 Amendment 226: Adoption of TSTF-439, B 3.8-5a, B 3.8-6, B 3.8-8c, Eliminate Second Completion Times Limiting B 3.8-9, B 3.8-75, B 3.8-76, &

Time. B 3.8-77 2020-085 Amendment 225: Adoption of TSTF-566, B 3.4-47, B 3.4-48, B 3.4-49, Revise Actions for Inoperable RHR B 3.4-55, B 3.4-56, B 3.9-27, Shutdown Coolinq System. & B 3.9-31 2020-086 Amendment 227: Adoption of Containment B3.6-11 Leak Rate Testinq Interval Chanqe.

2020-087 Amendment 228: Adoption of TSTF-501 B 3.8-44, B 3.8-46, &

EOG Fuel Oil and Lube Oil Inventory. B 3.8-49 2020-088 Amendment 229: Adoption of TSTF-563 No Bases Changes Review of Instrument Testing Definitions and Incorporation of Surveillance Frequency Control Proqram 2021-019 Update Technical Specification Bases to B 3.1-38, & B 3.1-44 align with EPG/SAG/TSG documents, it was identified that SLC is needed post OBA LOCA for suppression pool pH control.

2021-028 Correct Technical Specification B 3.6.2.3 B 3.6-73 discussion of Hydrogen lgniters. This LBDCR revises Tech Spec Bases to address the Design Basis function of the Hydrogen lqniters.

2021-044 Amendment 231: Adoption of TSTF-554, B 3.4-24, B 3.4-25, B 3.4-26 Revised Reactor Coolant Leakage & B 3.4-27 Requirements 2021-058 Amendment 230: Adoption of TSTF-541 B 3.5-11, B 3.5-19a, B 3.5-Add Exception to Surveillance Requirements 26, B 3.6-40a, B 3.6-101, for Valves and Dampers in the Actuated B 3.7-7, B 3.7-8, B 3.7-11, &

Position B 3.7-19 2022-013 Administrative LBDCR to correct two B 3.4-20 typographical errors identified by condition report CR-GGN-2022-00327 2022-026 Update the T.S. Bases to reflect the B 3.2-5, B 3.2-6, & B 3.2-8a implementation of TRACG AOO and Kp's for power-dependent OLMCPR calculations. EC90704 evaluates the Cycle 24 reload.

GNRO2022-00023 Page 4 of 4 N/A Technical Specification Bases Section 3.4 All Pages (all pages) general reformat of pages to ensure consistence of font (type and size) and formattin and s acin of ara ra hs.

N/A Technical Specification Bases Section 3.7 All Pages (all pages) general reformat of pages to ensure consistence of font (type and size) and formattin and s acin of ara ra hs.

LCO Applicability B 3.0 BASES LCO 3.0.4 LCO 3.0.4.b allows entry into a MODE of other specified condition in the

( continued) Applicability with the LCO not met after performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering the MODE or other specified condition in the Applicability, and establishment of risk management actions, if appropriate.

The risk assessment may be quantitative, qualitative, or blended approaches, and the risk assessment will be conducted using the plant program, procedures, and criteria in place to implement 10 CFR 50.65(a)(4), which requires that risk impacts of maintenance activities to be assessed and managed. The risk assessment, for the purposes of LCO 3.0.4(b), must take into account all inoperable Technical Specification equipment regardless of whether the equipment is included in the normal 10 CFR 50.65(a)(4) risk assessment scope. The risk assessments will be conducted using the procedures and guidance endorsed by Regulatory Guide 1.182, "Assessing and Managing Risk Before Maintenance Activities at Nuclear Power Plants." Regulatory Guide 1.182 endorses the guidance in Section 11 of NU MARC 93-01, "Industry Guideline for Monitoring the Effectiveness of Maintenance at Nuclear Power Plants." These documents address general guidance for conduct of the risk assessment, quantitative and qualitative guidelines for establishing risk management actions, and example risk management actions. Also refer to TSF-1 G-06-02 (May 2006) "IMPLEMENTATION GUIDANCE FOR TSTF-359, REVISION 9, "INCREASE FLEXIBILITY IN MODE RESTRAINTS" for additional clarification. These include actions to plan and conduct other activities in a manner that controls overall risk, increased risk awareness by shift and management personnel, actions to reduce the duration of the condition, actions to minimize the magnitude of risk increases (establishment of backup success paths or compensatory measures), and determination that the proposed MODE change is acceptable. Consideration should also be given to the probability of completing restoration such that the requirements of the LCO would be met prior to the expiration of ACTIONS Completion Times that would require exiting the Applicability.

LCO 3.0.4.b may be used with single, or multiple systems and components unavailable. NU MARC 93-01 provides guidance relative to consideration of simultaneous unavailability of multiple systems and components.

The results of the risk assessment shall be considered in determining the acceptability of entering the MODE or other specified condition in the Applicability, and any corresponding risk management actions. The LCO 3.0.4.b risk assessments do not have to be documented.

The Technical Specifications allow continued operation with equipment unavailable in MODE 1 for the duration of the (continued)

GRAND GULF B 3.0-6 LBDCR 20053

SLC System B 3.1.7 BASES APPLICABLE that is above the pump suction shutoff level in the boron SAFETY ANALYSES solution storage tank. No credit is taken for the portion (continued) of the tank volume that cannot be injected.

The SLC System is also credited in the LOCA radiological analysis. The sodium pentaborate solution has been shown to sufficiently buffer the post-accident suppression pool that iodine re-evaluation can be precluded.

The SLC System satisfies the requirements of the NRC Policy Statement because operating experience and probabilistic risk assessment have generally shown it to be important to public health and safety.

The leakage limit for the SLC system is 2.67 gpm. This includes the 0.13 gpm leakage for the restricting orifice on the class boundary at the SLC test tank. (Ref. 4)

LCO The OPERABILITY of the SLC System provides backup capability for reactivity control, independent of normal reactivity control provisions provided by the control rods. The OPERABILITY of the SLC System is based on the conditions of the borated solution in the storage tank and the availability of a flow path to the RPV, including the OPERABILITY of the pumps and valves. Two SLC subsystems are required to be OPERABLE, each containing an OPERABLE pump, an explosive valve and associated piping, valves, and instruments and controls to ensure an OPERABLE flow path.

APPLICABILITY In MODES 1 and 2, shutdown capability is required. In MODES 3 and 4, control rods are not able to be withdrawn since the reactor mode switch is in shutdown and a control rod block is applied. This provides adequate controls to ensure the reactor remains subcritical. In MODE 5, only a single control rod can be withdrawn from a core cell containing fuel assemblies. Demonstration of adequate SOM (LCO 3.1.1, "SHUTDOWN MARGIN (SOM)") ensures that the reactor will not become critical.

Therefore, the SLC System is not required to be OPERABLE during these conditions, when only a single control rod can be withdrawn.

(continued)

GRAND GULF B 3.1-38 LBDCR 21019

SLC System B 3.1.7 BASES SURVEILLANCE SR 3.1.7.9 REQUIREMENTS Enriched sodium pentaborate solution is made by mixing granular, enriched sodium pentaborate with water. Isotopic tests on the sodium pentaborate solution to determine the actual 8-10 enrichment must be performed once within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after boron is added to the solution in order to ensure that the 8-10 enrichment is adequate. Enrichment testing is only required when boron addition is made since enrichment change cannot occur by any other processes.

REFERENCES 1. 10 CFR 50.62.

2. UFSAR, Section 9.3.5.3.

3. GNRl-91/00153, Issuance of Amendment No. 79 to Facility Operating License No. NPF Grand Gulf Nuclear Station, Unit 1, Regarding Standby Liquid Control System Technical Specifications, dated July 30, 1991.

4. MC-Q1C41-13001, Rev. 2, SLC Leakage Limit GRAND GULF B 3.1-44 LBDCR 21019

MCPR B 3.2.2 B 3.2 POWER DISTRIBUTION LIMITS B 3.2.2 Minimum Critical Power Ratio (MCPR)

BASES BACKGROUND MCPR is a ratio of the fuel assembly power that would result in the onset of boiling transition to the actual fuel assembly power. The operating limit MCPR is established to ensure that no fuel damage results during anticipated operational occurrences (AOOs) and that 99.9% of the fuel rods are not susceptible to boiling transition if the limit is not violated.

Although fuel damage does not necessarily occur if a fuel rod actually experiences boiling transition (Ref. 1), the critical power at which boiling transition is calculated to occur has been adopted as a fuel design criterion.

The onset of transition boiling is a phenomenon that is readily detected during the testing of various fuel bundle designs. Based on these experimental data, correlations have been developed to predict critical bundle power (i.e., the bundle power level at the onset of transition boiling) for a given set of plant parameters (e.g., reactor vessel pressure, flow, and subcooling). Because plant operating conditions and bundle power levels are monitored and determined relatively easily, monitoring the MCPR is a convenient way of ensuring that fuel failures due to inadequate cooling do not occur.

APPLICABLE The analytical methods and assumptions used in evaluating SAFETY ANALYSES the AOOs to establish the operating limit MCPR are presented in the UFSAR, Chapters 4, 6, and 15, and References 2, 3, 4, 5, 7, and 8. To ensure that 99.9% of the fuel rods avoid boiling transition during any transient that occurs with moderate frequency, limiting transients are analyzed either with TRACG or other methodologies. The types of transients evaluated are loss of flow, increase in pressure and power, positive reactivity insertion, and coolant temperature increase. The TRACG methodology calculates an operating limit MCPR (OLMCPR) for the transient initial condition that will result in no more than 0.1 % of the fuel rods susceptible to boiling transition. The other methodologies calculate a reduction in CPR for each transient, with the largest change in CPR (b.CPR) resulting from the limiting transient. When the largest b.CPR is added to the MCPR SL, an OLMCPR is obtained. The OLMCPR, calculated by either the TRACG or other methodology, sets the core operating limits.

MCPRee.e% is determined to ensure more than 99.9% of the fuel rods in the core are not susceptible to boiling transition using a statistical model that combines all the uncertainties in operating parameters and the procedures used to calculate critical power. The probability of the (continued)

GRAND GULF B 3.2-5 LBDCR 22026

MCPR B 3.2.2 BASES APPLICABLE occurrence of boiling transition is determined using the approved Critical SAFETY ANALYSES Power correlations. Details of the MCPR99 9% calculation are given in (continued) Reference 2. Reference 2 also includes a tabulation of the uncertainties and the nominal values of the parameters used in the MCPR99 9%

statistical analysis.

The MCPR operating limits are derived from the MCPR99.9% value and the transient analysis, and are dependent on the operating core flow and power state (MCPR1 and MCPRp, respectively) to ensure adherence to fuel design limits during the worst transient that occurs with moderate frequency (Refs. 3, 4, and 5). Flow dependent MCPR limits are determined by steady state thermal hydraulic methods using the three dimensional BWR simulator code (Ref. 6) and the steady state thermal hydraulic code (Ref. 2). MCPR1 curves are provided based on the maximum credible flow runout transient for Loop Manual operation. The result of a single failure or single operator error during Loop Manual operation is the runout of only one loop because both recirculation loops are under independent control.

Power dependent MCPR limits (MCPRp) are determined by approved transient analysis models. (Ref. 2). The MCPRP limits are established for a set of exposure intervals. The limiting transients are analyzed at the limiting exposure for each interval. Due to the sensitivity of the transient response to initial core flow levels at power levels below those at which the turbine stop valve closure and turbine control valve fast closure scram trips are bypassed, high and low flow MCPRP operating limits are provided for operating between 21.8% RTP and the previously mentioned bypass power level.

The MCPR satisfies Criterion 2 of the NRC Policy Statement.

LCO The MCPR operating limits specified in the COLR MCPR99.9% value, MCPRt values, and MCPRp values are the result of the Design Basis Accident (OBA) and transient analysis. The MCPR operating limits are determined by the larger of the MCPR1 and MCPRP limits, which are based on the MCPRss s% limit specified in the COLR.

APPLICABILITY The MCPR operating limits are primarily derived from transient analyses that are assumed to occur at high power levels. Below 21.8% RTP, the reactor is operating at a slow recirculation pump speed and the moderator void ratio is small. Surveillance of thermal limits below 21.8% RTP is unnecessary due to the large inherent margin that ensures that the MCPR SL is not exceeded even if a limiting transient occurs.

(continued)

GRAND GULF B 3.2-6 LBDCR 22026

MCPR B 3.2.2 BASES (continued)

SURVEILLANCE REFERENCES (continued)

REQUIREMENTS

5. UFSAR, Chapter 15, Appendix 15D.

6. NEDE-30130-P-A, Steady-State Nuclear Methods.

7. NEDE-32906P-A, Rev. 3, TRACG Application for Anticipated Operational Occurrences (AOO) Transient Analyses; Sept 2006.

8. NEDE-32906P Supplement 3-A, Rev. 1, Migration to TRACG04 /

PANAC11 from TRACG02 / PANAC10 for TRACG AOO and ATWS Overpressure Transients; Apr. 2010.

GRAND GULF B 3.2-Ba LBDCR 22026

SRM Instrumentation B 3.3.1.2 B 3.3 INSTRUMENTATION B 3.3.1.2 Source Range Monitor (SRM) Instrumentation BASES BACKGROUND The SRMs provide the operator with information relative to the neutron level at very low flux levels in the core. As such, the SRM indication is used by the operator to monitor the approach to criticality and to determine when criticality is achieved. The SRMs are maintained fully inserted until the count rate is greater than a minimum allowed count rate (a control rod block is set at this condition). After SRM to intermediate range monitor (IRM) overlap is demonstrated (as required by SR 3.3.1.1.1 /SR 3.3.1.1.19), the SRMs are normally fully withdrawn from the core.

The SRM subsystem of the Neutron Monitoring System (NMS) consists of six channels. Each of the SRM channels can be bypassed, but only one in each group of three at any given time, by the operation of a bypass switch. Each channel includes one detector that can be physically positioned in the core. Each detector assembly consists of a miniature fission chamber with associated cabling, signal conditioning equipment, and electronics associated with the various SRM functions. The signal conditioning equipment converts the current pulses from the fission chamber to analog DC currents that correspond to the count rate. Each channel also includes indication, alarm, and control rod blocks. However, this LCO specifies OPERABILITY requirements only for the monitoring and indication functions of the SRMs.

During refueling, shutdown, and low power operations, the primary indication of neutron flux levels is provided by the SRMs or special movable detectors connected to the normal SRM circuits. The SRMs provide monitoring of reactivity changes during fuel or control rod movement and give the control room operator early indication of unexpected subcritical multiplication that could be indicative of an approach to criticality.

APPLICABLE Prevention and mitigation of prompt reactivity excursions SAFETY ANALYSES during refueling and low power operation are provided by LCO 3.9.1, "Refueling Equipment Interlocks"; LCO 3.1.1, "SHUTDOWN MARGIN (SOM)"; LCO 3.3.1.1, "Reactor Protection (continued)

GRAND GULF B 3.3-31 LBDCR 20037

SRM Instrumentation B 3.3.1.2 BASES ACTIONS A.1 and B.1 (continued) take corrective actions to restore the required SRMs to OPERABLE status or to establish alternate IRM monitoring capability. During this time, control rod withdrawal and power increase are not precluded by this Required Action. Having the ability to monitor the core with at least one SRM, proceeding to IRM Range 3 or greater (with overlap required by SR 3.3.1.1.1/SR 3.3.1.1.19) and thereby exiting the Applicability of this LCO, is acceptable for ensuring adequate core monitoring and allowing continued operation.

With four required SRMs inoperable, Required Action B.1 allows no positive changes in reactivity (control rod withdrawal must be immediately suspended) due to the inability to monitor the changes. Required Action A.1 still applies and allows 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months to restore monitoring capability prior to requiring control rod insertion. This allowance is based on the limited risk of an event during this time, provided that no control rod withdrawals are allowed, and the desire to concentrate efforts on repair, rather than to immediately shut down, with no SRMs OPERABLE.

C.1 In MODE 2, if the required number of SRMs is not restored to OPERABLE status within the allowed Completion Time, the reactor shall be placed in MODE 3. With all control rods fully inserted, the core is in its least reactive state with the most margin to criticality. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 in an orderly manner and without challenging plant systems.

D.1 and D.2 With one or more required SRM channels inoperable in MODE 3 or 4, the neutron flux monitoring capability is degraded or nonexistent. The requirement to fully insert all insertable control rods ensures that the reactor will be at its minimum reactivity level while no neutron monitoring capability is available. Placing the reactor mode switch in the shutdown position prevents subsequent control rod withdrawal by maintaining a control rod block. Subsequently, the reactor (continued)

GRAND GULF B 3.3-34 LBDCR 20037

Recirculation Loops Operating B 3.4.1 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.1 Recirculation Loops Operating BASES BACKGROUND The Reactor Coolant Recirculation System is designed to provide a forced coolant flow through the core to remove heat from the fuel. The forced coolant flow removes more heat from the fuel than would be possible with just natural circulation. The forced flow, therefore, allows operation at significantly higher power than would otherwise be possible.

The recirculation system also controls reactivity over a wide span of reactor power by varying the recirculation flow rate to control the void content of the moderator. The Reactor Coolant Recirculation System consists of two recirculation pump loops external to the reactor vessel.

These loops provide the piping path for the driving flow of water to the reactor vessel jet pumps. Each external loop contains a two speed motor driven recirculation pump, a flow control valve, and associated piping, jet pumps, valves, and instrumentation. The recirculation loops are part of the reactor coolant pressure boundary and are located inside the drywell structure. The jet pumps are reactor vessel internals.

The recirculated coolant consists of saturated water from the steam separators and dryers that has been subcooled by incoming feedwater.

This water passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold, from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the driving flow. The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.

(continued)

GRAND GULF B 3.4-1 Revision No. 0

Recirculation Loops Operating B 3.4.1 BASES BACKGROUND The subcooled water enters the bottom of the fuel channels (continued) and contacts the fuel cladding, where heat is transferred to the coolant.

As it rises, the coolant begins to boil, creating steam voids within the fuel channel that continue until the coolant exits the core. Because of reduced moderation, the steam voiding introduces negative reactivity that must be compensated for to maintain or to increase reactor power. The recirculation flow control allows operators to increase recirculation flow and sweep some of the voids from the fuel channel, overcoming the negative reactivity void effect. Thus, the reason for having variable recirculation flow is to compensate for reactivity effects of boiling over a wide range of power generation (i.e., 55 to 100% RTP) without having to move control rods and disturb desirable flux patterns.

Each recirculation loop is manually started from the control room. The recirculation flow control valves provide regulation of individual recirculation loop drive flows. The flow in each loop is manually controlled.

APPLICABLE The operation of the Reactor Coolant Recirculation System is SAFETY an initial condition assumed in the design basis loss of coolant accident ANALYSES (LOCA) (Ref. 1). During a LOCA caused by a recirculation loop pipe break, the intact loop is assumed to provide coolant flow during the first few seconds of the accident. The initial core flow decrease is rapid because the recirculation pump in the broken loop ceases to pump reactor coolant to the vessel almost immediately. The pump in the intact loop coasts down relatively slowly. This pump coastdown governs the core flow response for the next several seconds until the jet pump suction is uncovered (Ref. 1). The analyses assume that both loops are operating at the same flow prior to the accident. However, the LOCA analysis was reviewed for the case with a flow mismatch between the two loops, with the pipe break assumed to be in the loop with the higher flow.

While the flow coastdown and core response are potentially more severe in this assumed case (since the intact loop starts at a lower flow rate and the core response is the same as if both loops were operating at the lower flow rate) a small mismatch has been determined to be acceptable based on engineering judgement. The recirculation system is also assumed to have sufficient flow coastdown characteristics to maintain fuel thermal (continued)

GRAND GULF B 3.4-2 Revision No. O

Recirculation Loops Operating B 3.4.1 BASES APPLICABLE margins during abnormal operational transients (Ref. 2),

SAFETY which are analyzed in Chapter 15 of the UFSAR.

ANALYSES (continued) A plant specific LOCA analysis has been performed assuming only one operating recirculation loop. This analysis has demonstrated that, in the event of a LOCA caused by a pipe break in the operating recirculation loop, the Emergency Core Cooling System response will provide adequate core cooling, provided the APLHGR requirements are modified accordingly (Ref. 3).

The transient analyses of Chapter 15 of the UFSAR have also been performed for single recirculation loop operation (Ref. 3) and demonstrate sufficient flow coastdown characteristics to maintain fuel thermal margins during the abnormal operational transients analyzed provided the MCPR requirements are modified. The APLHGR and MCPR limits for single loop operation are specified in the COLR. The Maximum Extended Load Line Limit Analysis Plus (MELLLA+) operating domain is not analyzed for reactor recirculation single loop operation (SLO). Therefore, SLO is prohibited in the MELLLA+ operating domain (Ref. 4).

Recirculation loops operating satisfies Criterion 2 of the NRC Policy Statement.

LCO Two recirculation loops are normally required to be in operation with their flows matched within the limits specified in SR 3.4.1.1 to ensure that during a LOCA caused by a break of the piping of one recirculation loop the assumptions of the LOCA analysis are satisfied. Alternatively, with only one recirculation loop in operation, modifications to the required APLHGR limits (LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)"), MCPR limits (LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)"), LCO 3.2.3 "Linear Heat Generation Rate" (LHGR), and LCO 3.3.1.1, "RPS Instrumentation",

must be applied to allow continued operation consistent with the assumptions of References 3.

The LCO is modified by a Note which allows up to 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months before having to put in effect the required modifications to required limits after a change in the reactor operating conditions from two recirculation loops operating to single recirculation loop operation. If the required limits are (continued)

GRAND GULF B 3.4-3 LBDCR 16070

Recirculation Loops Operating B 3.4.1 BASES LCO not in compliance with the applicable requirements at the

( continued) end of this period, the associated equipment must be declared inoperable or the limits "not satisfied," and the ACTIONS required by nonconformance with the applicable specifications implemented. This time is provided due to the need to stabilize operation with one recirculation loop, including the procedural steps necessary to limit flow and flow control mode in the operating loop, limit total THERMAL POWER, and the complexity and detail required to fully implement and confirm the required limit modifications.

APPLICABILITY In MODES 1 and 2, requirements for operation of the Reactor Coolant Recirculation System are necessary since there is considerable energy in the reactor core and the limiting design basis transients and accidents are assumed to occur.

In MODES 3, 4, and 5, the consequences of an accident are reduced and the coastdown characteristics of the recirculation loops are not important.

ACTIONS With both recirculation loops operating but the flows not matched, the recirculation loops must be restored to operation with matched flows within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months . Should a LOCA occur with one recirculation loop not in operation, the core flow coastdown and resultant core response may not be bounded by the LOCA analyses. Therefore, only a limited time is allowed to restore the inoperable loop to operating status.

Alternatively, if the single loop requirements of the LCO are applied to operating limits and RPS setpoints, operation with only one recirculation loop would satisfy the requirements of the LCO and the initial conditions of the accident sequence.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is based on the low probability of an accident occurring during this time period, on a reasonable time to complete the Required Action, and on (continued)

GRAND GULF B 3.4-4 LDC 98037

Recirculation Loops Operating B 3.4.1 BASES ACTIONS A.1 (continued)

(continued) frequent core monitoring by operators allowing abrupt changes in core flow conditions to be quickly detected.

This Required Action does not require tripping the recirculation pump in the lowest flow loop when the mismatch between total jet pump flows of the two loops is greater than the required limits. However, in cases where large flow mismatches occur, low flow or reverse flow can occur in the low flow loop jet pumps, causing vibration of the jet pumps. If zero or reverse flow is detected, the condition should be alleviated by changing flow control valve position to re-establish forward flow or by tripping the pump.

(continued)

GRAND GULF B 3.4-5 LDC 98037

Recirculation Loops Operating B 3.4.1 BASES ACTIONS B.1 (continued)

With no recirculation loops in operation, the unit is required to be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . In this condition, the recirculation loops are not required to be operating because of the reduced severity of DBAs and minimal dependence on the recirculation loop coastdown characteristics. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

C.1 If the required limit modifications for single recirculation loop operation are not performed within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after transition from two recirculation loop operation to single recirculation loop operation, the required limits which have not been modified must be immediately declared not met. The Required Actions for the associated limits must then be taken.

{continued)

GRAND GULF B 3.4-6 LDC 98037

Recirculation Loops Operating B 3.4.1 BASES SURVEILLANCE SR 3.4.1.1 REQUIREMENTS This SR ensures the recirculation loop flows are within the allowable limits for mismatch. At low core flow (i.e., < 70% of rated core flow), the MCPR requirements provide larger margins to the fuel cladding integrity Safety Limit such that the potential adverse effect of early boiling transition during a LOCA is reduced. A larger flow mismatch can therefore be allowed when core flow is < 70% of rated core flow. The recirculation loop jet pump flow, as used in this Surveillance, is the summation of the flows from all of the jet pumps associated with a single recirculation loop.

The mismatch is measured in terms of percent of rated core flow. This Surveillance can be met by verifying that the recirculation loop drive flow mismatch, when two loops are in operation, is< 5% of rated recirculation drive flow with core flow ::::: 70% of rated core flow and < 10% of rated recirculation drive flow with core flow< 70% of rated core flow.

This SR is not required when both loops are not in operation since the mismatch limits are meaningless during single loop or natural circulation operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.4-7 LBDCR 18127

Recirculation Loops Operating B 3.4.1 BASES REFERENCES 1. UFSAR, Section 6.3.3.7.

2. UFSAR, Section 5.4.1.1.

3. UFSAR, Chapter 15, Appendix 15C.

4. NEDC-33006P-A, "Maximum Extended Load Line Limit Analysis Plus," Revision 3.

5. Deleted GRAND GULF B 3.4-8 LBDCR 16070

FCVs B 3.4.2 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.2 Flow Control Valves (FCVs)

BASES BACKGROUND The Reactor Coolant Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how this affects the design basis transient and accident analyses.

The jet pumps and the FCVs are part of the Reactor Coolant Recirculation System. The jet pumps are described in the Bases for LCO 3.4.3, "Jet Pumps."

The Recirculation Flow Control System consists of the electronic and hydraulic components necessary for the positioning of the two hydraulically actuated FCVs. The recirculation loop flow rate can be rapidly changed within the expected flow range, in response to rapid changes in system demand. Limits on the system response are required to minimize the impact on core flow response during certain accidents and transients. Solid state control logic will generate an FCV "motion inhibit" signal in response to any one of several hydraulic power unit or analog control circuit failure signals. The "motion inhibit" signal causes hydraulic power unit shutdown and hydraulic isolation such that the FCVs fail "as is." A minor amount of FCV drift may occur depending upon internal hydraulic leakage and friction.

APPLICABLE The FCV stroke rate is limited to~ 11 % per second in SAFETY the opening and closing directions on a control signal failure of maximum ANALYSES demand. This stroke rate is an assumption of the analysis of the recirculation flow control failures on decreasing and increasing flow (Refs. 1 and 2).

Flow control valves satisfy Criterion 2 of the NRC Policy Statement.

LCO An FCV in each operating recirculation loop must be OPERABLE to ensure that the assumptions of the design basis transient and accident analyses are satisfied.

(continued)

GRAND GULF B 3.4-9 LBDCR 11044

FCVs B 3.4.2 BASES APPLICABILITY In MODES 1 and 2, the FCVs are required to be OPERABLE, since during these conditions there is considerable energy in the reactor core, and the limiting design basis transients and accidents are assumed to occur. In MODES 3, 4, and 5, the consequences of a transient or accident are reduced and OPERABILITY of the flow control valves is not important.

ACTIONS A Note has been provided to modify the ACTIONS related to FCVs.

Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable FCVs provide appropriate compensatory measures for separate inoperable FCVs. As such, a Note has been provided that allows separate Condition entry for each inoperable FCV.

With one or two required FCVs inoperable, the assumptions of the design basis transient and accident analyses may not be met and the inoperable FCV must be returned to OPERABLE status or hydraulically locked within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months .

Opening an FCV faster than the limit could result in a more severe flow runout transient, resulting in violation of the Safety Limit MCPR. Closing an FCV faster than the limit assumed in the LOCA analysis could affect the recirculation flow coastdown, resulting in higher peak clad temperatures. Therefore, if an FCV is inoperable due to stroke times faster than the limits, deactivating the valve will essentially lock the valve in position, which will prohibit the FCV from adversely affecting the OBA and transient analyses. Continued operation is allowed in this Condition.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is a reasonable time period to complete the Required Action, while limiting the time of operation with an inoperable FCV.

(continued)

GRAND GULF B 3.4-10 Revision No. O

FCVs B 3.4.2 BASES ACTIONS B.1 (continued)

If the FCVs are not deactivated (locked up) and cannot be restored to OPERABLE status within the associated Completion Time, the unit must be brought to a MODE in which the LCO does not apply. To achieve this status, the unit must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . This brings the unit to a condition where the flow coastdown characteristics of the recirculation loop are not important. The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.4.2.1 REQUIREMENTS Hydraulic power unit pilot operated isolation valves located between the servo valves and the common "open" and "close" lines are required to close in the event of a loss of hydraulic pressure. When closed, these valves inhibit FCV motion by blocking hydraulic pressure from the servo valve to the common open and close lines as well as to the alternate subloop. This Surveillance verifies FCV lockup on a loss of hydraulic pressure.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.2.2 This SR ensures the overall average rate of FCV movement at all positions is maintained within the analyzed limits.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.4-11 LBDCR 18127

FCVs B 3.4.2 BASES REFERENCES 1. UFSAR, Section 15.3.2.

2. UFSAR, Section 15.4.5.

GRAND GULF B 3.4-12 LBDCR 18127

Jet Pumps B 3.4.3 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.3 Jet Pumps BASES BACKGROUND The Reactor Coolant Recirculation System is described in the Background section of the Bases for LCO 3.4.1, "Recirculation Loops Operating," which discusses the operating characteristics of the system and how these characteristics affect the Design Basis Accident (OBA) analyses.

The jet pumps are part of the Reactor Coolant Recirculation System and are designed to provide forced circulation through the core to remove heat from the fuel. The jet pumps are located in the annular region between the core shroud and the vessel inner wall. Because the jet pump suction elevation is at two thirds core height, the vessel can be reflooded and coolant level maintained at two thirds core height even with the complete break of the recirculation loop pipe that is located below the jet pump suction elevation.

Each reactor coolant recirculation loop contains 12 jet pumps.

Recirculated coolant passes down the annulus between the reactor vessel wall and the core shroud. A portion of the coolant flows from the vessel, through the two external recirculation loops, and becomes the driving flow for the jet pumps. Each of the two external recirculation loops discharges high pressure flow into an external manifold from which individual recirculation inlet lines are routed to the jet pump risers within the reactor vessel. The remaining portion of the coolant mixture in the annulus becomes the suction flow for the jet pumps. This flow enters the jet pump at suction inlets and is accelerated by the drive flow. The drive flow and suction flow are mixed in the jet pump throat section. The total flow then passes through the jet pump diffuser section into the area below the core (lower plenum), gaining sufficient head in the process to drive the required flow upward through the core.

APPLICABLE Jet pump OPERABILITY is an explicit assumption in the design SAFETY basis loss of coolant accident (LOCA) analysis evaluated in Reference 1.

ANALYSES (continued)

GRAND GULF B 3.4-13 Revision No. O

Jet Pumps B 3.4.3 BASES APPLICABLE The capability of reflooding the core to two-thirds core SAFETY height is dependent upon the structural integrity of the jet ANALYSES pumps. If the structural system, including the beam holding a jet pump in (continued) place, fails, jet pump displacement and performance degradation could occur, resulting in an increased flow area through the jet pump and a lower core flooding elevation. This could adversely affect the water level in the core during the reflood phase of a LOCA as well as the assumed blowdown flow during a LOCA.

Jet pumps satisfy Criterion 2 of the NRC Policy Statement.

LCO The structural failure of any of the jet pumps could cause significant degradation in the ability of the jet pumps to allow reflooding to two thirds core height during a LOCA. OPERABILITY of all jet pumps is required to ensure that operation of the Reactor Coolant Recirculation System will be consistent with the assumptions used in the licensing basis analysis (Ref. 1).

APPLICABILITY In MODES 1 and 2, the jet pumps are required to be OPERABLE since there is a large amount of energy in the reactor core and since the limiting DBAs are assumed to occur in these MODES. This is consistent with the requirements for operation of the Reactor Coolant Recirculation System (LCO 3.4.1 ).

In MODES 3, 4, and 5, the Reactor Coolant Recirculation System is not required to be in operation, and when not in operation sufficient flow is not available to evaluate jet pump OPERABILITY.

ACTIONS A.1 An inoperable jet pump can increase the blowdown area and reduce the capability of reflooding during a design basis LOCA. If one or more of the jet pumps are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

(continued)

GRAND GULF *B 3.4-14 Revision No. O

Jet Pumps B 3.4.3 BASES SURVEILLANCE SR 3.4.3.1 REQUIREMENTS This SR is designed to detect significant degradation in jet pump performance that precedes jet pump failure (Ref. 2). This SR is required to be performed only when the loop has forced recirculation flow since surveillance checks and measurements can only be performed during jet pump operation. The jet pump failure of concern is a complete mixer displacement due to jet pump beam failure. Jet pump plugging is also of concern since it adds flow resistance to the recirculation loop. Significant degradation is indicated if the specified criteria confirm unacceptable deviations from established patterns or relationships. The allowable deviations from the established patterns have been developed based on the variations experienced at plants during normal operation and with jet pump assembly failures (Refs. 2 and 3). Since refueling activities (fuel assembly replacement or shuffle, as well as any modifications to fuel support orifice size or core plate bypass flow) can affect the relationship between core flow, jet pump flow, and recirculation loop flow, these relationships may need to be re-established each cycle. Similarly, initial entry into extended single recirculation loop operation may also require establishment of these relationships. During the initial weeks of operation under such conditions, while baselining new "established patterns,"

engineering judgment of the surveillance results is used to detect significant abnormalities which could indicate a jet pump failure.

The recirculation flow control valve (FCV) operating characteristics (loop flow versus FCV position) are determined by the flow resistance from the loop suction through the jet pump nozzles. A change in the relationship indicates a flow restriction, loss in pump hydraulic performance, leak, or new flow path between the recirculation pump discharge and jet pump nozzle. For this criterion, the loop flow versus FCV position relationship must be verified.

Total core flow can be determined from measurements of the recirculation loop drive flows. Once this relationship has been established, increased or reduced total core flow for the same recirculation loop drive flow may be an indication of failures in one or several jet pumps.

(continued)

GRAND GULF B 3.4-15 LBDCR 18127

Jet Pumps B 3.4.3 BASES SURVEILLANCE SR 3.4.3.1 (continued)

REQUIREMENTS (continued)

Individual jet pumps in a recirculation loop typically do not have the same flow. The unequal flow is due to the drive flow manifold, which does not distribute flow equally to all risers. The flow (or jet pump diffuser to lower plenum differential pressure) pattern or relationship of one jet pump to the loop average is repeatable. An appreciable change in this relationship is an indication that increased (or reduced) resistance has occurred in one of the jet pumps. This may be indicated by an increase in the relative flow for a jet pump that has experienced beam cracks.

The deviations from normal are considered indicative of a potential problem in the recirculation drive flow or jet pump system (Ref. 2).

Normal flow ranges and established jet pump flow and differential pressure patterns are established by plotting historical data as discussed in Reference 2.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by two Notes. Note 1 allows this Surveillance not to be performed until 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the associated recirculation loop is in operation, since these checks can only be performed during jet pump operation. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is an acceptable time to establish conditions appropriate for data collection and evaluation.

Note 2 allows this SR not to be performed when THERMAL POWER is s 21.8% RTP. During low flow conditions, jet pump noise_approaches the threshold response of the associated flow instrumentation and precludes the collection of repeatable and meaningful data.

REFERENCES 1. UFSAR, Section 6.3.

2. GE Service Information Letter No. 330, "Jet Pump Beam Cracks,"

June 9, 1990.

3. NUREG/CR-3052, "Closeout of IE Bulletin 80-07: BWR Jet Pump Assembly Failure," November 1984.

GRAND GULF B 3.4-16 LBDCR 20036

S/RVs B 3.4.4 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.4 Safety/Relief Valves (S/RVs)

BASES BACKGROUND The American Society of Mechanical Engineers (ASME) Boiler and Pressure Vessel Code (Ref. 1) requires the Reactor Pressure Vessel be protected from overpressure during upset conditions by self actuated safety valves. As part of the nuclear pressure relief system, the size and number of safety/relief valves (S/RVs) are selected such that peak pressure in the nuclear system will not exceed the ASME Code limits for the reactor coolant pressure boundary (RCPB).

The S/RVs are located on the main steam lines between the reactor vessel and the first isolation valve within the drywell. Each S/RV discharges steam through a discharge line to a point below the minimum water level in the suppression pool.

The S/RVs can actuate by either of two modes: the safety mode or the relief mode. In the safety mode (or spring mode of operation), the direct action of the steam pressure in the main steam lines will act against a spring loaded disk that will pop open when the valve inlet pressure exceeds the spring force. In the relief mode (or power actuated mode of operation), a pneumatic piston or cylinder and mechanical linkage assembly are used to open the valve by overcoming the spring force, even with the valve inlet pressure equal to O psig. The pneumatic operator is arranged so that its malfunction will not prevent the valve disk from lifting if steam inlet pressure reaches the spring lift set pressures. In the relief mode, valves may be opened manually or automatically at the selected preset pressure. Six of the S/RVs providing the relief function also provide the low-low set relief function specified in LCO 3.6.1.6, "Low-Low Set (LLS) Valves." Eight of the S/RVs that provide the relief function are part of the Automatic Depressurization System specified in LCO 3.5.1, "ECCS- Operating." The instrumentation associated with the relief valve function and low-low set relief function is discussed in the Bases for LCO 3.3.6.5, "Relief and Low-Low Set (LLS) Instrumentation,"

and instrumentation for the ADS function is discussed in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation."

(continued)

GRAND GULF B 3.4-17 Revision No. O

S/RVs B 3.4.4 BASES APPLICABLE The overpressure protection system must accommodate the SAFETY most severe pressure transient. Evaluations have determined that the ANALYSES most severe transient is the closure of all main steam isolation valves (MS IVs) followed by reactor scram on high neutron flux (i.e., failure of the direct scram associated with MSIV position) (Ref. 2). For the purpose of the analyses, six of the S/RVs are assumed to operate in the relief mode, and nine in the safety mode. The analysis_results demonstrate that the design S/RV capacity is capable of maintaining reactor pressure below the ASME Code limit of 110% of vessel design pressure (110% x 1250 psig = 1375 psig). This LCO helps to ensure that the acceptance limit of 1375 psig is met during the design basis event.

Reference 3 discusses additional events that are expected to actuate the S/RVs. From an overpressure standpoint, the design basis events are bounded by the MSIV closure with flux scram event described above.

S/RVs satisfy Criterion 3 of the NRG Policy Statement.

LCO The safety function of nine S/RVs is required to be OPERABLE in the safety mode, and an additional six S/RVs (other than the nine S/RVs that satisfy the safety function) must be_OPERABLE in the relief mode. The requirements of this LCO are applicable only to the capability of the S/RVs to mechanically open to relieve excess pressure. In Reference 2, an evaluation was performed to establish the parametric relationship between the peak vessel pressure and the number of OPERABLE S/RVs.

The results show that with a minimum of nine S/RVs in the safety mode and six S/RVs inJhe relief mode OPERABLE, the ASME Code limit of 1375 psig is not exceeded.

The S/RV setpoints are established to ensure the ASME Code limit on peak reactor pressure is satisfied. The ASME Code specifications require the lowest safety valve be set at or below vessel design pressure (1250 psig) and the highest safety valve be set so the total accumulated pressure does not exceed 110% of the design pressure for conditions.

The transient evaluations in Reference 3 are based on these setpoints, but also include the additional uncertainties of .:t 3% of the nominal setpoint to account for potential setpoint drift to provide an added degree of conservatism.

(continued)

GRAND GULF B 3.4-18 LBDCR 12035

S/RVs B 3.4.4 BASES LCO Operation with fewer valves OPERABLE than specified, or with (continued) setpoints outside the ASME limits, could result in a more severe reactor response to a transient than predicted, possibly resulting in the ASME Code limit on reactor pressure being exceeded.

APPLICABILITY In MODES 1, 2, and 3, the specified number of S/RVs must be OPERABLE since there may be considerable energy in the reactor core and the limiting design basis transients are assumed to occur. The S/RVs may be required to provide pressure relief to discharge energy from the core until such time that the Residual Heat Removal (RHR)

System is capable of dissipating the heat.

In MODE 4, decay heat is low enough for the RHR System to provide adequate cooling, and reactor pressure is low enough that the overpressure limit is unlikely to be approached by assumed operational transients or accidents. In MODE 5, the reactor vessel head is unbolted or removed and the reactor is at atmospheric pressure. The S/RV function is not needed during these conditions.

ACTIONS A.1 and A.2 With less than the minimum number of required S/RVs OPERABLE, a transient may result in the violation of the ASME Code limit on reactor pressure. If one or more required S/RVs are inoperable, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.4.1 REQUIREMENTS This Surveillance demonstrates that the required S/RVs will open at the pressures assumed in the safety analysis of Reference 2. The demonstration of the S/RV safety function (continued)

GRAND GULF B 3.4-19 Revision No. 2

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.1 (continued)

REQUIREMENTS

( continued) lift settings must be performed during shutdown, since this is a bench test, and in accordance with the lnservice Testing Program. The lift setting pressure shall correspond to ambient conditions of the valves at nominal operating temperatures and pressures. The safety lift setpoints will still be set within a tolerance of+/- 1 percent, but the setpoints will be tested to within +/- 3 percent to determine acceptance or failure of the as-found valve lift setpoint. If a valve is tested and the lift setpoint is found outside the 3 percent tolerance, two additional valves are to be tested (Reference 4).

The Frequency was selected because this Surveillance must be performed during shutdown conditions and is based on the time between refuelings.

SR 3.4.4.2 The required relief function S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to verify the mechanical portions of the automatic relief function operate as designed when initiated either by an actual or simulated initiation signal. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.5.4 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes valve actuation. This prevents an RPV pressure blowdown.

SR 3.4.4.3 A manual actuation of each required S/RV (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to (continued)

GRAND GULF B 3.4-20 LBDCR 18127

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS (continued) verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by method 1), plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per the INSERVICE TESTING PROGRAM requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and provides a reasonable time to complete the SR.

If performed by method 2), valve OPERABILITY has been demonstrated for all installed S/RVs based upon the successful operation of a test sample of S/RVs.

1. Manual actuation of the S/RV, with verification of the response of the turbine control valves or bypass valves, by a change in the measured steam flow, or any other method suitable to verify steam flow (e.g., tailpipe temperature or pressure). Adequate reactor steam pressure must be available to perform this test to avoid damaging the valve. Also, adequate steam flow must be passing through the main turbine or turbine bypass valves to continue to control reactor pressure when the S/RVs divert steam flow upon opening. Sufficient time is therefore allowed after the required pressure and flow are achieved to perform this test. Adequate pressure at which this test is to be performed is consistent with the pressure recommended by the valve manufacturer.

2. The sample population of S/RVs tested each refueling outage to satisfy SR 3.4.4.1 will be stroked in the relief mode during "as-found" testing to verify proper operation of the S/RV. Just prior to installation of the to be newly-installed S/RVs to satisfy 3.4.4.1 the valve will be stroked in the relief mode during certification testing to verify proper operation of the S/RV. The successful performance of the test sample of S/RVs will perform in a similar fashion. After the S/RVs are replaced, the electrical and pneumatic connections shall be verified either through (continued)

GRAND GULF B 3.4-21 LBDCR 18085

S/RVs B 3.4.4 BASES SURVEILLANCE SR 3.4.4.3 (continued)

REQUIREMENTS (continued) mechanical/electrical inspection or test prior to the resumption of electric power generation to ensure that no damage has occurred to the S/RV during transportation and installation.

This verifies that each replaced S/RV will properly perform its intended function.

If the valve fails to actuate due only to the failure of the solenoid but is capable of opening on overpressure, the safety function of the S/RV is considered OPERABLE.

The STAGGERED TEST BASIS Frequency ensures that each solenoid for each S/RV relief-mode actuator is alternately tested. The Frequency of the required relief-mode actuator testing was developed based on the S/RV tests required by INSERVICE TESTING PROGRAM. The testing Frequency required by the lnservice Testing Program is based on operating experience and valve performance. Therefore, the Frequency was concluded to be acceptable from a reliability standpoint. (Reference 5)

REFERENCES 1. Deleted

2. UFSAR, Section 5.2.2.2.3.

3. UFSAR, Section 15.

4. GNRl-96/00134, Amendment 123 to the Operating License.

5. GNRl-96/00229, Amendment 130 to the Operating License.

6. Deleted GRAND GULF B 3.4-22 LBDCR 18085

RCS Operational LEAKAGE B 3.4.5 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.5 RCS Operational LEAKAGE BASES BACKGROUND The RCS includes systems and components that contain or transport the coolant to or from the reactor core. The pressure containing components of the RCS and the portions of connecting systems out to and including the isolation valves define the reactor coolant pressure boundary (RCPB).

The joints of the RCPB components are welded or bolted.

During plant life, the joint and valve interfaces can produce varying amounts of reactor coolant LEAKAGE, through either normal operational wear or mechanical deterioration. Limits on RCS operational LEAKAGE are required to ensure appropriate action is taken before the integrity of the RCPB is impaired. This LCO specifies the types and limits of LEAKAGE.

This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3).

The safety significance of leaks from the RCPB varies widely depending on the source, rate, and duration. Therefore, detection of LEAKAGE in the drywell is necessary. Methods for quickly separating the identified LEAKAGE from the unidentified LEAKAGE are necessary to provide the operators quantitative information to permit them to take corrective action should a leak occur detrimental to the safety of the facility or the public.

A limited amount of leakage inside the drywell is expected from auxiliary systems that cannot be made 100% leaktight. Leakage from these systems should be detected and isolated from the drywell atmosphere, if possible, so as not to mask RCS operational LEAKAGE detection.

This LCO deals with protection of the RCPB from degradation and the core from inadequate cooling, in addition to preventing the accident analyses radiation release assumptions from being exceeded. The consequences of violating this LCO include the possibility of a loss of coolant accident.

(continued)

GRAND GULF B 3.4-23 Revision No. O

RCS Operational LEAKAGE B 3.4.5 BASES APPLICABLE The allowable RCS operational LEAKAGE limits are based on SAFETY the predicted and experimentally observed behavior of pipe cracks. The ANALYSES normally expected background LEAKAGE due to equipment design and the detection capability of the instrumentation for determining system LEAKAGE were also considered. The evidence from experiments suggests, for LEAKAGE even greater than the specified unidentified LEAKAGE limits, the probability is small that the imperfection or crack associated with such LEAKAGE would grow rapidly.

The unidentified LEAKAGE flow limit allows time for corrective action before the RCPB could be significantly compromised. The 5 gpm limit is a small fraction of the calculated flow from a critical crack in the primary system piping. Crack behavior from experimental programs (Refs. 4 and 5) shows leak rates of hundreds of gallons per minute will precede crack instability (Ref. 6).

The low limit on increase in unidentified LEAKAGE assumes a failure mechanism of intergranular stress corrosion cracking (IGSCC) that produces tight cracks. This flow increase limit is capable of providing an early warning of such deterioration.

No applicable safety analysis assumes the total LEAKAGE limit. The total LEAKAGE limit considers RCS inventory makeup capability and drywell floor sump capacity.

RCS operational LEAKAGE satisfies Criterion 2 of the NRC Policy Statement.

LCO RCS operational LEAKAGE shall be limited to:

a. Pressure Boundary LEAKAGE Pressure boundary LEAKAGE is prohibited as the leak itself could cause further RCPB deterioration, resulting in higher LEAKAGE.

(continued)

GRAND GULF B 3.4-24 LBDCR 21044

RCS Operational LEAKAGE B 3.4.5 BASES LCO b. Unidentified LEAKAGE

( continued)

Five gpm of unidentified LEAKAGE is allowed as a reasonable minimum detectable amount that the drywell atmospheric monitoring, drywell sump level monitoring, and drywell air cooler condensate flow rate monitoring equipment can detect within a reasonable time period. Separating the sources of leakage (i.e.,

leakage from an identified source versus leakage from an unidentified source) is necessary for prompt identification of potentially adverse conditions, assessment of the safety significance, and corrective action.

c. Total LEAKAGE The total LEAKAGE limit is based on a reasonable minimum detectable amount. The limit also accounts for LEAKAGE from known sources (identified LEAKAGE). Violation of this LCO indicates an unexpected amount of LEAKAGE and, therefore, could indicate new or additional degradation in an RCPB component or system.

d. Unidentified LEAKAGE Increase An unidentified LEAKAGE increase of> 2 gpm within the previous 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period indicates a potential flaw in the RCPB and must be quickly evaluated to determine the source and extent of the LEAKAGE. The increase is measured relative to the steady state value; temporary changes in LEAKAGE rate as a result of transient conditions (e.g., startup) are not considered. As such, the 2 gpm increase limit is only applicable in MODE 1 when operating pressures and temperatures are established.

APPLICABILITY In MODES 1, 2, and 3, the RCS operational LEAKAGE LCO applies because the potential for RCPB LEAKAGE is greatest when the reactor is pressurized.

In MODES 4 and 5, RCS operational LEAKAGE limits are not required since the reactor is not pressurized and stresses in the RCPB materials and potential for LEAKAGE are reduced.

(continued)

GRAND GULF B 3.4-25 LBDCR 21044

RCS Operational LEAKAGE B 3.4.5 BASES ACTIONS A.1 If pressure boundary LEAKAGE exists, the affected component, pipe, or vessel must be isolated from the RCS by a closed manual valve, closed and de-activated automatic valve, blind flange, or check valve within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . While in this condition, structural integrity of the system should be considered because the structural integrity of the part of the system within the isolation boundary must be maintained under all licensing basis conditions, including consideration of the potential for further degradation of the isolated location. Normal LEAKAGE past the isolation device is acceptable as it will limit RCS LEAKAGE and is included in identified or unidentified LEAKAGE. This action is necessary to prevent further deterioration of the RCPB.

B.1 With RCS unidentified or total LEAKAGE greater than the limits, actions must be taken to reduce the leakage. Because the LEAKAGE limits are conservatively below the LEAKAGE that would constitute a critical crack size, 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is allowed to reduce the LEAKAGE rates before the reactor must be shut down. If an unidentified LEAKAGE has been identified and quantified, it may be reclassified and considered as identified LEAKAGE.

However, the total LEAKAGE limit would remain unchanged.

C.1 An unidentified LEAKAGE increase of> 2 gpm within a 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months period is an indication of a potential flaw in the RCPB and must be quickly evaluated. Although the increase does not necessarily violate the absolute unidentified LEAKAGE limit, certain susceptible components must be determined not to be the source of the LEAKAGE increase within the required Completion Time. For an unidentified LEAKAGE increase greater than required limits, an alternative to reducing LEAKAGE increase to within limits (i.e., reducing the leakage rate such that the current rate is less than the 2 gpm increase in the previous 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months ; either by isolating the source or other possible methods) is to evaluate RCS type 304 and type 316 austenitic stainless steel piping that is subject to high stress or that contains relatively stagnant or intermittent flow fluids and determine it is not the source of the increased LEAKAGE. This type of piping is very susceptible to IGSCC.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is needed to properly reduce the LEAKAGE increase or verify the source before the reactor must be shut down.

(continued)

GRAND GULF B 3.4-26 LBDCR 21044

RCS Operational LEAKAGE B 3.4.5 BASES ACTIONS 0.1 and 0.2 (continued)

If any Required Action and associated Completion Time is not met, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.5.1 REQUIREMENTS The RCS LEAKAGE is monitored by a variety of instruments designed to quantify the various types of LEAKAGE. Leakage detection instrumentation is discussed in more detail in the Bases for LCO 3.4.7, "RCS Leakage Detection Instrumentation." Sump level is typically monitored to determine actual LEAKAGE rates. However, any method may be used to quantify LEAKAGE within the guidelines of Reference 7.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).

3. 10 CFR 50, Appendix A, GDC 55.

4. GEAP-5620, "Failure Behavior in ASTM A 1068 Pipes Containing Axial Through-Wall Flaws," April 1968.

5. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants,"

October 1975.

6. UFSAR, Section 5.2.5.5.3.

7. Regulatory Guide 1.45, May 1973 with exceptions per UFSAR Appendix 3A.

GRAND GULF B 3.4-27 LBDCR 21044

RCS PIV Leakage B 3.4.6 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.6 RCS Pressure Isolation Valve (PIV) Leakage BASES BACKGROUND RCS PIVs are defined as any two normally closed valves in series within the reactor coolant pressure boundary (RCPB). The function of RCS PIVs is to separate the high pressure RCS from an attached low pressure system. This protects the RCS pressure boundary described in 10 CFR 50.2, 10 CFR 50.55a(c), and GDC 55 of 10 CFR 50, Appendix A (Refs. 1, 2, and 3). PIVs were originally designed to meet the requirements of Reference 4. During their lives, these valves can produce varying amounts of reactor coolant leakage through either normal operational wear or mechanical deterioration.

The RCS PIV LCO allows RCS high pressure operation when leakage through these valves exists in amounts that do not compromise safety.

The PIV leakage limit applies to each individual valve. Leakage through these valves is not included in any allowable LEAKAGE specified in LCO 3.4.5, "RCS Operational LEAKAGE."

Although this specification provides a limit on allowable PIV leakage rate, its main purpose is to prevent overpressure failure of the low pressure portions of connecting systems. The leakage limit is an indication that the PIVs between the RCS and the connecting systems are degraded or degrading. PIV leakage could lead to overpressure of the low pressure piping or components. Failure consequences could be a loss of coolant accident (LOCA) outside of containment, an unanalyzed accident which could degrade the ability for low pressure injection.

A study (Ref. 5) evaluated various PIV configurations to determine the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce intersystem LOCA probability.

PIVs are provided to isolate the RCS from the following connected systems:

a. Residual Heat Removal (RHR) System;

b. Low Pressure Core Spray System; (continued)

GRAND GULF B 3.4-28 LDC 99008

RCS PIV Leakage B 3.4.6 BASES BACKGROUND C. High Pressure Core Spray System; and (continued)

d. Reactor Core Isolation Cooling System.

The PIVs are listed in applicable plant procedures.

APPLICABLE Reference 5 evaluated various PIV configurations, leakage SAFETY ANALYSES testing of the valves, and operational changes to determine the effect on the probability of intersystem LOCAs. This study concluded that periodic leakage testing of the PIVs can substantially reduce the probability of an intersystem LOCA.

PIV leakage is not considered in any Design Basis Accident analyses.

This Specification provides for monitoring the condition of the RCPB to detect PIV degradation that has the potential to cause a LOCA outside of containment. RCS PIV leakage satisfies Criterion 2 of the NRC Policy Statement.

LCO RCS PIV leakage is leakage into closed systems connected to the RCS.

Isolation valve leakage is usually on the order of drops per minute.

Leakage that increases significantly suggests that something is operationally wrong and corrective action must be taken. Violation of this LCO could result in continued degradation of a PIV, which could lead to overpressurization of a low pressure system and the loss of the integrity of a fission product barrier.

The LCO PIV leakage limit is 1 gpm.

Reference 6 permits leakage testing at a lower pressure differential than between the specified maximum RCS pressure and the normal pressure of the connected system during RCS operation (the maximum pressure differential). The observed rate may be adjusted to the maximum pressure differential by assuming leakage is directly proportional to the pressure differential to the one-half power.

APPLICABILITY In MODES 1, 2, and 3, this LCO applies because the PIV leakage potential is greatest when the RCS is pressurized. In MODE 3, valves in the RHR flowpath are not required to (continued)

GRAND GULF B 3.4-29 Revision No. 0

RCS PIV Leakage B 3.4.6 BASES APPLICABILITY meet the requirements of this LCO when in, or during (continued) transition to or from, the RHR Shutdown Cooling mode of operation.

In MODES 4 and 5, leakage limits are not provided because the lower reactor coolant pressure results in a reduced potential for leakage and for a LOCA outside the containment. Accordingly, the potential for the consequences of reactor coolant leakage is far lower during these MODES.

ACTIONS The ACTIONS are modified by two Notes. Note 1 has been provided to modify the ACTIONS related to RCS PIV flow paths. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition.

However, the Required Actions for the Condition of RCS PIV leakage limits exceeded provide appropriate compensatory measures for separate affected RCS PIV flow paths. As such, a Note has been provided that allows separate Condition entry for each affected RCS PIV flow path.

Note 2 requires an evaluation of affected systems if a PIV is inoperable.

The leakage may have affected system OPERABILITY, or isolation of a leaking flow path with an alternate valve may have degraded the ability of the interconnected system to perform its safety function. As a result, the applicable Conditions and Required Actions for systems made inoperable by PIVs must be entered. This ensures appropriate remedial actions are taken, if necessary, for the affected systems.

A.1 and A.2 If leakage from one or more RCS PIVs is not within limit, the flow path must be isolated by at least one closed manual, deactivated automatic, or check valve within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . Required Action A.1 is modified by a Note stating that the valves used for isolation must meet the same leakage requirements as the PIVs and must be on the high pressure portion of the system.

(continued)

GRAND GULF B 3.4-30 Revision No. O

RCS PIV Leakage B 3.4.6 BASES ACTIONS A.1 and A.2 (continued)

(continued)

Four hours provides time to reduce leakage in excess of the allowable limit and to isolate the flow path if leakage cannot be reduced while corrective actions to reseat the leaking PIVs are taken. The 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months allows time for these actions and restricts the time of operation with leaking valves.

Required Action A.2 specifies that the double isolation barrier of two valves be restored by closing another valve qualified for isolation or restoring one leaking PIV. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time after exceeding the limit considers the time required to complete the Required Action, the low probability of a second valve failing during this time period, and the low probability of a pressure boundary rupture of the low pressure ECCS piping when overpressurized to reactor pressure (Ref. 7).

B.1 and B.2 If leakage cannot be reduced or the system isolated, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This action may reduce the leakage and also reduces the potential for a LOCA outside the containment. The Completion Times are reasonable, based on operating experience, to achieve the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.6.1 REQUIREMENTS Performance of leakage testing on each RCS PIV is required to verify that leakage is below the specified limit and to identify each leaking valve.

The leakage limit of 1 gpm applies to each valve. Leakage testing requires a stable pressure condition. For the two PIVs in series, the leakage requirement applies to each valve individually and not to the combined leakage across both valves. If the PIVs are not individually leakage tested, one valve may have failed completely and not be detected if the other valve in series meets the leakage requirement. In this situation, the protection provided by redundant valves would be lost.

(continued)

GRAND GULF B 3.4-31 Revision No. O

RCS PIV Leakage B 3.4.6 BASES SURVEILLANCE SR 3.4.6.1 (continued)

REQUIREMENTS (continued)

The Frequency is every 2 years and is required by the lnservice Testing Program per the ASME Code requirement (Ref. 6).

Therefore, this SR is modified by a Note that states the leakage Surveillance is only required to be performed in MODES 1 and 2. Entry into MODE 3 is permitted for leakage testing at high differential pressures with stable conditions not possible in the lower MODES.

REFERENCES 1. 10 CFR 50.2.

2. 10 CFR 50.55a(c).

3. 10 CFR 50, Appendix A, GDC 55.

4. ASME, Boiler and Pressure Vessel Code,Section XI.

5. NUREG-0677, "The Probability of lntersystem LOCA: Impact Due to Leak Testing and Operational Changes," May 1980.

6. ASME code for Operation and Maintenance of Nuclear Power Plants, 2001 Edition thru 2003 Addendums with portions of 2004 Edition, Subsection 1ST C-3630.

7. NEDC-31339, "BWR Owners Group Assessment of ECCS Pressurization in BWRs," November 1986.

GRAND GULF B 3.4-32 LBDCR 16269

RCS Leakage Detection Instrumentation B 3.4.7 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.7 RCS Leakage Detection Instrumentation BASES BACKGROUND GDC 30 of 10 CFR 50, Appendix A (Ref. 1), requires means for detecting and, to the extent practical, identifying the location of the source of RCS LEAKAGE. Regulatory Guide 1 .45, Revision 0, (Ref. 2) describes acceptable methods for selecting leakage detection systems.

Limits on LEAKAGE from the reactor coolant pressure boundary (RCPB) are required so that appropriate action can be taken before the integrity of the RCPB is impaired (Ref. 2). Leakage detection systems for the RCS are provided to alert the operators when leakage rates above normal background levels are detected and also to supply quantitative measurement of rates. In addition to meeting the OPERABILITY requirements, the monitors are typically set to_provide the most sensitive response without causing an excessive number of spurious alarms. The Bases for LCO 3.4.5, "RCS Operational LEAKAGE," discuss the limits on RCS LEAKAGE rates.

Systems for separating the LEAKAGE of an identified source from an unidentified source are necessary to provide prompt and quantitative information to the operators to permit them to take immediate corrective action.

LEAKAGE from the RCPB inside the drywell is detected by at least one of three independently monitored variables, such as sump level changes and drywell gaseous and particulate radioactivity levels. The primary means of quantifying LEAKAGE in the drywell is the drywell floor drain sump monitoring system.

The drywell floor drain sump monitoring system monitors the LEAKAGE collected in the floor drain sump. This unidentified LEAKAGE consists of LEAKAGE from control rod drives, valve flanges or packings, floor drains, the Closed Cooling Water System, and drywell air cooling unit condensate drains, and any LEAKAGE not collected in the drywell equipment drain sump.

(continued)

GRAND GULF B 3.4-33 LBDCR 11068

RCS Leakage Detection Instrumentation B 3.4.7 BASES BACKGROUND The Drywell floor drain in-leakage is monitored by the P45

( continued) floor drain sump level transmitters and associated instrumentation. The leakage and change in leakage can be determined by monitoring the associated computer point or recorders which calculate leakage based on the level rate of change.

The drywell atmospheric monitoring systems continuously monitor the drywell atmosphere for airborne particulate and gaseous radioactivity. A sudden increase of radioactivity, which may be attributed to RCPB steam or reactor water LEAKAGE, is annunciated in the control room.

Condensate from four of the six drywell coolers is routed to the drywell floor drain sump and is monitored by a flow transmitter that provides indication and alarms in the control room. This drywell air cooler condensate flow rate monitoring system serves as an added indicator, but not quantifier, of RCS unidentified LEAKAGE.

APPLICABLE A threat of significant compromise to the RCPB exists if the SAFETY barrier contains a crack that is large enough to propagate rapidly.

ANALYSES LEAKAGE rate limits are set low enough to detect the LEAKAGE emitted from a single crack in the RCPB (Refs. 3 and 4).

Identification of the LEAKAGE allows the operators to evaluate the significance of the indicated LEAKAGE and, if necessary, shut down the reactor for further investigation and corrective action. The allowed LEAKAGE rates are well below the rates predicted for critical crack sizes (Ref. 5).

Therefore, these actions provide adequate response before a significant break in the RCPB can occur.

(continued)

GRAND GULF B 3.4-34 LDC 07044, & LBDCR 11068

RCS Leakage Detection Instrumentation B 3.4.7 BASES APPLICABLE RCS leakage detection instrumentation satisfies Criterion 1 SAFETY of the NRC Policy Statement.

ANALYSES (continued)

LCO The LCO requires instruments of diverse monitoring principles to be OPERABLE to provide confidence that small amounts of unidentified LEAKAGE are detected in time to allow actions to place the plant in a safe condition, when RCS LEAKAGE indicates possible RCPB degradation.

The LCO requires three instruments to be OPERABLE.

The drywell floor drain sump monitoring system is required to quantify the unidentified LEAKAGE rate from the RCS. Thus, for the system to be considered OPERABLE, the sump level monitoring portion of the system must be OPERABLE and capable of determining the leakage rate. The identification of an increase in unidentified LEAKAGE will be delayed by the time required for the unidentified LEAKAGE to travel to the drywell floor drain sump and it may take longer than one hour to detect a 1 gpm increase in unidentified LEAKAGE, depending on the origin and magnitude of the LEAKAGE. This sensitivity is acceptable for containment sump monitor OPERABILITY.

The reactor coolant contains radioactivity that, when released to the drywell, can be detected by the gaseous or particulate drywell atmospheric radioactivity monitor. Only one of the two detectors is required to be OPERABLE. Radioactivity detection systems are included for monitoring both particulate and gaseous activities because of their sensitivities and rapid response to RCS LEAKAGE, but have recognized limitations. Reactor coolant radioactivity levels will be low during initial reactor startup and for a few weeks thereafter, until activated corrosion products have been formed and fission products appear from fuel element cladding contamination or cladding defects. If there are few fuel element cladding defects and low levels of activation products, it may not be possible for the gaseous or particulate drywell atmospheric radioactivity monitors to detect a 1 gpm increase within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months during normal operation. However, the gaseous or particulate drywell atmospheric radioactivity monitor is OPERABLE when it is capable of detecting a 1 gpm increase in unidentified LEAKAGE within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months given an RCS activity equivalent to that assumed in the design calculations for the monitors (Reference 6).

This LCO is satisfied when monitors of diverse measurement means are available. Thus, the drywell floor drain sump monitoring system, in combination with a gaseous or (continued)

GRAND GULF B 3.4-35 LBDCR 11068

RCS Leakage Detection Instrumentation B 3.4.7 BASES LCO particulate drywell atmospheric radioactivity monitor and a (continued) drywell air cooler condensate flow rate monitoring system, provides an acceptable minimum.

APPLICABILITY In MODES 1, 2, and 3, leakage detection systems are required to be OPERABLE to support LCO 3.4.5. This Applicability is consistent with that for LCO 3.4.5.

ACTIONS A.1 With the drywell floor drain sump monitoring system inoperable, no other form of sampling can provide the equivalent information to quantify leakage. However, the drywell atmospheric activity monitor and the drywell air cooler condensate flow rate monitor will provide indications of changes in leakage.

With the drywell floor drain sump monitoring system inoperable, but with RCS unidentified and total LEAKAGE being determined every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months (SR 3.4.5.1 ), operation may continue for 30 days. Manual methods, using approved M&TE, can be used to monitor sump fill times and leakage and change in leakage during the 30 day allowed outage time for the drywell floor drain sump monitoring system to ensure compliance with SR 3.4.5.1. The 30 day Completion Time of Required Action A.1 is acceptable, based on operating experience, considering the multiple forms of leakage detection that are still available.

(continued)

GRAND GULF B 3.4-36 LBDCR 11068

RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS 8.1 (continued)

With both gaseous and particulate drywell atmospheric monitoring channels inoperable, grab samples of the drywell atmosphere shall be taken and analyzed to provide periodic leakage information. Provided a sample is obtained and analyzed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months , the plant may continue operation since at least one other form of drywell leakage detection (i.e.,

air cooler condensate flow rate monitor) is available. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval provides periodic information that is adequate to detect LEAKAGE.

C.1 With the required drywell air cooler condensate flow rate monitoring system inoperable, SR 3.4.7.1 is performed every 8 hours9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months to provide periodic information of activity in the drywell at a more frequent interval than the routine Frequency of SR 3.4. 7.1. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months interval provides periodic information that is adequate to detect LEAKAGE and recognizes that other forms of leakage detection are available. However, this Required Action is modified by a Note that allows this action to be not applicable if the required drywell atmospheric monitoring system is inoperable. Consistent with SR 3.0.1, Surveillances are not required to be performed on inoperable equipment.

0.1, 0.2, D.3.1, and D.3.2 With the drywell floor drain sump monitoring system and the drywell air cooler condensate flow rate monitoring system inoperable, the only means of detecting LEAKAGE is the drywell atmospheric gaseous radiation monitor. A Note clarifies this applicability of the Condition. The drywell atmospheric gaseous radiation monitor typically cannot detect a 1 gpm leak within one hour when RCS activity is low. In addition, this configuration does not provide the required diverse means of leakage detection. Indirect methods of monitoring RCS leakage must be implemented. Grab samples of the drywell atmosphere must be performed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months to provide alternate periodic information.

Administrative means of monitoring RCS leakage include monitoring and trending parameters that may indicate an increase in RCS leakage.

There are diverse alternative mechanisms from which appropriate indicators may be selected based on plant conditions. It is not necessary to utilize all of these methods, but a method or methods should be selected considering the current plant conditions and historical or expected sources of unidentified leakage. The administrative methods are drywell pressure and temperature, Component Cooling Water System outlet temperatures and makeup, Reactor Recirculation System pump seal motor cooler temperature indication, Drywell cooling fan outlet temperatures, Control Rod Drive System flange temperatures, and Safety Relief Valves tailpipe temperature. These indications, coupled with the atmospheric grab (continued)

GRAND GULF B 3.4-37 LBDCR 11068

RCS Leakage Detection Instrumentation B 3.4.7 BASES ACTIONS D.1, D.2, D.3.1, and D.3.2 {continued)

(continued) samples, are sufficient to alert the operating staff to an_unexpected increase in unidentified LEAKAGE.

The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months interval is sufficient to detect increasing RCS_leakage. The Required Action provides 7 days to restore _another RCS leakage monitor to OPERABLE status to regain the_intended leakage detection diversity.

The 7 day Completion_Time ensures that the plant will not be operated in a _degraded configuration for a lengthy time period.

E.1 and E.2 With both the gaseous and particulate drywell atmospheric monitor channels and the drywell air cooler condensate flow rate monitor inoperable, the only means of detecting LEAKAGE is the drywell floor drain sump monitoring system. This Condition does not provide the required diverse means of leakage detection. The Required Action is to restore either of the inoperable monitoring systems to OPERABLE status within 30 days to regain the intended leakage detection diversity. The 30 day Completion Time ensures that the plant will not be operated in a degraded configuration for a lengthy time period.

F.1 and F.2 If any Required Action of Condition A, B, C, D, or E cannot_be met within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions in an orderly manner and without challenging plant systems.

G.1 With all required monitors inoperable, no required automatic means of monitoring LEAKAGE are available, and immediate plant shutdown in accordance with LCO 3.0.3 is required.

SURVEILLANCE SR 3.4.7.1 REQUIREMENTS This SR requires the performance of a CHANNEL CHECK of the required drywell atmospheric monitoring system. The check gives reasonable confidence that the channel is operating properly. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.4-38 LBDCR 18127

RCS Leakage Detection Instrumentation B 3.4.7 BASES SURVEILLANCE REQUIREMENTS SR 3.4.7.2 (continued)

This SR requires the performance of a CHANNEL FUNCTIONAL TEST of the required RCS leakage detection instrumentation. The test ensures that the monitors can perform their function in the desired manner. The test also verifies the relative accuracy of the instrumentation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.4-39 LBDCR 18127

RCS Leakage Detection Instrumentation B 3.4.7 BASES SURVEILLANCE SR 3.4.7.3 REQUIREMENTS (continued) This SR requires the performance of a CHANNEL CALIBRATION of the required RCS leakage detection instrumentation channels. The calibration verifies the accuracy of the instrumentation, including the instruments located inside the drywell. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program ..

REFERENCES 1. 10 CFR 50, Appendix A, GDC 30.

2. Regulatory Guide 1.45, Revision 0, "Reactor Coolant Pressure Boundary Leakage Detection System." May 1973.

3. GEAP-5620, "Failure Behavior in ASTM A106B Pipes Containing Axial Through - Wall Flaws," April 1968.

4. NUREG-75/067, "Investigation and Evaluation of Cracking in Austenitic Stainless Steel Piping of Boiling Water Reactor Plants,"

October 1975.

5. UFSAR, Section 5.2.5.5.3.

6. UFSAR, Section 5.2.5.2.

GRAND GULF B 3.4-40 LBDCR 18127

RCS Specific Activity B 3.4.8 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.8 RCS Specific Activity BASES BACKGROUND During circulation, the reactor coolant acquires radioactive materials due to release of fission products from fuel leaks into the coolant and activation of corrosion products in the reactor coolant. These radioactive materials in the coolant can plate out in the RCS, and, at times, an accumulation will break away to spike the normal level of radioactivity.

The release of coolant during a Design Basis Accident (OBA) could send radioactive materials into the environment.

Limits on the maximum allowable level of radioactivity in the reactor coolant are established to ensure, in the event of a release of any radioactive material to the environment during a OBA, radiation doses are maintained within the limits of 10 CFR 50.67 (Ref. 1).

This LCO contains iodine specific activity limits. The iodine isotopic activities per gram of reactor coolant are expressed in terms of a DOSE EQUIVALENT 1-131. The allowable levels are intended to limit the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months radiation dose to an individual at the site boundary to a small fraction of the 10 CFR 50.67 limit.

APPLICABLE Analytical methods and assumptions involving radioactive SAFETY material in the primary coolant are presented in the UFSAR (Ref. 2). The ANALYSES specific activity in the reactor coolant (the source term) is an initial condition for evaluation of the consequences of an accident due to a main steam line break (MSLB) outside containment. No fuel damage is postulated in the MSLB accident, and the release of radioactive material to the environment is assumed to end when the main steam isolation valves (MSIVs) close completely.

This MSLB release forms the basis for determining offsite doses (Ref. 2).

The limits on the specific activity of the primary coolant ensure that the 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months thyroid and whole body doses at the site boundary, resulting from an MSLB outside containment during steady state operation, will not exceed 10% of the dose guidelines of 10 CFR 50.67.

(continued)

GRAND GULF B 3.4-41 LDC 01050

RCS Specific Activity B 3.4.8 BASES APPLICABLE The limit on specific activity is from a parametric SAFETY evaluation of typical site locations. This limit is ANALYSES conservative because the evaluation considered more restrictive (continued) parameters than for a specific site, such as the location of the site boundary and the meteorological conditions of the site.

RCS specific activity satisfies Criterion 2 of the NRC Policy Statement.

LCO The specific iodine activity is limited to _:::0.2 µCi/gm DOSE EQUIVALENT 1-131. This limit ensures the source term assumed in the safety analysis for the MSLB is not exceeded, so any release of radioactivity to the environment during an MSLB is less than a small fraction of the 10 CFR 50.67 limits.

APPLICABILITY In MODE 1, and MODES 2 and 3 with any main steam line not isolated, a limit on the primary coolant radioactivity is applicable since there is an escape path for release of radioactive material from the primary coolant to the environment in the event of an MSLB outside of primary containment.

In MODES 2 and 3 with the Main Steam Lines Isolated, such a limit does not apply since an escape path does not exist. In MODES 4 and 5, no limit is required since the reactor is not pressurized and the potential for leakage is reduced.

ACTIONS A.1 and A.2 When the reactor coolant specific activity exceeds the LCO DOSE EQUIVALENT 1-131 limit, but is _:::4.0 µCi/gm, samples must be analyzed for DOSE EQUIVALENT 1-131 at least once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months . In addition, the specific activity must be restored to the LCO limit within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months . The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on the time needed to take and analyze a sample. The 48 hour5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Completion Time to restore the activity level provides a reasonable time for temporary coolant activity increases (iodine spikes or crud bursts) to be cleaned up with the normal processing systems.

(continued)

GRAND GULF B 3.4-42 LDC 01050

RCS Specific Activity B 3.4.8 BASES ACTIONS A.1 and A.2 (continued)

(continued)

A Note permits the use of the provisions of LCO 3.0.4.c. This allowance permits entry into the applicable MODE(S} while relying on the ACTIONS.

This allowance is acceptable due to the significant conservatism incorporated into the specific activity limit, the low probability of a limiting event while exceeding this limit, and the ability to restore transient specific activity excursions while the plant remains at, or proceeds to, power operation.

B.1, B.2.1, B.2.2.1, and B.2.2.2 If the DOSE EQUIVALENT 1-131 cannot be restored to~ 0.2 µCi/gm within 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months , or if at any time it is > 4.0 µCi/gm, it must be determined at least every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months and all the main steam lines must be isolated within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . Isolating the main steam lines precludes the possibility of releasing radioactive material to the environment in an amount that is more than a small fraction of the requirements of 10 CFR 50.67 during a postulated MSLB accident.

Alternately, the plant can be brought to MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . This option is provided for those instances when isolation of main steam lines is not desired (e.g., due to the decay heat loads). In MODE 4, the requirements of the LCO are no longer applicable.

The Completion Time of once every 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months is based on the time needed to take and analyze a sample. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to isolate the main steam lines in an orderly manner and without challenging plant systems. Also, the allowed Completion Times for Required Actions B.2.2.1 and B.2.2.2 for bringing the plant to MODES 3 and 4 are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

GRAND GULF B 3.4-43 LDC 07028

RCS Specific Activity B 3.4.8 BASES SURVEILLANCE SR 3.4.8.1 REQUIREMENTS (continued) This Surveillance is performed to ensure iodine remains within limit during normal operation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that requires this Surveillance to be performed only in MODE 1 because the level of fission products generated in other MODES is much less.

REFERENCES 1. 10 CFR 50.67, Accident Source Term.

2. UFSAR, Section 15.6.4.

GRAND GULF B 3.4-44 LBDCR 18127

RHR Shutdown Cooling System-Hot Shutdown B 3.4.9 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.9 Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to reduce the temperature of the reactor coolant to ,:::200°F. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Hot Shutdown condition.

The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each loop consists of a motor driven pump, two heat exchangers in series, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via separate feedwater lines or to the reactor via the LPCI injection path. The RHR heat exchangers transfer heat to the Standby Service Water System (LCO 3.7.1, "Standby Service Water (SSW) System and Ultimate Heat Sink (UHS)").

APPLICABLE Decay heat removal by the RHR System in the shutdown cooling SAFETY mode is not required for mitigation of any event or accident evaluated in ANALYSES the safety analyses. Loss of RHR shutdown cooling has been evaluated and found not to result in adverse consequences since adequate alternate decay heat removal methods remain available. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. Although the RHR Shutdown Cooling System does not meet a specific criterion of the NRC Policy Statement, it was identified in the NRC Policy Statement as a significant contributor to risk reduction. Therefore, the RHR Shutdown Cooling System is retained as a Technical Specification.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and, when no recirculation pump is in operation, one shutdown cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one (continued)

GRAND GULF B 3.4-45 Revision No. O

RHR Shutdown Cooling System - Hot Shutdown B 3.4.9 BASES LCO OPERABLE RHR pump, two heat exchangers in series, and the

( continued) associated piping and valves. Each shutdown cooling subsystem is considered OPERABLE if it can be manually aligned (remote or local) in the shutdown cooling mode for removal of decay heat. In MODE 3, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy.

Operation of one subsystem can maintain or reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. Management of gas voids is important to RHR Shutdown Cooling System OPERABILITY.

Note 1 permits both RHR shutdown cooling subsystems and recirculation pumps to not be in operation for a period of_2 hours in an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period.

Note 2 allows one RHR shutdown cooling subsystem to be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for performance of surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR cut in permissive pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping. Decay heat removal at reactor pressures greater than or equal to the RHR cut in permissive pressure is typically accomplished by condensing the steam in the main condenser. Additionally, in MODE 2 below this pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCS - Operating") do not allow placing the RHR shutdown cooling subsystem into operation.

In MODE 3 with reactor steam dome pressure below the RHR cut in permissive pressure (i.e., the actual pressure at which the interlock resets) the RHR System may be operated in the (continued)

GRAND GULF B 3.4-46 LBDCR 14044

RHR Shutdown Cooling System - Hot Shutdown B 3.4.9 BASES APPLICABILITY shutdown cooling mode to remove decay heat to reduce or

( continued) maintain coolant temperature. Otherwise, a recirculation pump is required to be in operation.

The requirements for decay heat removal in MODES 4 and 5 are discussed in LCO 3.4.10, "Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown"; LCO 3.9.8, "Residual Heat Removal (RHR) - High Water Level"; and LCO 3.9.9, "Residual Heat Removal (RHR) - Low Water Level."

ACTIONS A_Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

A.1 With one required RHR shutdown cooling subsystem inoperable for decay heat removal, except as permitted by LCO Note 2, the overall reliability is reduced, however, because a single failure in the OPERABLE subsystem could result in reduced RHR shutdown cooling capability. Therefore an alternate method of decay heat removal must be provided.

(continued)

GRAND GULF B 3.4-47 LBDCR 20085

RHR Shutdown Cooling System - Hot Shutdown B 3.4.9 BASES ACTIONS A.1 (continued)

(continued)

With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability.

This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate methods(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will provide assurance of continued heat removal capability.

The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as contributing to the alternate method capability. Alternate methods that can be used include (but are not limited to) the Spent Fuel Pool Cooling System the Reactor Water Cleanup System, or an inoperable but functional RHR shutdown cooling subsystem.

B.1 If the required alternate method(s) of decay heat removal cannot be verified within one hour, immediate action must be taken to restore the inoperable RHR shutdown cooling subsystem(s) to operable status. The Required Action will restore redundant decay heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

C.1, C.2, and C.3 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as is permitted by LCO Note 1, reactor coolant circulation by the RHR shutdown cooling subsystem or one recirculation pump must be restored without delay.

Until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature.

The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the coolant circulation function and is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable (continued}

GRAND GULF B 3.4-48 LBDCR 20085

RHR Shutdown Cooling System - Hot Shutdown B 3.4.9 BASES ACTIONS C.1, C.2, and C.3 (continued)

(continued) separately for each occurrence involving a loss of coolant circulation.

Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling system or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

SURVEILLANCE SR 3.4.9.1 REQUIREMENTS This Surveillance verifies that one RHR shutdown cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This Surveillance is modified by a Note allowing sufficient time to align the RHR System for shutdown cooling operation after clearing the pressure interlock that isolates the system, or for placing a recirculation pump in operation. The Note takes exception to the requirements of the Surveillance being met (i.e., forced coolant circulation is not required for this initial 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months period), which also allows entry into the Applicability of this Specification in accordance with SR 3.0.4 since the Surveillance will not be "not met" at the time of entry into the Applicability.

SR 3.4.9.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling system subsystems and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system high points and to confirm the location and orientation of (continued)

GRAND GULF B 3.4-49 LBDCR 20085

RHR Shutdown Cooling System - Hot Shutdown B 3.4.9 BASES SURVEILLANCE SR 3.4.9.2 {continued)

REQUIREMENTS (continued) important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration. Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.

Accumulated gas should be eliminated or brought within the acceptance criteria limits.

RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas intrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY.

The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

This SR is modified by a Note that states the SR is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam dome pressure is < the RHR cut in permissive pressure. In a rapid shutdown, there may be insufficient time to verify all susceptible locations prior to entering the Applicability.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

REFERENCES None.

GRAND GULF B 3.4-50 LBDCR 18127

RHR Shutdown Cooling System - Cold Shutdown B 3.4.10 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.10 Residual Heat Removal (RHR) Shutdown Cooling System - Cold Shutdown BASES BACKGROUND Irradiated fuel in the shutdown reactor core generates heat during the decay of fission products and increases the temperature of the reactor coolant. This decay heat must be removed to maintain the temperature of the reactor coolant at ,:::200°F. This decay heat removal is in preparation for performing refueling or maintenance operations, or for keeping the reactor in the Cold Shutdown condition.

The two redundant, manually controlled shutdown cooling subsystems of the RHR System provide decay heat removal. Each loop consists of a motor driven pump, two heat exchangers in series, and associated piping and valves. Both loops have a common suction from the same recirculation loop. Each pump discharges the reactor coolant, after circulation through the respective heat exchanger, to the reactor via separate feedwater lines or to the reactor via the LPCI injection path.

APPLICABLE Decay heat removal by the RHR System in the shutdown cooling SAFETY ANALYSES mode is not required for mitigation of any event or accident evaluated in the safety analyses. Loss of RHR shutdown cooling has been evaluated and found not to result in adverse consequences since adequate alternate decay heat removal methods remain available. Decay heat removal is, however, an important safety function that must be accomplished or core damage could result. Although the RHR Shutdown Cooling System does not meet a specific criterion of the NRC Policy Statement, it was identified in the NRC Policy Statement as a significant contributor to risk reduction. Therefore, the RHR Shutdown Cooling System is retained as a Technical Specification.

LCO Two RHR shutdown cooling subsystems are required to be OPERABLE, and, when no recirculation pump is in operation, one Shutdown Cooling subsystem must be in operation. An OPERABLE RHR shutdown cooling subsystem consists of one OPERABLE RHR pump, two heat exchangers in series, and the associated piping and valves. Each shutdown cooling subsystem is considered OPERABLE if it can be manually

{continued)

GRAND GULF B 3.4-51 Revision No. O

RHR Shutdown Cooling System - Cold Shutdown B 3.4.10 BASES LCO aligned (remote or local) in the shutdown cooling mode for (continued) removal of decay heat. In MODE 4, one RHR shutdown cooling subsystem can provide the required cooling, but two subsystems are required to be OPERABLE to provide redundancy. Operation of one subsystem can maintain and reduce the reactor coolant temperature as required. However, to ensure adequate core flow to allow for accurate average reactor coolant temperature monitoring, nearly continuous operation is required. Management of gas voids is important to RHR Shutdown Cooling System OPERABILITY.

Note 1 permits both RHR shutdown cooling subsystems and recirculation pumps to not be in operation for a period of 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months in an 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months period.

Note 2 allows one RHR shutdown cooling subsystem to be inoperable for up to 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months for performance of surveillance tests. These tests may be on the affected RHR System or on some other plant system or component that necessitates placing the RHR System in an inoperable status during the performance. This is permitted because the core heat generation can be low enough and the heatup rate slow enough to allow some changes to the RHR subsystems or other operations requiring RHR flow interruption and loss of redundancy.

Note 3 permits both RHR shutdown cooling subsystems and recirculation pumps to not be in operation during performance of inservice leak testing and during hydrostatic testing. This is permitted because RCS pressures and temperatures are being closely monitored as required by LCO 3.4.11.

APPLICABILITY In MODES 1 and 2, and in MODE 3 with reactor steam dome pressure greater than or equal to the RHR cut in permissive pressure, this LCO is not applicable. Operation of the RHR System in the shutdown cooling mode is not allowed above this pressure because the RCS pressure may exceed the design pressure of the shutdown cooling piping. Decay heat removal at reactor pressures greater than or equal to the RHR cut in permissive pressure is typically accomplished by condensing the steam in the main condenser. Additionally, in MODE 2 below this pressure, the OPERABILITY requirements for the Emergency Core Cooling Systems (ECCS) (LCO 3.5.1, "ECCS - Operating") do not allow placing the RHR shutdown cooling subsystem into operation.

(continued)

GRAND GULF B 3.4-52 LBDCR 14044

RHR Shutdown Cooling System - Cold Shutdown B 3.4.10 BASES APPLICABILITY In MODE 4, the RHR System may be operated in the shutdown (continued) cooling mode to remove decay heat to maintain coolant temperature below 200°F. Otherwise, a recirculation pump is required to be in operation.

The requirements for decay heat removal in MODE 3 below the cut in permissive pressure and in MODE 5 are discussed in LCO 3.4.9, "Residual Heat Removal (RHR) Shutdown Cooling System - Hot Shutdown"; LCO 3.9.8, "Residual Heat Removal (RHR)- High Water Level"; and LCO 3.9.9, "Residual Heat Removal (RHR)- Low Water Level."

ACTIONS A Note has been provided to modify the ACTIONS related to RHR shutdown cooling subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable shutdown cooling subsystems provide appropriate compensatory measures for separate inoperable shutdown cooling subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable RHR shutdown cooling subsystem.

A.1 With one of the two required RHR shutdown cooling subsystems inoperable except as permitted by LCO Note 2, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore, an alternate method of decay heat removal must be provided. With both RHR shutdown cooling subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem inoperability. This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities.

Furthermore, verification of the (continued)

GRAND GULF B 3.4-53 Revision No. O

RHR Shutdown Cooling System-Cold Shutdown B 3.4.10 BASES ACTIONS A.1 (continued)

(continued) functional availability of these alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will provide assurance of continued heat removal capability.

The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to the alternate method capability. Alternate methods that can be used include (but are not limited to) the Spent Fuel Pool Cooling System the Reactor Water Cleanup System, or an inoperable but functional RHR shutdown cooling subsystem.

B.1 If the required alternate method(s) of decay heat removal cannot be verified within one hour, immediate action must be taken to restore the inoperable RHR shutdown cooling subsystem(s) to operable status. The Required Action will restore redundant decay heat removal paths. The immediate Completion Time reflects the importance of maintaining the availability of two paths for heat removal.

C.1 and C.2 With no RHR shutdown cooling subsystem and no recirculation pump in operation, except as is permitted by LCO Notes, and until RHR or recirculation pump operation is re-established, an alternate method of reactor coolant circulation must be placed into service. This will provide the necessary circulation for monitoring coolant temperature. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the coolant circulation function and is modified such that the 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months is applicable separately for each occurrence involving a loss of coolant circulation. Furthermore, verification of the functioning of the alternate method must be reconfirmed every 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months thereafter. This will provide assurance of continued temperature monitoring capability.

During the period when the reactor coolant is being circulated by an alternate method (other than by the required RHR shutdown cooling system or recirculation pump), the reactor coolant temperature and pressure must be periodically monitored to ensure proper function of the alternate method. The once per hour Completion Time is deemed appropriate.

(continued)

GRAND GULF B 3.4-54 LBDCR 18127

RHR Shutdown Cooling System-Cold Shutdown B 3.4.10 BASES SURVEILLANCE SR 3.4.10.1 REQUIREMENTS This Surveillance verifies that one RHR Shutdown Cooling subsystem or recirculation pump is in operation and circulating reactor coolant. The required flow rate is determined by the flow rate necessary to provide sufficient decay heat removal capability. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.10.2 RHR Shutdown Cooling System piping and components have the potential to develop voids and pockets of entrained gases. Preventing and managing gas intrusion and accumulation is necessary for proper operation of the RHR shutdown cooling subsystems and may also prevent water hammer, pump cavitation, and pumping of noncondensible gas into the reactor vessel.

Selection of RHR Shutdown Cooling System locations susceptible to gas accumulation is based on a review of system design information, including piping and instrumentation drawings, isometric drawings, plan and elevation drawings, and calculations. The design review is supplemented by system walk downs to validate the system highpoints and to confirm the location and orientation of important components that can become sources of gas or could otherwise cause gas to be trapped or difficult to remove during system maintenance or restoration.

Susceptible locations depend on plant and system configuration, such as stand-by versus operating conditions.

The RHR Shutdown Cooling System is OPERABLE when it is sufficiently filled with water. Acceptance criteria are established for the volume of accumulated gas at susceptible locations. If accumulated gas is discovered that exceeds the acceptance criteria for the susceptible location (or the volume of accumulated gas at one or more susceptible locations exceeds an acceptance criteria for gas volume at the suction or discharge of a pump), the Surveillance is not met. If it is determined by subsequent evaluation that the RHR Shutdown Cooling System is not rendered inoperable by the accumulated gas (i.e., the system is sufficiently filled with water), the Surveillance may be declared met.

Accumulated gas should be eliminated or brought within the acceptance criteria limits.

(continued)

GRAND GULF B 3.4-55 LBDCR 20085

RHR Shutdown Cooling System-Cold Shutdown B 3.4.10 BASES SURVEILLANCE SR 3.4.10.2 (continued)

REQUIREMENTS (continued)

RHR Shutdown Cooling System locations susceptible to gas accumulation are monitored and, if gas is found, the gas volume is compared to the acceptance criteria for the location. Susceptible locations in the same system flow path which are subject to the same gas inrusion mechanisms may be verified by monitoring a representative subset of susceptible locations. Monitoring may not be practical for locations that are inaccessible due to radiological or environmental conditions, the plant configuration, or personnel safety. For these locations alternative methods (e.g., operating parameters, remote monitoring) may be used to monitor the susceptible location. Monitoring is not required for susceptible locations where the maximum potential accumulated gas void volume has been evaluated and determined to not challenge system OPERABILITY.

The accuracy of the method used for monitoring the susceptible locations and trending of the results should be sufficient to assure system OPERABILITY during the Surveillance interval.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. The Surveillance Frequency may vary by location susceptible to gas accumulation.

REFERENCES None.

GRAND GULF B 3.4-56 LBDCR 20085

RCS PIT Limits B 3.4.11 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.11 RCS Pressure and Temperature (P/T) Limits BASES BACKGROUND All components of the RCS are designed to withstand effects of cyclic loads due to system pressure and temperature changes. These loads are introduced by startup (heatup) and shutdown (cooldown) operations, power transients, and reactor trips. This LCO limits the pressure and temperature changes during RCS heatup and cooldown, within the design assumptions and the stress limits for cyclic operation.

The Pressure Temperature Limits Report (PTLR) (Ref. 13) contains PIT limit curves for normal operation (including heatup and cooldown), and inservice leak and hydrostatic testing.

Each PIT limit curve defines an acceptable region for normal operation.

The usual use of the curves is operational guidance during heatup or cooldown maneuvering, when pressure and temperature indications are monitored and compared to the applicable curve to determine that operation is within the allowable region (i.e., to the right of the applicable curve).

The LCO establishes operating limits that provide a margin to brittle failure of the reactor vessel and piping of the reactor coolant pressure boundary (RCPB). The vessel is the component most subject to brittle failure.

Therefore, the LCO limits apply mainly to the vessel.

10 CFR 50, Appendix G (Ref. 1), requires the establishment of PIT limits for material fracture toughness requirements of the RCPB materials.

Reference 1 requires an adequate margin to brittle failure during normal operation, anticipated operational occurrences, and system hydrostatic tests. It mandates the use of the American Society of Mechanical Engineers (ASME) Code, Section Ill, Appendix G (Ref. 2).

The actual shift in the RT Nor (Reference Temperature of the Nil-Ductility Transition) of the vessel material will be established periodically by removing and evaluating the irradiated reactor vessel material specimens, in accordance with ASTM E 185 (Ref. 3), 10 CFR 50, Appendix H (Ref. 4) and the UFSAR Reactor Materials Surveillance Program (Ref. 9, 1O, 11 ).

The operating PIT limit curves will be adjusted, as (continued)

GRAND GULF B 3.4-57 LBDCR 12035

RCS PIT Limits B 3.4.11 BASES BACKGROUND necessary, based on the evaluation findings and the (continued) recommendations of Reference 5.

The PIT limit curves are composite curves established by superimposing limits derived from stress analyses of those portions of the reactor vessel and head that are the most restrictive. At any specific pressure, temperature, and temperature rate of change, one location within the reactor vessel will dictate the most restrictive limit. Across the span of the PIT limit curves, different locations are more restrictive, and, thus, the curves are composites of the most restrictive regions.

The criticality limits include the Reference 1 requirement that they be at least 40°F above the core not critical limit curve and not lower than the minimum permissible temperature for the inservice leak and hydrostatic testing.

The consequence of violating the LCO limits is that the RCS has been operated under conditions that can result in brittle failure of the RCPB, possibly leading to a nonisolable leak or loss of coolant accident. In the event these limits are exceeded, an evaluation must be performed to determine the effect on the structural integrity of the RCPB components.

The ASME Code,Section XI, Appendix E (Ref. 6), provides a recommended methodology for evaluating an operating event that causes an excursion outside the limits.

APPLICABLE The PIT limits are not derived from Design Basis Accident SAFETY (OBA) analyses. They are prescribed during normal operation to avoid ANALYSES encountering pressure, temperature, and temperature rate of change conditions that might cause undetected flaws to propagate and cause nonductile failure of the RCPB, a condition that is unanalyzed.

Reference 7 establishes the methodology for determining the PIT limits.

Since the PIT limits are not derived from any OBA, there are no acceptance limits related to the P/T limits. Rather, the PIT limits (continued)

GRAND GULF B 3.4-58 LDC 97070

RCS PIT Limits B 3.4.11 BASES APPLICABLE are acceptance limits themselves since they preclude SAFETY operation in an unanalyzed condition.

ANALYSES (continued)

RCS PIT limits satisfy Criterion 2 of the NRC Policy Statement.

LCO The elements of this LCO are:

a. RCS pressure and temperature are within the limits specified in the PL TR and heatup or cooldown rate is within the limits specified in the PTLR.

b. The temperature difference between the reactor vessel bottom head coolant and the reactor pressure vessel (RPV) coolant is within the limits specified in the PTLR during recirculation pump startup and during increases in THERMAL POWER or loop flow while operating at low THERMAL POWER or loop flow.

c. The temperature difference between the reactor coolant in the respective recirculation loop and in the reactor vessel is within the limits specified in the PTLR during pump startup and during increases in THERMAL POWER or loop flow while operating at low THERMAL POWER or loop flow.

d. RCS pressure and temperature are within the criticality limits specified in the PTLR based on the current Effective Fuel Power Year (EFPY) prior to achieving criticality.

e. The reactor vessel flange and the head flange temperatures is within the limits specified in the PTLR when tensioning the reactor vessel head bolting studs.

These limits define allowable operating regions and permit a large number of operating cycles while also providing a wide margin to nonductile failure.

The rate of change of temperature limits control the thermal gradient through the vessel wall and are used as inputs for calculating the heatup, cooldown, and inservice leak and (continued)

GRAND GULF B 3.4-59 LBDCR 12035

RCS PIT Limits B 3.4.11 BASES LCO hydrostatic testing P/T limit curves. Thus, the LCO for the (continued) rate of change of temperature restricts stresses caused by thermal gradients and also ensures the validity of the PIT limit curves.

Violation of the limits places the reactor vessel outside of the bounds of the stress analyses and can increase stresses in other RCS components.

The consequences depend on several factors, as follows:

a. The severity of the departure from the allowable operating pressure temperature regime or the severity of the rate of change of temperature;

b. The length of time the limits were violated (longer violations allow the temperature gradient in the thick vessel walls to become more pronounced); and

c. The existences, sizes, and orientations of flaws in the vessel material.

APPLICABILITY The potential for violating a PIT limit exists at all times. For example, PIT limit violations could result from ambient temperature conditions that result in the reactor vessel metal temperature being less than the minimum allowed temperature for boltup. Therefore, this LCO is applicable even when fuel is not loaded in the core.

ACTIONS A.1 and A.2 Operation outside the PIT limits while in MODE 1, 2, or 3 must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses.

The 30 minute Completion Time reflects the urgency of restoring the parameters to within the analyzed range. Most violations will not be severe, and the activity can be accomplished in this time in a controlled manner.

Besides restoring operation within limits, an evaluation is required to determine if RCS operation can continue. The evaluation must verify the RCPB integrity remains acceptable and must be completed if continued operation is desired.

{continued)

GRAND GULF B 3.4-60 Revision No. O

RCS PIT Limits B 3.4.11 BASES ACTIONS A.1 and A.2 (continued)

(continued)

Several methods may be used, including comparison with pre-analyzed transients in the stress analyses, new analyses, or inspection of the components.

ASME Code,Section XI, Appendix E (Ref. 6), may be used to support the evaluation. However, its use is restricted to evaluation of the vessel beltline.

The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable to accomplish the evaluation of a mild violation. More severe violations may require special, event specific stress analyses or inspections. A favorable evaluation must be completed if continued operation is desired.

Condition A is modified by a Note requiring Required Action A.2 be completed whenever the Condition is entered. The Note emphasizes the need to perform the evaluation of the effects of the excursion outside the allowable limits. Restoration alone per Required Action A.1 is insufficient because higher than analyzed stresses may have occurred and may have affected the RCPB integrity.

8.1 and 8.2 If a Required Action and associated Completion Time of Condition A are not met, the plant must be brought to a lower MODE because either the RCS remained in an unacceptable PIT region for an extended period of increased stress, or a sufficiently severe event caused entry into an unacceptable region. Either possibility indicates a need for more careful examination of the event, best accomplished with the RCS at reduced pressure and temperature. With the reduced pressure and temperature conditions, the possibility of propagation of undetected flaws is decreased.

Pressure and temperature are reduced by bringing the plant to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

GRAND GULF B 3.4-61 Revision No. O

RCS PIT Limits B 3.4.11 BASES ACTIONS C.1 and C.2 (continued)

Operation outside the PIT limits in other than MODES 1, 2, and 3 (including defueled conditions) must be corrected so that the RCPB is returned to a condition that has been verified by stress analyses. The Required Action must be initiated without delay and continued until the limits are restored.

Besides restoring the PIT limit parameters to within limits, an evaluation is required to determine if RCS operation is allowed. This evaluation must verify that the RCPB integrity is acceptable and must be completed before approaching criticality or heating up to> 200°F. Several methods may be used, including comparison with pre-analyzed transients, new analyses, or inspection of the components. ASME Section XI, Appendix E (Ref. 6), may be used to support the evaluation; however, its use is restricted to evaluation of the beltline.

SURVEILLANCE SR 3.4.11.1 REQUIREMENTS Verification that operation is within limits is required when RCS pressure and temperature conditions are undergoing planned changes. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

Surveillance for heatup and cooldown, or inservice leakage and hydrostatic testing may be discontinued when the criteria given in the relevant plant procedure for ending the activity are satisfied.

This SR has been modified by a Note that requires this Surveillance to be performed only during system heatup and cooldown operations and inservice leakage and hydrostatic testing.

(continued)

GRAND GULF B 3.4-62 LBDCR 18127

RCS PIT Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.2 REQUIREMENTS (continued) A separate limit is used when the reactor is approaching criticality (curve C). Consequently, the RCS pressure and temperature must be verified within the appropriate limits before withdrawing control rods that will make the reactor critical.

Performing the Surveillance within 15 minutes before control rod withdrawal for the purpose of achieving criticality provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the control rod withdrawal.

SR 3.4.11.3 and SR 3.4.11.4 Differential temperatures within the applicable limits ensure that thermal stresses resulting from the startup of an idle recirculation pump will not exceed design allowances. In addition, compliance with these limits ensures that the assumptions of the analysis for the startup of an idle recirculation loop (Ref. 8) are satisfied.

Performing the Surveillance within 15 minutes before starting the idle recirculation pump provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the idle pump start.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.4 is to compare the temperatures of the operating recirculation loop and the idle loop.

SR 3.4.11.3 and SR 3.4.11.4 have been modified by a Note that requires the Surveillance to be met only in MODES 1, 2, 3, and 4 during recirculating pump start. In addition, SR 3.4.11.3 is only required to be met when reactor steam dome pressure ?::.25 psig. In MODE 5, the overall stress on limiting components is lower; therefore, ti T limits are not required.

(continued)

GRAND GULF B 3.4-63 Revision No. 1

RCS PIT Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.5, SR 3.4.11.6, and SR 3.4.11. 7 REQUIREMENTS (continued) Limits on the reactor vessel flange and head flange temperatures are generally bounded by the other PIT limits during system heatup and cooldown. However, operations approaching MODE 4 from MODE 5 and in MODE 4 with RCS temperature less than or equal to certain specified values require assurance that these temperatures meet the LCO limits.

The flange temperatures must be verified to be above the limits before and while tensioning the vessel head bolting studs to ensure that once the head is tensioned the limits are satisfied. When in MODE 4 with RCS temperatures 80°F, checks of the flange temperatures are required because of the reduced margin to the limits. When in MODE 4 with RCS temperature s100°F, monitoring of the flange temperature is required to ensure the temperatures are within the limits.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.4.11.8 and SR 3.4.11.9 Differential temperatures within the applicable limits ensure that thermal stresses resulting from increases in THERMAL POWER or recirculation loop flow during single recirculation loop operation will not exceed design allowances. Performing the Surveillance within 15 minutes before beginning such an increase in power or flow rate provides adequate assurance that the limits will not be exceeded between the time of the Surveillance and the time of the change in operation.

An acceptable means of demonstrating compliance with the temperature differential requirement in SR 3.4.11.9 is to compare the temperatures of the operating recirculation loop and the idle loop.

(continued)

GRAND GULF B 3.4-64 LBDCR 18127

RCS Prr Limits B 3.4.11 BASES SURVEILLANCE SR 3.4.11.8 and SR 3.4.11.9 (continued)

REQUIREMENTS (continued)

Plant specific test data has determined that the bottom head is not subject to temperature stratification with natural circulation at power levels as low as 36% of RTP with any single loop flow rate when the recirculation pump is on high speed operation. Therefore, SR 3.4.11.8 and SR 3.4.11.9 have been modified by a Note that requires the Surveillance to be met only when THERMAL POWER or loop flow is being increased when the above conditions are not met. The Note for SR 3.4.11.9 further limits the requirement for this Surveillance to exclude comparison of the idle loop temperature if the idle loop is isolated from the RPV since the water in the loop cannot be introduced into the remainder of the reactor coolant system.

REFERENCES 1. 10 CFR 50, Appendix G.

2. ASME, Boiler and Pressure Vessel Code, Section Ill, Appendix G.

3. ASTM E 185-82, "Standard Practice for Conducting Surveillance Tests For Light-Water Cooled Nuclear Power Reactor Vessels,"

July 1982.

4. 10 CFR 50, Appendix H.

5. Regulatory Guide 1.99, Revision 2, May 1988.

6. ASME, Boiler and Pressure Vessel Code,Section XI, Appendix E.

7. NEDO-21778-A, "Transient Pressure Rises Affecting Fracture Toughness Requirements For BWRs," December 1978.

8. UFSAR, Section 15.4.4.

9. GNRl-96/00176, Amendment 127 Safety Evaluation

10. GNRl-96/00186, Amendment 127 Safety Evaluation, Correction

11. UFSAR, Section 5.3.1.6.1

12. GNRl-97/00139, Amendment 132 to the Operating License.

13. GGNS Pressure Temperature Limits Report, Revision O GRAND GULF B 3.4-65 LBDCR 12035

Reactor Steam Dome Pressure B 3.4.12 B 3.4 REACTOR COOLANT SYSTEM (RCS)

B 3.4.12 Reactor Steam Dome Pressure BASES BACKGROUND The reactor steam dome pressure is an assumed value in the determination of compliance with reactor pressure vessel overpressure protection criteria and is also an assumed initial condition of Design Basis Accidents (DBAs) and transients.

APPLICABLE The reactor steam dome pressure of s 1045 psig is an SAFETY ANALYSES initial condition of the vessel overpressure protection analysis of Reference 1. This analysis assumes an initial maximum reactor steam dome pressure and evaluates the response of the pressure relief system, primarily the safety/relief valves, during the limiting pressurization transient. The determination of compliance with the overpressure criteria is dependent on the initial reactor steam dome pressure; therefore, the limit on this pressure ensures that the assumptions of the overpressure protection analysis are conserved. Reference 2 also assumes an initial reactor steam dome pressure for the analysis of DBAs and transients used to determine the limits for fuel cladding integrity MCPR (see Bases for LCO 3.2.2, "MINIMUM CRITICAL POWER RATIO (MCPR)") and 1%

cladding plastic strain (see Bases for LCO 3.2.1, "AVERAGE PLANAR LINEAR HEAT GENERATION RATE (APLHGR)").

Reactor steam dome pressure satisfies the requirements of Criterion 2 of the NRC Policy Statement.

LCO The specified reactor steam dome pressure limit of s 1045 psig ensures the plant is operated within the assumptions of the vessel overpressure protection analysis. Operation above the limit may result in a transient response more severe than analyzed.

APPLICABILITY In MODES 1 and 2, the reactor steam dome pressure is required to be less than or equal to the limit. In these MODES, the reactor may be generating significant steam, and events which may challenge the overpressure limits are possible.

(continued)

GRAND GULF B 3.4-66 Revision No. O

Reactor Steam Dome Pressure B 3.4.12 BASES APPLICABILITY In MODES 3, 4, and 5, the limit is not applicable because

( continued) the reactor is shut down. In these MODES, the reactor pressure is well below the required limit, and no anticipated events will challenge the overpressure limits.

ACTIONS A.1 With the reactor steam dome pressure greater than the limit, prompt action should be taken to reduce pressure to below the limit and return the reactor to operation within the bounds of the analyses. The 15 minute Completion Time is reasonable considering the importance of maintaining the pressure within limits. This Completion Time also ensures that the probability of an accident while pressure is greater than the limit is minimal.

B.1 If the reactor steam dome pressure cannot be restored to within the limit within the associated Completion Time, the plant must be brought to a MODE in which the LCO does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months . The allowed Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is reasonable, based on operating experience, to reach MODE 3 from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.4.12.1 REQUIREMENTS Verification that reactor steam dome pressure is s 1045 psig ensures that the initial conditions of the vessel overpressure protection analysis are met. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 5.2.

2. UFSAR, Section 15.

GRAND GULF B 3.4-67 LBDCR 18127

ECCS - Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.4 (continued)

REQUIREMENTS

( continued) The Frequency for this Surveillance is in accordance with the INSERVICE TESTING PROGRAM requirements.

SR 3.5.1.5 The ECCS subsystems are required to actuate automatically to perform their design functions. This Surveillance test verifies that, with a required system initiation signal (actual or simulated), the automatic initiation logic of HPCS, LPCS, and LPCI will cause the systems or subsystems to operate as designed, including actuation of the system throughout its emergency operating sequence, automatic pump startup, and actuation of all automatic valves to their required positions. This Surveillance also ensures that the HPCS System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool. The SR excludes automatic valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to valves that are locked, sealed, or otherwise secured in the actuated position since the affected valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured.

Placing an automatic valve in a locked, sealed or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve to be repositioned to the non-actuated position to support the accident analysis.

Restoration of an automatic valve to the non-actuated position requires verification that the SR has been met within its required Frequency. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1, "Emergency Core Cooling System (ECCS) Instrumentation," overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

(continued)

GRAND GULF B 3.5-11 LBDCR 21058

ECCS - Operating B 3.5.1 BASES SURVEILLANCE SR 3.5.1.6 REQUIREMENTS

( continued) The ADS designated S/RVs are required to actuate automatically upon receipt of specific initiation signals. A system functional test is performed to demonstrate that the mechanical portions of the ADS function (i.e.,

solenoids) operate as designed when initiated either by an actual or simulated initiation signal, causing proper actuation of all the required components. SR 3.5.1.7 and the LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.1 overlap this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes valve actuation. This prevents an RPV pressure blowdown.

SR 3.5.1.7 A manual actuation of each required ADS valve (those valves removed and replaced to satisfy SR 3.4.4.1) is performed to verify that the valve is functioning properly. This SR can be demonstrated by one of two methods. If performed by method 1), plant startup is allowed prior to performing this test because valve OPERABILITY and the setpoints for overpressure protection are verified, per the INSERVICE TESTING PROGRAM requirements, prior to valve installation. Therefore, this SR is modified by a Note that states the Surveillance is not required to be performed until 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after reactor steam pressure and flow are adequate to perform the test. The 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months allowed for manual actuation after the required pressure is reached is sufficient to achieve stable conditions for testing and (continued)

GRAND GULF B 3.5-12 LBDCR 18127

RPV Water Inventory Control B 3.5.2 BASES SURVEILLANCE SR 3.5.2.7 REQUIREMENTS (continued)

Verifying that each valve credited for automatically isolating a penetration flow path actuates to the isolation position on an actual or simulated RPV water level isolation signal is required to prevent RPV water inventory from dropping below the TAF should an unexpected draining event occur. The SR excludes automatic valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to valves that are locked, sealed, or otherwise secured in the actuated position since the affect valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured. Placing an automatic valve in a locked, sealed or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve to be repositioned to the non-actuated position to support the accident analysis. Restoration of an automatic valve to the non-actuated position requires verification that the SR has been met within its required Frequency.

The current Frequency is based on the need to perform this Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.5.2.8 The required ECCS subsystem is required to have a manual start capability.

This Surveillance verifies that a manual initiation signal will cause the required LCPI subsystem or LCPS System to start and operate as designed, including pump startup and actuation of all automatic valves to their required positions. The HPCS system is verified to start manually from a standby configuration, and includes the ability to override the RPV Level 8 injection valve isolation.

The current Surveillance Frequency is based on the need to perform the Surveillance under the conditions that apply during a plant outage and the potential for an unplanned transient if the Surveillance were performed with the reactor at power.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection/spray during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

( continued)

GRAND GULF B 3.5-19a LBDCR 21058

RCIC System B 3.5.3 BASES SURVEILLANCE SR 3.5.3.5 (continued)

REQUIREMENTS (continued) automatic pump startup and actuation of all automatic valves to their required positions. This Surveillance test also ensures that the RCIC System will automatically restart on an RPV low water level (Level 2) signal received subsequent to an RPV high water level (Level 8) trip and that the suction is automatically transferred from the CST to the suppression pool. The SR excludes automatic valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to valves that are locked, sealed, or otherwise secured in the actuated position since the affect valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured.

Placing an automatic valve in a locked, sealed or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve to be repositioned to the non-actuated position to support the accident analysis.

Restoration of an automatic valve to the non-actuated position requires verification that the SR has been met within its required Frequency. The LOGIC SYSTEM FUNCTIONAL TEST performed in LCO 3.3.5.2, "Reactor Core Isolation Cooling (RCIC) System Instrumentation,"

overlaps this Surveillance to provide complete testing of the assumed safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

This SR is modified by a Note that excludes vessel injection during the Surveillance. Since all active components are testable and full flow can be demonstrated by recirculation through the test line, coolant injection into the RPV is not required during the Surveillance.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 33.

2. UFSAR, Section 5.4.6.2.

3. Memorandum from R. L. Baer (NRC) to V. Stello, Jr. (NRC),

"Recommended Interim Revisions to LCO's for ECCS Components," December 1, 1975.

GRAND GULF B 3.5-26 LBDCR 21058

Primary Containment Air Locks B 3.6.1.2 BASES ACTIONS D.1 and D.2 (continued}

does not apply. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and to MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

SURVEILLANCE SR 3.6.1.2.1 REQUIREMENTS Maintaining primary containment air locks OPERABLE requires compliance with the leakage rate test requirements of 10 CFR 50, Appendix J (Ref. 2), as modified by approved exemptions. This SR reflects the leakage rate testing requirements with regard to air lock leakage (Type B leakage tests). The leakage rate testing requirements include the airlock test connection valves (Type C leakage tests). The periodic testing requirements verify that the air lock leakage does not exceed the allowed fraction of the overall primary containment leakage rate.

The SR has been modified to add a Note. Note 1 states that an inoperable air lock door does not invalidate the previous successful performance of the overall air lock leakage test. This is considered reasonable since either air lock door is capable of providing a fission product barrier in the event of a OBA.

SR 3.6.1.2.2 The seal air flask pressure is verified to be at ~ 90 psig to ensure that the seal system remains viable. It must be checked because it could bleed down during or GRAND GULF B 3.6-11 LBDCR 20086

RHR Containment Spray System B 3.6.1.7 BASES SURVEILLANCE SR 3.6.1.7.4 REQUIREMENTS (continued)

This SR verifies that each RHR containment spray subsystem automatic valve actuates to its correct position upon receipt of an actual or simulated automatic actuation signal. Actual spray initiation is not required to meet this SR. The SR excludes automatic valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to valves that are locked, sealed, or otherwise secured in the actuated position since the affected valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured.

Placing an automatic valve in a locked, sealed or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve to be repositioned to the non-actuated position to support the accident analysis.

Restoration of an automatic valve to the non-actuated position requires verification that the SR has been met within its required Frequency. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.3.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.6.1.7.5 This surveillance is performed to verify the spray nozzles are not obstructed. This surveillance may be accomplished by verifying the nozzle openings are free of material that would obstruct the flow of water or the performance of an air flow test through each nozzle. The type of testing utilized should be based on system operating history and the availability of the appropriate testing equipment. UFSAR Section 6.2.2.2 (Reference 3) defines preoperational testing performed on the system, which is not required to be duplicated by the performance of this surveillance testing. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.6-40a LBDCR 21058

Primary Containment and Drywell Hydrogen lgniters B 3.6.3.2 BASES BACKGROUND When the hydrogen igniters are energized they heat up to a (continued) surface temperature.::: 1700°F. At this temperature, they ignite the hydrogen gas that is present in the airspace in the vicinity of the igniter.

The hydrogen igniters depend on the dispersed location of the igniters so that local pockets of hydrogen at increased concentrations would burn before reaching a hydrogen concentration significantly higher than the lower flammability limit.

APPLICABLE The hydrogen igniters cause hydrogen in containment to burn SAFETY ANALYSES in a controlled manner as it accumulates following a degraded core accident (Ref. 3). Burning occurs at the lower flammability concentration, where the resulting temperatures and pressures are relatively benign.

Without the system, hydrogen could build up to higher concentrations that could result in a violent reaction if ignited by a random ignition source after such a buildup.

The Hydrogen igniter assemblies will be used to burn at a low concentration as it is produced following a postulated design basis accident (OBA). The system will maintain the hydrogen concentration within acceptable limits, thereby precluding hydrogen detonation at high concentrations. The hydrogen igniters have been shown by probabilistic risk analysis to be a significant contributor to limiting the severity of accident sequences that are commonly found to dominate risk for units with Mark Ill containment.

The hydrogen igniters are considered to be risk significant in accordance with the NRC Policy Statement.

LCO Two divisions of primary containment and drywell hydrogen igniters must be OPERABLE, each with more than 90% of the igniters OPERABLE (i.e., no more than 4 igniters inoperable).

This ensures operation of at least one igniter division, with adequate coverage of the primary containment and drywell, in the event of a worst case single active failure. This will ensure that the hydrogen concentration remains near 4.0 v/o.

(continued)

GRAND GULF B 3.6-73 LBDCR 21028

SGT System B 3.6.4.3 BASES SURVEILLANCE SR 3.6.4.3.2 (continued)

REQUIREMENTS Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.6.4.3.3 The SR requires verification that each SGT subsystem starts upon receipt of an actual or simulated initiation signal. The SR excludes automatic dampers that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to dampers that are locked, sealed, or otherwise secured in the actuated position since the affected dampers were verified to be in the actuated position prior to being locked, sealed, or otherwise secured. Placing an automatic damper in a locked, sealed, or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the damper to be repositioned to the non-actuated position to support the accident analysis. Restoration of an automatic damper to within its required Frequency. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.6.2.6 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. 10 CFR 50, Appendix A, GDC 41.

2. UFSAR, Section 6.5.3.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.6-101 LBDCR 21058

SSW System and UHS B 3.7.1 B 3.7 PLANT SYSTEMS B 3.7.1 Standby Service Water (SSW) System and Ultimate Heat Sink (UHS)

BASES BACKGROUND The SSW System is designed to provide cooling water for the removal of heat from unit auxiliaries, such as Residual Heat Removal (RHR) System heat exchangers, standby diesel generators (DGs), and room coolers for Emergency Core Cooling System equipment required for a safe reactor shutdown following a Design Basis Accident (OBA) or transient. The SSW System also provides cooling to unit components, as required, during normal shutdown and reactor isolation modes. During a OBA, the equipment required for normal operation only is isolated from the SSW System, and cooling is directed only to safety related equipment.

The SSW System consists of two independent cooling water headers (subsystems A and B), and their associated pumps, piping, valves, and instrumentation. The two SSW pumps, or one SSW pump and the high pressure core spray service water pump, are sized to provide sufficient cooling capacity to support the required safety related systems during safe shutdown of the unit following a loss of coolant accident (LOCA).

Subsystems A and B service equipment in SSW Divisions 1 and 2, respectively.

The UHS consists of two cooling towers with two required fan cells per tower, each with a concrete makeup water cooling tower basin. These two cooling tower basins are interconnected by a siphon line (to transfer water between them) and together constitute the UHS basin. The combined UHS basin volume is sized such that sufficient water inventory is available for all SSW System post LOCA cooling requirements for a 30 day period with no external makeup water source available (Regulatory Guide 1.27, Ref. 1). Normal makeup for each cooling tower basin is provided automatically by the Plant Service Water System.

Cooling water is pumped from the cooling tower basins by the two SSW pumps to the essential components through the two main supply headers (subsystems A and B). After removing heat from the components, the water is discharged to the cooling towers where the heat is rejected through direct contact with ambient air.

(continued}

GRAND GULF B 3.7-1 Revision No. O

SSW System and UHS B 3.7.1 BASES BACKGROUND Subsystems A and B supply cooling water to equipment

( continued) required for a safe reactor shutdown. Additional information on the design and operation of the SSW System and UHS along with the specific equipment for which the SSW System supplies cooling water is provided in the UFSAR, Section 9.2.1 and the UFSAR, Table 9.2-3 (Refs. 2 and 3, respectively). The SSW System is designed to withstand a single active or passive failure, coincident with a loss of offsite power, without losing the capability to supply adequate cooling water to equipment required for safe reactor shutdown.

Following a OBA or transient, the SSW System will operate automatically without operator action. Manual initiation of supported systems (e.g.,

suppression pool cooling) is, however, performed for long term cooling operations.

APPLICABLE The volume of each water source incorporated in a UHS SAFETY complex is sized so that sufficient water inventory is available for all SSW ANALYSES System post LOCA cooling requirements for a 30 day period with no additional makeup water source available (Ref. 1). The ability of the SSW System to support long term cooling of the reactor or containment is assumed in evaluations of the equipment required for safe reactor shutdown presented in the UFSAR, Sections 9.2.1, 6.2.1.1.3.3 and Chapter 15, (Refs. 2, 4, and 5, respectively). These analyses include the evaluation of the long term primary containment response after a design basis LOCA. The SSW System provides cooling water for the RHR suppression pool cooling mode to limit suppression pool temperature and primary containment pressure following a LOCA. This ensures that the primary containment can perform its intended function of limiting the release of radioactive materials to the environment following a LOCA.

The SSW System also provides cooling to other components assumed to function during a LOCA (e.g., RHR and Low Pressure Core Spray systems). Also, the ability to provide onsite emergency AC power is dependent on the ability of the SSW System to cool the DGs.

The safety analyses for long term containment cooling were performed, as discussed in the UFSAR, Sections 6.2.1.1.3.3 and 6.2.2.3 (Refs. 4 and 6, respectively), for a LOCA, concurrent with a loss of offsite power, and minimum available DG power. The worst case single failure affecting (continued)

GRAND GULF B 3.7-2 Revision No. O

SSW System and UHS B 3.7.1 BASES APPLICABLE the performance of the SSW System is the failure of one of SAFETY the two standby DGs, which would in turn affect one SSW ANALYSES subsystem. The SSW flow assumed in the analyses is 7900 gpm per (continued) per pump to the heat exchanger (UFSAR, Table 6.2-2, Ref. 7).

Reference 2 discusses SSW System performance during these conditions.

The SSW System, together with the UHS, satisfy Criterion 3 of the NRC Policy Statement.

LCO The OPERABILITY of subsystem A (Division 1) and subsystem B (Division 2) of the SSW System is required to ensure the effective operation of the RHR System in removing heat from the reactor, and the effective operation of other safety related equipment during a OBA or transient. Requiring both subsystems to be OPERABLE ensures that either subsystem A or B will be available to provide adequate capability to meet cooling requirements of the equipment required for safe shutdown in the event of a single failure.

A subsystem is considered OPERABLE when:

a. The associated pump is OPERABLE; and

b. The associated piping, valves, instrumentation, and controls required to perform the safety related function are OPERABLE.

OPERABILITY of the UHS is based on a minimum basin water level at or above elevation 130 ft 3 in mean sea level (equivalent to an indicated level of.:: 7 ft 3 in) and an OPERABLE siphon line between the cooling tower basins. Also, four cooling tower fans are required to be OPERABLE (2 per UHS cooling tower basin).

The isolation of the SSW System to components or systems may render those components or systems inoperable, but may not affect the OPERABILITY of the SSW System.

OPERABILITY of the High Pressure Core Spray (HPCS) Service Water System (SWS) is addressed by LCO 3.7.2, "HPCS SWS."

(continued)

GRAND GULF B 3.7-3 Revision No. 2

SSW System and UHS B 3.7.1 BASES APPLICABILITY In MODES 1, 2, and 3, the SSW System and the UHS are required to be OPERABLE to support OPERABILITY of the equipment serviced by the SSW System and UHS and required to be OPERABLE in these MODES.

In MODES 4 and 5, the OPERABILITY requirements of the SSW System and UHS are determined by the systems they support.

ACTIONS A.1 If one cooling tower has one fan inoperable, action must be taken to restore the inoperable cooling tower fan to OPERABLE status within 7 days.

The 7 day Completion Time is reasonable, based on the low probability of an accident occurring during the 7 days that one cooling tower fan is inoperable, the number of available systems, and the time required to complete the Required Action.

B.1 and D.1 If one SSW subsystem is inoperable or if both fans in one cooling tower are inoperable (since this is equivalent to the loss of function of one SSW subsystem), it must be restored to OPERABLE status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months .

With the unit in this condition, the remaining OPERABLE SSW subsystem is adequate to perform the heat removal function. However, the overall reliability is reduced because a single failure in the OPERABLE SSW subsystem could result in loss of SSW function. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time was developed taking into account the redundant capabilities afforded by the OPERABLE subsystem and the low probability of a OBA occurring during this period.

The Required Action is modified by two Notes indicating that the applicable Conditions of LCO 3.8.1, "AC Sources-Operating," and LCO 3.4.9, "Residual Heat Removal (RHR) Shutdown Cooling System-Hot Shutdown," be entered and the Required Actions taken if the inoperable SSW subsystem results in an inoperable DG or RHR shutdown cooling subsystem, respectively. This is in accordance with LCO 3.0.6 and ensures the proper actions are taken for these components.

(continued)

GRAND GULF B 3.7-4 Revision No. 0

SSW System and UHS B 3.7.1 BASES ACTIONS C.1 (continued)

A low water level in the UHS basin indicates that the required 30 day water supply for the post LOCA cooling requirements may not be available. However, changes in water level for such a large volume are slowly occurring events and the degradation when discovered is unlikely to have significantly degraded the basin capability. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time was developed taking into account the remaining capability of the UHS basin, the low probability that this inoperability occurring during the assumed maximum heat load conditions, and the low probability of a OBA occurring during this period.

If any Required Action and associated Completion Time of Condition A, C, or D are not met the unit must be placed in a MODE in which overall plant risk is minimized. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 8) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action E.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

GRAND GULF B 3.7-5 LBDCR 14043

SSW System and UHS B 3.7.1 BASES ACTIONS F.1 and F.2 (continued)

If both SSW subsystems are inoperable, more than one of the UHS cooling towers have inoperable cooling tower fan(s), or the UHS basin is inoperable for reasons other than condition C, the unit must be placed in a MODE in which the LCO does not apply. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months and in MODE 4 within 36 hours4.166667e-4 days 0.01 hours 5.952381e-5 weeks 1.3698e-5 months . The allowed Completion Times are reasonable, based on operating experience, to reach the required unit conditions from full Cl power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.1.1 REQUIREMENTS This SR ensures adequate long term (30 days) cooling can be maintained. With the UHS water source below the minimum level, the UHS basin must be declared inoperable. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.2 Operating each cooling tower fan for ~ 15 minutes ensures that all fans are OPERABLE and that all associated controls are functioning properly.

It also ensures that fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.3 Verifying the correct alignment for each required manual, power operated, and automatic valve in each SSW subsystem flow path provides assurance that the proper flow paths will exist for SSW operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves were verified to be in the correct position prior to locking, sealing, or securing. A valve is also allowed to be in the nonaccident position and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that those valves capable of potentially being mispositioned are in the correct position.

(continued)

GRAND GULF B 3.7-6 LBDCR 18127

SSW System and UHS B 3.7.1 BASES SURVEILLANCE SR 3.7.1.3 REQUIREMENTS (continued)

This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

Isolation of the SSW System to components or systems does not necessarily affect the OPERABILITY of the SSW subsystem. As such, when all SSW pumps, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the SSW subsystem needs to be evaluated to determine if it is still OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.1.4 This SR verifies that the automatic isolation valves of the SSW System will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by use of an actual or simulated initiation signal. This SR also verifies the automatic start capability of the SSW pump and cooling tower fans in each subsystem. The SR excludes automatic valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to valves that are locked, sealed, or otherwise secured in the actuated position since the affected valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured. Placing an automatic valve in a locked, sealed, or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve to be repositioned to the non-actuated position to support the accident analysis. Restoration of an automatic valve to the non-actuated position requires verification that the SR has been met within its required Frequency. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.5.1.6 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. Regulatory Guide 1.27, Revision 2, January 1976.

2. UFSAR, Section 9.2.1.

3. UFSAR, Table 9.2-3.

4. UFSAR, Section 6.2.1.1.3.3.

GRAND GULF B 3.7-7 LBDCR 21058

SSW System and UHS B 3.7.1 BASES REFERENCES (continued) 5. UFSAR, Chapter 15.

6. UFSAR, Section 6.2.2.3.

7. UFSAR, Table 6.2-2.

8. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR.

GRAND GULF B 3.7-8 LBDCR 21058

HPCS SWS B 3.7.2 B 3. 7 PLANT SYSTEMS B 3.7.2 High Pressure Core Spray (HPCS) Service Water System (SWS)

BASES BACKGROUND The HPCS SWS is designed to provide cooling water for the removal of heat from components of the Division 3 HPCS System.

The HPCS SWS consists of one cooling water header (subsystem C of the Standby Service Water (SSW) System), and the associated pumps, piping, and valves. The Ultimate Heat Sink (UHS) is also considered part of the SSW System (LCO 3. 7.1, "Standby Service Water (SSW) System and Ultimate Heat Sink (UHS)").

Cooling water is pumped from a UHS water source by the HPCS service water pump to the essential components through the HPCS service water supply header. After removing heat from the components, the water is discharged to the cooling tower, where the heat is rejected through direct contact with ambient air via natural draft.

The HPCS SWS specifically supplies cooling water to the Division 3 HPCS diesel generator jacket water coolers and HPCS pump room cooler. The HPCS SWS pump is sized such that it will provide adequate cooling water to the equipment required for safe shutdown. Following a Design Basis Accident or transient, the HPCS SWS will operate automatically and without operator action as described in the UFSAR, Section 9.2.1 (Ref. 1).

APPLICABLE The ability of the HPCS SWS to provide adequate cooling to SAFETY the HPCS System is an implicit assumption for safety analyses evaluated ANALYSES in the UFSAR, Chapters 6 and 15 (Refs. 2 and 3, respectively).

The HPCS SWS satisfies Criterion 3 of the NRC Policy Statement.

(continued}

GRAND GULF B 3.7-9 Revision No. O

HPCS SWS B 3.7.2 BASES LCO The HPCS SWS is required to be OPERABLE to ensure that the HPCS System will operate as required. An OPERABLE HPCS SWS consists of an OPERABLE pump, and an OPERABLE flow path, capable of taking suction from the UHS basin and transferring the water to the appropriate unit equipment.

The OPERABILITY of the UHS is discussed in LCO 3.7.1. However, the OPERABILITY of the basin cooling tower fans does not affect the OPERABILITY of the HPCS SWS, due to the limited heat removal during its operation.

APPLICABILITY In MODES 1, 2, and 3, the HPCS SWS is required to be OPERABLE to support OPERABILITY of the HPCS System since it is required to be OPERABLE in these MODES.

In MODES 4 and 5, the OPERABILITY requirements of the HPCS SWS and the UHS are determined by the HPCS System.

ACTIONS A. 1 When the HPCS SWS is inoperable, the capability of the HPCS System to perform its intended function cannot be ensured. Therefore, if the HPCS SWS is inoperable, the HPCS System must be declared inoperable immediately and the applicable Conditions of LCO 3.5.1, "ECCS-Operating," or LCO 3.5.2, "RPV Water Inventory Control,"

entered.

SURVEILLANCE SR 3.7.2.1 REQUIREMENTS Verifying the correct alignment for each required manual, power operated, and automatic valve in the HPCS service water flow path provides assurance that the proper flow paths will exist for HPCS service water operation. This SR does not apply to valves that are locked, sealed, or otherwise secured in position, since these valves are verified to be in correct position prior to locking, sealing, or securing.

A valve is also allowed to be in the nonaccident position and yet considered in the correct position, provided it can be automatically realigned to its accident position within the required time. This SR does not require any testing or valve manipulation; rather, it involves verification that (continued)

GRAND GULF B 3.7-10 LBDCR 18128

HPCS SWS B 3.7.2 BASES SURVEILLANCE SR 3.7.2.1 REQUIREMENTS

( continued) those valves capable of potentially being mispositioned are in the correct position. This SR does not apply to valves that cannot be inadvertently misaligned, such as check valves.

Isolation of the HPCS SWS to components or systems may render those components or systems inoperable, but may not affect the OPERABILITY of the HPCS SWS. As such, when all HPCS SWS pumps, valves, and piping are OPERABLE, but a branch connection off the main header is isolated, the HPCS SWS needs to be evaluated to determine if it is still OPERABLE.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.2.2 This SR verifies that the automatic isolation valves of the HPCS SWS will automatically switch to the safety or emergency position to provide cooling water exclusively to the safety related equipment during an accident event. This is demonstrated by use of an actual or simulated initiation signal. The SR excludes automatic valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to valves that are locked, sealed, or otherwise secured in the actuated position since the affected valves were verified to be in the actuated position prior to being locked, sealed, or otherwise secured.

Placing an automatic valve in a locked, sealed, or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve to be repositioned to the non-actuated position to support the accident analysis.

Restoration of an automatic valve to the non-actuated position requires verification that the SR has been met within its required Frequency. This SR also verifies the automatic start capability of the HPCS SWS pump.

The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.5.1.6 overlaps this SR to provide complete testing of the safety function.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. UFSAR, Section 9.2.1.

2. UFSAR, Chapter 6.

3. UFSAR, Chapter 15.

GRAND GULF B 3.7-11 LBDCR 21058

CRFA System B 3.7.3 B 3. 7 PLANT SYSTEMS B 3.7.3 Control Room Fresh Air (CRFA) System BASES BACKGROUND The CRFA System provides a protected environment from which occupants can control the unit following an uncontrolled release of radioactivity, hazardous chemicals, or smoke.

The safety related function of the CRFA System used to control radiation exposure consists of redundant isolation valves in each inlet and exhaust flow path. The system also includes two independent and redundant high efficiency air filtration subsystems for treatment of recirculated air or outside supply air and a Control Room Envelope (CRE) boundary that limits the inleakage of unfiltered air. Each CFRA subsystem consists of a demister, an electric heater, a prefilter, a high efficiency particulate air (HEPA) filter, an activated charcoal adsorber section (optional), a second HEPA filter, a fan, and the associated ductwork, valves or dampers, doors, barriers, and instrumentation. Demisters remove water droplets from the airstream. Prefilters and HEPA filters remove particulate matter, which may be radioactive. The charcoal adsorbers, if utilized, provide a holdup period for gaseous iodine, allowing time for decay.

The CRE is the area within the confines of the CRE boundary that contains the spaces that control room occupants inhabit to control the unit during normal and accident conditions. This area encompasses the control room, and may encompass other non-critical areas to which frequent personnel access or continuous occupancy is not necessary in the event of an accident. The CRE is protected for normal operation, natural events, and accident conditions. The CRE boundary is the combination of walls, floor, roof, ducting, doors, penetrations and equipment that physically form the CRE. The OPERABILITY of the CRE boundary must be maintained to ensure that the inleakage of unfiltered air into the CRE will not exceed the inleakage assumed in the licensing basis analysis of design basis accident (OBA) consequences to CRE occupants. The CRE and its boundary are defined in the Control Room Envelope Habitability Program.

(continued)

GRAND GULF B 3.7-12 LBDCR 09001

CRFA System B 3.7.3 BASES BACKGROUND With the implementation of the alternative source term

( continued) (Reference 7), the filtration of elemental and organic iodine is no longer credited in the accident analyses and is not a safety-related function.

Parts of the CRFA System are operated to maintain the CRE environment during normal operation. Upon receipt of the initiation signal(s) (indicative of conditions that could result in radiation exposure to CRE occupants),

the CRFA System automatically switches to the isolation mode of operation to minimize infiltration of contaminated air into the CRE. A system of valves isolates the CRE. CRE air flow may be recirculated and processed through either of the two filter subsystems.

The CRFA System is designed to maintain the control room environment for a 30 day continuous occupancy after a OBA, per the requirements of GDC 19. CRFA System operation in maintaining the control room habitability is discussed in the UFSAR, Sections 6.5.1 and 9.4.1 (Refs. 1 and 2, respectively).

APPLICABLE The ability of the CRFA System to maintain the habitability SAFETY of the CRE is an explicit assumption for the safety analyses presented in ANALYSES the UFSAR, Chapters 6 and 15 (Refs. 3 and 4, respectively).

The CRFA System is assumed to isolate the CRE in response to manual initiation following a loss of coolant accident.

Analyses of these events have assumed the CRE would be isolated for at least three days. At that time, isolation was terminated and the CRE was again ventilated with filtered (i.e., HEPA) outside air. Safety analysis of the fuel handling accident has demonstrated that CRE isolation is not required for this accident. The radiological doses to CRE occupants as a result of the various DBAs are summarized in Reference 4. No single active or passive failure will cause the loss of outside or recirculated air from the CRE.

The CRFA System provides protection from smoke and hazardous chemicals to the CRE occupants. The analysis of hazardous chemical releases demonstrates that the toxicity limits are not exceeded in the CRE following a hazardous chemical release (Ref. 5). The evaluation of a smoke challenge (continued)

GRAND GULF B 3.7-13 LBDCR 09001

CRFA System B 3.7.3 BASES APPLICABLE demonstrates that it will not result in the inability of the SAFETY CRE occupants to control the reactor either from the control ANALYSES room or from the remote shutdown panels (Ref. 8).

( continued)

The CRFA System satisfies Criterion 3 of the NRC Policy Statement.

LCO Two redundant subsystems of the CRFA System are required to be OPERABLE to ensure that at least one is available, if a single active failure disables the other subsystem. Total CRFA system failure, such as from a loss of both ventilation subsystems or from an inoperable CRE boundary, could result in a failure to meet the dose requirements of GDC 19 in the event of a OBA.

Each CRFA subsystem is considered OPERABLE when the individual components necessary to limit CRE occupant exposure are OPERABLE.

A subsystem is considered OPERABLE when its associated:

a. Fan is OPERABLE;

b. HEPA filter is not excessively restricting flow and is capable of performing its filtration functions; and

c. Demister, ductwork, valves, and dampers are OPERABLE, and air circulation can be maintained.

In order for the CRFA subsystems to be considered OPERABLE, the CRE boundary must be maintained such that the CRE occupant dose from a large radioactive release does not exceed the calculated dose in the licensing basis consequence analyses for DBAs, and that CRE occupants are protected from hazardous chemicals and smoke.

The LCO is modified by a Note allowing the CRE boundary to be opened intermittently under administrative controls. This Note only applies to openings in the CRE boundary that can be rapidly restored to the design condition, such as doors, hatches, floor plugs, and access panels. For entry and exit through doors, the administrative control of the opening is performed by the person(s) entering or exiting the area. For other openings, these controls should be proceduralized and consist of stationing a dedicated (continued)

GRAND GULF B 3.7-14 LBDCR 09001

CRFA System B 3.7.3 BASES LCO individual at the opening who is in continuous communication (continued) with the operators in the CRE. This individual will have a method to rapidly close the opening and to restore the CRE boundary to a condition equivalent to the design condition when a need for CRE isolation is indicated.

APPLICABILITY In MODES 1, 2, and 3, the CRFA System must be OPERABLE to ensure that the CRE will remain habitable during and following a OBA, since the OBA could lead to a fission product release.

In MODES 4 and 5, the probability and consequences of a OBA are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the CRFA System OPERABLE is not required in MODE 4 or 5.

ACTIONS A. 1 With one CRFA subsystem inoperable for reasons other than an inoperable CRE boundary, the inoperable CRFA subsystem must be restored to OPERABLE status within 7 days. With the unit in this condition, the remaining OPERABLE CRFA subsystem is adequate to perform the CRE occupant protection function. However, the overall reliability is reduced because a failure in the OPERABLE subsystem could result in loss of CRFA System function. The 7 day Completion Time is based on the low probability of a OBA occurring during this time period, and that the remaining subsystem can provide the required capabilities.

B.1, B.2, and B.3 If the unfiltered inleakage of potentially contaminated air past the CRE boundary and into the CRE can result in CRE occupant radiological dose greater than the calculated dose of the licensing basis analyses of OBA consequences (allowed to be up to 5 rem TEDE), or inadequate protection of CRE occupants from hazardous chemicals or smoke, the CRE boundary is inoperable. Actions must be taken to restore an OPERABLE CRE boundary within 90 days.

(continued)

GRAND GULF B 3.7-15 LBDCR 18128

CRFA System B 3.7.3 BASES ACTIONS B.1, B.2, and 8.3 (continued)

During the period that the CRE boundary is considered inoperable, action must be initiated to implement mitigating actions to lessen the effect on CRE occupants from the potential hazards of a radiological or chemical event or a challenge from smoke. Actions must be taken within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months to verify that in the event of a OBA, the mitigating actions will ensure that CRE occupant radiological exposures will not exceed the calculated dose of the licensing basis analyses of OBA consequences, and that CRE occupants are protected from hazardous chemicals and smoke. These mitigating actions (i.e., actions that are taken to offset the consequences of the inoperable CRE boundary) should be preplanned for implementation upon entry into the condition, regardless of whether entry is intentional or unintentional. The 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months Completion Time is reasonable based on the low probability of a OBA occurring during this time period, and the use of mitigating actions. The 90 day Completion Time is reasonable based on the determination that the mitigating actions will ensure protection of CRE occupants within analyzed limits while limiting the probability that CRE occupants will have to implement protective measures that may adversely affect their ability to control the reactor and maintain it in a safe shutdown condition in the event of a OBA. In addition, the 90 day Completion Time is a reasonable time to diagnose, plan and possible repair, and test most problems with the CRE boundary.

C.1 In MODE 1, 2, or 3, if the inoperable CRFA subsystem or the CRE boundary cannot be restored to OPERABLE status within the required Completion Time, the unit must be placed in a MODE that minimizes overall plant risk. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

(continued)

GRAND GULF B 3.7-16 LBDCR 14043

CRFA System B 3.7.3 BASES ACTIONS C.1 (continued)

(continued)

Required Action C.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

0.1 If both CRFA subsystems are inoperable in MODE 1, 2, or 3 for reasons other than an inoperable CRE, the CRFA System may not be capable of performing the intended function and the unit is in a condition outside of the accident analyses. Therefore, the plant must be brought to a MODE in which the overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

(continued)

GRAND GULF B 3.7-17 LBDCR 18128

CRFA System B 3.7.3 BASES ACTIONS 0.1 (continued)

(continued)

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action E.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required plant conditions from full power conditions in an orderly manner and without challenging plant systems.

(continued)

GRAND GULF B 3.7-18 LBDCR 18128

CRFA System B 3.7.3 BASES SURVEILLANCE SR 3.7.3.1 REQUIREMENTS This SR verifies that a subsystem in a standby mode starts from the control room on demand and continues to operate. Standby systems should be checked periodically to ensure that they start and function properly. Operation for;?: 15 continuous minutes demonstrates OPERABILITY of the system. Periodic operation ensures that blockages fan or motor failure, or excessive vibration can be detected for corrective action. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.3.2 This SR verifies that the required CRFA testing is performed in accordance with the Ventilation Filter Testing Program (VFTP). The VFTP includes testing HEPA filter performance, and minimum system flow rate. Specific test frequencies and additional information are discussed in detail in the VFTP.

SR 3.7.3.3 This SR verifies that each CRFA subsystem starts and operates and that the isolation valves close in s; 4 seconds on an actual or simulated initiation signal. The SR excludes automatic dampers and valves that are locked, sealed, or otherwise secured in the actuated position. The SR does not apply to dampers or valves that are locked, sealed, or otherwise secured. Placing an automatic valve or damper in a locked, sealed, or otherwise secured position requires an assessment of the operability of the system or any supported systems, including whether it is necessary for the valve or damper to be repositioned to the non-actuated position to support the accident analysis. Restoration of an automatic valve or damper to the non-actuated position requires verification that the SR has been met within its required Frequency. The LOGIC SYSTEM FUNCTIONAL TEST in SR 3.3.7.1.1 overlaps this SR to provide complete testing of the safety function. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.3.4 This SR verifies the OPERABILITY of the CRE boundary by testing for unfiltered air in leakage past the CRE boundary and into the CRE. The details of the testing are specified in the Control Room Envelope Habitability Program.

(continued)

GRAND GULF B 3.7-19 LBDCR 21058

CRFA System B 3.7.3 BASES SURVEILLANCE SR 3.7.3.4 REQUIREMENTS (continued) The CRE is considered habitable when the radiological dose to CRE occupants calculated in the licensing basis analyses of OBA consequences is no more than 5 rem TEDE and the CRE occupants are protected from hazardous chemicals and smoke. This SR verifies that the unfiltered air in leakage into the CRE is no greater than the flow rate assumed in the licensing basis analyses of OBA consequences. When unfiltered air inleakage is greater than the assumed flow rate, Condition B must be entered. Required Action B.3 allows time to restore the CRE boundary to OPERABLE status provided mitigating actions can ensure that the CRE remains within the licensing basis habitability limits for the occupants following an accident. Compensatory measures are discussed in Regulatory Guide 1.196, Section C.2.7.3, which endorses, with exceptions, NEI 99-03, Section 8.4 and Appendix F (Ref. 9). These compensatory measures may also be used as mitigating actions as required by Required Action 8.2. Temporary analytical methods may also be used as compensatory measures to restore OPERABILITY (Ref. 10).

Options for restoring the CRE boundary to OPERABLE status include changing the licensing basis OBA consequence analysis, repairing the CRE boundary, or a combination of these actions. Depending upon the nature of the problem and the corrective action, a full scope inleakage test may not be necessary to establish that the CRE boundary has been restored to OPERABLE status.

REFERENCES 1. FSAR, Section 6.5.1.

2. FSAR, Section 9.4.1.

3. FSAR, Chapter 6.

4. FSAR, Chapter 15.

5. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

6. Engineering Evaluation Request 95/6213, Engineering Evaluation Request Response Partial Response dated 12/18/95.

7. Amendment 145 to GGNS Operating License.

(continued)

GRAND GULF B 3.7-20 LBDCR 14043

CRFA System B 3.7.3 BASES REFERENCES 8. UFSAR, Section 9.5 (continued)

9. NEI 99-03, Control Room Habitability Assessment, June 2001.

10. Letter from Eric J. Leeds (NRC) to James W. Davis (NEI) Use of Generic Letter 91-18 Process and Alternative Source Terms in the Context of Control Room Habitability." (ADAMS Accession No. ML04300694).

GRAND GULF B 3.7-21 LBDCR 14043

Control Room AC System B 3.7.4 B 3. 7 PLANT SYSTEMS B 3.7.4 Control Room Air Conditioning (AC) System BASES BACKGROUND The Control Room AC System provides temperature control for the control room.

The Control Room AC System consists of two independent, redundant subsystems that provide cooling and heating of recirculated control room air. Each subsystem consists of heating coils, cooling coils, fans, chillers, compressors, ductwork, dampers, and instrumentation and controls to provide for control room temperature control.

The Control Room AC System is designed to provide a controlled environment under both normal and accident conditions. The Control Room AC System operation in maintaining the control room temperature is discussed in the UFSAR, Sections 6.4 and 9.4.1 (Refs. 1 and 2, respectively).

APPLICABLE The design basis of the Control Room AC System is to SAFETY ANALYSES maintain the control room temperature for a 30 day continuous occupancy.

The Control Room AC System components are arranged in redundant safety related subsystems. During emergency operation, the Control Room AC System maintains a habitable environment and ensures the OPERABILITY of components in the control room. A single active failure of a component of the Control Room AC System, assuming a loss of offsite power, does not impair the ability of the system to perform its design function. Redundant detectors and controls are provided for control room temperature control. The Control Room AC System is designed in accordance with Seismic Category I requirements. The Control Room AC System is capable of removing sensible and latent heat loads from the control room, including consideration of equipment heat loads and personnel occupancy requirements to ensure equipment OPERABILITY.

The ability of the Control Room AC System to maintain the control room temperature during Modes 1, 2, and 3 is implicitly assumed in the analyses of the design basis (continued)

GRAND GULF B 3.7-22 LDC 00070

Control Room AC System B 3.7.4 BASES APPLICABLE SAFETY ANALYSIS (continued) accidents (e.g., LOCA, main steam line break).

The Control Room AC System satisfies Criterion 3 of the N RC Policy Statement.

LCO Two independent and redundant subsystems of the Control Room AC System are required to be OPERABLE to ensure that at least one is available, assuming a single failure disables the other subsystem. Total system failure could result in the equipment operating temperature exceeding limits.

The Control Room AC System is considered OPERABLE when the individual components necessary to maintain the control room temperature are OPERABLE in both subsystems. These components include the cooling coils, fans, chillers, compressors, ductwork, dampers, and associated instrumentation and controls. The heating coils are not required for Control Room AC System OPERABILITY.

APPLICABILITY In MODE 1, 2, or 3, the Control Room AC System must be OPERABLE to ensure that the control room temperature will not exceed equipment OPERABILITY limits.

In MODES 4 and 5, the probability and consequences of a Design Basis Accident are reduced due to the pressure and temperature limitations in these MODES. Therefore, maintaining the Control Room AC System OPERABLE is not required in MODE 4 or 5.

ACTIONS A.1 With one control room AC subsystem inoperable, the inoperable control room AC subsystem must be restored to OPERABLE status within 30 days. With the unit in this condition, the remaining OPERABLE control room AC subsystem is adequate to perform the control room air conditioning function. However, the overall reliability is reduced because a single failure in the OPERABLE subsystem could result in loss of the control room air conditioning function. The 30 day Completion Time is based on the low probability of an event occurring requiring control room isolation, the consideration that the remaining subsystem can provide the required protection, and the availability of alternate cooling methods.

(continued)

GRAND GULF B 3.7-23 LBDCR 18128

Control Room AC System B 3.7.4 BASES ACTIONS B.1 and B.2

( continued)

If both control room AC subsystems are inoperable, the Control Room AC System may not be capable of performing its intended function.

Therefore, the control room area temperature is required to be monitored to ensure that temperature is being maintained low enough that equipment in the control room is not adversely affected. With the control room temperature being maintained within the temperature limit, 7 days is allowed to restore a control room AC subsystem to OPERABLE status.

This Completion Time is reasonable considering that the control room temperature is being maintained within limits, the low probability of an event occurring requiring control room isolation, and the availability of alternate cooling methods.

C.1 In MODE 1, 2, or 3, if the control room area temperature cannot be maintained less than or equal to 90°F or if the inoperable control room AC subsystem cannot be restored to OPERABLE status within the associated Completion Time, the unit must be placed in a MODE that minimizes overall plant risk. To achieve this status the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 3) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action B.1 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

(continued)

GRAND GULF B 3.7-24 LBDCR 14043

Control Room AC System B 3.7.4 BASES SURVEILLANCE SR 3.7.4.1 REQUIREMENTS This SR verifies that the heat removal capability of the system is sufficient to remove the control room heat load assumed in the safety analysis.

The SR consists of a combination of testing and calculation. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES 1. FSAR, Section 6.4.

2. FSAR, Section 9.4.1.

3. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.7-25 LBDCR 18127, 18128

Main Condenser Offgas B 3.7.5 B 3. 7 PLANT SYSTEMS B 3.7.5 Main Condenser Offgas BASES BACKGROUND During unit operation, steam from the low pressure turbine is exhausted directly into the condenser. Air and noncondensible gases are collected in the condenser, then exhausted through the steam jet air ejectors (SJAEs) to the Main Condenser Offgas System. The offgas from the main condenser normally includes radioactive gases.

The Main Condenser Offgas System has been incorporated into the unit design to reduce the gaseous radwaste emission. This system uses a catalytic recombiner to recombine radiolytically dissociated hydrogen and oxygen. The gaseous mixture is cooled by the offgas condenser; the water and condensibles are stripped out by the offgas condenser and moisture separator. The radioactivity of the remaining gaseous mixture (i.e., the offgas recombiner effluent) is monitored downstream of the moisture separator prior to entering the holdup line.

APPLICABLE The main condenser offgas gross gamma activity rate is an SAFETY ANALYSES initial condition of the Main Condenser Offgas System failure event as discussed in the UFSAR, Section 15.7.1 (Ref. 1). The analysis assumes a gross failure in the Main Condenser Offgas System that results in the rupture of the Main Condenser Offgas System pressure boundary. The gross gamma activity rate is controlled to ensure that during the event, the calculated offsite doses will be well within the limits (NUREG-0800, Ref. 2) of 10 CFR 100 (Ref. 3), or the NRC staff approved licensing basis.

The main condenser offgas limits satisfy Criterion 2 of the NRC Policy Statement.

LCO To ensure compliance with the assumptions of the Main Condenser Offgas System failure event (Ref. 1), the fission product release rate should be consistent with a noble gas release to the reactor coolant of 100 µCi/MWt-second after decay of 30 minutes. The LCO is conservatively established based on 100 µCi/MWt-second and the original GGNS licensed power level of 3833 MWt.

(continued)

GRAND GULF B 3.7-26 LDC 02072

Main Condenser Offgas B 3.7.5 BASES APPLICABILITY The LCO is applicable when steam is being exhausted to the main condenser and the resulting noncondensibles are being processed via the Main Condenser Offgas System. This occurs during MODE 1, and during MODES 2 and 3 with any main steam line not isolated and the SJAE in operation. In MODES 4 and 5, steam is not being exhausted to the main condenser and the requirements are not applicable.

ACTIONS If the offgas radioactivity rate limit is exceeded, 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months is allowed to restore the gross gamma activity rate to within the limit. The 72 hour8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months Completion Time is reasonable, based on engineering judgment considering the time required to complete the Required Action, the large margins associated with permissible dose and exposure limits, and the low probability of a Main Condenser Offgas System rupture occurring.

B.1 and B.2 If the gross gamma activity rate is not restored to within the limits within the associated Completion Time, the SJAE must be isolated. This isolates the Main Condenser Offgas System from the source of the radioactive steam. The 12 hour1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months Completion Time is reasonable, based on operating experience, to perform the actions from full power conditions in an orderly manner and without challenging unit systems.

An alternative to Required Action B.1 is to place the unit in a MODE in which overall plant risk is minimized. To achieve this status, the unit must be placed in at least MODE 3 within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 4) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

Required Action B.2 is modified by a Note that states that LCO 3.0.4.a is not applicable when entering MODE 3. This Note prohibits the use of LCO 3.0.4.a to enter MODE 3 during startup with the LCO not met.

However, there is no restriction on the use of LCO 3.0.4.b, if applicable, because LCO 3.0.4.b requires performance of a risk assessment addressing (continued)

GRAND GULF B 3.7-27 LBDCR 14043

Main Condenser Offgas B 3.7.5 BASES ACTIONS B.1 and B.2 (continued)

(continued) inoperable systems and components, consideration of the results, determination of the acceptability of entering MODE 3, and establishment of risk management actions, if appropriate. LCO 3.0.4 is not applicable to, and the Note does not preclude, changes in MODES or other specified conditions in the Applicability that are required to comply with ACTIONS or that are part of a shutdown of the unit.

The allowed Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.5.2 REQUIREMENTS SR 3.7.5.2, requires an isotopic analysis of an offgas sample to ensure that the required limits are satisfied. The noble gases to be sampled include Xe-133, Xe-135, Xe-138, Kr-85, Kr-87, and Kr-88. If the measured rate of radioactivity increases significantly (by ;;:: 50% after correcting for expected increases due to changes in THERMAL POWER),

an isotopic analysis is also performed within 4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months after the increase is noted as required by SR 3.7.5.1, to ensure that the increase is not indicative of a sustained increase in the radioactivity rate. The SR 3.7.5.2 Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.5.2 is modified by a Note indicating that the SR is not required to be performed until 31 days after any SJAE is in operation. Only in this condition can radioactive fission gases be in the Main Condenser Offgas System at significant rates.

REFERENCES 1. FSAR, Section 15.7.1.

2. NUREG-0800.

3. 10 CFR 100.

4. NEDC-32988-A, Revision 2, Technical Justification to Support Risk-Informed Modification to Selected Required End States for BWR Plants, December 2002.

GRAND GULF B 3.7-28 LBDCR 18127

Fuel Pool Water Level B 3.7.6 B 3. 7 PLANT SYSTEMS B 3.7.6 Fuel Pool Water Level BASES BACKGROUND The minimum water level in the spent fuel storage pool and upper containment fuel storage pool meets the assumptions of iodine decontamination factors following a fuel handling accident.

A general description of the spent fuel storage pool and upper containment fuel storage pool design is found in the UFSAR, Section 9.1.2 (Ref. 1). The assumptions of the fuel handling accident are found in the UFSAR, Section 15.7.4 (Ref. 2).

APPLICABLE The water level above the irradiated fuel assemblies is an SAFETY ANALYSES explicit assumption of the fuel handling accident. A fuel handling accident is evaluated to ensure that the radiological consequences remain within the guidelines in NUREG-0800, Section 15.0.1 (Ref. 4) and 10 CFR 50.67, (Ref. 5). A fuel handling accident could release a fraction of the fission product inventory by breaching the fuel rod cladding as discussed in Appendix B to Regulatory Guide 1.183 (Ref. 6).

The fuel handling accident is evaluated for the dropping of an irradiated fuel assembly onto stored fuel bundles. The consequences of a fuel handling accident inside the auxiliary building and inside containment are documented in Reference 2. The water levels in the spent fuel storage pool and upper containment fuel storage pool provide for absorption of water soluble fission product gases and transport delays of soluble and insoluble gases that must pass through the water before being released to the secondary containment atmosphere. This absorption and transport delay reduces the potential radioactivity of the release during a fuel handling accident.

The fuel pool water level satisfies Criterion 2 of the NRC Policy Statement.

(continued)

GRAND GULF B 3.7-29 LDC 01050

Fuel Pool Water Level B 3.7.6 BASES LCO The specified water level preserves the assumption of the fuel handling accident analysis (Ref. 2). As such, it is the minimum required for fuel movement within the spent fuel storage pool and upper containment fuel storage pool.

APPLICABILITY This LCO applies whenever movement of irradiated fuel assemblies occurs in the associated fuel storage racks since the potential for a release of fission products exists.

ACTIONS A.1 Required Action A.1 is modified by a Note indicating that LCO 3.0.3 does not apply. If moving irradiated fuel assemblies while in MODE 1, 2, or 3, the fuel movement is independent of reactor operations. Therefore, inability to suspend movement of irradiated fuel assemblies is not a sufficient reason to require a reactor shutdown.

When the initial conditions for an accident cannot be met, steps should be taken to preclude the accident from occurring. With either fuel pool level less than required, the movement of irradiated fuel assemblies in the associated storage pool is suspended immediately. Suspension of this activity shall not preclude completion of movement of an irradiated fuel assembly to a safe position. This effectively precludes a spent fuel handling accident from occurring.

SURVEILLANCE SR 3.7.6.1 REQUIREMENTS This SR verifies that sufficient water is available in the event of a fuel handling accident. The water level in the spent fuel storage pool and upper containment fuel storage pool must be checked periodically. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

(continued)

GRAND GULF B 3.7-30 LBDCR 18127

Fuel Pool Water Level B 3.7.6 BASES REFERENCES 1. UFSAR, Section 9.1.2.

2. UFSAR, Section 15.7.4.

3. Deleted

4. NUREG-0800, Section 15.0.1, Revision 0, July 2000.

5. 10 CFR 50.67, "Accident Source Term."

6. Regulatory Guide 1.183, July 2000.

GRAND GULF B 3.7-31 LDC 01050

Main Turbine Bypass System B 3.7.7 B 3.7 PLANT SYSTEMS B 3.7.7 Main Turbine Bypass System BASES BACKGROUND The Main Turbine Bypass System is designed to control steam pressure when reactor steam generation exceeds turbine requirements during unit startup, sudden load reduction, and cooldown. It allows excess steam flow from the reactor to the condenser without going through the turbine.

The bypass capacity of the system is 30.4% of the Nuclear Steam Supply System rated steam flow. Sudden load reductions within the capacity of the steam bypass can be accommodated without reactor scram. The Turbine Bypass System consists of three hydraulically operated combined stop and control valves. The bypass valves are controlled by the turbine-generator and Pressure Control System, as discussed in FSAR Section 7.7.1.5. Normally, the bypass control valves are held closed and the pressure regulator controls the turbine control valves, directing all steam flow to the turbine. If the speed control load restricts steam flow to the turbine, the pressure regulator controls system pressure by opening the bypass control valves. If the capacity of the bypass valves is exceeded while the turbine cannot accept an increase in steam flow, the system pressure will rise and the reactor protection system action will cause shutdown of the reactor.

APPLICABLE The Main Turbine Bypass System is assumed to function during SAFETY the rod withdrawal error (RWE) at power event, as discussed ANALYSES in FSAR Section 15.4.2, loss of feedwater heating event (LOFWH), as discussed in FSAR Section 15.1.1 and the slow opening of the recirculation control valve events as described in FSAR Section 15.4.5. Opening the bypass valves during these events mitigates the increase in reactor vessel pressure, which affects the Minimum Critical Power Ratio (MCPR) and Linear Heat Generation Ratio (LHGR) during the event. Only the RWE and LOFWH events initiating from near RTP will open the bypass valves. The basis for the applicable power range of the Main Turbine Bypass System is the slow opening of the recirculation control valve. Two or more inoperable Main Turbine Bypass valves may result in LHGR and MCPR penalties.

{continued)

GRAND GULF B 3.7-32 LBDCR 12035

Main Turbine Bypass System B 3.7.7 BASES LCO Two of the three Main Turbine Bypass valves are required to be OPERABLE to limit peak pressure in the main steam lines and maintain reactor pressure within acceptable limits during events that cause slow pressurization, such that the Safety Limit MCPR is not exceeded. With two or more Main Turbine Bypass valves inoperable, modifications to the LHGR limits (LCO 3.2.3) and the MCPR limits (LCO 3.2.2) may be applied to allow continued operation.

Main Turbine Bypass valves are considered OPERABLE when they are capable of opening in response to increasing main steam line pressure.

This response is within the assumption of the applicable analysis. The LHGR and MCPR limits for two or more inoperable Main Turbine Bypass valves are specified in the COLR.

APPLICABILITY The Main Turbine Bypass System is required to be OPERABLE at~ 70%

Reactor Thermal Power (RTP) to ensure that the fuel cladding integrity safety limit and the cladding 1% plastic strain limit are not violated during the slow opening of the recirculation control valve event. As discussed in the Bases for LCO 3.2.2 and LCO 3.2.3, sufficient margin to these limits exists below 70% RTP. Additionally, the Main Turbine Bypass valves are not expected to open when the event initiates from below 70% RTP.

Therefore, these requirements are only necessary when operating at or above this power.

ACTIONS A.1 If the Main Turbine Bypass system is inoperable, or the LHGR and MCPR limits for two or more inoperable Main Turbine Bypass valves, as specified in the COLR, are not applied, the assumptions of the design basis transient analysis may not be met. Under such circumstances, prompt action should be taken to restore the Main Turbine Bypass System to OPERABLE status or adjust the LHGR and MCPR limits accordingly. The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time is reasonable, based on the time to complete the Required Action and the low probability of an event occurring during this period requiring two of the three Main Turbine Bypass valves.

(continued)

GRAND GULF B 3.7-33 LBDCR 12035

Main Turbine Bypass System B 3.7.7 BASES B.1 If the Main Turbine Bypass System cannot be restored to OPERABLE status or the LHGR and MCPR limits for two or more inoperable Main Turbine Bypass valves are not applied, THERMAL POWER must be reduced to < 70% RTP. As discussed in the Applicability section, operation at <70% RTP results in sufficient margin to the required limits, and the Main Turbine Bypass system is not required to protect fuel integrity during the feedwater controller failure, maximum demand event.

The 4 hour4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months Completion Time is reasonable, based on operating experience, to reach the required unit conditions from full power conditions in an orderly manner and without challenging unit systems.

SURVEILLANCE SR 3.7.7.1 REQUIREMENTS Cycling each Main Turbine Bypass valve through one complete cycle of full travel demonstrates that the valves are mechanically OPERABLE and will function when required. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.7.7.2 The Main Turbine Bypass System is required to actuate automatically to perform its design function. This SR demonstrates that, with the required system initiation signals, the valves will actuate to their required position.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

REFERENCES None GRAND GULF B 3.7-34 LBDCR 18127

AC Sources - Operating B 3.8.1 BASES ACTIONS A.2 (continued)

The Completion Time takes into account the capacity and capability of the remaining AC sources, reasonable time for repairs, and the low probability of a OBA occurring during this period.

(continued)

GRAND GULF B 3.8-5a LBDCR 20084

AC Sources - Operating B 3.8.1 BASES ACTIONS B.1 To ensure a highly reliable power source remains, it is necessary to verify the availability of the remaining required offsite circuit on a more frequent basis.

Since the Required Action only specifies "perform," a failure of SR 3.8.1.1 acceptance criteria does not result in a Required Action being not met.

However, if a circuit fails to pass SR 3.8.1.1, it is inoperable. Upon offsite circuit inoperability, additional Conditions must then be entered.

Required Action B.2 is intended to provide assurance that a loss of offsite power, during the period that a DG is inoperable, does not result in a complete loss of safety function of critical systems. These features are designed with redundant safety related divisions (i.e., single

{continued)

GRAND GULF B 3.8-6 LBDCR 20084

AC Sources - Operating B 3.8.1 BASES ACTIONS B.4 (continued)

5. High pressure injection systems (HPCS and RCIC) and the Division 3 DG (HPCS DG) will not be taken out of service for planned maintenance while DG Division 1 or 2 is out of service for extended maintenance.

(continued)

GRAND GULF B 3.8-8c LBDCR 20084

AC Sources - Operating B 3.8.1 BASES ACTIONS C.1 and C.2 Required Action C.1 addresses actions to be taken in the event of concurrent failure of redundant required features. Required Action C.1 reduces the vulnerability to a loss of function. The rationale for the 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is that Regulatory Guide 1.93 (Ref. 6) allows a Completion Time of 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months for two required offsite circuits inoperable, based upon the assumption that two complete safety divisions are OPERABLE. When a concurrent redundant required feature failure exists, this assumption is not the case, and a shorter Completion Time of 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months is appropriate. These features are designed with redundant safety related divisions (i.e., single division systems are not included in the list, although, for this Required Action, Division 3 is considered redundant to Division 1 and 2 ECCS). Redundant required features failures consist of any of these features that are inoperable, because any inoperability is on a division redundant to a division with inoperable offsite circuits.

(continued)

GRAND GULF B 3.8-9 LBDCR 20084

Diesel Fuel Oil, Lube Oil, and Starting Oil B 3.8.3 BASES (continued)

ACTIONS The ACTIONS Table is modified by a Note indicating that separate Condition entry is allowed for each DG. This is acceptable, since the Required Actions for each Condition provide appropriate compensatory actions for each inoperable DG subsystem. Complying with the Required Actions for one inoperable DG subsystem may allow for continued operation, and subsequent inoperable DG subsystem(s) are governed by separate Condition entry and application of associated Required Actions.

A.1 In this Condition, the 7 day fuel oil supply for a DG is not available.

However, the Condition is restricted to fuel oil level reductions that maintain at least a 6 day supply. The fuel oil level equivalent to a 6 day supply for DG 11 or DG 12 is ~ 59,173 gallons and for DG 13 is~ 38,280 gallons. These circumstances may be caused by events such as:

a. Full load operation required after an inadvertent start while at minimum required level; or

b. Feed and bleed operations that may be necessitated by increasing particulate levels or any number of other oil quality degradations.

This restriction allows sufficient time for obtaining the requisite replacement volume and performing the analyses required prior to addition of the fuel oil to the tank. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required level prior to declaring the DG inoperable. This period is acceptable based on the remaining capacity (> 6 days), the fact that procedures will be initiated to obtain replenishment, and the low probability of an event during this brief period.

B.1 In this Condition, the 7 day lube oil inventory, i.e., sufficient lube oil to support 7 days of continuous DG operation at full load conditions, is not available. However, the Condition is restricted to lube oil volume reductions that maintain at least a 6 day supply. The lube oil equivalent to a 6 day supply for DG 11 or 12 is 350 gallons and for DG 13 is 173 gallons. This restriction allows sufficient time for obtaining the requisite replacement volume. A period of 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months is considered sufficient to complete restoration of the required volume prior to declaring the DG inoperable. This period is acceptable (continued)

GRAND GULF B 3.8-44 LBDCR 20087

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES ACTIONS E.1 (continued)

With a Required Action and associated Completion Time not met, or the stored diesel fuel oil, lube oil or starting air subsystem not within limits for reasons other than addressed by Conditions A through D, the associated DG may be incapable of performing its intended function and must be immediately declared inoperable.

SURVEILLANCE SR 3.8.3.1 REQUIREMENTS This SR provides verification that there is an adequate inventory of fuel oil in the storage tanks to support each DG's operation for 7 days at its surveillance testing capacity as prescribed by Technical Specifications (5740 KW for Division 1 and 2, 3300 KW for Division 3). This capacity exceeds the maximum expected post LOCA loading. The fuel oil level equivalent to a 7 day supply for DG 11 or 12 is 68,744 gallons and for DG 13 is 44,616 gallons when calculated in accordance with References 2 and 3. The required fuel storage volume is determined using the most limiting energy content of the stored fuel. Using the known correlation of diesel fuel oil absolute specific gravity or API gravity to energy content, the required diesel generator output, and the corresponding fuel consumption rate, the onsite fuel storage volume required for 7 days of operation can be determined. SR 3.8.3.3 requires new fuel to be tested to verify that its properties are within the range assumed in the diesel fuel oil consumption calculations. The 7 day period is sufficient time to place the unit in a safe shutdown condition and to bring in replenishment fuel from an offsite location.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

SR 3.8.3.2 This Surveillance ensures that sufficient lube oil inventory is available to support at least 7 days of maximum expected post LOCA load operation for each DG. The lube oil level equivalent to a 7 day supply for DG 11 or DG 12 is 41 O gallons and for DG 13 is 173 gallons and is based on the DG manufacturer's consumption values for the run time of the DG.

Implicit in this SR is the requirement to verify the capability to transfer the lube oil from its storage location to the DG when the DG lube oil sump does not hold adequate inventory for 7 days of maximum expected post LOCA load operation without the level reaching the manufacturer's recommended minimum level.

The Surveillance Frequency is controlled under the Surveillance Frequency Control Program.

{continued)

GRAND GULF B 3.8-46 LBDCR 20087

Diesel Fuel Oil, Lube Oil, and Starting Air B 3.8.3 BASES SURVEILLANCE SR 3.8.3.5 REQUIREMENTS (continued) Microbiological fouling is a major cause of fuel oil degradation. There are numerous bacteria that can grow in fuel oil and cause fouling, but all must have a water environment in order to survive. Periodic removal of water from the storage tanks eliminates the necessary environment for bacterial survival. This is the most effective means of controlling microbiological fouling. In addition, it eliminates the potential for water entrainment in the fuel oil during DG operation. Water may come from any of several sources, including condensation, ground water, rain water, contaminated fuel oil, and from breakdown of the fuel oil by bacteria. Frequent checking for and removal of accumulated water minimizes fouling and provides data regarding the watertight integrity of the fuel oil system. The Surveillance Frequency is controlled under the Surveillance Frequency Control Program. This SR is for preventative maintenance. The presence of water does not necessarily represent a failure of this SR provided that accumulated water is removed during performance of the Surveillance.

REFERENCES 1. UFSAR, Section 9.5.4.

2. Regulatory Guide 1.137.

3. ANSI N195, 1976.

(continued)

GRAND GULF B 3.8-49 LBDCR 20087

Distribution Systems - Operating B 3.8.7 BASES ACTIONS A.1 (continued)

The Condition A worst scenario is one division without AC power (i.e., no offsite power to the division and the associated DG inoperable). In this Condition, the unit is more vulnerable to a complete loss of AC power. It is, therefore, imperative that the unit operators' attention be focused on minimizing the potential for loss of power to the remaining division by stabilizing the unit, and on restoring power to the affected division. The 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months time limit before requiring a unit shutdown in this Condition is acceptable because:

a. There is potential for decreased safety if the unit operators' attention is diverted from the evaluations and actions necessary to restore power to the affected division to the actions associated with taking the unit to shutdown within this time limit.

b. The potential for an event in conjunction with a single failure of a redundant component in the division with AC power. (The redundant component is verified OPERABLE in accordance with Specification 5.5.10, "Safety Function Determination Program (SFDP).")

(continued)

GRAND GULF B 3.8-75 LBDCR 20084

Distribution Systems - Operating B 3.8.7 BASES ACTIONS 8.1 With one or more Division 1 or 2 DC electrical power distribution subsystems inoperable, the remaining DC electrical power distribution subsystems are capable of supporting the minimum safety functions necessary to shut down the reactor and maintain it in a safe shutdown condition, assuming no single failure. The overall reliability is reduced, however, because a single failure in the remaining DC electrical power distribution subsystems could result in the minimum required ESF functions not being supported. Therefore, the required DC buses must be restored to OPERABLE status within 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months by powering the bus from the associated battery or charger.

Condition B may represent one division without adequate DC power, potentially with both the battery significantly degraded and the associated charger nonfunctioning. In this situation, the plant is significantly more vulnerable to a complete loss of all DC power. It is, therefore, imperative that the operator's attention focus on stabilizing the plant, minimizing the potential for loss of power to the remaining divisions, and restoring power to the affected division.

This 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months limit is more conservative than Completion Times allowed for the majority of components that could be without power. Taking exception to LCO 3.0.2 for components without adequate DC power, that would have Required Action Completion Times shorter than 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months , is acceptable because of:

a. The potential for decreased safety when requiring a change in plant conditions (i.e., requiring a shutdown) while not allowing stable operations to continue;

b. The potential for decreased safety when requiring entry into numerous applicable Conditions and Required Actions for components without DC power while not (continued)

GRAND GULF B 3.8-76 LBDCR 20084

Distribution Systems - Operating B 3.8.7 BASES ACTIONS B.1 (continued) providing sufficient time for the operators to perform the necessary evaluations and actions for restoring power to the affected division; and

c. The potential for an event in conjunction with a single failure of a redundant component.

The 2 hour2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months Completion Time for DC buses is consistent with Regulatory Guide 1.93 (Ref. 3).

C.1 If the inoperable electrical power distribution system cannot be restored to OPERABLE status within the associated Completion Times, the plant must be bought to a MODE in which overall plant risk is minimized. To achieve this status, the plant must be brought to at least MODE 3 within -

12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Remaining in the Applicability of the LCO is acceptable because the plant risk in MODE 3 is similar to or lower than the risk in MODE 4 (Ref. 5) and because the time spent in MODE 3 to perform the necessary repairs to restore the system to OPERABLE status will be short. However, voluntary entry into MODE 4 may be made as it is also an acceptable low-risk state.

(continued)

GRAND GULF B 3.8-77 LBDCR 20084

RHR - High Water Level B 3.9.8 BASES APPLICABILITY are covered by LCOs in Section 3.4, Reactor Coolant System (continued) (RCS); Section 3.5, Emergency Core Cooling Systems (ECCS) and Reactor Core Isolation Cooling (RCIC) System; and Section 3.6, Containment Systems. RHR Shutdown Cooling System requirements in MODE 5, with the water level < 22 ft 8 inches above the RPV flange, are given in LCO 3.9.9, "Residual Heat Removal (RHR) - Low Water Level."

ACTIONS With no RHR shutdown cooling subsystem OPERABLE, an alternate method of decay heat removal must be established within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . In this condition, the volume of water above the RPV flange provides adequate capability to remove decay heat from the reactor core. However, the overall reliability is reduced because loss of water level could result in reduced decay heat removal capability. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will ensure continued heat removal capability.

Alternate decay heat removal methods are available to the operators for review and preplanning in the unit's Operating Procedures. The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability.

Alternate methods that can be used include (but are not limited to) the Spent Fuel Pool Cooling System, the Reactor Water Cleanup System, or an inoperable but functional RHR shutdown cooling subsystem. The method used to remove the decay heat should be the most prudent choice based on unit conditions.

B.1, B.2, B.3, and B.4 If no RHR shutdown cooling subsystem is OPERABLE and an alternate method of decay heat removal is not available in accordance with Required Action A.1, actions shall be taken immediately to suspend operations involving an increase in reactor decay heat load by suspending the loading of irradiated fuel assemblies into the RPV.

Additional actions are required to minimize any potential fission product release to the environment. This includes (continued)

GRAND GULF B 3.9-27 LBDCR 20085

RHR - Low Water Level B 3.9.9 BASES (continued)

ACTIONS A Note to the ACTIONS has been provided to modify the ACTIONS related to decay heat removal subsystems. Section 1.3, Completion Times, specifies once a Condition has been entered, subsequent divisions, subsystems, components or variables expressed in the Condition, discovered to be inoperable or not within limits, will not result in separate entry into the Condition. Section 1.3 also specifies Required Actions of the Condition continue to apply for each additional failure, with Completion Times based on initial entry into the Condition. However, the Required Actions for inoperable decay heat removal subsystems provide appropriate compensatory measures for separate inoperable decay heat removal subsystems. As such, a Note has been provided that allows separate Condition entry for each inoperable decay heat removal subsystem.

A.1 With one of the two required decay heat removal subsystems inoperable, the remaining subsystem is capable of providing the required decay heat removal. However, the overall reliability is reduced. Therefore an alternate method of decay heat removal must be provided. With both required decay heat removal subsystems inoperable, an alternate method of decay heat removal must be provided in addition to that provided for the initial RHR shutdown cooling subsystem or ADHRS inoperability.

This re-establishes backup decay heat removal capabilities, similar to the requirements of the LCO. The 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months Completion Time is based on the decay heat removal function and the probability of a loss of the available decay heat removal capabilities. Furthermore, verification of the functional availability of these alternate method(s) must be reconfirmed every 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months thereafter. This will ensure continued heat removal capability.

Alternate decay heat removal methods are available to the operators for review and preplanning in the unit's Operating Procedures. The required cooling capacity of the alternate method should be sufficient to maintain or reduce temperature. Decay heat removal by ambient losses can be considered as, or contributing to, the alternate method capability.

Alternate methods that can be used include (but are not limited to) the Spent Fuel Pool Cooling System, the Reactor Water Cleanup System, or an inoperable but functional RHR shutdown cooling subsystem. The method used to remove the decay heat should be the most prudent choice based on unit conditions.

(continued)

GRAND GULF B 3.9-31 LBDCR 20085

ML22223A051

Contents

Text

SUBJECT:

Attachment:

Enclosure:

Navigation menu

ML22223A051

Text

SUBJECT:

Attachment:

Enclosure:

Navigation menu

Search